BASIC PACKET= INJECTION

Overview

The Basic Packet Injection scenario will clone the pac= ket and inject it back to the same layer. No modification is performed on the packet, with the following exceptions:

· The packet is loopback and only one of either the source or destination address is that of the software loopback. In this case, the IP header is modified= by changing the software loopback address to that of an address on the local machine. This is required due to T= CPIP’s stack validation logic.

· The packet is received at an inbound transpo= rt layer, and had been IPsec secured. In this case, it is necessary to reconst= ruct the IP header as IPsec processing does not remove the original ESP or AH information from it.

All filters added sit in WFPSampl= er's sublayer (which is weighted just below IPsec's sublayer), unless otherwise specified using the -sl <SUBLAYER> command line option. All filters are associated with WFPSampler's provider.

The following diagram shows how the code flows for this callout:

Figure A. Code flow for Basic Packet Injection Scenario

When traffic matches a filter at the specified layer, = ClassifyBasicPacketInjection() is invoked by the Filtering Engine. This function validates th= at we can perform the injection by looking at the pClassifyO= ut rights. It will then create the INJECTION_DATA which consists of the injectionHandle and the injectionState. If the injectionSt= ate indicates that we haven’t injected this packet before, then the injection method is determined (default is asynchronous), and the appropriate triggerFn is called.= At this point, the original packet will be blocked.

If the injection method is synchronous (inline), TriggerBasicPacketInjectionInline() is invoked. This function creates the CLASSIFY_DATA, which consists of the data that was passed into the cl= assifyFn. Depending on which layer the injection = is happening, the appropriate performFn is called.=

If the injection method is asynchronous (out of band),= TriggerBasicPacketInjectionOutOfBand() is invoked. This function creates the CLASSIFY_DATA= which consists of copies and references of the data that was passed into the classifyFn. = Based on the queuing method, the appropriate queueFn (de= fault is DeferredProcedureCalls) is invoked.

Regardless of which queueFn is used, each will call the appropriate performFn = based on the layer the injection is happening.

Each of the performFns are tailored to inject for their respective layers. Each will get the required data for its specific injectionFn. Depending on the layer, the offsets are adjusted on the original so = the whole packet is available. Once the offsets are adjusted, the original is cloned, and the offsets of the origin= al are returned to the original place. If any of the exceptions noted above are required, then modification of the IP header occurs. Finally, the appropriate injectionFn is invoked.

Upon successful injection, CompleteBasicPacketI= njection() will be called by the TCPIP stack. This function will show the status of the injected packet. Additionally, any memory that was allocated from the functions above, will be freed and any references released.

Applicable Layers

v FWPM_LAYER_INBOUND_IPPACKET_V4

v FWPM_LAYER_INBOUND_IPPACKET_V6

v FWPM_LAYER_OUTBOUND_IPPACKET_V4

v FWPM_LAYER_OUTBOUND_IPPACKET_V6

v FWPM_LAYER_IPFORWARD_V4

v FWPM_LAYER_IPFORWARD_V6

v FWPM_LAYER_INBOUND_TRANSPORT_V4

v FWPM_LAYER_INBOUND_TRANSPORT_V6

v FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v FWPM_LAYER_OUTBOUND_TRANSPORT_V6

v FWPM_LAYER_DATAGRAM_DATA_V4

v FWPM_LAYER_DATAGRAM_DATA_V6

v FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v FWPM_LAYER_ALE_AUTH_CONNECT_V4

v FWPM_LAYER_ALE_AUTH_CONNECT_V6

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v FWPM_LAYER_STREAM_PACKET_V4 (Win7+= )

v FWPM_LAYER_STREAM_PACKET_V6 (Win7+= )

v FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_ETHERNET (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_ETHERNET (Win8+)

Command Line Usage

Option	Argument	Meaning
-s	BASIC_PACKET_INJECTION	Implement the BASIC_PACKET_INJECTION scenario
-l	Applicable Layer	Layer at which this filter will apply
-sl	Applicable subLayer	SubLayer to associate with the filter= . [default is WFPSAMPLER_SUBLAYER].
-v		Make the objects associated with this scenario’s instance dynamic=
-b		Make the objects associated with this scenario’s instance availab= le during boot-time
-in		Perform the injection synchronously (inline)
-tdpc		Use threaded DPCs for asynchronous (out of band) queuing method
-wi		Use work items for asynchronous (out of band) queuing method
-r		Remove objects associated with this scenario instance
-?		Display help

“WFPSampler.E= xe -s BASIC_PACKET_INJECTION -?“ provides help output

“WFPSampler.E= xe -s BASIC_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v“ adds a dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout. This filter will have no conditions, me= aning it will act on all traffic seen at this layer.

“WFPSampler.E= xe -s BASIC_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 –v -r“ removes (-r= ) the dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l= ) which references the appropriate callout.

“WFPSampler.E= xe -s BASIC_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -ipla 1.0.0.1 –ipra 1.0.0.254= “ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout. This filter will have 2 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-= ipla) equals 1.0.0.1, and FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254.

“WFPSampler.E= xe -s BASIC_PACKET_INJECTION -l FWPM_LAYER_INBOUND_TRANSPORT_V4 -ipla 1.0.0.1 –ipra 1.0.0.254 –i= pp TCP -in“ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropri= ate callout. This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PRO= TOCOL (-ipp<= /b>) equals TCP. The injection will be performed synchronously (-in).=

For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring = each condition, refer to Co= nditions for Command Line.