FLOW ASSOCIA= TION
Overview
The Flow Association scenario will cause the classific= ation to associate context to the flow at the specified layers. This context will then be available as = the flowContext parameter of those c= lassifyFns.
All filters added sit in WFPSampl= er’s sublayer (which is weighted just below IPsec’s sublayer), unless otherwise specified using the –sl <SUBLAYER> command line option. All filters are associated with WFPSampler’s provider.
The following diagram shows how the code flows for thi= s callout:
![](3D"FLOW_ASSOCIATION_files/image002.png")
Figure A. Code flow for Flow Association Scenario
When traffic matches a filter at the specified layer, = ClassifyFlowAssociation() is invoked by the Filtering Engine. This function verify we ha= ve write access, and invoke PerformFlowAssociation().
PerformFlowAssociation() will create the FLOW_CONTEXT and call Fw= psFlowAssociateContext() for the layer(s) that were indicatedfor the con= text to be associated with (-awl).<= /p>
This context will be valid until the flow is terminate= d or until FwpsFlowRemoveContext= () is called, after which Notify= FlowDeleteNotification() will be invoked and will clean= up the FLOW_CONTEXT.
Applicable Layers
v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4
v FWPM_LAYER_ALE_ FLOW_ESTABLISHED_V6
Command Line Usage
|
Option |
Argument |
Meaning |
|
-s |
FLOW_ASSOCIATION |
Implement the FLOW_ASSOCIATION scenario |
|
-l |
Applicable Layer |
Layer at which this filter will apply |
|
-aws |
Scenario |
Applicable scenario |
|
-awl |
Applicable Layer … |
Layer(s) at which to associate Flow |
|
-sl |
Applicable sublayer |
SubLayer to associate with the filter= . [default is WFPSAMPLER_SUBLAYER]. |
|
-v |
|
Make the objects associated with this scenario’s instance dynamic= |
|
-b |
|
Make the objects associated with this scenario’s instance availab= le during boot-time |
|
-r |
|
Remove objects associated with this scenario instance |
|
-? |
|
Display help |
“WFPSampler.E= xe -s FLOW_ASSOCIATION -?“ provides help output
“WFPSampler.E=
xe -s FLOW_ASSOCIATION
-l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -aws BASI=
C_STREAM_INJECTION
-awl FWPM_LAYER_STREAM_V4 -v“ adds a dynamic filter (-v) at FWPM_LAYER_ALE_FLOW_ESTABL=
ISHED_V4
(-l) which references the
appropriate callout. This filter w=
ill
have no conditions, meaning it will act on all flows seen at this layer.
“WFPSampler.E= xe -s FLOW_ASSOCIATION -l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -aws BASIC_STREAM_INJECTION -awl FWPM_LAYER_STREAM_V4 -v -r“ removes (-r) the dynamic filter (-v) at FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 (-l) which references the appropriate callout.
“WFPSampler.E= xe -s FLOW_ASSOCIATION -l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -ipla 1.0= .0.1 -ipra 1.0.0.254 –aws BASIC= _STREAM_INJECTION –awl FWPM_LAYER_STREAM_V4“ adds a persistent filter at FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 (-l) which references the appropriate callout. This filter will have 2 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-= ipla) equals 1.0.0.1, and FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254. The context will then be visible to all classifies at FWPM_LAYER_STREAM_V4 (-awl) us= ing the BASIC_STREAM_INJECTION callout (-aws). No= te that the scenario for BASIC_STREAM_INJECTION must already have been configured before implementing this scenario.
“WFPSampler.E= xe -s FLOW_ASSOCIATION -l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -aaid C:\Traffic.exe -ipla= 1.0.0.1 -ipra 1.0.0.254 -ipp TCP –iprp 6000 –aws BASIC_STRE= AM_INJECTION –awl FWPM_LAYER_STEAM_V4 FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4“ adds a persistent filter at FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 (-l) which references the appropriate callout. This filter will have 5 conditions; FWPM_CONDITION_ALE_APP_ID (-aaid= ) equals C:\Traffic.exe, FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254, FWPM_CONDITION_IP_PROTOCOL (-ipp)= equals TCP, and FWPM_CONDITION_IP_REMOTE_PORT equals 6000. The context will then be visible to all classifies at FWPM_LAYER_STREAM_V4 and FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 (-awl) using the BASIC_STREAM_INJECTION (and PEND_ENDPOINT_CLOSURE) callout (-aws)= . Note that the scenario for BASIC_STREAM_INJECTION and PEND_ENDPOINT_CLOSURE must already have been configured before implementing this scenario.
For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.
For a list of command line parameters for configuring = each condition, refer to Co= nditions for Command Line.
Notes
FlowDelete
The FlowDeleteNotificationFn is only invoked when the flow terminates or FwpsFlowRemov= eContext is called.
Mixing Scenar= ios
FLOW_ASSOCIATION is only useful when mixed with other scenarios. For example:
WFPSampler.exe -s BASIC_STREAM_INJECTION -l FWPM_LAYER_STREAM_V4 -ipr= a 1.0.0.254 -iprp 6000 -v
WFPSampler.exe -s PEND_ENDPOINT_CLOSURE -l FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 -aaid C:\Traffic.exe -ipra 1.0.0.254 -ipp TCP -iprp 6000 -pcd 5000 -v
WFPSampler.exe -s FLOW_ASSOCIATION -l FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 -aaid C:\Traffic.exe -ipra 1.0.0.254 -ippTCP -iprp 6000 -aws BASIC_STREAM_INJECTION -awl FWPM_LAYER_STREAM_V4 FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 -v
This will associate flows with both the BASIC_STREAM_I= NJECTION and PEND_ENDPOINT_CLOSURE scenarios. The endpoint associated with the speci= fied flow will remain open for the duration of the injection being performed at STREAM. Once everything has been injected, the endpoint is allowed to close, and the flow contexts are clean= ed up.