PEND AUTHORI= ZATION

Overview

The Pend Authorization scenario will cause the classification to pend for a specified period of time. In a real world scenario, this time cou= ld be used to perform additional process of the packet. For this scenario though, the thread is= just put to sleep for the specified period.

For the layers that contain an NBL, that NBL will be injected back in the final action is to permit the traffic.

All filters added sit in WFPSampl= er’s sublayer (which is weighted just below IPsec’s sublayer), unless otherwise specified using the –sl <SUBLAYER> command line option. All filters are associated with WFPSampler’s provider.

The following diagram shows how the code flows for this callout:

Figure A. Code flow for Pend Authorization Scenario=

When traffic matches a filter at the specified layer, = ClassifyPendAuthorization() is invoked by the Filtering Engine. This function validates th= at we can perform the injection by looking at the pClassifyO= ut rights. It will then create the INJECTION_DATA which consists of the injectionHandle and the injectionState. If the injectionSt= ate indicates that we haven’t injected this packet before, then the triggerFn is called.= At this point, the original packet will be blocked.

Because we are essentially telling the classifyFn “Hold on, we need more time”, the injection will always be asynchronous. TriggerPendAuthoriz= ationOutOfBand() is invoked. This function creates the CLASSIFY_DATA= which consists of copies and references of the data that was passed into the classifyFn. = Based on the queuing method, the appropriate queueFn is invoked. The only time a DPC can b= e used is if there is no delay. This is d= ue to the fact that the delay introduced is done by using a function only availab= le at PASSIVE_LEVEL. Introducing dela= ys at DISPATCH_LEVEL is rarely a good idea.

Regardless of which queueFn is used, each will call the PerformPendAuthorization().

PerformPendAuthoriza= tion() will cause the thread to sleep = for the duration provided. When it wak= es up, if the layer contains an NBL and the final action is to allow the traffic, = then the data offset of the original NBL is retreated to the beginning of the IP Header. A clone is created, and the offset of the original is advanced back to the original offset. Once the clone is ready, it is injected= back into the TCP/IP stack.

Upon successful injection, CompletePendAuthoriz= ation() will be called by the TCP/IP stack. This function will show the status of the injected packet. Additionally, any memory that was allocated from the functions above, will be freed and any references released.

Note that with long delays, it is possible to bugcheck the machine by holding on to the inbound NBL= for too long. This normally happens wh= en a machine requests to drop into a power managed state, and processing of the = NBL exceeds the allotted time for allowing the state transition to begin.

Applicable Layers

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6

v FWPM_LAYER_ALE_AUTH_LISTEN_V4

v FWPM_LAYER_ALE_AUTH_LISTEN_V6

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v FWPM_LAYER_ALE_AUTH_CONNECT_V4

v FWPM_LAYER_ALE_AUTH_CONNECT_V6

Command Line Usage

Option	Argument	Meaning
-s	PEND_AUTHORIZATION	Implement the PEND_AUTHORIZATION scenario
-l	Applicable Layer	Layer at which this filter will apply
-pcd	Integer	How long of a pend completion delay to introduce (in ms)
-fab		Return FWP_ACTION_BLOCK after the delay. If there is an NBL, no injection occu= rs. [default]
-fap		Return FWP_ACTION_PERMIT after the delay. If there is an NBL it will be injecte= d.
-sl	Applicable subLayer	SubLayer to associate with the filter= . [default is WFPSAMPLER_SUBLAYER].
-v		Make the objects associated with this scenario’s instance dynamic=
-b		Make the objects associated with this scenario’s instance availab= le during boot-time
-tdpc		Use threaded DPCs for asynchronous (out of band) queuing method
-wi		Use work items for asynchronous (out of band) queuing method
-r		Remove objects associated with this scenario instance
-?		Display help

“WFPSampler.E= xe -s PEND_AUTHORIZATION -?“ provides help output

“WFPSampler.E= xe -s PEND_AUTHORIZATION -l FWPM_LAYER_ALE_AUTH_CONNECT_V4 -v“ adds a dynamic filter (-v) at FWPM_LAYER_ALE_AUTH_CONNEC= T_V4 (-l) which references the appropri= ate callout. This filter will have no = conditions, meaning it will act on all connections seen at this layer. The traffic will, by default, be blocke= d.

“WFPSampler.E= xe -s PEND_AUTHORIZATION -l FWPM_LAYER_ALE_AUTH_CONNECT_V4 -v -r“ removes (-r) the dynamic filter (-v) at FWPM_LAYER_ALE_AUTH_CONNEC= T_V4 (-l) which references the appropri= ate callout.

“WFPSampler.E= xe -s PEND_AUTHORIZATION -l FWPM_LAYER_ALE_AUTH_CONNECT_V4 -= ipla 1.0.0.1 -ipra 1.0.0.254 -f= ap“ adds a persistent filter at FWPM_LAYER_ALE_AUTH_CONN= ECT_V4 (-l) which references the appr= opriate callout. This filter will have 2 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, and FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254. The traffic will be permi= tted (-fap)= and the NBL injected.

“WFPSampler.E= xe -s PEND_AUTHORIZATION -l FWPM_LAYER_ALE_AUTH_CONNECT_V4 -aaid C:\Traffic.exe -ipla 1.0.0.1 -ipra 1.0.0.254 -ipp TCP -fap –pcd 5000“ adds a persistent filter at FWPM_LAYER_= ALE_AUTH_CONNECT_V4 (-l) which references the appropriate callout. This filter will have 4 conditions; FWPM_CONDITION_ALE_APP_ID (-aaid= ) equals C:\Traffic.exe, FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (= -ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PROTOCOL (-ipp)= equals TCP. The decision will be delayed = for 5 seconds (-pcd= ) before being permitted (-fap).

For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring = each condition, refer to Co= nditions for Command Line.