PROXY
Overview
The Proxy scenario is divided into two types:
· Proxy the socket which is achieved in Win7+ by use of FWPM_LAYER_ALE_BIND_REDIRECT.
· Proxy the connection which is further divided into two methods:
<= span style=3D'mso-list:Ignore'>o&nb= sp; Proxy the connection using injection which is supported on Vista+. It should be = noted though that for Win7+ the redirect method should be used.
<= span style=3D'mso-list:Ignore'>o&nb= sp; Proxy the connection using FWPM_LAYER_ALE_CONNECT_REDIRECT. T= his method is recommended for all proxying of conne= ctions post Vista.
All filters added sit in WFPSampl= er's sublayer (which is weighted just below IPsec's sublayer), unless otherwise specified using the -sl <SUBLAYER> command line option. All filters are associated with WFPSampler's provider.
Proxy the Socket
The following diagram shows how the code flows for this callout:
![](3D"PROXY_files/image002.png")
Figure A. Code flow for Proxy (socket) by ALE Redirect Scenario
When traffic matches a filter at the specified layer, = ClassifyProxyByALERedirect() is invoked by the Filtering Engine. This function will create = the REDIRECT_DATA which consists of the classifyHandle, the redirectHandle, and the writableLayerData. The appropriate tr= iggerFn is called.
If the operation method is synchronous (inline), TriggerProxyByALERedirectInline() is invoked. This function creates the CLASSIFY_DATA, which consists of the data that was passed into the cl= assifyFn. PerformProxySocketRedirection() is then invoked.
If the injection method is asynchronous (out of band),= TriggerProxyByALERedirectOutOfBand() is invoked. This function creates the CLASSIFY_DATA= which consists of copies and references of the data that was passed into the classifyFn. = Based on the queuing method, the appropriate queueFn is invoked.
Regardless of which queueFn is used, each will call PerformProxySocketRedirection= ().
PerformProxySocketRedirection
() will modify the writable layer data with the values passed to the command
line. The action is set to
FWP_ACTION_PERMIT and the layer data is applied. From this point on, the socket will be =
bound
to the new local address and /or new local port that was specified on the
command line.
Applicable Layers
v FWPM_LAYER_ALE_BIND_REDIRECT_V4 (Win7+)
v FWPM_LAYER_ALE_BIND_REDIRECT_V6 (Win7+)
Proxy the Connection
By Injection
The following diagram shows how the code flows for this callout:
![](3D"PROXY_files/image004.png")
Figure B. Code flow for Proxy By Injection
Scenario
When traffic matches a filter at the specified layer, = ClassifyProxyByInjection() is invoked by the Filtering Engine. This function validates th= at we can perform the injection by looking at the pClassifyO= ut rights. It will then create the INJECTION_DATA which consists of the injectionHandle and the injectionState. If the injectionSt= ate indicates that we haven’t injected this packet before, then the injection method is determined (default is asynchronous), and the appropriate triggerFn is called.= At this point, the original packet will be blocked.
If the injection method is synchronous (inline), TriggerProxyInjectionInline() is invoked. This function creates the CLASSIFY_DATA, which consists of the data that was passed into the cl= assifyFn. Depending on which layer the injection = is happening, the appropriate performFn is called.=
If the injection method is asynchronous (out of band),= TriggerProxyInjectionOutOfBand() is invoked. This function creates the CLASSIFY_DATA= which consists of copies and references of the data that was passed into the classifyFn. = Based on the queuing method, the appropriate queueFn is invoked.
Regardless of which queueFn is used, each will call the appropriate performFn = based on the layer the injection is happening.
Each of the performFns are tailored to inject for their respective layers. Each will get the required data for its specific injectionFn. Depending on the layer, the offsets are= adjusted on the original so the whole packet is available. Once the offsets are adjusted, the orig= inal is cloned, and the offsets of the original are returned to the original place. The clone is modified with = the new address and ports that are specified, and the injection function is cal= led.
Upon successful injection, CompleteProxyInjecti= on() will be called by the TCP/IP stack. This function will show the status of the injected packet. Additionally, any memory that was allocated from the functions above, will be freed and any references released.
Applicable Layers
v FWPM_LAYER_INBOUND_TRANSPORT_V4 (Vista+)
v FWPM_LAYER_INBOUND_TRANSPORT _V6 (Vista+)
v FWPM_LAYER_OUTBOUND_TRANSPORT_V4 (Vista+)
v FWPM_LAYER_OUTBOUND_TRANSPORT _V6 (Vista+)
v FWPM_LAYER_DATAGRAM_DATA_V4 (Vista+)
v FWPM_LAYER_DATAGRAM_DATA_V6 (Vista+)
v FWPM_LAYER_STREAM_PACKET_V4 (Win7+)
v FWPM_LAYER_STREAM_PACKET_V6 (Win7+)
By ALE Redirect
The following diagram shows how the code flows for this callout:
![](3D"PROXY_files/image006.png")
Figure C. Code flow for Proxy (connection) by ALE Redirect Scenario
When traffic matches a filter at the specified layer, = ClassifyProxyByALERedirect() is invoked by the Filtering Engine. This function will create = the REDIRECT_DATA which consists of the classifyHandle, the redirectHandle, and the writableLayerData. The appropriate tr= iggerFn is called.
If the operation method is synchronous (inline), TriggerProxyByALERedirectInline() is invoked. This function creates the CLASSIFY_DATA, which consists of the data that was passed into the cl= assifyFn. PerformProxyConnectRedirection() is then invoked.
If the injection method is asynchronous (out of band),= TriggerProxyByALERedirectOutOfBand() is invoked. This function creates the CLASSIFY_DATA= which consists of copies and references of the data that was passed into the classifyFn. = Based on the queuing method, the appropriate queueFn is invoked.
Regardless of which queueFn is used, each will call PerformProxyConnectRedirection().
PerformProxyConnectRedirection
() will modify the writable layer data with the values passed to the command
line. The action is set to
FWP_ACTION_PERMIT and the layer data is applied. From this point on, the connection will=
be adjusted
to use the new remote address and /or new remote port that was specified on=
the
command line.
Applicable Layers
v FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 (Win7+)
v FWPM_LAYER_ALE_CONNECT_REDIRECT_V6 (Win7+)
Command Line Usage
|
Option |
Argument |
Meaning |
|
-s |
PROXY |
Implement the PROXY scenario |
|
-l |
Applicable Layer |
Layer at which this filter will apply |
|
-pla |
IP Address |
New local IP address for the socket (or connection if proxying the connection by injection). |
|
-plp |
Port |
New local port for the socket (or connection if proxying the connection by injection). |
|
-pra |
IP Address |
New destination IP address for the connection. |
|
-prp |
Port |
New destination port for the connection. |
|
-plspid |
Process ID of local Proxy Service |
Proxy to the specified local proxy service. This is only valid for proxying the connection by ALE redirection. |
|
-prs |
|
Proxy to a remote proxy service. This is valid only for proxying the connection by ALE redirection. |
|
-sl |
Applicable subLayer |
SubLayer to associate with the filter= . [default is WFPSAMPLER_SUBLAYER]. |
|
-v |
|
Make the objects associated with this scenario’s instance dynamic= |
|
-b |
|
Make the objects associated with this scenario’s instance availab= le during boot-time |
|
-in |
|
Perform the injection synchronously (inline) |
|
-tdpc |
|
Use threaded DPCs for asynchronous (out of band) queuing method |
|
-wi |
|
Use work items for asynchronous (out of band) queuing method |
|
-r |
|
Remove objects associated with this scenario instance |
|
-? |
|
Display help |
“WFPSampler.E= xe -s PROXY -?“ provides help output
“WFPSampler.E= xe -s PROXY -l FWPM_LAYER_ALE_BIND_REDIRECT_V4 -aaid C:\Traffic.exe -ipla 1.0.0.1 -pla 1.0.0.2 -plp 0x4444 -v” adds a dynamic filt= er (-v) at FWPM_LAYER_ALE_BIND_REDIRE= CT_V4 (-l) which references the appropriate callout. This filter w= ill have 2 conditions; FWPM_CONDITION_ALE_APP_ID (-aaid) equals C:\Traffic, and FWPM_CONDITION_IP_LOCAL_ADDRESS (-= ipla) equals 1.0.0.1. When classified, it will modify the socket to be bound to local addr= ess (-pla<= /b>) 1.0.0.2 and local port (-plp) 0x4444. This change endures for the lifetime of the socket.
WFPSampler.Ex= e -s PROXY -l FWPM_LAYER_ALE_BIND_REDIRECT_V4 -aaid C:\Traffic.exe -ipla 1.0.0.1 -pla 1.0.0.2 -plp 0x4444 -v -r“ removes (-r) the dynamic filter (-v) at FWPM_LAYER_ALE_BIND_REDIRECT_V4 (-= l) which references the appropriate callout.
“WFPSampler.E= xe -s PROXY -l FWPM_LAYER_OUTBOUND_TRANSPORT_V4 -pra 127.0.0.1 -prp 0x4444“ = adds a persistent filter at FWPM_LAYER_OUTBOUND_TRANSPORT_V4 (-l) which references the appropriate callout. This filter will have no conditions, me= aning it will act on all traffic seen at this layer. It will modify the destination address (-pra) to the software loopback (127.= 0.0.1) and the destination port (-prp) to 0x4444. For full end-to-end proxying to occur, a second filter will need to be added in the inverse direction to proxy back = to the original endpoint.
“WFPSampler.E= xe -s PROXY -l FWPM_LAYER_OUTBOUND_TRANSPORT_V4 -pra 127.0.0.1 -prp 0x4444 -r“ removes (-r) the persis= tent filter at FWPM_LAYER_OUTBOUND_TRANSPORT_V4 (-l) which references the appropriate callout.
“WFPSampler.E= xe -s PROXY -l FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 -aaid C:\Traffic.exe -ipla 1.0.0.1 -pra 127.0.0.1 -prp 0x4444 –pls= pid 501 -v” adds a dynamic filter (-v) at FWPM_LAYER_ALE_BIND_REDIRECT_V4 (-l) which references the appropriate callout. This filter will have 2 conditions; FWPM_CONDITION_ALE_APP_ID (-aaid= ) equals C:\Traffic, and FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1. When classified, it will modify the connection’s TCB to use remote address (-pra) 127.0.0.1 and remote port (-prp) 0x4444. The process that is listening for this modified traffic is identified by processe ID (= -plspid) 501. This change endures for the lifetime of the connection.
“WFPSampler.E= xe -s PROXY -l FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 -aaid C:\Traffic.exe -ipla 1.0.0.1 -pra 127.0.0.1 -prp 0x4444 –pls= pid 501 -v -r“ removes (-r) the dynamic filter (-v) at FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 (-l) which references the appropriate callout.
“WFPSampler.E= xe -s PROXY -l FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 -aaid C:\Traffic.exe -ipla 1.0.0.1 -pra 1.0.0.254 -prp 0x4444 –prs= -v” adds a dynamic filter (-v) at FWPM_LAYER_ALE_BIND_REDIRECT_V4 (-= l) which references the appropriate callout. This filter will have 2 conditions; FWPM_CONDITION_ALE_APP_ID (-aaid= ) equals C:\Traffic, and FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1. When classified, it will modify the connection’s TCB to use remote address (-pra) 1.0.0.254 and remote port (-prp) 0x4444. The process that is listening for this modified traffic is on a remote server (-prs). This change endures for the lifetime of the connection.
For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.
For a list of command line parameters for configuring = each condition, refer to Co= nditions for Command Line.