Understanding Windows Networking_WFP

Tags:
Categories:
  • Understanding Windows Networking_WFP

Understanding Windows Networking

  • Understanding Windows Networking

WFP

Terminology

https://learn.microsoft.com/en-us/windows/win32/fwp/object-model
https://learn.microsoft.com/en-us/windows/win32/fwp/basic-operation
https://learn.microsoft.com/en-us/windows-hardware/drivers/network

callout: A callout provides functionality that extends the capabilities of the Windows Filtering Platform. A callout consists of a set of callout functions and a GUID key that uniquely identifies the callout.
callout driver: A callout driver is a driver that registers callouts with the Windows Filtering Platform. A callout driver is a type of filter driver.
callout function: A callout function is a function that is called by the Windows Filtering Platform to perform a specific task. A callout function is associated with a callout.
filter: A filter is a set of functions that are called by the Windows Filtering Platform to perform filtering operations. A filter consists of a set of filter functions and a GUID key that uniquely identifies the filter.
filter engine: The filter engine is the component of the Windows Filtering Platform that performs filtering operations. The filter engine is responsible for calling the filter functions that are registered with the Windows Filtering Platform.
filter layer: A filter layer is a set of functions that are called by the Windows Filtering Platform to perform filtering operations. A filter layer consists of a set of filter layer functions and a GUID key that uniquely identifies the filter layer.

The dispatcher queue triggers callbacks as soon as possible without waiting for the queue to fill, thus satisfying real-time requirements.
When the user callback is slow, blocked packets are inserted into the next queue whenever possible, up to a queue limit of 256. Any additional blocked packets are buffered by the system. Rough testing shows a buffer capacity of around 16,500; this system cache size can vary with machine performance and configuration.

When the user callback processes a packet, there are two packet entities:

  • Kernel packet: Released in bulk after the callback finishes processing the queue. Therefore, when the callback is slow, one callback execution can lock up to 256 system packet buffers.
  • Copy in callback: Released immediately after the individual packet is processed.

Copying and assembling packets in FwppNetEvent1Callback does not touch the original packets, so business operations remain unaffected.

Subscribing with template filters can reduce the number of packets that need processing:

https://learn.microsoft.com/en-us/windows/win32/api/fwpmtypes/ns-fwpmtypes-fwpm_net_event_enum_template0

filterCondition

An array of FWPM_FILTER_CONDITION0 structures containing distinct filter conditions (duplicate filter conditions will produce an error). All conditions must be true for the action to occur; in other words, the conditions are AND’ed together. If no conditions are provided, the action is always performed.

  • Identical filters cannot be used.
  • The relationship among all filters is logical AND—all must be satisfied.
  • Microsoft documentation lists eight supported filters, but in practice many more are supported.

FWPM_CONDITION_IP_PROTOCOL
The IP protocol number, as specified in RFC 1700.

FWPM_CONDITION_IP_LOCAL_ADDRESS
The local IP address.

FWPM_CONDITION_IP_REMOTE_ADDRESS
The remote IP address.

FWPM_CONDITION_IP_LOCAL_PORT
The local transport protocol port number. For ICMP, this is the message type.

FWPM_CONDITION_IP_REMOTE_PORT
The remote transport protocol port number. For ICMP, this is the message code.

FWPM_CONDITION_SCOPE_ID
The interface IPv6 scope identifier; reserved for internal use.

FWPM_CONDITION_ALE_APP_ID
The full path of the application.

FWPM_CONDITION_ALE_USER_ID
The identification of the local user.

Enumerating registered subscriptions shows two existing ones. Their sessionKey GUIDs provide no clues about the registering identity. Analysis shows each implements:

  • Subscription to all FWPM_NET_EVENT_TYPE_CLASSIFY_DROP packets to collect statistics on dropped packets.
  • Subscription to all FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW packets for traffic accounting.

Both subscriptions use the condition filter FWPM_CONDITION_NET_EVENT_TYPE (206e9996-490e-40cf-b831-b38641eb6fcb), confirming that more filters can be applied than the eight listed in Microsoft’s documentation.

Further investigation indicates that the user-mode API can only capture drop events. Non-drop events must be obtained via kernel mode, so a micro-segmentation solution cannot use FWPM_CONDITION_NET_EVENT_TYPE to gather events.