does FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE have a wrong description?

Or Eliyahu 0 Reputation points
2024-07-15T12:26:44.65+00:00

i see that FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE represents "the destination IP address type for forwarded packets."

this condition is supported for the following layers

  • FWPM_LAYER_IPFORWARD
  • FWPM_LAYER_OUTBOUND_TRANSPORT
  • FWPM_LAYER_ALE_CONNECT_REDIRECT
  • FWPM_LAYER_ALE_AUTH_CONNECT
  • FWPM_LAYER_ALE_FLOW_ESTABLISHED

but for the enumeration type, the condition is described as "The destination IP address type"

e.g: FWPS_FIELDS_ALE_AUTH_CONNECT_V4 / FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_DESTINATION_ADDRESS_TYPE

so I've a few concerns here

  • WFP uses a local/remote name convention with a direction flag, but in this case, it provides a destination for ALE layers which is quite unusual, Why doesn't provide FWPM_CONDITION_IP_REMOTE_ADDRESS_TYPE ?
  • moreover, except for ipforward and flow established, i see it's supported for outbound layers so in this case local = source, remote = destination, therefore, can i assume that FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE provides the address type of the remote address? for testing: I've added logs to callout that associate with FWPM_LAYER_ALE_AUTH_CONNECT and seems that for "authorization", FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_DESTINATION_ADDRESS_TYPE provides the expected address type for remote address (btw, for "reauthorization" it doesn't work well)
  • does FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE have a wrong description? or should i use it only for forwarded packets?
Windows Network
Windows Network
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Network: A group of devices that communicate either wirelessly or via a physical connection.
770 questions
Windows Driver Kit (WDK)
Windows Driver Kit (WDK)
A set of Microsoft tools that are used to develop, test, and deploy Windows drivers.
122 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.