i see that FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE represents "the destination IP address type for forwarded packets."
this condition is supported for the following layers
- FWPM_LAYER_IPFORWARD
- FWPM_LAYER_OUTBOUND_TRANSPORT
- FWPM_LAYER_ALE_CONNECT_REDIRECT
- FWPM_LAYER_ALE_AUTH_CONNECT
- FWPM_LAYER_ALE_FLOW_ESTABLISHED
but for the enumeration type, the condition is described as "The destination IP address type"
e.g: FWPS_FIELDS_ALE_AUTH_CONNECT_V4 / FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_DESTINATION_ADDRESS_TYPE
so I've a few concerns here
- WFP uses a local/remote name convention with a direction flag, but in this case, it provides a destination for ALE layers which is quite unusual, Why doesn't provide FWPM_CONDITION_IP_REMOTE_ADDRESS_TYPE ?
- moreover, except for ipforward and flow established, i see it's supported for outbound layers so in this case local = source, remote = destination, therefore, can i assume that FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE provides the address type of the remote address? for testing: I've added logs to callout that associate with FWPM_LAYER_ALE_AUTH_CONNECT and seems that for "authorization", FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_DESTINATION_ADDRESS_TYPE provides the expected address type for remote address (btw, for "reauthorization" it doesn't work well)
- does FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE have a wrong description? or should i use it only for forwarded packets?