{"componentChunkName":"component---src-templates-post-template-js","path":"/a-part-of-anti-virus-3-02-en","result":{"data":{"markdownRemark":{"id":"ba160964-c618-5515-b5d9-7249f2e919b0","html":"
\n

This page has been machine-translated from the original page.

\n
\n

In this chapter, we will actually verify how the communication filtering functionality using WFP, explained in the previous chapter, works.

\n

To verify the behavior, we will use a user-mode program that can add various filters to a specified layer.

\n

The source code for the user-mode program used in this sample is published in the following repository.

\n

URL: https://github.com/kash1064/book06-wfp-samples

\n\n

Table of Contents

\n\n

Overview of the Sample Program

\n

The code for the sample program (UserModeWFPFilter) downloaded from the repository above can be built with Visual Studio 2022.

\n

This program has the following two functions.

\n
    \n
  1. Add filters to a specific layer according to settings hardcoded in the program
    2. \n
  2. Delete all filters registered by the program
    3. \n
\n

All filters registered by this program are associated with its own WFP provider, Simple WFP User-Mode Provider.\nTo restore the configuration, the program deletes all filters associated with this provider.

\n

The following is a screenshot of adding and deleting filters with this sample program.

\n

\n \n , rule.name, filterId);\n\n}\n

In the loop, the DefineFilterConditions function, which is called first, creates objects of the FWPM_FILTER_CONDITION0 structure that defines filter conditions.13

\n

This structure is defined as follows and includes members of the FWP_MATCH_TYPE enumeration14 and the FWP_CONDITION_VALUE0 structure15.

\n
typedef struct FWPM_FILTER_CONDITION0_ {\n  GUID                 fieldKey;\n  FWP_MATCH_TYPE       matchType;\n  FWP_CONDITION_VALUE0 conditionValue;\n} FWPM_FILTER_CONDITION0;
\n

For fieldKey, the first member of the FWPM_FILTER_CONDITION0 structure, you specify the GUID to use as a condition for the filter being registered.

\n

The keys available here are defined as filtering condition identifiers.16

\n

For example, if you use the destination port number as a filter condition, you can use FWPM_CONDITION_IP_REMOTE_PORT; if you use the path of the source application as a condition, you can use FWPM_CONDITION_ALE_APP_ID.

\n

The FWP_MATCH_TYPE enumeration defines various kinds of matching used for filter conditions.

\n

The filters added in the sample program basically use FWP_MATCH_EQUAL, so they function as simple filters that determine whether the configured value matches the condition.

\n

Depending on the FWP_MATCH_TYPE enumeration used for the filter condition, you can also flexibly create filters that determine whether a value is greater than or less than the value set as the condition.

\n

On the other hand, the FWP_CONDITION_VALUE0 structure contains information about the value used when matching filter conditions.

\n

If FWPM_CONDITION_IP_REMOTE_PORT is used for fieldKey, for example, the integer value of the destination port number used for the condition is registered as follows.

\n
conditionValue.type = FWP_UINT16;\nconditionValue.uint16 = remotePort;
\n

After creating objects of the FWPM_FILTER_CONDITION0 structure that define the filter conditions, the next step is to create an object of the FWPM_FILTER0 structure.

\n

This structure contains the state of the filter and is defined as follows.17

\n
typedef struct FWPM_FILTER0_ {\n  GUID                   filterKey;\n  FWPM_DISPLAY_DATA0     displayData;\n  UINT32                 flags;\n  GUID                   *providerKey;\n  FWP_BYTE_BLOB          providerData;\n  GUID                   layerKey;\n  GUID                   subLayerKey;\n  FWP_VALUE0             weight;\n  UINT32                 numFilterConditions;\n  FWPM_FILTER_CONDITION0 *filterCondition;\n  FWPM_ACTION0           action;\n  union {\n    UINT64 rawContext;\n    GUID   providerContextKey;\n  };\n  GUID                   *reserved;\n  UINT64                 filterId;\n  FWP_VALUE0             effectiveWeight;\n} FWPM_FILTER0;
\n

In the sample program, the BuildFilter function is used to create filter, an object of the FWPM_FILTER0 structure.

\n

Most of the values registered here, such as the filter name and description, the GUIDs of the layer and sublayer, and the filter action, are values defined as global variables as members of FILTER_RULES.

\n
void BuildFilter(\n\tFWPM_FILTER0* filter,\n\tFWPM_FILTER_CONDITION0* condition,\n\tUINT32 conditionCount,\n\tconst FILTER_RULES& rule,\n\tconst GUID& providerKey)\n{\n\tif (filter == NULL || condition == NULL || conditionCount == 0) {\n\t\treturn;\n\t}\n\n\tfilter->displayData.name = (wchar_t*)rule.name;\n\tfilter->displayData.description = (wchar_t*)rule.description;\n\tfilter->filterKey = rule.filterKey;\n\tfilter->providerKey = const_cast<GUID*>(&providerKey);\n\tfilter->layerKey = rule.layerKey;\n\tfilter->subLayerKey = rule.subLayerKey;\n\tfilter->action.type = rule.action;\n\tfilter->weight.type = FWP_UINT64;\n\tfilter->weight.uint64 = const_cast<UINT64*>(&rule.weight);\n\tfilter->numFilterConditions = conditionCount;\n\tfilter->filterCondition = condition;\n\tfilter->flags = FWPM_FILTER_FLAG_PERSISTENT;\n}
\n

After creating the FWPM_FILTER0 structure object, the final step is to register the filter using the FwpmFilterAdd0 function.

\n

FwpmFilterAdd0 is a function provided to register a new filter in the system and is called with a session handle and a FWPM_FILTER0 structure object as parameters.18

\n
DWORD FwpmFilterAdd0(\n  [in]            HANDLE               engineHandle,\n  [in]            const FWPM_FILTER0   *filter,\n  [in, optional]  PSECURITY_DESCRIPTOR sd,\n  [out, optional] UINT64               *id\n);
\n

Committing the Transaction

\n

After all filter registrations are complete, call the FwpmTransactionCommit0 function to commit the transaction you started.19

\n

This completes filter registration by the user-mode program.

\n
result = FwpmTransactionCommit0(engineHandle);\nif (result != ERROR_SUCCESS) {\n\tprintf(\"Error: Commit failed (0x%x)\\n\", result);\n\tFwpmTransactionAbort0(engineHandle);\n}\nelse {\n\tprintf(\"SUCCESS: Persistent filters added.\\n\");\n}
\n

Checking How Filter Arbitration Works

\n

Now that we have confirmed the behavior of adding filters with the user-mode sample program, we will use this sample program to check various filtering behaviors in practice.

\n

Blocking Connections to a Specific Port Number

\n

First, add a filter with the following conditions defined in FILTER_RULES in the sample program.

\n
{ \n  FILTER_KEY_1, \n  FWPM_LAYER_ALE_AUTH_CONNECT_V4, \n  FWPM_SUBLAYER_UNIVERSAL, \n  L\"Block HTTPS(443)\", \n  L\"Block HTTPS(443)\", \n  443, \n  NULL, \n  FWP_ACTION_BLOCK, \n  0xFFFFFFFFFFFFFFF1 \n}
\n

If you inspect the event generated when this filter is registered with wfpdiag, you can confirm that a filter with a condition that blocks all traffic to remote port 443 has been added to the FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer.

\n

\n \n \n \n \n \n \n \n \n

\n

Also, if you inspect the event processed by this filter’s filterId, 71431, you can confirm that traffic to port 443 from various applications was dropped by this filter.

\n

\n \n \n \n \n \n \n \n \n

\n

Checking the Effect of Filter Weight Within the Same Sublayer

\n

Next, while keeping the Block HTTPS(443) filter configuration that blocks all traffic to port 443 unchanged, add a filter to the FWPM_SUBLAYER_UNIVERSAL sublayer of the same FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer that allows all traffic from msedge.exe.

\n

At this time, the Allow Edge filter’s Weight is specified as a value 1 smaller than the Block HTTPS(443) filter’s Weight.

\n
{ \n  FILTER_KEY_2, \n  FWPM_LAYER_ALE_AUTH_CONNECT_V4, \n  FWPM_SUBLAYER_UNIVERSAL, \n  L\"Allow Edge\", \n  L\"Allow Edge\", \n  0, \n  L\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\", \n  FWP_ACTION_PERMIT, \n  0xFFFFFFFFFFFFFFF0 \n}
\n

If these two filters are registered, the Allow Edge filter will not take effect, and all traffic to port 443 by msedge.exe will be blocked.

\n

Also, the count of terminatingFiltersInfo in netEvents, which indicates that this traffic was dropped, does not increase, showing that the evaluation result within the FWPM_SUBLAYER_UNIVERSAL sublayer applied FWP_ACTION_BLOCK, the filter with the highest Weight.

\n

\n \n \n \n \n \n \n \n \n

\n

Next, change the Weight of the Allow Edge filter to 0xFFFFFFFFFFFFFFFF, and then register the filters again.

\n

This time, traffic to port 443 becomes possible only when using msedge.exe.

\n

This behavior shows that when conflicting filters are registered within the same sublayer, the action of the filter with the highest Weight is used for the decision.

\n

Checking the Effect of Weight Across Different Sublayers

\n

Next, we will check the behavior when conflicting filters are registered in different sublayers of the same layer.

\n

First, like filters, sublayers have a Weight value that represents priority, and network traffic inspected at a given layer passes through all sublayers of that layer in order of sublayer Weight.

\n

\n \n \n \n \n \n \n \n \n

\n

The major difference between this evaluation and the filter evaluation described in the previous section is that even if a matching filter is found in a higher-priority sublayer, evaluation still proceeds through all lower-priority sublayers.

\n

To confirm this behavior, change the FILTER_RULES settings in the sample program as follows.

\n
const FILTER_RULES rules[] = {\n\t{ FILTER_KEY_1, FWPM_LAYER_ALE_AUTH_CONNECT_V4, FWPM_SUBLAYER_MPSSVC_QUARANTINE, L\"Block HTTPS(443)\", L\"Block HTTPS(443)\", 443, NULL, FWP_ACTION_BLOCK, 0xFFFFFFFFFFFFFFF1 },\n\t{ FILTER_KEY_2, FWPM_LAYER_ALE_AUTH_CONNECT_V4, FWPM_SUBLAYER_UNIVERSAL, L\"Allow Edge\", L\"Allow Edge\", 0, L\"C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\", FWP_ACTION_PERMIT, 0xFFFFFFFFFFFFFFFF },\n};
\n

Here, Block HTTPS(443), which blocks all traffic to port 443, and Allow Edge, which allows traffic from msedge.exe, are assigned to different sublayers of the same layer.

\n

The FWPM_SUBLAYER_MPSSVC_QUARANTINE to which the Block HTTPS(443) filter is assigned has a Weight of 4.\nMeanwhile, FWPM_SUBLAYER_UNIVERSAL, to which the Allow Edge filter is assigned, has a Weight of 32768, so in terms of registered sublayer priority, FWPM_SUBLAYER_UNIVERSAL, which holds the Allow Edge filter, has the higher priority.

\n

However, if the filters are registered with this configuration, communication by msedge.exe is not allowed, and all traffic to port 443 is blocked.

\n

As explained in Chapter 1, in the case of sublayers, even if a matching filter is registered in a sublayer with a higher Weight, all sublayers in the layer are evaluated before the final action is determined.

\n

Also, the final action is determined based on WFP’s policy rules, and basically a “block” action overrides an “allow” action.

\n

Therefore, as this test result shows, even when traffic is “allowed” in a sublayer with a higher Weight, if it is “blocked” in another sublayer, the final decision is “block” except in exceptional circumstances.

\n

In fact, the results in netevents also show that the count of evaluated filters in terminatingFiltersInfo increased to 3, confirming that both the Allow Edge filter (filterId:71441) and the Block HTTPS(443) filter (filterId:71440) were evaluated, and that the final decision was to drop the traffic.

\n

\n \n \n \n \n \n \n \n \n

\n

Summary

\n

In this chapter, we reviewed the basic operations for registering and deleting WFP filters from a user-mode program via the BFE.

\n

Using the FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer as an example, we also verified the differences in evaluation results between filters in the same sublayer and filters in different sublayers, confirming the actual behavior of WFP filtering.

\n

In the next chapter, we will use a callout driver to extend classification processing and handle dynamic allow/block control through coordination with user mode.

\n

Table of Contents for This Book

\n\n
\n
\n
    \n
  1. \n

    FWPM_FILTER0 structure (fwpmtypes.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmtypes/ns-fwpmtypes-fwpm_filter0

    \n↩\n
    2. \n
  2. \n

    Management filtering layer identifiers https://learn.microsoft.com/windows-hardware/drivers/network/management-filtering-layer-identifiers

    \n↩\n
    3. \n
  3. \n

    Filtering sublayer identifiers https://learn.microsoft.com/ja-jp/windows/win32/fwp/management-filtering-sublayer-identifiers

    \n↩\n
    4. \n
  4. \n

    FWPM_DISPLAY_DATA0 structure (fwptypes.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwptypes/ns-fwptypes-fwpmdisplaydata0

    \n↩\n
    5. \n
  5. \n

    FWPM_ACTION0 structure (fwpmtypes.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmtypes/ns-fwpmtypes-fwpm_action0

    \n↩\n
    6. \n
  6. \n

    Management Functions https://learn.microsoft.com/ja-jp/windows/win32/fwp/fwp-mgmt-functions

    \n↩\n
    7. \n
  7. \n

    Sessions https://learn.microsoft.com/ja-jp/windows/win32/fwp/object-management#sessions

    \n↩\n
    8. \n
  8. \n

    FwpmEngineOpen0 function (fwpmu.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmu/nf-fwpmu-fwpmengineopen0

    \n↩\n
    9. \n
  9. \n

    Transactions https://learn.microsoft.com/ja-jp/windows/win32/fwp/object-management#transactions

    \n↩\n
    10. \n
  10. \n

    FwpmTransactionBegin0 function (fwpmu.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmu/nf-fwpmu-fwpmtransactionbegin0

    \n↩\n
    11. \n
  11. \n

    FwpmProviderAdd0 function (fwpmu.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmu/nf-fwpmu-fwpmprovideradd0

    \n↩\n
    12. \n
  12. \n

    FwpmProviderAdd0 function (fwpmu.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmu/nf-fwpmu-fwpmprovideradd0

    \n↩\n
    13. \n
  13. \n

    FWPM_FILTER_CONDITION0 structure (fwpmtypes.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmtypes/ns-fwpmtypes-fwpmfiltercondition0

    \n↩\n
    14. \n
  14. \n

    FWP_MATCH_TYPE enumeration (fwptypes.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwptypes/ne-fwptypes-fwpmatchtype

    \n↩\n
    15. \n
  15. \n

    FWP_CONDITION_VALUE0 structure (fwptypes.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwptypes/ns-fwptypes-fwpconditionvalue0

    \n↩\n
    16. \n
  16. \n

    Filtering condition identifiers https://learn.microsoft.com/ja-jp/windows/win32/fwp/filtering-condition-identifiers-

    \n↩\n
    17. \n
  17. \n

    FWPM_FILTER0 structure (fwpmtypes.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmtypes/ns-fwpmtypes-fwpm_filter0

    \n↩\n
    18. \n
  18. \n

    FwpmFilterAdd0 function (fwpmu.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmu/nf-fwpmu-fwpmfilteradd0

    \n↩\n
    19. \n
  19. \n

    FwpmFilterAdd0 function (fwpmu.h) https://learn.microsoft.com/ja-jp/windows/win32/api/fwpmu/nf-fwpmu-fwpmfilteradd0

    \n↩\n
    20. \n
\n
","fields":{"slug":"/a-part-of-anti-virus-3-02-en","tagSlugs":["/tag/a-part-of-anti-virus-3-en/","/tag/windows-en/","/tag/win-dbg-en/","/tag/anti-virus-en/","/tag/english/"]},"frontmatter":{"date":"2026-04-11","description":"This is the WEB edition of A PART OF ANTI-VIRUS 3, distributed at Technical Book Fest 20.","tags":["A PART OF ANTI-VIRUS 3 (en)","Windows (en)","WinDbg (en)","AntiVirus (en)","English"],"title":"A PART OF ANTI-VIRUS 3 - Learning Windows Filtering Platform (WFP) from Public Sample Code - (WEB Edition) [Chapter 2: A Sample That Uses WFP for Access Control]","socialImage":{"publicURL":"/static/272acc1e889df0e25d89217e89d5fd13/a-part-of-anti-virus-3.png"}}}},"pageContext":{"slug":"/a-part-of-anti-virus-3-02-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}