Skip to content

Add WFP listen hook simulation for sock_addr listen testing #306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mikeagun wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add WFP listen hook simulation for sock_addr listen testing #306

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4012569
Add support for SOCK_OPS listen hook.
Aug 13, 2025
05e548f
fix for flow_id.
Aug 14, 2025
40562a6
Rename sock_ops_listen to cgroup_inet_listen for sock_addr alignment
May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions inc/usersim/fwp_test.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,12 @@ usersim_fwp_sock_ops_v4(_In_ fwp_classify_parameters_t* parameters, _Out_opt_ ui
USERSIM_API FWP_ACTION_TYPE
usersim_fwp_sock_ops_v6(_In_ fwp_classify_parameters_t* parameters, _Out_opt_ uint64_t* flow_id);

USERSIM_API FWP_ACTION_TYPE
usersim_fwp_cgroup_inet4_listen(_In_ fwp_classify_parameters_t* parameters);

USERSIM_API FWP_ACTION_TYPE
usersim_fwp_cgroup_inet6_listen(_In_ fwp_classify_parameters_t* parameters);

USERSIM_API void
usersim_fwp_set_sublayer_guids(
_In_ const GUID& default_sublayer, _In_ const GUID& connect_v4_sublayer, _In_ const GUID& connect_v6_sublayer);
Expand Down
44 changes: 44 additions & 0 deletions src/fwp_um.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -469,6 +469,38 @@ fwp_engine_t::test_sock_ops_v6(_In_ fwp_classify_parameters_t* parameters, _Out_
FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6, FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6, _default_sublayer, incoming_value, flow_id);
}

// This is used to test the sock_addr listen hook for IPv4 traffic.
FWP_ACTION_TYPE
fwp_engine_t::test_cgroup_inet4_listen(_In_ fwp_classify_parameters_t* parameters)
{
FWPS_INCOMING_VALUE0 incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V4_MAX] = {};
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_ADDRESS].value.uint32 = parameters->destination_ipv4_address;
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_PORT].value.uint16 = parameters->destination_port;
Copy link
Copy Markdown
Contributor

@saxena-anurag saxena-anurag May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: should we rename destination_ipv4_address and destination_port to a more accurate name, like local_ip and remote_ip?

incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V4_COMPARTMENT_ID].value.uint32 = parameters->compartment_id;
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_INTERFACE].value.uint64 = &parameters->interface_luid;
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_APP_ID].value.byteBlob = &parameters->app_id;

return test_callout(
FWPS_LAYER_ALE_AUTH_LISTEN_V4, FWPM_LAYER_ALE_AUTH_LISTEN_V4, _default_sublayer, incoming_value, nullptr);
}

// This is used to test the sock_addr listen hook for IPv6 traffic.
FWP_ACTION_TYPE
fwp_engine_t::test_cgroup_inet6_listen(_In_ fwp_classify_parameters_t* parameters)
{
FWPS_INCOMING_VALUE0 incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V6_MAX] = {};
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V6_IP_LOCAL_ADDRESS].value.byteArray16 =
&parameters->destination_ipv6_address;
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V6_IP_LOCAL_PORT].value.uint16 = parameters->destination_port;
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V6_COMPARTMENT_ID].value.uint32 = parameters->compartment_id;
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V6_IP_LOCAL_INTERFACE].value.uint64 = &parameters->interface_luid;
incoming_value[FWPS_FIELD_ALE_AUTH_LISTEN_V6_ALE_APP_ID].value.byteBlob = &parameters->app_id;

return test_callout(
FWPS_LAYER_ALE_AUTH_LISTEN_V6, FWPM_LAYER_ALE_AUTH_LISTEN_V6, _default_sublayer, incoming_value, nullptr);
}

#pragma endregion fwp_engine_t

#pragma region fwpm_apis

Expand Down Expand Up @@ -1042,6 +1074,18 @@ usersim_fwp_sock_ops_v6(_In_ fwp_classify_parameters_t* parameters, _Out_opt_ ui
return fwp_engine_t::get()->test_sock_ops_v6(parameters, flow_id);
}

FWP_ACTION_TYPE
usersim_fwp_cgroup_inet4_listen(_In_ fwp_classify_parameters_t* parameters)
{
return fwp_engine_t::get()->test_cgroup_inet4_listen(parameters);
}

FWP_ACTION_TYPE
usersim_fwp_cgroup_inet6_listen(_In_ fwp_classify_parameters_t* parameters)
{
return fwp_engine_t::get()->test_cgroup_inet6_listen(parameters);
}

void
usersim_fwp_set_sublayer_guids(
_In_ const GUID& default_sublayer, _In_ const GUID& connect_v4_sublayer, _In_ const GUID& connect_v6_sublayer)
Expand Down
6 changes: 6 additions & 0 deletions src/fwp_um.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,12 @@ typedef class fwp_engine_t
void
test_sock_ops_v6_remove_flow_context(_In_ uint64_t flow_id);

FWP_ACTION_TYPE
test_cgroup_inet4_listen(_In_ fwp_classify_parameters_t* parameters);

FWP_ACTION_TYPE
test_cgroup_inet6_listen(_In_ fwp_classify_parameters_t* parameters);

static fwp_engine_t*
get()
{
Expand Down