wf icon indicating copy to clipboard operation
wf copied to clipboard

Error with filter by Ip range

Open idan1109 opened this issue 2 years ago • 1 comments

First of all thank you for this beautiful package! I think i've found a problem when trying to set an ip range

	// Get the absolute path of the current program
	execPath := ""C:\\Windows\\system32\\cmd.exe""
	// Ask windows for the corresponding application ID
	appID, err := wf.AppID(execPath)
	if err != nil {
		println("Error Getting AppID:", err)
	}
	ruleGuid, _ := windows.GenerateGUID()
	iprange, err := netaddr.ParseIPRange("192.168.1.10-192.168.1.25")
	if err != nil {
		println("Error parsing IP:", err)
	}
	err = session.AddRule(&wf.Rule{
		ID:       wf.RuleID(ruleGuid),
		Name:     "My Rule",
		Layer:    wf.LayerALEAuthConnectV4,
		Sublayer: sublayerID,
		Weight:   900,
		Conditions: []*wf.Match{
			{
				Field: wf.FieldALEAppID,
				Op:    wf.MatchTypeEqual,
				Value: appID,
			},
			{
				Field: wf.FieldIPRemoteAddress,
				Op:    wf.MatchTypeRange,
				Value: iprange, // IP Range
			},
		},
		Action: wf.ActionBlock,
	})

Cannot add rule: (0x1bada0,0xc00032b120)

idan1109 avatar Jul 09 '22 17:07 idan1109

i've seen the pull request. After updating the compose.go file i changed my code into this:

                      {
				Field: wf.FieldIPRemoteAddress,
				Op:    wf.MatchTypeRange,
				Value: wf.Range{From: iprange.From(), To: iprange.To()}, // IP Range
			},

Still no luck. I've seen also the microsoft blog where someone asked about this:

According to the Doc: FWP_MATCH_TYPE enumeration

The value data type and the filter condition data type must be the same. The Base Filtering Engine (BFE) does not perform any data conversion.

An FWP_UINT32 field that contains an IPv4 address can be compared with an FWP_V4_ADDR_MASK value.

Only sortable data types support FWP_MATCH_RANGE. Sortable data types consist of all integer types, FWP_BYTE_ARRAY16_TYPE, FWP_BYTE_BLOB_TYPE, and FWP_UNICODE_STRING_TYPE.

This is my first week of learning about golang so i cannot really help much more than that

idan1109 avatar Jul 09 '22 23:07 idan1109