Hello everyone!
I have a question about WFP, registered FWPM_LAYER_ALE_AUTH_CONNECT_V4 to filter outbound authorization callback function classifyFn(), my understanding is that the TCP data of the application layer will call back my registered classifyFn() when calling connect(), but for UDP I have 2 questions that I don’t quite understand, as follows:
1. For UDP data, does the application layer call my registered classifyFn() when calling sendto() for the first time?
2. When will the UDP of the application layer be re-authorized? I found that after the first authorization of UDP, if no data packets are sent for a period of time, it will be re-authorized?