diff options
| author | J M Rossy <[email protected]> | 2015-07-29 15:40:09 -0700 |
|---|---|---|
| committer | J M Rossy <[email protected]> | 2015-07-29 16:34:40 -0700 |
| commit | 5d61a4a79a1e96dc5d9af1e5e712c84507307544 (patch) | |
| tree | 49ed270893578cd18758b74ffcca16dc7ab948d6 /network/trans/WFPSampler/syslib/HelperFunctions_FwpObjects.cpp | |
| parent | 5d41613e26e147d2300c786bb2b34cb4b4067a25 (diff) | |
Samples update for public Windows 10 release
Fix #2 Enabling WPP Recorder in Sensors Samples causes errors
Fix #4 Add back fixed KMDOD sample
Add new BarcodeScanner sample in pos folder
Add new MagneticStripeReader sample in pos folder
Add new SynpaticsTouch sample in input folder
Add new Power Engine Plugin sample in pofx folder
Add new DeviceMft sample in avstream folder
Add new AvsCamera sample in root
Add new SimBatt sample in root
Add other pre-existing samples not yet released for Win10
Diffstat (limited to 'network/trans/WFPSampler/syslib/HelperFunctions_FwpObjects.cpp')
| -rw-r--r-- | network/trans/WFPSampler/syslib/HelperFunctions_FwpObjects.cpp | 9068 |
1 files changed, 9068 insertions, 0 deletions
diff --git a/network/trans/WFPSampler/syslib/HelperFunctions_FwpObjects.cpp b/network/trans/WFPSampler/syslib/HelperFunctions_FwpObjects.cpp new file mode 100644 index 00000000..cc9a0646 --- /dev/null +++ b/network/trans/WFPSampler/syslib/HelperFunctions_FwpObjects.cpp @@ -0,0 +1,9068 @@ +//////////////////////////////////////////////////////////////////////////////////////////////////// +// +// Copyright (c) 2014 Microsoft Corporation. All Rights Reserved. +// +// Module Name: +// HelperFunctions\FwpObjects.c +// +// Abstract: +// This module contains kernel helper functions that allocate, populate, purge, and free WFP +// structures in memory. +// +// Naming Convention: +// +// <Module><Object><Action><Modifier> +// +// i.e. +// +// KrnlHlprFwpValueCreateLocalCopy +// +// <Module> +// KrnlHlpr - Function is located in syslib\ and applies to kernel +// mode. +// <Object> +// { +// FwpByteBlob - Function pertains to FWP_BYTE_BLOB objects. +// FwpConditionValue - Function pertains to FWP_CONDITION_VALUE objects. +// FwpmClassifyOption - Function pertains to FWPM_CLASSIFY_OPTION objects. +// FwpmClassifyOptions - Function pertains to FWPM_CLASSIFY_OPTIONS objects. +// FwpmDisplayData - Function pertains to FWPM_DISPLAY_DATA objects. +// FwpmProviderContext - Function pertains to FWPM_PROVIDER_CONTEXT objects. +// FwpRange - Function pertains to FWP_RANGE objects. +// FwpsClassifyOut - Function pertains to FWPS_CLASSIFY_OUT objects. +// FwpsFilter - Function pertains to FWPS_FILTER objects. +// FwpsFilterCondition - Function pertains to FWPS_FILTER_CONDITION objects. +// FwpsIncomingMetadataValues - Function pertains to FWPS_INCOMING_METADATA +// objects. +// FwpsIncomingValues - Function pertains to FWPS_INCOMING_VALUES objects. +// FwpsStreamCalloutIOPacket - Function pertains to FWPS_STREAM_DATA objects. +// FwpsStreamData - Function pertains to FWPS_STREAM_DATA objects. +// FwpTokenInformation - Function pertains to FWP_TOKEN_INFORMATION objects. +// FwpV4AddrAndMask - Function pertains to FWP_V4_ADDR_AND_MASK objects. +// FwpV6AddrAndMask - Function pertains to FWP_V6_ADDR_AND_MASK objects. +// FwpValue - Function pertains to FWP_VALUE objects. +// IPsecDoSPOptions - Function pertains to IPSEC_DOSP_OPTIONS objects. +// } +// <Action> +// { +// Get - Function returns a pointer or value +// Create - Function allocates and fills memory +// Populate - Function fills memory with values +// Acquire - Function will take a reference on an object +// Release - Function releases the reference on the object +// Purge - Function cleans up values +// Destroy - Function cleans up and frees memory +// } +// <Modifier> +// LocalCopy - Function acts on the LocalCopy (as opposed to the original) +// +// Author: +// Dusty Harper (DHarper) +// +// Revision History: +// +// [ Month ][Day] [Year] - [Revision]-[ Comments ] +// May 01, 2010 - 1.0 - Creation +// December 13, 2013 - 1.1 - Add support for multiple injectors, add +// KrnlHlprFwpValueGetStringForFwpsIncomingValue, +// KrnlHlprFwpsRedirectHandleCreate, +// KrnlHlprFwpsRedirecthandleDestroy, +// KrnlHlprFwpsLayerIsDiscard, +// KrnlHlprFwpsLayerIDToString functions, add missing +// conditions, and fix invalid conditions. +// +//////////////////////////////////////////////////////////////////////////////////////////////////// + +#include "HelperFunctions_Include.h" /// . +#include "HelperFunctions_FwpObjects.tmh" /// $(OBJ_PATH)\$(O)\ + +HANDLE g_EngineHandle = 0; +HANDLE g_pIPv4InboundMACInjectionHandles[2] = {0}; +HANDLE g_pIPv4IngressVSwitchEthernetInjectionHandles[2] = {0}; +HANDLE g_pIPv4InboundForwardInjectionHandles[2] = {0}; +HANDLE g_pIPv4InboundNetworkInjectionHandles[2] = {0}; +HANDLE g_pIPv4InboundTransportInjectionHandles[2] = {0}; +HANDLE g_pIPv4InboundStreamInjectionHandles[2] = {0}; +HANDLE g_pIPv4OutboundMACInjectionHandles[2] = {0}; +HANDLE g_pIPv4EgressVSwitchEthernetInjectionHandles[2] = {0}; +HANDLE g_pIPv4OutboundForwardInjectionHandles[2] = {0}; +HANDLE g_pIPv4OutboundNetworkInjectionHandles[2] = {0}; +HANDLE g_pIPv4OutboundTransportInjectionHandles[2] = {0}; +HANDLE g_pIPv4OutboundStreamInjectionHandles[2] = {0}; +HANDLE g_pIPv6InboundMACInjectionHandles[2] = {0}; +HANDLE g_pIPv6IngressVSwitchEthernetInjectionHandles[2] = {0}; +HANDLE g_pIPv6InboundForwardInjectionHandles[2] = {0}; +HANDLE g_pIPv6InboundNetworkInjectionHandles[2] = {0}; +HANDLE g_pIPv6InboundTransportInjectionHandles[2] = {0}; +HANDLE g_pIPv6InboundStreamInjectionHandles[2] = {0}; +HANDLE g_pIPv6OutboundForwardInjectionHandles[2] = {0}; +HANDLE g_pIPv6OutboundNetworkInjectionHandles[2] = {0}; +HANDLE g_pIPv6OutboundTransportInjectionHandles[2] = {0}; +HANDLE g_pIPv6OutboundStreamInjectionHandles[2] = {0}; +HANDLE g_pIPv6OutboundMACInjectionHandles[2] = {0}; +HANDLE g_pIPv6EgressVSwitchEthernetInjectionHandles[2] = {0}; +HANDLE g_pInboundForwardInjectionHandles[2] = {0}; +HANDLE g_pInboundNetworkInjectionHandles[2] = {0}; +HANDLE g_pInboundTransportInjectionHandles[2] = {0}; +HANDLE g_pInboundStreamInjectionHandles[2] = {0}; +HANDLE g_pInboundMACInjectionHandles[2] = {0}; +HANDLE g_pIngressVSwitchEthernetInjectionHandles[2] = {0}; +HANDLE g_pOutboundForwardInjectionHandles[2] = {0}; +HANDLE g_pOutboundNetworkInjectionHandles[2] = {0}; +HANDLE g_pOutboundTransportInjectionHandles[2] = {0}; +HANDLE g_pOutboundStreamInjectionHandles[2] = {0}; +HANDLE g_pOutboundMACInjectionHandles[2] = {0}; +HANDLE g_pEgressVSwitchEthernetInjectionHandles[2] = {0}; +HANDLE g_pRedirectionHandles[2] = {0}; + +#ifndef FWP_BYTE_BLOB____ +#define FWP_BYTE_BLOB____ + +#pragma warning(disable: 24002) /// Code is IPv4 & IPv6 specific + +/** + @kernel_helper_function="KrnlHlprFwpByteBlobPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWP_BYTE_BLOB. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552427.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpByteBlobPurgeLocalCopy(_Inout_ FWP_BYTE_BLOB* pBlob) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpByteBlobPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pBlob); + + HLPR_DELETE_ARRAY(pBlob->data, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpByteBlobPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpByteBlobDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWP_BYTE_BLOB. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552427.aspx <br> +*/ +_At_(*ppBlob, _Pre_ _Notnull_) +_At_(*ppBlob, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppBlob == 0) +inline VOID KrnlHlprFwpByteBlobDestroyLocalCopy(_Inout_ FWP_BYTE_BLOB** ppBlob) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpByteBlobDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppBlob); + + if(*ppBlob) + KrnlHlprFwpByteBlobPurgeLocalCopy(*ppBlob); + + HLPR_DELETE(*ppBlob, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpByteBlobDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpByteBlobPopulateLocalCopy" + + Purpose: Populate a local copy of an FWP_BYTE_BLOB. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpByteBlobPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552427.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpByteBlobPopulateLocalCopy(_In_ const FWP_BYTE_BLOB* pOriginalBlob, + _Inout_ FWP_BYTE_BLOB* pBlob) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpByteBlobPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalBlob); + NT_ASSERT(pBlob); + + NTSTATUS status = STATUS_SUCCESS; + + pBlob->size = pOriginalBlob->size; + + if(pBlob->size) + { + HLPR_NEW_ARRAY(pBlob->data, + BYTE, + pBlob->size, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pBlob->data, + status); + + RtlCopyMemory(pBlob->data, + pOriginalBlob->data, + pBlob->size); + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpByteBlobPurgeLocalCopy(pBlob); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpByteBlobPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpByteBlobCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWP_BYTE_BLOB. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpByteBlobDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552427.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_BYTE_BLOB* KrnlHlprFwpByteBlobCreateLocalCopy(_In_ const FWP_BYTE_BLOB* pOriginalBlob) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpByteBlobCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalBlob); + + NTSTATUS status = STATUS_SUCCESS; + FWP_BYTE_BLOB* pByteBlob = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pByteBlob is expected to be cleaned up by caller using KrnlHlprFwpByteBlobDestroyLocalCopy + + HLPR_NEW(pByteBlob, + FWP_BYTE_BLOB, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pByteBlob, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpByteBlobPopulateLocalCopy(pOriginalBlob, + pByteBlob); + HLPR_BAIL_ON_FAILURE(status); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pByteBlob initialized with call to HLPR_NEW & KrnlHlprFwpByteBlobPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pByteBlob) + KrnlHlprFwpByteBlobDestroyLocalCopy(&pByteBlob); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpByteBlobCreateLocalCopy() [pByteBlob: %#p]\n", + pByteBlob); + +#endif /// DBG + + return pByteBlob; + +#pragma warning(pop) +} + +#endif /// FWP_BYTE_BLOB____ + +#ifndef FWPM_DISPLAY_DATA____ +#define FWPM_DISPLAY_DATA____ + +/** + @kernel_helper_function="KrnlHlprFwpmDisplayDataPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPM_DISPLAY_DATA. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364261.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpmDisplayDataPurgeLocalCopy(_Inout_ FWPM_DISPLAY_DATA* pData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmDisplayDataPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pData); + + HLPR_DELETE_ARRAY(pData->name, + WFPSAMPLER_SYSLIB_TAG); + + HLPR_DELETE_ARRAY(pData->description, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmDisplayDataPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmDisplayDataDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPM_DISPLAY_DATA. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364261.aspx <br> +*/ +_At_(*ppDisplayData, _Pre_ _Notnull_) +_At_(*ppDisplayData, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppDisplayData == 0) +inline VOID KrnlHlprFwpmDisplayDataDestroyLocalCopy(_Inout_ FWPM_DISPLAY_DATA** ppDisplayData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmDisplayDataDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppDisplayData); + + if(*ppDisplayData) + KrnlHlprFwpmDisplayDataPurgeLocalCopy(*ppDisplayData); + + HLPR_DELETE(*ppDisplayData, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmDisplayDataDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmDisplayDataPopulateLocalCopy" + + Purpose: Populate a local copy of an FWPM_DISPLAY_DATA. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpmDisplayDataPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364261.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpmDisplayDataPopulateLocalCopy(_In_ const FWPM_DISPLAY_DATA* pOriginalData, + _Inout_ FWPM_DISPLAY_DATA* pData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmDisplayDataPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalData); + NT_ASSERT(pData); + + NTSTATUS status = STATUS_SUCCESS; + KIRQL irql = KeGetCurrentIrql(); + size_t nameSize = 0; + size_t descriptionSize = 0; + + if(irql == PASSIVE_LEVEL) + { + status = RtlStringCchLengthW(pOriginalData->name, + NTSTRSAFE_MAX_CCH, + &nameSize); + HLPR_BAIL_ON_FAILURE(status); + + if(pOriginalData->description) + { + status = RtlStringCchLengthW(pOriginalData->description, + NTSTRSAFE_MAX_CCH, + &descriptionSize); + HLPR_BAIL_ON_FAILURE(status); + } + } + else + { + nameSize = wcslen(pOriginalData->name); + + if(pOriginalData->description) + descriptionSize = wcslen(pOriginalData->description); + } + + /// name is required for the FWPM_DISPLAY_DATA to be valid + if(nameSize) + { + HLPR_NEW_ARRAY(pData->name, + WCHAR, + nameSize + 1, /// add space for '\0' + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pData->name, + status); + + RtlCopyMemory(pData->name, + pOriginalData->name, + nameSize); + + pData->name[nameSize] = L'\0'; + } + else + { + status = STATUS_INVALID_BUFFER_SIZE; + + HLPR_BAIL; + } + + /// description is not required for the FWPM_DISPLAY_DATA to be valid + if(descriptionSize) + { + HLPR_NEW_ARRAY(pData->description, + WCHAR, + descriptionSize + 1, /// add space for '\0' + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pData->description, + status); + + RtlCopyMemory(pData->description, + pOriginalData->description, + nameSize); + + pData->description[descriptionSize] = L'\0'; + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + { + HLPR_DELETE_ARRAY(pData->name, + WFPSAMPLER_SYSLIB_TAG); + + HLPR_DELETE_ARRAY(pData->description, + WFPSAMPLER_SYSLIB_TAG); + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmDisplayDataPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpmDisplayDataCreateLocalCopy" + + Purpose: ALlocate and populate a local copy of an FWPM_DISPLAY_DATA. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpmDisplayDataDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364261.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPM_DISPLAY_DATA* KrnlHlprFwpmDisplayDataCreateLocalCopy(_In_ const FWPM_DISPLAY_DATA* pOriginalDisplayData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmDisplayDataCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalDisplayData); + + NTSTATUS status = STATUS_SUCCESS; + FWPM_DISPLAY_DATA* pDisplayData = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pDisplayData is expected to be cleaned up by caller using KrnlHlprFwpmDisplayDataDestroyLocalCopy + + HLPR_NEW(pDisplayData, + FWPM_DISPLAY_DATA, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pDisplayData, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpmDisplayDataPopulateLocalCopy(pOriginalDisplayData, + pDisplayData); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pDisplayData initialized with call to HLPR_NEW & KrnlHlprFwpmDisplayDataPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pDisplayData) + KrnlHlprFwpmDisplayDataDestroyLocalCopy(&pDisplayData); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmDisplayDataCreateLocalCopy() [pDisplayData: %#p]\n", + pDisplayData); + +#endif /// DBG + + return pDisplayData; + +#pragma warning(pop) +} + +#endif /// FWP_DISPLAY_DATA____ + +#ifndef FWPM_CLASSIFY_OPTION____ +#define FWPM_CLASSIFY_OPTION____ + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPM_CLASSIFY_OPTION. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364259.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpmClassifyOptionPurgeLocalCopy(_Inout_ FWPM_CLASSIFY_OPTION* pOption) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOption); + + KrnlHlprFwpValuePurgeLocalCopy(&(pOption->value)); + + pOption->type = FWP_CLASSIFY_OPTION_MAX; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPM_CLASSIFY_OPTION. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364259.aspx <br> +*/ +_At_(*ppOption, _Pre_ _Notnull_) +_At_(*ppOption, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppOption == 0) +inline VOID KrnlHlprFwpmClassifyOptionDestroyLocalCopy(_Inout_ FWPM_CLASSIFY_OPTION** ppOption) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppOption); + + if(*ppOption) + KrnlHlprFwpmClassifyOptionPurgeLocalCopy(*ppOption); + + HLPR_DELETE(*ppOption, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionPopulateLocalCopy" + + Purpose: Populate a local copy of an FWPM_CLASSIFY_OPTION. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpmClassifyOptionPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364259.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpmClassifyOptionPopulateLocalCopy(_In_ const FWPM_CLASSIFY_OPTION* pOriginalOption, + _Inout_ FWPM_CLASSIFY_OPTION* pOption) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalOption); + NT_ASSERT(pOption); + + NTSTATUS status = STATUS_SUCCESS; + + status = KrnlHlprFwpValuePopulateLocalCopy(&(pOriginalOption->value), + &(pOption->value)); + HLPR_BAIL_ON_FAILURE(status); + + pOption->type = pOriginalOption->type; + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + { + KrnlHlprFwpValuePurgeLocalCopy(&(pOption->value)); + + pOption->type = FWP_CLASSIFY_OPTION_MAX; + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWPM_CLASSIFY_OPTION. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpmClassifyOptionDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364259.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPM_CLASSIFY_OPTION* KrnlHlprFwpmClassifyOptionCreateLocalCopy(_In_ const FWPM_CLASSIFY_OPTION* pOriginalOption) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionCreateLocalCopy()\n"); + +#endif /// DBG + + FWPM_CLASSIFY_OPTION* pOption = 0; + + if(pOriginalOption) + { + NTSTATUS status = STATUS_SUCCESS; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pOption is expected to be cleaned up by caller using KrnlHlprFwpmClassifyOptionDestroyLocalCopy + + HLPR_NEW(pOption, + FWPM_CLASSIFY_OPTION, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pOption, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpmClassifyOptionPopulateLocalCopy(pOriginalOption, + pOption); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pOption initialized with call to HLPR_NEW & KrnlHlprFwpmClassifyOptionPopulateLocalCopy + + if(status != STATUS_SUCCESS) + KrnlHlprFwpmClassifyOptionDestroyLocalCopy(&pOption); + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionCreateLocalCopy() [pOption: %#p]\n", + pOption); + +#endif /// DBG + + return pOption; + +#pragma warning(pop) +} + +#endif /// FWPM_CLASSIFY_OPTION____ + +#ifndef FWPM_CLASSIFY_OPTIONS____ +#define FWPM_CLASSIFY_OPTIONS____ + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionsPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPM_CLASSIFY_OPTIONS. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364260.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpmClassifyOptionsPurgeLocalCopy(_Inout_ FWPM_CLASSIFY_OPTIONS* pOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionsPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOptions); + + for(UINT32 optionIndex = 0; + optionIndex < pOptions->numOptions; + optionIndex++) + { + KrnlHlprFwpmClassifyOptionPurgeLocalCopy(&(pOptions->options[optionIndex])); + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionsPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionsDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPM_CLASSIFY_OPTIONS. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364260.aspx <br> +*/ +_At_(*ppOptions, _Pre_ _Notnull_) +_At_(*ppOptions, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppOptions == 0) +inline VOID KrnlHlprFwpmClassifyOptionsDestroyLocalCopy(_Inout_ FWPM_CLASSIFY_OPTIONS** ppOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionsDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppOptions); + + if(*ppOptions) + KrnlHlprFwpmClassifyOptionsPurgeLocalCopy(*ppOptions); + + HLPR_DELETE(*ppOptions, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionsDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionsPopulateLocalCopy" + + Purpose: Populate a local copy of an FWPM_CLASSIFY_OPTIONS. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpmClassifyOptionsPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364260.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpmClassifyOptionsPopulateLocalCopy(_In_ const FWPM_CLASSIFY_OPTIONS* pOriginalOptions, + _Inout_ FWPM_CLASSIFY_OPTIONS* pOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionsPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalOptions); + NT_ASSERT(pOptions); + + NTSTATUS status = STATUS_SUCCESS; + + if(pOriginalOptions->numOptions) + { + HLPR_NEW_ARRAY(pOptions->options, + FWPM_CLASSIFY_OPTION, + pOriginalOptions->numOptions, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pOptions->options, + status); + + pOptions->numOptions = pOriginalOptions->numOptions; + + for(UINT32 optionIndex = 0; + optionIndex < pOptions->numOptions; + optionIndex++) + { + status = KrnlHlprFwpmClassifyOptionPopulateLocalCopy(&(pOriginalOptions->options[optionIndex]), + &(pOptions->options[optionIndex])); + HLPR_BAIL_ON_FAILURE(status); + } + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpmClassifyOptionsPurgeLocalCopy(pOptions); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionsPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpmClassifyOptionsCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWPM_CLASSIFY_OPTIONS. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpmClassifyOptionsDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364260.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPM_CLASSIFY_OPTIONS* KrnlHlprFwpmClassifyOptionsCreateLocalCopy(_In_ const FWPM_CLASSIFY_OPTIONS* pOriginalOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmClassifyOptionsCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalOptions); + + NTSTATUS status = STATUS_SUCCESS; + FWPM_CLASSIFY_OPTIONS* pOptions = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pOptions is expected to be cleaned up by caller using KrnlHlprFwpmClassifyOptionsDestroyLocalCopy + + HLPR_NEW(pOptions, + FWPM_CLASSIFY_OPTIONS, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pOptions, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpmClassifyOptionsPopulateLocalCopy(pOriginalOptions, + pOptions); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pOptions initialized with call to HLPR_NEW & KrnlHlprFwpmClassifyOptionsPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pOptions) + KrnlHlprFwpmClassifyOptionsDestroyLocalCopy(&pOptions); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmClassifyOptionsCreateLocalCopy() [pOptions: %#p]\n", + pOptions); + +#endif /// DBG + + return pOptions; + +#pragma warning(pop) +} + +#endif /// FWPM_CLASSIFY_OPTIONS____ + +#ifndef IPSEC_DOSP_OPTIONS____ +#define IPSEC_DOSP_OPTIONS____ + +#if(NTDDI_VERSION >= NTDDI_WIN7) + +/** + @kernel_helper_function="KrnlHlprIPsecDoSPOptionsPurgeLocalCopy" + + Purpose: Cleanup a local copy of an IPSEC_DOSP_OPTIONS. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744994.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprIPsecDoSPOptionsPurgeLocalCopy(_Inout_ IPSEC_DOSP_OPTIONS* pOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprIPsecDoSPOptionsPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOptions); + + HLPR_DELETE_ARRAY(pOptions->publicIFLuids, + WFPSAMPLER_SYSLIB_TAG); + + HLPR_DELETE_ARRAY(pOptions->internalIFLuids, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprIPsecDoSPOptionsPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprIPsecDoSPOptionsDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an IPSEC_DOSP_OPTIONS. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744994.aspx <br> +*/ +_At_(*ppOptions, _Pre_ _Notnull_) +_At_(*ppOptions, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppOptions == 0) +inline VOID KrnlHlprIPsecDoSPOptionsDestroyLocalCopy(_Inout_ IPSEC_DOSP_OPTIONS** ppOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprIPsecDoSPOptionsDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppOptions); + + if(*ppOptions) + KrnlHlprIPsecDoSPOptionsPurgeLocalCopy(*ppOptions); + + HLPR_DELETE(*ppOptions, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprIPsecDoSPOptionsDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprIPsecDoSPOptionsPopulateLocalCopy" + + Purpose: Allocate and populate a local copy of an IPSEC_DOSP_OPTIONS. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprIPsecDoSPOptionsDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744994.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprIPsecDoSPOptionsPopulateLocalCopy(_In_ const IPSEC_DOSP_OPTIONS* pOriginalOptions, + _Inout_ IPSEC_DOSP_OPTIONS* pOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprIPsecDoSPOptionsPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalOptions); + NT_ASSERT(pOptions); + + NTSTATUS status = STATUS_SUCCESS; + + RtlCopyMemory(pOptions, + pOriginalOptions, + sizeof(IPSEC_DOSP_OPTIONS)); + + pOptions->publicIFLuids = 0; + pOptions->internalIFLuids = 0; + + if(pOptions->numPublicIFLuids) + { + HLPR_NEW_ARRAY(pOptions->publicIFLuids, + UINT64, + pOptions->numPublicIFLuids, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pOptions->publicIFLuids, + status); + } + + if(pOptions->numInternalIFLuids) + { + HLPR_NEW_ARRAY(pOptions->internalIFLuids, + UINT64, + pOptions->numInternalIFLuids, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pOptions->internalIFLuids, + status); + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprIPsecDoSPOptionsPurgeLocalCopy(pOptions); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprIPsecDoSPOptionsPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; + +} + +/** + @kernel_helper_function="KrnlHlprIPsecDoSPOptionsCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an IPSEC_DOSP_OPTIONS. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprIPsecDoSPOptionsDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744994.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +IPSEC_DOSP_OPTIONS* KrnlHlprIPsecDoSPOptionsCreateLocalCopy(_In_ const IPSEC_DOSP_OPTIONS* pOriginalOptions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprIPsecDoSPOptionsCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalOptions); + + NTSTATUS status = STATUS_SUCCESS; + IPSEC_DOSP_OPTIONS* pOptions = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pOptions is expected to be cleaned up by caller using KrnlHlprIPsecDoSPOptionsPopulateLocalCopy + + HLPR_NEW(pOptions, + IPSEC_DOSP_OPTIONS, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pOptions, + status); + +#pragma warning(pop) + + status = KrnlHlprIPsecDoSPOptionsPopulateLocalCopy(pOriginalOptions, + pOptions); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pOptions initialized with call to HLPR_NEW & KrnlHlprIPsecDoSPOptionsPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pOptions) + KrnlHlprIPsecDoSPOptionsDestroyLocalCopy(&pOptions); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprIPsecDoSPOptionsCreateLocalCopy() [pOptions: %#p]\n", + pOptions); + +#endif /// DBG + + return pOptions; + +#pragma warning(pop) +} + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + +#endif /// IPSEC_DOSP_OPTIONS____ + +#ifndef FWP_TOKEN_INFORMATION____ +#define FWP_TOKEN_INFORMATION____ + +/** + @kernel_helper_function="KrnlHlprFwpTokenInformationPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWP_TOKEN_INFORMATION. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552440.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpTokenInformationPurgeLocalCopy(_Inout_ FWP_TOKEN_INFORMATION* pTokenInfo) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpTokenInformationPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pTokenInfo); + + for(UINT32 i = 0; + i < pTokenInfo->sidCount; + i++) + { + HLPR_DELETE_ARRAY(pTokenInfo->sids[i].Sid, + WFPSAMPLER_SYSLIB_TAG); + } + + HLPR_DELETE_ARRAY(pTokenInfo->sids, + WFPSAMPLER_SYSLIB_TAG); + + for(UINT32 i = 0; + i < pTokenInfo->restrictedSidCount; + i++) + { + HLPR_DELETE_ARRAY(pTokenInfo->restrictedSids[i].Sid, + WFPSAMPLER_SYSLIB_TAG); + } + + HLPR_DELETE_ARRAY(pTokenInfo->restrictedSids, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpTokenInformationPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpTokenInformationDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWP_TOKEN_INFORMATION. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552440.aspx <br> +*/ +_At_(*ppTokenInfo, _Pre_ _Notnull_) +_At_(*ppTokenInfo, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppTokenInfo == 0) +inline VOID KrnlHlprFwpTokenInformationDestroyLocalCopy(_Inout_ FWP_TOKEN_INFORMATION** ppTokenInfo) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpTokenInformationDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppTokenInfo); + + if(*ppTokenInfo) + KrnlHlprFwpTokenInformationPurgeLocalCopy(*ppTokenInfo); + + HLPR_DELETE(*ppTokenInfo, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpTokenInformationDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpTokenInformationPopulateLocalCopy" + + Purpose: Populate a local copy of an FWP_TOKEN_INFORMATION. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpTokenInformationPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552440.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpTokenInformationPopulateLocalCopy(_In_ const FWP_TOKEN_INFORMATION* pOriginalTokenInfo, + _Inout_ FWP_TOKEN_INFORMATION* pTokenInfo) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpTokenInformationPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalTokenInfo); + NT_ASSERT(pTokenInfo); + + NTSTATUS status = STATUS_SUCCESS; + KIRQL irql = KeGetCurrentIrql(); + + HLPR_NEW_ARRAY(pTokenInfo->sids, + SID_AND_ATTRIBUTES, + pOriginalTokenInfo->sidCount, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pTokenInfo->sids, + status); + + pTokenInfo->sidCount = pOriginalTokenInfo->sidCount; + + for(UINT32 i = 0; + i < pTokenInfo->sidCount; + i++) + { + UINT32 sidSize = 0; + + if(irql < DISPATCH_LEVEL) + { + if(RtlValidSid(pOriginalTokenInfo->sids[i].Sid)) + { + sidSize = RtlLengthSid(pOriginalTokenInfo->sids[i].Sid); + if(sidSize) + { + HLPR_NEW_ARRAY(pTokenInfo->sids[i].Sid, + BYTE, + sidSize, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pTokenInfo->sids[i].Sid, + status); + + status = RtlCopySid(sidSize, + pTokenInfo->sids[i].Sid, + pOriginalTokenInfo->sids[i].Sid); + HLPR_BAIL_ON_FAILURE(status); + } + else + { + status = STATUS_INVALID_BUFFER_SIZE; + + HLPR_BAIL; + } + } + else + { + status = STATUS_INVALID_SID; + + HLPR_BAIL; + } + } + else + { + sidSize = SID_LENGTH(pOriginalTokenInfo->sids[i].Sid); + if(sidSize) + { + HLPR_NEW_ARRAY(pTokenInfo->sids[i].Sid, + BYTE, + sidSize, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pTokenInfo->sids[i].Sid, + status); + + RtlCopyMemory(pTokenInfo->sids[i].Sid, + pOriginalTokenInfo->sids[i].Sid, + sidSize); + } + else + { + status = STATUS_INVALID_BUFFER_SIZE; + + HLPR_BAIL; + } + } + + pTokenInfo->sids[i].Attributes = pTokenInfo->sids[i].Attributes; + } + + HLPR_NEW_ARRAY(pTokenInfo->restrictedSids, + SID_AND_ATTRIBUTES, + pOriginalTokenInfo->restrictedSidCount, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pTokenInfo->restrictedSids, + status); + + pTokenInfo->restrictedSidCount = pOriginalTokenInfo->restrictedSidCount; + + for(UINT32 i = 0; + i < pTokenInfo->restrictedSidCount; + i++) + { + UINT32 sidSize = 0; + + if(irql < DISPATCH_LEVEL) + { +#pragma warning(push) +#pragma warning(disable: 28118) /// IRQL check has already been performed + + if(RtlValidSid(pOriginalTokenInfo->restrictedSids[i].Sid)) + { + +#pragma warning(pop) + + sidSize = RtlLengthSid(pOriginalTokenInfo->restrictedSids[i].Sid); + if(sidSize) + { + HLPR_NEW_ARRAY(pTokenInfo->restrictedSids[i].Sid, + BYTE, + sidSize, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pTokenInfo->restrictedSids[i].Sid, + status); + + status = RtlCopySid(sidSize, + pTokenInfo->restrictedSids[i].Sid, + pOriginalTokenInfo->restrictedSids[i].Sid); + HLPR_BAIL_ON_FAILURE(status); + } + else + { + status = STATUS_INVALID_BUFFER_SIZE; + + HLPR_BAIL; + } + } + else + { + status = STATUS_INVALID_SID; + + HLPR_BAIL; + } + } + else + { + sidSize = SID_LENGTH(pOriginalTokenInfo->restrictedSids[i].Sid); + if(sidSize) + { + HLPR_NEW_ARRAY(pTokenInfo->restrictedSids[i].Sid, + BYTE, + sidSize, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pTokenInfo->restrictedSids[i].Sid, + status); + + RtlCopyMemory(pTokenInfo->restrictedSids[i].Sid, + pOriginalTokenInfo->restrictedSids[i].Sid, + sidSize); + } + else + { + status = STATUS_INVALID_BUFFER_SIZE; + + HLPR_BAIL; + } + } + + pTokenInfo->restrictedSids[i].Attributes = pTokenInfo->restrictedSids[i].Attributes; + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpTokenInformationDestroyLocalCopy(&pTokenInfo); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpTokenInformationPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpTokenInformationCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWP_TOKEN_INFORMATION. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpTokenInformationDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552440.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_TOKEN_INFORMATION* KrnlHlprFwpTokenInformationCreateLocalCopy(_In_ const FWP_TOKEN_INFORMATION* pOriginalTokenInfo) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpTokenInformationCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalTokenInfo); + + NTSTATUS status = STATUS_SUCCESS; + FWP_TOKEN_INFORMATION* pTokenInfo = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pTokenInfo is expected to be cleaned up by caller using KrnlHlprFwpTokenInformationDestroyLocalCopy + + HLPR_NEW(pTokenInfo, + FWP_TOKEN_INFORMATION, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pTokenInfo, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpTokenInformationPopulateLocalCopy(pOriginalTokenInfo, + pTokenInfo); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pTokenInfo initialized with call to HLPR_NEW & KrnlHlprFwpTokenInformationPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pTokenInfo) + KrnlHlprFwpTokenInformationDestroyLocalCopy(&pTokenInfo); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpTokenInformationCreateLocalCopy() [pTokenInfo: %#p]\n", + pTokenInfo); + +#endif /// DBG + + return pTokenInfo; + +#pragma warning(pop) +} + +#endif /// FWP_TOKEN_INFORMATION____ + +#ifndef FWP_VALUE____ +#define FWP_VALUE____ + +/** + @kernel_helper_function="KrnlHlprFwpValueGetStringForFwpsIncomingValue" + + Purpose: Return a string representing the condition field of the FWPS_INCOMING_VALUE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552450.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windwos/Hardware/FF549939.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(return != 0) +PSTR KrnlHlprFwpValueGetStringForFwpsIncomingValue(_In_ UINT32 layerID, + _In_ UINT32 fieldID, + _Out_opt_ BOOLEAN* pFormat) /* 0 */ +{ + PSTR pString = 0; + + if(pFormat) + *pFormat = FALSE; + + switch(layerID) + { + case FWPS_LAYER_INBOUND_IPPACKET_V4: + case FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD: + case FWPS_LAYER_INBOUND_IPPACKET_V6: + case FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_IPPACKET_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + + break; + } + case FWPS_LAYER_OUTBOUND_IPPACKET_V4: + case FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD: + case FWPS_LAYER_OUTBOUND_IPPACKET_V6: + case FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_IPPACKET_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + + break; + } + case FWPS_LAYER_IPFORWARD_V4: + case FWPS_LAYER_IPFORWARD_V4_DISCARD: + case FWPS_LAYER_IPFORWARD_V6: + case FWPS_LAYER_IPFORWARD_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_IPFORWARD_V4_IP_SOURCE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_SOURCE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_IP_DESTINATION_ADDRESS) + { + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_IP_DESTINATION_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_IP_FORWARD_INTERFACE) + pString = "FWPM_CONDITION_IP_FORWARD_INTERFACE"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_SOURCE_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SOURCE_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_SOURCE_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_DESTINATION_INTERFACE_INDEX) + pString = "FWPM_CONDITION_DESTINATION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_DESTINATION_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_IP_PHYSICAL_ARRIVAL_INTERFACE) + pString = "FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_ARRIVAL_INTERFACE_PROFILE_ID) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_IP_PHYSICAL_NEXTHOP_INTERFACE) + pString = "FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE"; + else if(fieldID == FWPS_FIELD_IPFORWARD_V4_NEXTHOP_INTERFACE_PROFILE_ID) + pString = "FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID"; + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_INBOUND_TRANSPORT_V4: + case FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD: + case FWPS_LAYER_INBOUND_TRANSPORT_V6: + case FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_PROFILE_ID) + pString = "FWPM_CONDITION_PROFILE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_INBOUND_TRANSPORT_V4_IPSEC_SECURITY_REALM_ID) + pString = "FWPM_CONDITION_IPSEC_SECURITY_REALM_ID"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_OUTBOUND_TRANSPORT_V4: + case FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD: + case FWPS_LAYER_OUTBOUND_TRANSPORT_V6: + case FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_DESTINATION_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_PROFILE_ID) + pString = "FWPM_CONDITION_PROFILE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IPSEC_SECURITY_REALM_ID) + pString = "FWPM_CONDITION_IPSEC_SECURITY_REALM_ID"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_STREAM_V4: + case FWPS_LAYER_STREAM_V4_DISCARD: + case FWPS_LAYER_STREAM_V6: + case FWPS_LAYER_STREAM_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_STREAM_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_STREAM_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_STREAM_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_STREAM_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_STREAM_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_STREAM_V4_DIRECTION) + pString = "FWPM_CONDITION_DIRECTION"; + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(fieldID == FWPS_FIELD_STREAM_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_DATAGRAM_DATA_V4: + case FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD: + case FWPS_LAYER_DATAGRAM_DATA_V6: + case FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_DIRECTION) + pString = "FWPM_CONDITION_DIRECTION"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_DATAGRAM_DATA_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + + break; + } + case FWPS_LAYER_INBOUND_ICMP_ERROR_V4: + case FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD: + case FWPS_LAYER_INBOUND_ICMP_ERROR_V6: + case FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_PROTOCOL) + pString = "FWPM_CONDITION_EMBEDDED_PROTOCOL"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_REMOTE_ADDRESS) + pString = "FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_LOCAL_PORT) + pString = "FWPM_CONDITION_EMBEDDED_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_REMOTE_PORT) + pString = "FWPM_CONDITION_EMBEDDED_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ICMP_TYPE) + pString = "FWPM_CONDITION_ICMP_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ICMP_CODE) + pString = "FWPM_CONDITION_ICMP_CODE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_ARRIVAL_INTERFACE) + pString = "FWPM_CONDITION_IP_ARRIVAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_INDEX) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_TYPE) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_TUNNEL_TYPE) + pString = "FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_PROFILE_ID) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_QUARANTINE_EPOCH) + pString = "FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH"; + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4: + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD: + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6: + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_ICMP_TYPE) + pString = "FWPM_CONDITION_ICMP_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_ICMP_CODE) + pString = "FWPM_CONDITION_ICMP_CODE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_NEXTHOP_INTERFACE_PROFILE_ID) + pString = "FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_QUARANTINE_EPOCH) + pString = "FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH"; + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4: + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD: + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6: + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_PROMISCUOUS_MODE) + pString = "FWPM_CONDITION_ALE_PROMISCUOUS_MODE"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_LOCAL_INTERFACE_PROFILE_ID) + pString = "FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_SIO_FIREWALL_SOCKET_PROPERTY) + pString = "FWPM_CONDITION_SIO_FIREWALL_SOCKET_PROPERTY"; + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_ALE_AUTH_LISTEN_V4: + case FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD: + case FWPS_LAYER_ALE_AUTH_LISTEN_V6: + case FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_LOCAL_INTERFACE_PROFILE_ID) + pString = "FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_SIO_FIREWALL_SOCKET_PROPERTY) + pString = "FWPM_CONDITION_SIO_FIREWALL_SOCKET_PROPERTY"; + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4: + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD: + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6: + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_REMOTE_USER_ID) + pString = "FWPM_CONDITION_ALE_REMOTE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_REMOTE_MACHINE_ID) + pString = "FWPM_CONDITION_ALE_REMOTE_MACHINE_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_SIO_FIREWALL_SYSTEM_PORT) + pString = "FWPM_CONDITION_SIO_FIREWALL_SYSTEM_PORT"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NAP_CONTEXT) + pString = "FWPM_CONDITION_NAP_CONTEXT"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_ARRIVAL_INTERFACE) + pString = "FWPM_CONDITION_IP_ARRIVAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_INTERFACE_TYPE) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_TUNNEL_TYPE) + pString = "FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_INTERFACE_INDEX) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX"; + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_NEXTHOP_INTERFACE) + pString = "FWPM_CONDITION_IP_NEXTHOP_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_INTERFACE_TYPE) + pString = "FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_TUNNEL_TYPE) + pString = "FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_INTERFACE_INDEX) + pString = "FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ORIGINAL_PROFILE_ID) + pString = "FWPM_CONDITION_ORIGINAL_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_CURRENT_PROFILE_ID) + pString = "FWPM_CONDITION_CURRENT_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_REAUTHORIZE_REASON) + pString = "FWPM_CONDITION_REAUTHORIZE_REASON"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ORIGINAL_ICMP_TYPE) + pString = "FWPM_CONDITION_ORIGINAL_ICMP_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_QUARANTINE_EPOCH) + pString = "FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH"; + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_ALE_AUTH_CONNECT_V4: + case FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD: + case FWPS_LAYER_ALE_AUTH_CONNECT_V6: + case FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_USER_ID) + pString = "FWPM_CONDITION_ALE_REMOTE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_MACHINE_ID) + pString = "FWPM_CONDITION_ALE_REMOTE_MACHINE_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_DESTINATION_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_ARRIVAL_INTERFACE) + pString = "FWPM_CONDITION_IP_ARRIVAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ARRIVAL_INTERFACE_TYPE) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ARRIVAL_TUNNEL_TYPE) + pString = "FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ARRIVAL_INTERFACE_INDEX) + pString = "FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_NEXTHOP_INTERFACE) + pString = "FWPM_CONDITION_IP_NEXTHOP_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_INTERFACE_TYPE) + pString = "FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_TUNNEL_TYPE) + pString = "FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_INTERFACE_INDEX) + pString = "FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ORIGINAL_PROFILE_ID) + pString = "FWPM_CONDITION_ORIGINAL_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_CURRENT_PROFILE_ID) + pString = "FWPM_CONDITION_CURRENT_PROFILE_ID"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_REAUTHORIZE_REASON) + pString = "FWPM_CONDITION_REAUTHORIZE_REASON"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_PEER_NAME) + pString = "FWPM_CONDITION_PEER_NAME"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ORIGINAL_ICMP_TYPE) + pString = "FWPM_CONDITION_ORIGINAL_ICMP_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_INTERFACE_QUARANTINE_EPOCH) + pString = "FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH"; + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_ORIGINAL_APP_ID) + { + pString = "FWPM_CONDITION_ALE_ORIGINAL_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4: + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD: + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6: + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD: + { + if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_REMOTE_USER_ID) + pString = "FWPM_CONDITION_ALE_REMOTE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_REMOTE_MACHINE_ID) + pString = "FWPM_CONDITION_ALE_REMOTE_MACHINE_ID"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_DESTINATION_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_DIRECTION) + pString = "FWPM_CONDITION_DIRECTION"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_ORIGINAL_APP_ID) + { + pString = "FWPM_CONDITION_ALE_ORIGINAL_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWPS_LAYER_NAME_RESOLUTION_CACHE_V4: + case FWPS_LAYER_NAME_RESOLUTION_CACHE_V6: + { + if(fieldID == FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_PEER_NAME) + pString = "FWPM_CONDITION_PEER_NAME"; + + break; + } + case FWPS_LAYER_ALE_RESOURCE_RELEASE_V4: + case FWPS_LAYER_ALE_RESOURCE_RELEASE_V6: + { + if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V4: + case FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V6: + { + if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_ALE_CONNECT_REDIRECT_V4: + case FWPS_LAYER_ALE_CONNECT_REDIRECT_V6: + { + if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_DESTINATION_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_ORIGINAL_APP_ID) + { + pString = "FWPM_CONDITION_ALE_ORIGINAL_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_ALE_BIND_REDIRECT_V4: + case FWPS_LAYER_ALE_BIND_REDIRECT_V6: + { + if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_APP_ID) + { + pString = "FWPM_CONDITION_ALE_APP_ID"; + + if(pFormat) + *pFormat = UNICODE_STRING_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_USER_ID) + pString = "FWPM_CONDITION_ALE_USER_ID"; + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_PACKAGE_ID) + pString = "FWPM_CONDITION_ALE_PACKAGE_ID"; + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(fieldID == FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pString = "FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_STREAM_PACKET_V4: + case FWPS_LAYER_STREAM_PACKET_V6: + { + if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_IP_LOCAL_ADDRESS) + { + pString = "FWPM_CONDITION_IP_LOCAL_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_IP_REMOTE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_REMOTE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_IP_LOCAL_PORT) + pString = "FWPM_CONDITION_IP_LOCAL_PORT"; + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_IP_REMOTE_PORT) + pString = "FWPM_CONDITION_IP_REMOTE_PORT"; + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_IP_LOCAL_INTERFACE) + pString = "FWPM_CONDITION_IP_LOCAL_INTERFACE"; + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_SUB_INTERFACE_INDEX) + pString = "FWPM_CONDITION_SUB_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_DIRECTION) + pString = "FWPM_CONDITION_DIRECTION"; + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_FLAGS) + { + pString = "FWPM_CONDITION_FLAGS"; + + if(pFormat) + *pFormat = FLAGS_VALUE; + } + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_STREAM_PACKET_V4_TUNNEL_TYPE) + pString = "FWPM_CONDITION_TUNNEL_TYPE"; + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + case FWPS_LAYER_INBOUND_MAC_FRAME_ETHERNET: + { + if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_INTERFACE_MAC_ADDRESS) + pString = "FWPM_CONDITION_INTERFACE_MAC_ADDRESS"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS) + pString = "FWPM_CONDITION_MAC_LOCAL_ADDRESS"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS) + pString = "FWPM_CONDITION_MAC_REMOTE_ADDRESS"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS_TYPE) + pString = "FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_ETHER_TYPE) + pString = "FWPM_CONDITION_ETHER_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_VLAN_ID) + pString = "FWPM_CONDITION_VLAN_ID"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_INTERFACE) + pString = "FWPM_CONDITION_INTERFACE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_NDIS_PORT) + pString = "FWPM_CONDITION_NDIS_PORT"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_L2_FLAGS) + { + pString = "FWPM_CONDITION_L2_FLAGS"; + + if(pFormat) + *pFormat = L2_FLAGS_VALUE; + } + + break; + } + case FWPS_LAYER_OUTBOUND_MAC_FRAME_ETHERNET: + { + if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_INTERFACE_MAC_ADDRESS) + pString = "FWPM_CONDITION_INTERFACE_MAC_ADDRESS"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS) + pString = "FWPM_CONDITION_MAC_LOCAL_ADDRESS"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS) + pString = "FWPM_CONDITION_MAC_REMOTE_ADDRESS"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS_TYPE) + pString = "FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS_TYPE) + pString = "FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_ETHER_TYPE) + pString = "FWPM_CONDITION_ETHER_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_VLAN_ID) + pString = "FWPM_CONDITION_VLAN_ID"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_INTERFACE) + pString = "FWPM_CONDITION_INTERFACE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_NDIS_PORT) + pString = "FWPM_CONDITION_NDIS_PORT"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_L2_FLAGS) + { + pString = "FWPM_CONDITION_L2_FLAGS"; + + if(pFormat) + *pFormat = L2_FLAGS_VALUE; + } + + break; + } + case FWPS_LAYER_INBOUND_MAC_FRAME_NATIVE: + { + if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_NDIS_MEDIA_TYPE) + pString = "FWPM_CONDITION_NDIS_MEDIA_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_NDIS_PHYSICAL_MEDIA_TYPE) + pString = "FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_INTERFACE) + pString = "FWPM_CONDITION_INTERFACE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_NDIS_PORT) + pString = "FWPM_CONDITION_NDIS_PORT"; + else if(fieldID == FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_L2_FLAGS) + { + pString = "FWPM_CONDITION_L2_FLAGS"; + + if(pFormat) + *pFormat = L2_FLAGS_VALUE; + } + + break; + } + case FWPS_LAYER_OUTBOUND_MAC_FRAME_NATIVE: + { + if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_NDIS_MEDIA_TYPE) + pString = "FWPM_CONDITION_NDIS_MEDIA_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_NDIS_PHYSICAL_MEDIA_TYPE) + pString = "FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_INTERFACE) + pString = "FWPM_CONDITION_INTERFACE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_INTERFACE_TYPE) + pString = "FWPM_CONDITION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_INTERFACE_INDEX) + pString = "FWPM_CONDITION_INTERFACE_INDEX"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_NDIS_PORT) + pString = "FWPM_CONDITION_NDIS_PORT"; + else if(fieldID == FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_L2_FLAGS) + { + pString = "FWPM_CONDITION_L2_FLAGS"; + + if(pFormat) + *pFormat = L2_FLAGS_VALUE; + } + + break; + } + case FWPS_LAYER_INGRESS_VSWITCH_ETHERNET: + { + if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS_TYPE) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS_TYPE) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_ETHER_TYPE) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_ETHER_TYPE"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VLAN_ID) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VLAN_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_TENANT_NETWORK_ID) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_TENANT_NETWORK_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_ID) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_NETWORK_TYPE) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_NETWORK_TYPE"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_ID) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_TYPE) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_VM_ID) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_VM_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_L2_FLAGS) + pString = "FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_L2_FLAGS"; + + break; + } + case FWPS_LAYER_EGRESS_VSWITCH_ETHERNET: + { + if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS_TYPE) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS_TYPE) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_ETHER_TYPE) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_ETHER_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VLAN_ID) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VLAN_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_TENANT_NETWORK_ID) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_TENANT_NETWORK_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_ID) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_NETWORK_TYPE) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_NETWORK_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_ID) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_TYPE) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_VM_ID) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_VM_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_INTERFACE_ID) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_INTERFACE_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_INTERFACE_TYPE) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_VM_ID) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_VM_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_L2_FLAGS) + pString = "FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_L2_FLAGS"; + + break; + } + case FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V4: + case FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V6: + { + if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_SOURCE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_ADDRESS) + { + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_PORT) + pString = "FWPM_CONDITION_IP_SOURCE_PORT"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_PORT) + pString = "FWPM_CONDITION_IP_DESTINATION_PORT"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VLAN_ID) + pString = "FWPM_CONDITION_VLAN_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_TENANT_NETWORK_ID) + pString = "FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_ID) + pString = "FWPM_CONDITION_VSWITCH_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_NETWORK_TYPE) + pString = "FWPM_CONDITION_VSWITCH_NETWORK_TYPE"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_ID) + pString = "FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_TYPE) + pString = "FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_VM_ID) + pString = "FWPM_CONDITION_VSWITCH_SOURCE_VM_ID"; + else if(fieldID == FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_L2_FLAGS) + { + pString = "FWPM_CONDITION_L2_FLAGS"; + + if(pFormat) + *pFormat = L2_FLAGS_VALUE; + } + + break; + } + case FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V4: + case FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V6: + { + if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_ADDRESS) + { + pString = "FWPM_CONDITION_IP_SOURCE_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_ADDRESS) + { + pString = "FWPM_CONDITION_IP_DESTINATION_ADDRESS"; + + if(pFormat) + *pFormat = ADDRESS_VALUE; + } + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_IP_PROTOCOL) + pString = "FWPM_CONDITION_IP_PROTOCOL"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_PORT) + pString = "FWPM_CONDITION_IP_SOURCE_PORT"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_PORT) + pString = "FWPM_CONDITION_IP_DESTINATION_PORT"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VLAN_ID) + pString = "FWPM_CONDITION_VLAN_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_TENANT_NETWORK_ID) + pString = "FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_ID) + pString = "FWPM_CONDITION_VSWITCH_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_NETWORK_TYPE) + pString = "FWPM_CONDITION_VSWITCH_NETWORK_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_ID) + pString = "FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_TYPE) + pString = "FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_VM_ID) + pString = "FWPM_CONDITION_VSWITCH_SOURCE_VM_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_DESTINATION_INTERFACE_ID) + pString = "FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_DESTINATION_INTERFACE_TYPE) + pString = "FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_DESTINATION_VM_ID) + pString = "FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID"; + else if(fieldID == FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_L2_FLAGS) + { + pString = "FWPM_CONDITION_L2_FLAGS"; + + if(pFormat) + *pFormat = L2_FLAGS_VALUE; + } + + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + } + + return pString; +} + + +/** + @kernel_helper_function="KrnlHlprFwpValueGetFromFwpsIncomingValues" + + Purpose: Retrieve a pointer to the FWP_VALUE for a given condition in the + FWPS_INCOMING_VALUES. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552450.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windwos/Hardware/FF549939.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_VALUE* KrnlHlprFwpValueGetFromFwpsIncomingValues(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ const GUID* pConditionKey) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpValueGetFromFwpsIncomingValues()\n"); + +#endif /// DBG + + NT_ASSERT(pClassifyValues); + NT_ASSERT(pConditionKey); + + FWP_VALUE* pValue = 0; + + switch(pClassifyValues->layerId) + { + case FWPS_LAYER_INBOUND_IPPACKET_V4: + case FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD: + case FWPS_LAYER_INBOUND_IPPACKET_V6: + case FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_IPPACKET_V4_TUNNEL_TYPE].value); + + break; + } + case FWPS_LAYER_OUTBOUND_IPPACKET_V4: + case FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD: + case FWPS_LAYER_OUTBOUND_IPPACKET_V6: + case FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_IPPACKET_V4_TUNNEL_TYPE].value); + + break; + } + case FWPS_LAYER_IPFORWARD_V4: + case FWPS_LAYER_IPFORWARD_V4_DISCARD: + case FWPS_LAYER_IPFORWARD_V6: + case FWPS_LAYER_IPFORWARD_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_SOURCE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_IP_SOURCE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_IP_DESTINATION_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_IP_DESTINATION_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_FORWARD_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_IP_FORWARD_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_SOURCE_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_SOURCE_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_SOURCE_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_DESTINATION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_DESTINATION_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_DESTINATION_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_IP_PHYSICAL_ARRIVAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_ARRIVAL_INTERFACE_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_IP_PHYSICAL_NEXTHOP_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_IPFORWARD_V4_NEXTHOP_INTERFACE_PROFILE_ID].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_INBOUND_TRANSPORT_V4: + case FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD: + case FWPS_LAYER_INBOUND_TRANSPORT_V6: + case FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_CURRENT_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_TRANSPORT_V4_PROFILE_ID].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_OUTBOUND_TRANSPORT_V4: + case FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD: + case FWPS_LAYER_OUTBOUND_TRANSPORT_V6: + case FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_DESTINATION_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_CURRENT_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_PROFILE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_IPSEC_SECURITY_REALM_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IPSEC_SECURITY_REALM_ID].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_STREAM_V4: + case FWPS_LAYER_STREAM_V4_DISCARD: + case FWPS_LAYER_STREAM_V6: + case FWPS_LAYER_STREAM_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_DIRECTION) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_V4_DIRECTION].value); + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_V4_FLAGS].value); + +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_DATAGRAM_DATA_V4: + case FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD: + case FWPS_LAYER_DATAGRAM_DATA_V6: + case FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_DIRECTION) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_DIRECTION].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_DATAGRAM_DATA_V4_TUNNEL_TYPE].value); + + break; + } + case FWPS_LAYER_INBOUND_ICMP_ERROR_V4: + case FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD: + case FWPS_LAYER_INBOUND_ICMP_ERROR_V6: + case FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_EMBEDDED_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_EMBEDDED_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_EMBEDDED_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_ICMP_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ICMP_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ICMP_CODE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ICMP_CODE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(pConditionKey == &FWPM_CONDITION_IP_ARRIVAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_ARRIVAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_TUNNEL_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_QUARANTINE_EPOCH].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4: + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD: + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6: + case FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_ICMP_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_ICMP_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ICMP_CODE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_ICMP_CODE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_NEXTHOP_INTERFACE_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_QUARANTINE_EPOCH].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4: + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD: + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6: + case FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_PROMISCUOUS_MODE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_PROMISCUOUS_MODE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_LOCAL_INTERFACE_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_SIO_FIREWALL_SOCKET_PROPERTY) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_SIO_FIREWALL_SOCKET_PROPERTY].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_ALE_AUTH_LISTEN_V4: + case FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD: + case FWPS_LAYER_ALE_AUTH_LISTEN_V6: + case FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_LOCAL_INTERFACE_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_LOCAL_INTERFACE_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_SIO_FIREWALL_SOCKET_PROPERTY) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_SIO_FIREWALL_SOCKET_PROPERTY].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + break; + } + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4: + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD: + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6: + case FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_REMOTE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_REMOTE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_REMOTE_MACHINE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_REMOTE_MACHINE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_SIO_FIREWALL_SYSTEM_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_NAP_CONTEXT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NAP_CONTEXT].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_TUNNEL_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_SUB_INTERFACE_INDEX].value); + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(pConditionKey == &FWPM_CONDITION_IP_ARRIVAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_ARRIVAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_TUNNEL_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_INTERFACE_INDEX].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_IP_NEXTHOP_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_NEXTHOP_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_TUNNEL_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NEXTHOP_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_ORIGINAL_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ORIGINAL_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_CURRENT_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_CURRENT_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_REAUTHORIZE_REASON) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_REAUTHORIZE_REASON].value); + else if(pConditionKey == &FWPM_CONDITION_ORIGINAL_ICMP_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ORIGINAL_ICMP_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_QUARANTINE_EPOCH].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_ALE_AUTH_CONNECT_V4: + case FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD: + case FWPS_LAYER_ALE_AUTH_CONNECT_V6: + case FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_REMOTE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_REMOTE_MACHINE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_MACHINE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_DESTINATION_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_SUB_INTERFACE_INDEX].value); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(pConditionKey == &FWPM_CONDITION_IP_ARRIVAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_ARRIVAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ARRIVAL_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ARRIVAL_TUNNEL_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ARRIVAL_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_IP_NEXTHOP_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_NEXTHOP_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_TUNNEL_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_NEXTHOP_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_ORIGINAL_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ORIGINAL_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_CURRENT_PROFILE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_CURRENT_PROFILE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_REAUTHORIZE_REASON) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_REAUTHORIZE_REASON].value); + else if(pConditionKey == &FWPM_CONDITION_PEER_NAME) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_PEER_NAME].value); + else if(pConditionKey == &FWPM_CONDITION_ORIGINAL_ICMP_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ORIGINAL_ICMP_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_QUARANTINE_EPOCH) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_INTERFACE_QUARANTINE_EPOCH].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_ORIGINAL_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_ORIGINAL_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4: + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD: + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6: + case FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_REMOTE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_REMOTE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_REMOTE_MACHINE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_REMOTE_MACHINE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_DESTINATION_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_DIRECTION) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_DIRECTION].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_TUNNEL_TYPE].value); + +#if(NTDDI_VERSION >= NTDDI_VISTASP1) + + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_ORIGINAL_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_ORIGINAL_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_VISTASP1) + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWPS_LAYER_NAME_RESOLUTION_CACHE_V4: + case FWPS_LAYER_NAME_RESOLUTION_CACHE_V6: + { + if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_PEER_NAME) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_NAME_RESOLUTION_CACHE_V4_PEER_NAME].value); + + break; + } + case FWPS_LAYER_ALE_RESOURCE_RELEASE_V4: + case FWPS_LAYER_ALE_RESOURCE_RELEASE_V6: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_RESOURCE_RELEASE_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V4: + case FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V6: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_ENDPOINT_CLOSURE_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_ALE_CONNECT_REDIRECT_V4: + case FWPS_LAYER_ALE_CONNECT_REDIRECT_V6: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_DESTINATION_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_ORIGINAL_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_ORIGINAL_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_CONNECT_REDIRECT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_ALE_BIND_REDIRECT_V4: + case FWPS_LAYER_ALE_BIND_REDIRECT_V6: + { + if(pConditionKey == &FWPM_CONDITION_ALE_APP_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_APP_ID].value); + else if(pConditionKey == &FWPM_CONDITION_ALE_USER_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_USER_ID].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_FLAGS].value); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(pConditionKey == &FWPM_CONDITION_ALE_PACKAGE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_PACKAGE_ID].value); + +#if(NTDDI_VERSION >= NTDDI_WINTHRESHOLD) + + else if(pConditionKey == &FWPM_CONDITION_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_ALE_BIND_REDIRECT_V4_ALE_SECURITY_ATTRIBUTE_FQBN_VALUE].value); + +#endif /// (NTDDI_VERSION >= NTDDI_WINTHRESHOLD) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + break; + } + case FWPS_LAYER_STREAM_PACKET_V4: + case FWPS_LAYER_STREAM_PACKET_V6: + { + if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_IP_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_IP_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_IP_LOCAL_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_REMOTE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_IP_REMOTE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_LOCAL_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_IP_LOCAL_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_SUB_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_SUB_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_DIRECTION) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_DIRECTION].value); + else if(pConditionKey == &FWPM_CONDITION_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_FLAGS].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_TUNNEL_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_STREAM_PACKET_V4_TUNNEL_TYPE].value); + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + case FWPS_LAYER_INBOUND_MAC_FRAME_ETHERNET: + { + if(pConditionKey == &FWPM_CONDITION_INTERFACE_MAC_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_INTERFACE_MAC_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ETHER_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_ETHER_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VLAN_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_VLAN_ID].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_NDIS_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_NDIS_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_ETHERNET_L2_FLAGS].value); + + break; + } + case FWPS_LAYER_OUTBOUND_MAC_FRAME_ETHERNET: + { + if(pConditionKey == &FWPM_CONDITION_INTERFACE_MAC_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_INTERFACE_MAC_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_LOCAL_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_REMOTE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_LOCAL_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_MAC_REMOTE_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ETHER_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_ETHER_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VLAN_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_VLAN_ID].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_NDIS_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_NDIS_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_ETHERNET_L2_FLAGS].value); + + break; + } + case FWPS_LAYER_INBOUND_MAC_FRAME_NATIVE: + { + if(pConditionKey == &FWPM_CONDITION_NDIS_MEDIA_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_NDIS_MEDIA_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_NDIS_PHYSICAL_MEDIA_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_NDIS_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_NDIS_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INBOUND_MAC_FRAME_NATIVE_L2_FLAGS].value); + + break; + } + case FWPS_LAYER_OUTBOUND_MAC_FRAME_NATIVE: + { + if(pConditionKey == &FWPM_CONDITION_NDIS_MEDIA_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_NDIS_MEDIA_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_NDIS_PHYSICAL_MEDIA_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_INTERFACE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_INTERFACE_INDEX) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_INTERFACE_INDEX].value); + else if(pConditionKey == &FWPM_CONDITION_NDIS_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_NDIS_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_OUTBOUND_MAC_FRAME_NATIVE_L2_FLAGS].value); + + break; + } + case FWPS_LAYER_INGRESS_VSWITCH_ETHERNET: + { + if(pConditionKey == &FWPM_CONDITION_MAC_SOURCE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_DESTINATION_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ETHER_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_ETHER_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VLAN_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VLAN_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_TENANT_NETWORK_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_NETWORK_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_NETWORK_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_VM_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_VM_ID].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_ETHERNET_L2_FLAGS].value); + + break; + } + case FWPS_LAYER_EGRESS_VSWITCH_ETHERNET: + { + if(pConditionKey == &FWPM_CONDITION_MAC_SOURCE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_SOURCE_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_DESTINATION_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_MAC_DESTINATION_ADDRESS_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_ETHER_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_ETHER_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VLAN_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VLAN_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_TENANT_NETWORK_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_NETWORK_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_NETWORK_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_VM_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_SOURCE_VM_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_INTERFACE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_VSWITCH_DESTINATION_VM_ID].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_ETHERNET_L2_FLAGS].value); + + break; + } + case FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V4: + case FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V6: + { + if(pConditionKey == &FWPM_CONDITION_IP_SOURCE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_SOURCE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_VLAN_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VLAN_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_TENANT_NETWORK_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_NETWORK_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_NETWORK_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_VM_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_VM_ID].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_L2_FLAGS].value); + + break; + } + case FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V4: + case FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V6: + { + if(pConditionKey == &FWPM_CONDITION_IP_SOURCE_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_ADDRESS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_ADDRESS].value); + else if(pConditionKey == &FWPM_CONDITION_IP_PROTOCOL) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_PROTOCOL].value); + else if(pConditionKey == &FWPM_CONDITION_IP_SOURCE_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_SOURCE_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_IP_DESTINATION_PORT) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_INGRESS_VSWITCH_TRANSPORT_V4_IP_DESTINATION_PORT].value); + else if(pConditionKey == &FWPM_CONDITION_VLAN_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VLAN_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_TENANT_NETWORK_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_NETWORK_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_NETWORK_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_SOURCE_VM_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_SOURCE_VM_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_DESTINATION_INTERFACE_ID].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_DESTINATION_INTERFACE_TYPE].value); + else if(pConditionKey == &FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_VSWITCH_DESTINATION_VM_ID].value); + else if(pConditionKey == &FWPM_CONDITION_L2_FLAGS) + pValue = &(pClassifyValues->incomingValue[FWPS_FIELD_EGRESS_VSWITCH_TRANSPORT_V4_L2_FLAGS].value); + + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpValueGetFromFwpsIncomingValues() [pValue: %#p]\n", + pValue); + +#endif /// DBG + + return pValue; +} + +/** + @kernel_helper_function="KrnlHlprFwpValuePurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWP_VALUE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552450.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpValuePurgeLocalCopy(_Inout_ FWP_VALUE* pValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpValuePurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pValue); + + switch(pValue->type) + { + case FWP_UINT64: + { + HLPR_DELETE(pValue->uint64, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_INT64: + { + HLPR_DELETE(pValue->int64, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_DOUBLE: + { + HLPR_DELETE(pValue->double64, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_BYTE_ARRAY16_TYPE: + { + HLPR_DELETE(pValue->byteArray16, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_BYTE_BLOB_TYPE: + { + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pValue->byteBlob)); + + break; + } + case FWP_SID: + { + HLPR_DELETE_ARRAY(pValue->sid, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_SECURITY_DESCRIPTOR_TYPE: + { + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pValue->sd)); + + break; + } + case FWP_TOKEN_INFORMATION_TYPE: + { + KrnlHlprFwpTokenInformationDestroyLocalCopy(&(pValue->tokenInformation)); + + break; + } + case FWP_TOKEN_ACCESS_INFORMATION_TYPE: + { + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pValue->tokenAccessInformation)); + + break; + } + case FWP_UNICODE_STRING_TYPE: + { + HLPR_DELETE_ARRAY(pValue->unicodeString, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWP_BYTE_ARRAY6_TYPE: + { + HLPR_DELETE(pValue->byteArray6, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + default: + { + pValue->uint64 = 0; + + break; + } + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpValuePurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpValueDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWP_VALUE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552450.aspx <br> +*/ +_At_(*ppValue, _Pre_ _Notnull_) +_At_(*ppValue, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppValue == 0) +inline VOID KrnlHlprFwpValueDestroyLocalCopy(_Inout_ FWP_VALUE** ppValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpValueDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppValue); + + if(*ppValue) + KrnlHlprFwpValuePurgeLocalCopy(*ppValue); + + HLPR_DELETE(*ppValue, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpValueDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpValuePopulateLocalCopy" + + Purpose: Populate a local copy of an FWP_VALUE. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpValuePurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552450.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpValuePopulateLocalCopy(_In_ const FWP_VALUE* pOriginalValue, + _Inout_ FWP_VALUE* pValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpValuePopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalValue); + NT_ASSERT(pValue); + + NTSTATUS status = STATUS_SUCCESS; + KIRQL irql = KeGetCurrentIrql(); + + pValue->type = pOriginalValue->type; + + switch(pValue->type) + { + case FWP_UINT64: + { + HLPR_NEW(pValue->uint64, + UINT64, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->uint64, + status); + + RtlCopyMemory(pValue->uint64, + pOriginalValue->uint64, + sizeof(UINT64)); + + break; + } + case FWP_INT64: + { + HLPR_NEW(pValue->int64, + INT64, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->int64, + status); + + RtlCopyMemory(pValue->int64, + pOriginalValue->int64, + sizeof(INT64)); + + break; + } + case FWP_DOUBLE: + { + HLPR_NEW(pValue->double64, + double, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->double64, + status); + + RtlCopyMemory(pValue->double64, + pOriginalValue->double64, + sizeof(double)); + + break; + } + case FWP_BYTE_ARRAY16_TYPE: + { + HLPR_NEW(pValue->byteArray16, + FWP_BYTE_ARRAY16, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->byteArray16, + status); + + RtlCopyMemory(pValue->byteArray16, + pOriginalValue->byteArray16, + sizeof(FWP_BYTE_ARRAY16)); + + break; + } + case FWP_BYTE_BLOB_TYPE: + { + pValue->byteBlob = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalValue->byteBlob); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->byteBlob, + status); + + break; + } + case FWP_SID: + { + HLPR_DELETE_ARRAY(pValue->sid, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_SECURITY_DESCRIPTOR_TYPE: + { + pValue->sd = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalValue->sd); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->sd, + status); + break; + } + case FWP_TOKEN_INFORMATION_TYPE: + { + pValue->tokenInformation = KrnlHlprFwpTokenInformationCreateLocalCopy(pOriginalValue->tokenInformation); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->tokenInformation, + status); + + break; + } + case FWP_TOKEN_ACCESS_INFORMATION_TYPE: + { + pValue->tokenAccessInformation = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalValue->tokenAccessInformation); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->tokenAccessInformation, + status); + + break; + } + case FWP_UNICODE_STRING_TYPE: + { + size_t stringSize = 0; + + if(irql == PASSIVE_LEVEL) + { + status = RtlStringCchLengthW(pOriginalValue->unicodeString, + NTSTRSAFE_MAX_CCH, + &stringSize); + HLPR_BAIL_ON_FAILURE(status); + } + else + stringSize = wcslen(pOriginalValue->unicodeString); + + if(stringSize) + { + HLPR_NEW_ARRAY(pValue->unicodeString, + WCHAR, + stringSize + 1, /// add space for '\0' + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->unicodeString, + status); + +#pragma warning(push) +#pragma warning(disable: 26018) /// buffers are contrained by stringSize + + RtlCopyMemory(pValue->unicodeString, + pOriginalValue->unicodeString, + stringSize * sizeof(WCHAR)); + + pValue->unicodeString[stringSize] = L'\0'; + +#pragma warning(pop) + } + else + { + status = STATUS_INVALID_BUFFER_SIZE; + + HLPR_BAIL; + } + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWP_BYTE_ARRAY6_TYPE: + { + HLPR_NEW(pValue->byteArray6, + FWP_BYTE_ARRAY6, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->byteArray6, + status); + + RtlCopyMemory(pValue->byteArray6, + pOriginalValue->byteArray6, + sizeof(FWP_BYTE_ARRAY6)); + + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + default: + { + /// this is a straight value copy so it's safe to use the largest static space + pValue->uint64 = pOriginalValue->uint64; + + break; + } + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpValuePurgeLocalCopy(pValue); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpValuePopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpValueCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWP_VALUE. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpValueDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552450.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_VALUE* KrnlHlprFwpValueCreateLocalCopy(_In_ const FWP_VALUE* pOriginalValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpValueCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalValue); + + NTSTATUS status = STATUS_SUCCESS; + FWP_VALUE* pValue = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pValue is expected to be cleaned up by caller using KrnlHlprFwpValueDestroyLocalCopy + + HLPR_NEW(pValue, + FWP_VALUE, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpValuePopulateLocalCopy(pOriginalValue, + pValue); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pValue initialized with call to HLPR_NEW & KrnlHlprFwpValuePopulateLocalCopy + + if(status != STATUS_SUCCESS && + pValue) + KrnlHlprFwpValueDestroyLocalCopy(&pValue); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpValueCreateLocalCopy() [pValue: %#p]\n", + pValue); + +#endif /// DBG + + return pValue; + +#pragma warning(pop) +} + +#endif /// FWP_VALUE____ + +#ifndef FWP_V4_ADDR_AND_MASK____ +#define FWP_V4_ADDR_AND_MASK____ + +/** + @kernel_helper_function="KrnlHlprFwpV4AddrAndMaskPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWP_V4_ADDR_AND_MASK. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552441.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpV4AddrAndMaskPurgeLocalCopy(_Inout_ FWP_V4_ADDR_AND_MASK* pAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV4AddrAndMaskPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pAddrMask); + + RtlZeroMemory(pAddrMask, + sizeof(FWP_V4_ADDR_AND_MASK)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV4AddrAndMaskPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpV4AddrAndMaskDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWP_V4_ADDR_AND_MASK. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552441.aspx <br> +*/ +_At_(*ppAddrMask, _Pre_ _Notnull_) +_At_(*ppAddrMask, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppAddrMask == 0) +inline VOID KrnlHlprFwpV4AddrAndMaskDestroyLocalCopy(_Inout_ FWP_V4_ADDR_AND_MASK** ppAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV4AddrAndMaskDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppAddrMask); + + if(*ppAddrMask) + KrnlHlprFwpV4AddrAndMaskPurgeLocalCopy(*ppAddrMask); + + HLPR_DELETE(*ppAddrMask, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV4AddrAndMaskDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpV4AddrAndMaskPopulateLocalCopy" + + Purpose: Populate a local copy of an FWP_V4_ADDR_AND_MASK. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpV4AddrMaskPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552441.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpV4AddrAndMaskPopulateLocalCopy(_In_ const FWP_V4_ADDR_AND_MASK* pOriginalAddrMask, + _Inout_ FWP_V4_ADDR_AND_MASK* pAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV4AddrAndMaskPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalAddrMask); + NT_ASSERT(pAddrMask); + + NTSTATUS status = STATUS_SUCCESS; + + pAddrMask->addr = pOriginalAddrMask->addr; + pAddrMask->mask = pOriginalAddrMask->mask; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV4AddrAndMaskPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpV4AddrAndMaskCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWP_V4_ADDR_AND_MASK. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpV4AddrMaskDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552441.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_V4_ADDR_AND_MASK* KrnlHlprFwpV4AddrAndMaskCreateLocalCopy(_In_ const FWP_V4_ADDR_AND_MASK* pOriginalAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV4AddrAndMaskCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalAddrMask); + + NTSTATUS status = STATUS_SUCCESS; + FWP_V4_ADDR_AND_MASK* pAddrMask = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pAddrMask is expected to be cleaned up by caller using KrnlHlprFwpV4AddrAndMaskDestroyLocalCopy + + HLPR_NEW(pAddrMask, + FWP_V4_ADDR_AND_MASK, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pAddrMask, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpV4AddrAndMaskPopulateLocalCopy(pOriginalAddrMask, + pAddrMask); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pAddrMask initialized with call to HLPR_NEW & KrnlHlprFwpV4AddrAndMaskPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pAddrMask) + KrnlHlprFwpV4AddrAndMaskDestroyLocalCopy(&pAddrMask); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV4AddrAndMaskCreateLocalCopy() [pAddrMask: %#p]\n", + pAddrMask); + +#endif /// DBG + + return pAddrMask; + +#pragma warning(pop) +} + +#endif /// FWP_V4_ADDR_AND_MASK____ + +#ifndef FWP_V6_ADDR_AND_MASK____ +#define FWP_V6_ADDR_AND_MASK____ + +/** + @kernel_helper_function="KrnlHlprFwpV6AddrAndMaskPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWP_V6_ADDR_AND_MASK. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552446.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpV6AddrAndMaskPurgeLocalCopy(_Inout_ FWP_V6_ADDR_AND_MASK* pAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV6AddrAndMaskPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pAddrMask); + + RtlZeroMemory(pAddrMask, + sizeof(FWP_V6_ADDR_AND_MASK)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV6AddrAndMaskPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpV6AddrAndMaskDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWP_V6_ADDR_AND_MASK. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552446.aspx <br> +*/ +_At_(*ppAddrMask, _Pre_ _Notnull_) +_At_(*ppAddrMask, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppAddrMask == 0) +inline VOID KrnlHlprFwpV6AddrAndMaskDestroyLocalCopy(_Inout_ FWP_V6_ADDR_AND_MASK** ppAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV6AddrAndMaskDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppAddrMask); + + if(*ppAddrMask) + KrnlHlprFwpV6AddrAndMaskPurgeLocalCopy(*ppAddrMask); + + HLPR_DELETE(*ppAddrMask, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV6AddrAndMaskDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpV6AddrAndMaskPopulateLocalCopy" + + Purpose: Populate a local copy of an FWP_V6_ADDR_AND_MASK. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpV6AddrMaskPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552446.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpV6AddrAndMaskPopulateLocalCopy(_In_ const FWP_V6_ADDR_AND_MASK* pOriginalAddrMask, + _Inout_ FWP_V6_ADDR_AND_MASK* pAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV6AddrAndMaskPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalAddrMask); + NT_ASSERT(pAddrMask); + + NTSTATUS status = STATUS_SUCCESS; + + RtlCopyMemory(pAddrMask->addr, + pOriginalAddrMask->addr, + FWP_V6_ADDR_SIZE); + + pAddrMask->prefixLength = pOriginalAddrMask->prefixLength; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV6AddrAndMaskPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpV6AddrAndMaskCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWP_V6_ADDR_AND_MASK. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpV6AddrMaskDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552446.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_V6_ADDR_AND_MASK* KrnlHlprFwpV6AddrAndMaskCreateLocalCopy(_In_ const FWP_V6_ADDR_AND_MASK* pOriginalAddrMask) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpV6AddrAndMaskCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalAddrMask); + + NTSTATUS status = STATUS_SUCCESS; + FWP_V6_ADDR_AND_MASK* pAddrMask = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pAddrMask is expected to be cleaned up by caller using KrnlHlprFwpV6AddrAndMaskDestroyLocalCopy + + HLPR_NEW(pAddrMask, + FWP_V6_ADDR_AND_MASK, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pAddrMask, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpV6AddrAndMaskPopulateLocalCopy(pOriginalAddrMask, + pAddrMask); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pAddrMask initialized with call to HLPR_NEW & KrnlHlprFwpV6AddrAndMaskPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pAddrMask) + KrnlHlprFwpV6AddrAndMaskDestroyLocalCopy(&pAddrMask); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpV6AddrAndMaskCreateLocalCopy() [pAddrMask: %#p]\n", + pAddrMask); + +#endif /// DBG + + return pAddrMask; + +#pragma warning(pop) +} + +#endif /// FWP_V6_ADDR_AND_MASK____ + +#ifndef FWP_RANGE____ +#define FWP_RANGE____ + +/** + @kernel_helper_function="KrnlHlprFwpRangePurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWP_RANGE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552438.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpRangePurgeLocalCopy(_Inout_ FWP_RANGE* pRange) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpRangePurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pRange); + + KrnlHlprFwpValuePurgeLocalCopy(&(pRange->valueLow)); + + KrnlHlprFwpValuePurgeLocalCopy(&(pRange->valueHigh)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpRangePurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpRangeDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWP_RANGE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552438.aspx <br> +*/ +_At_(*ppRange, _Pre_ _Notnull_) +_At_(*ppRange, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppRange == 0) +inline VOID KrnlHlprFwpRangeDestroyLocalCopy(_Inout_ FWP_RANGE** ppRange) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpRangeDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppRange); + + if(*ppRange) + KrnlHlprFwpRangePurgeLocalCopy(*ppRange); + + HLPR_DELETE(*ppRange, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpRangeDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpRangePopulateLocalCopy" + + Purpose: Populate a local copy of an FWP_RANGE. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpRangePurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552438.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpRangePopulateLocalCopy(_In_ const FWP_RANGE* pOriginalRange, + _Inout_ FWP_RANGE* pRange) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpRangePopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalRange); + NT_ASSERT(pRange); + + NTSTATUS status = STATUS_SUCCESS; + + status = KrnlHlprFwpValuePopulateLocalCopy(&(pOriginalRange->valueLow), + &(pRange->valueLow)); + HLPR_BAIL_ON_FAILURE(status); + + status = KrnlHlprFwpValuePopulateLocalCopy(&(pOriginalRange->valueHigh), + &(pRange->valueHigh)); + HLPR_BAIL_ON_FAILURE(status); + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpRangePurgeLocalCopy(pRange); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpRangePopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpRangeCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWP_RANGE. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpRangeDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552438.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_RANGE* KrnlHlprFwpRangeCreateLocalCopy(_In_ const FWP_RANGE* pOriginalRange) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpRangeCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalRange); + + NTSTATUS status = STATUS_SUCCESS; + FWP_RANGE* pRange = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pRange is expected to be cleaned up by caller using KrnlHlprFwpRangeDestroyLocalCopy + + HLPR_NEW(pRange, + FWP_RANGE, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pRange, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpValuePopulateLocalCopy(&(pOriginalRange->valueLow), + &(pRange->valueLow)); + HLPR_BAIL_ON_FAILURE(status); + + status = KrnlHlprFwpValuePopulateLocalCopy(&(pOriginalRange->valueHigh), + &(pRange->valueHigh)); + HLPR_BAIL_ON_FAILURE(status); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pRange initialized with call to HLPR_NEW & KrnlHlprFwpValuePopulateLocalCopy + + if(status != STATUS_SUCCESS && + pRange) + KrnlHlprFwpRangeDestroyLocalCopy(&pRange); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpRangeCreateLocalCopy() [pRange: %#p]\n", + pRange); + +#endif /// DBG + + return pRange; + +#pragma warning(pop) +} + +#endif /// FWP_RANGE____ + +#ifndef FWP_CONDITION_VALUE____ +#define FWP_CONDITION_VALUE____ + +/** + @kernel_helper_function="KrnlHlprFwpConditionValuePurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWP_CONDITION_VALUE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552430.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpConditionValuePurgeLocalCopy(_Inout_ FWP_CONDITION_VALUE* pValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpConditionValuePurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pValue); + + switch(pValue->type) + { + case FWP_UINT64: + { + HLPR_DELETE(pValue->uint64, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_INT64: + { + HLPR_DELETE(pValue->int64, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_DOUBLE: + { + HLPR_DELETE(pValue->double64, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_BYTE_ARRAY16_TYPE: + { + HLPR_DELETE(pValue->byteArray16, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_BYTE_BLOB_TYPE: + { + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pValue->byteBlob)); + + break; + } + case FWP_SID: + { + HLPR_DELETE_ARRAY(pValue->sid, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_SECURITY_DESCRIPTOR_TYPE: + { + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pValue->sd)); + + break; + } + case FWP_TOKEN_INFORMATION_TYPE: + { + KrnlHlprFwpTokenInformationDestroyLocalCopy(&(pValue->tokenInformation)); + + break; + } + case FWP_TOKEN_ACCESS_INFORMATION_TYPE: + { + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pValue->tokenAccessInformation)); + + break; + } + case FWP_UNICODE_STRING_TYPE: + { + HLPR_DELETE_ARRAY(pValue->unicodeString, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWP_BYTE_ARRAY6_TYPE: + { + HLPR_DELETE(pValue->byteArray6, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + case FWP_SINGLE_DATA_TYPE_MAX: + { + break; + } + case FWP_V4_ADDR_MASK: + { + KrnlHlprFwpV4AddrAndMaskDestroyLocalCopy(&(pValue->v4AddrMask)); + + break; + } + case FWP_V6_ADDR_MASK: + { + KrnlHlprFwpV6AddrAndMaskDestroyLocalCopy(&(pValue->v6AddrMask)); + + break; + } + case FWP_RANGE_TYPE: + { + KrnlHlprFwpRangeDestroyLocalCopy(&(pValue->rangeValue)); + + break; + } + case FWP_DATA_TYPE_MAX: + { + break; + } + default: + { + pValue->uint64 = 0; + + break; + } + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpConditionValuePurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpConditionValueDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWP_CONDITION_VALUE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552430.aspx <br> +*/ +_At_(*ppValue, _Pre_ _Notnull_) +_At_(*ppValue, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppValue == 0) +inline VOID KrnlHlprFwpConditionValueDestroyLocalCopy(_Inout_ FWP_CONDITION_VALUE** ppValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpConditionValueDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppValue); + + if(*ppValue) + KrnlHlprFwpConditionValuePurgeLocalCopy(*ppValue); + + HLPR_DELETE(*ppValue, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpConditionValueDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpConditionValuePopulateLocalCopy" + + Purpose: Populate a local copy of an FWP_CONDITION_VALUE. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpConditionValuePurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552430.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpConditionValuePopulateLocalCopy(_In_ const FWP_CONDITION_VALUE* pOriginalValue, + _Inout_ FWP_CONDITION_VALUE* pValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpConditionValuePopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalValue); + NT_ASSERT(pValue); + + NTSTATUS status = STATUS_SUCCESS; + + KIRQL irql = KeGetCurrentIrql(); + + pValue->type = pOriginalValue->type; + + switch(pValue->type) + { + case FWP_UINT64: + { + HLPR_NEW(pValue->uint64, + UINT64, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->uint64, + status); + + RtlCopyMemory(pValue->uint64, + pOriginalValue->uint64, + sizeof(UINT64)); + + break; + } + case FWP_INT64: + { + HLPR_NEW(pValue->int64, + INT64, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->int64, + status); + + RtlCopyMemory(pValue->int64, + pOriginalValue->int64, + sizeof(INT64)); + + break; + } + case FWP_DOUBLE: + { + HLPR_NEW(pValue->double64, + double, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->double64, + status); + + RtlCopyMemory(pValue->double64, + pOriginalValue->double64, + sizeof(double)); + + break; + } + case FWP_BYTE_ARRAY16_TYPE: + { + HLPR_NEW(pValue->byteArray16, + FWP_BYTE_ARRAY16, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->byteArray16, + status); + + RtlCopyMemory(pValue->byteArray16, + pOriginalValue->byteArray16, + sizeof(FWP_BYTE_ARRAY16)); + + break; + } + case FWP_BYTE_BLOB_TYPE: + { + pValue->byteBlob = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalValue->byteBlob); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->byteBlob, + status); + + break; + } + case FWP_SID: + { + HLPR_DELETE_ARRAY(pValue->sid, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWP_SECURITY_DESCRIPTOR_TYPE: + { + pValue->sd = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalValue->sd); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->sd, + status); + break; + } + case FWP_TOKEN_INFORMATION_TYPE: + { + pValue->tokenInformation = KrnlHlprFwpTokenInformationCreateLocalCopy(pOriginalValue->tokenInformation); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->tokenInformation, + status); + + break; + } + case FWP_TOKEN_ACCESS_INFORMATION_TYPE: + { + pValue->tokenAccessInformation = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalValue->tokenAccessInformation); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->tokenAccessInformation, + status); + + break; + } + case FWP_UNICODE_STRING_TYPE: + { + size_t stringSize = 0; + + if(irql == PASSIVE_LEVEL) + { + status = RtlStringCchLengthW(pOriginalValue->unicodeString, + NTSTRSAFE_MAX_CCH, + &stringSize); + HLPR_BAIL_ON_FAILURE(status); + } + else + stringSize = wcslen(pOriginalValue->unicodeString); + + if(stringSize) + { + HLPR_NEW_ARRAY(pValue->unicodeString, + WCHAR, + stringSize + 1, /// add space for '\0' + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->unicodeString, + status); + +#pragma warning(push) +#pragma warning(disable: 26018) /// buffers are contrained by stringSize + + RtlCopyMemory(pValue->unicodeString, + pOriginalValue->unicodeString, + stringSize * sizeof(WCHAR)); + + pValue->unicodeString[stringSize] = L'\0'; + +#pragma warning(pop) + } + else + { + status = STATUS_INVALID_BUFFER_SIZE; + + HLPR_BAIL; + } + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWP_BYTE_ARRAY6_TYPE: + { + HLPR_NEW(pValue->byteArray6, + FWP_BYTE_ARRAY6, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->byteArray6, + status); + + RtlCopyMemory(pValue->byteArray6, + pOriginalValue->byteArray6, + sizeof(FWP_BYTE_ARRAY6)); + + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + case FWP_SINGLE_DATA_TYPE_MAX: + { + status = STATUS_INVALID_LABEL; + + break; + } + case FWP_V4_ADDR_MASK: + { + pValue->v4AddrMask = KrnlHlprFwpV4AddrAndMaskCreateLocalCopy(pOriginalValue->v4AddrMask); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->v4AddrMask, + status); + + break; + } + case FWP_V6_ADDR_MASK: + { + pValue->v6AddrMask = KrnlHlprFwpV6AddrAndMaskCreateLocalCopy(pOriginalValue->v6AddrMask); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->v6AddrMask, + status); + + break; + } + case FWP_RANGE_TYPE: + { + pValue->rangeValue = KrnlHlprFwpRangeCreateLocalCopy(pOriginalValue->rangeValue); + HLPR_BAIL_ON_ALLOC_FAILURE(pValue->rangeValue, + status); + + break; + } + case FWP_DATA_TYPE_MAX: + { + status = STATUS_INVALID_LABEL; + + break; + } + default: + { + /// this is a straight value copy so it's safe to use the largest static space + pValue->uint64 = pOriginalValue->uint64; + + break; + } + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpConditionValuePurgeLocalCopy(pValue); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpConditionValuePopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpConditionValueCreateLocalCopy" + + Purpose: Allocate ans populate a local copy of an FWP_CONDITION_VALUE. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpConditionValueDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552430.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWP_CONDITION_VALUE* KrnlHlprFwpConditionValueCreateLocalCopy(_In_ const FWP_CONDITION_VALUE* pOriginalValue) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpConditionValueCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalValue); + + NTSTATUS status = STATUS_SUCCESS; + FWP_CONDITION_VALUE* pConditionValue = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pConditionValue is expected to be cleaned up by caller using KrnlHlprFwpConditionValueDestroyLocalCopy + + HLPR_NEW(pConditionValue, + FWP_CONDITION_VALUE, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pConditionValue, + status); + +#pragma warning(push) + + status = KrnlHlprFwpConditionValuePopulateLocalCopy(pOriginalValue, + pConditionValue); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pConditionValue initialized with call to HLPR_NEW & KrnlHlprFwpConditionValuePopulateLocalCopy + + if(status != STATUS_SUCCESS && + pConditionValue) + KrnlHlprFwpConditionValueDestroyLocalCopy(&pConditionValue); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpConditionValueCreateLocalCopy() [pConditionValue: %#p]\n", + pConditionValue); + +#endif /// DBG + + return pConditionValue; + +#pragma warning(pop) +} + +#endif /// FWP_CONDITION_VALUE____ + +#ifndef FWPS_INCOMING_VALUES____ +#define FWPS_INCOMING_VALUES____ + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingValueConditionFlagsAreSet" + + Purpose: Determine if the FWPS_INCOMING_VALUES has the FLAGS condition set with the given + flags. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552401.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +BOOLEAN KrnlHlprFwpsIncomingValueConditionFlagsAreSet(_In_ const FWPS_INCOMING_VALUES* pClassifyValues, + _In_ UINT32 flags) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingValueConditionFlagsAreSet()\n"); + +#endif /// DBG + + NT_ASSERT(pClassifyValues); + + BOOLEAN flagsAreSet = FALSE; + FWP_VALUE* pFlagsValue = KrnlHlprFwpValueGetFromFwpsIncomingValues(pClassifyValues, + &FWPM_CONDITION_FLAGS); + + if(pFlagsValue && + pFlagsValue->uint32 & flags) + flagsAreSet = TRUE; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingValueConditionFlagsAreSet()\n"); + +#endif /// DBG + + return flagsAreSet; +} + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingValuesPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPS_INCOMING_VALUES. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552401.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsIncomingValuesPurgeLocalCopy(_Inout_ FWPS_INCOMING_VALUES* pValues) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingValuesPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pValues); + + for(UINT32 valueIndex = 0; + valueIndex < pValues->valueCount; + valueIndex++) + { + KrnlHlprFwpValuePurgeLocalCopy(&(pValues->incomingValue[valueIndex].value)); + } + + HLPR_DELETE_ARRAY(pValues->incomingValue, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingValuesPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingValuesDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPS_INCOMING_VALUES. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552401.aspx <br> +*/ +_At_(*ppValues, _Pre_ _Notnull_) +_At_(*ppValues, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppValues == 0) +inline VOID KrnlHlprFwpsIncomingValuesDestroyLocalCopy(_Inout_ FWPS_INCOMING_VALUES** ppValues) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingValuesDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppValues); + + if(*ppValues) + KrnlHlprFwpsIncomingValuesPurgeLocalCopy(*ppValues); + + HLPR_DELETE(*ppValues, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingValuesDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingValuesPopulateLocalCopy" + + Purpose: Populate a local copy of an FWPS_INCOMING_VALUES. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsIncomingValuesPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552401.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsIncomingValuesPopulateLocalCopy(_In_ const FWPS_INCOMING_VALUES* pOriginalValues, + _Inout_ FWPS_INCOMING_VALUES* pValues) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingValuesPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalValues); + NT_ASSERT(pValues); + + NTSTATUS status = STATUS_SUCCESS; + + HLPR_NEW_ARRAY(pValues->incomingValue, + FWPS_INCOMING_VALUE, + pOriginalValues->valueCount, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pValues->incomingValue, + status); + + for(UINT32 valueIndex = 0; + valueIndex < pOriginalValues->valueCount; + valueIndex++) + { + status = KrnlHlprFwpValuePopulateLocalCopy(&(pOriginalValues->incomingValue[valueIndex].value), + &(pValues->incomingValue[valueIndex].value)); + HLPR_BAIL_ON_FAILURE(status); + } + + pValues->valueCount = pOriginalValues->valueCount; + pValues->layerId = pOriginalValues->layerId; + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpsIncomingValuesPurgeLocalCopy(pValues); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingValuesPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingValuesCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWPS_INCOMING_VALUES. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsIncomingValuesDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552401.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPS_INCOMING_VALUES* KrnlHlprFwpsIncomingValuesCreateLocalCopy(_In_ const FWPS_INCOMING_VALUES* pOriginalValues) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingValuesCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalValues); + + NTSTATUS status = STATUS_SUCCESS; + FWPS_INCOMING_VALUES* pIncomingValues = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pIncomingValues is expected to be cleaned up by caller using KrnlHlprFwpsIncomingValuesDestroyLocalCopy + + HLPR_NEW(pIncomingValues, + FWPS_INCOMING_VALUES, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pIncomingValues, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpsIncomingValuesPopulateLocalCopy(pOriginalValues, + pIncomingValues); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pIncomingValues initialized with call to HLPR_NEW & KrnlHlprFwpsIncomingValuesPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pIncomingValues) + KrnlHlprFwpsIncomingValuesDestroyLocalCopy(&pIncomingValues); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingValuesCreateLocalCopy() [pIncomingValues: %#p]\n", + pIncomingValues); + +#endif /// DBG + + return pIncomingValues; + +#pragma warning(pop) +} + +#endif /// FWPS_INCOMING_VALUES____ + +#ifndef FWPS_INCOMING_METADATA_VALUES____ +#define FWPS_INCOMING_METADATA_VALUES____ + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingMetadataValuesPurgeLocalCopy + + Purpose: Cleanup a local copy of an FWPS_INCOMING_METADATA_VALUES. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552397.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsIncomingMetadataValuesPurgeLocalCopy(_Inout_ FWPS_INCOMING_METADATA_VALUES* pMetadata) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingMetadataValuesPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pMetadata); + + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pMetadata->processPath)); + + HLPR_DELETE_ARRAY(pMetadata->controlData, + WFPSAMPLER_SYSLIB_TAG); + +#if(NTDDI_VERSION >= NTDDI_WIN6SP1) + + HLPR_DELETE_ARRAY(pMetadata->headerIncludeHeader, + WFPSAMPLER_SYSLIB_TAG); + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + HLPR_DELETE_ARRAY(pMetadata->originalDestination, + WFPSAMPLER_SYSLIB_TAG); + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + if(pMetadata->vSwitchPacketContext) + FwpsDereferencevSwitchPacketContext(pMetadata->vSwitchPacketContext); + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_WIN6SP1) + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingMetadataValuesPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingMetadataValuesDestroyLocalCopy + + Purpose: Cleanup and free a local copy of an FWPS_INCOMING_METADATA_VALUES. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552397.aspx <br> +*/ +_At_(*ppMetadata, _Pre_ _Notnull_) +_At_(*ppMetadata, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppMetadata == 0) +inline VOID KrnlHlprFwpsIncomingMetadataValuesDestroyLocalCopy(_Inout_ FWPS_INCOMING_METADATA_VALUES** ppMetadata) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingMetadataValuesDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppMetadata); + + if(*ppMetadata) + KrnlHlprFwpsIncomingMetadataValuesPurgeLocalCopy(*ppMetadata); + + HLPR_DELETE(*ppMetadata, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingMetadataValuesDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingMetadataValuesPopulateLocalCopy + + Purpose: Populate a local copy of the FWPS_INCOMING_METADATA_VALUES. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpsIncomingMetadataValuesPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552397.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsIncomingMetadataValuesPopulateLocalCopy(_In_ const FWPS_INCOMING_METADATA_VALUES* pOriginalMetadata, + _Inout_ FWPS_INCOMING_METADATA_VALUES* pMetadata) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingMetadataValuesPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalMetadata); + + NTSTATUS status = STATUS_SUCCESS; + + pMetadata->currentMetadataValues = pOriginalMetadata->currentMetadataValues; + pMetadata->flags = pOriginalMetadata->flags; + + /// Used internally by the filter engine. Callout drivers should ignore this member. + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_RESERVED)) + pMetadata->reserved = pOriginalMetadata->reserved; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_DISCARD_REASON)) + { + pMetadata->discardMetadata.discardModule = pOriginalMetadata->discardMetadata.discardModule; + pMetadata->discardMetadata.discardReason = pOriginalMetadata->discardMetadata.discardReason; + pMetadata->discardMetadata.filterId = pOriginalMetadata->discardMetadata.filterId; + } + + /// Not guaranteed to be available outside of the classifyFn. + /// Use of an invalid handle will fail gracefully. + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_FLOW_HANDLE)) + pMetadata->flowHandle = pOriginalMetadata->flowHandle; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_IP_HEADER_SIZE)) + pMetadata->ipHeaderSize = pOriginalMetadata->ipHeaderSize; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE)) + pMetadata->transportHeaderSize = pOriginalMetadata->transportHeaderSize; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_PROCESS_PATH)) + { + pMetadata->processPath = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalMetadata->processPath); + HLPR_BAIL_ON_ALLOC_FAILURE(pMetadata->processPath, + status); + } + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_TOKEN)) + pMetadata->token = pOriginalMetadata->token; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_PROCESS_ID)) + pMetadata->processId = pOriginalMetadata->processId; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_SOURCE_INTERFACE_INDEX)) + pMetadata->sourceInterfaceIndex = pOriginalMetadata->sourceInterfaceIndex; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_DESTINATION_INTERFACE_INDEX)) + pMetadata->destinationInterfaceIndex = pOriginalMetadata->destinationInterfaceIndex; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_COMPARTMENT_ID)) + pMetadata->compartmentId = pOriginalMetadata->compartmentId; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_FRAGMENT_DATA)) + { + pMetadata->fragmentMetadata.fragmentIdentification = pOriginalMetadata->fragmentMetadata.fragmentIdentification; + pMetadata->fragmentMetadata.fragmentOffset = pOriginalMetadata->fragmentMetadata.fragmentOffset; + pMetadata->fragmentMetadata.fragmentLength = pOriginalMetadata->fragmentMetadata.fragmentLength; + } + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_PATH_MTU)) + pMetadata->pathMtu = pOriginalMetadata->pathMtu; + + /// Not guaranteed to be available outside of the classifyFn. + /// Use of an invalid handle will fail gracefully. + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_COMPLETION_HANDLE)) + pMetadata->completionHandle = pOriginalMetadata->completionHandle; + + /// Not guaranteed to be available outside of the classifyFn. + /// Use of an invalid handle will fail gracefully. + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE)) + pMetadata->transportEndpointHandle = pOriginalMetadata->transportEndpointHandle; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_REMOTE_SCOPE_ID)) + pMetadata->remoteScopeId = pOriginalMetadata->remoteScopeId; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA)) + { + BYTE* pControlData = 0; + + HLPR_NEW_ARRAY(pControlData, + BYTE, + pOriginalMetadata->controlDataLength, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pControlData, + status); + + RtlCopyMemory(pControlData, + pOriginalMetadata->controlData, + pOriginalMetadata->controlDataLength); + + pMetadata->controlData = (WSACMSGHDR*)pControlData; + pMetadata->controlDataLength = pOriginalMetadata->controlDataLength; + } + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_PACKET_DIRECTION)) + pMetadata->packetDirection= pOriginalMetadata->packetDirection; + +#if(NTDDI_VERSION >= NTDDI_WIN6SP1) + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_TRANSPORT_HEADER_INCLUDE_HEADER)) + { + HLPR_NEW_ARRAY(pMetadata->headerIncludeHeader, + BYTE, + pOriginalMetadata->headerIncludeHeaderLength, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pMetadata->headerIncludeHeader, + status); + + RtlCopyMemory(pMetadata->headerIncludeHeader, + pOriginalMetadata->headerIncludeHeader, + pOriginalMetadata->headerIncludeHeaderLength); + + pMetadata->headerIncludeHeaderLength = pOriginalMetadata->headerIncludeHeaderLength; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_DESTINATION_PREFIX)) + pMetadata->destinationPrefix = pOriginalMetadata->destinationPrefix; + + /// Not guaranteed to be available outside of the classifyFn. + /// Use of an invalid handle will fail gracefully. + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE)) + pMetadata->parentEndpointHandle = pOriginalMetadata->parentEndpointHandle; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE)) + pMetadata->icmpIdAndSequence = pOriginalMetadata->icmpIdAndSequence; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_LOCAL_REDIRECT_TARGET_PID)) + pMetadata->localRedirectTargetPID = pOriginalMetadata->localRedirectTargetPID; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_ORIGINAL_DESTINATION)) + { + BYTE* pDestination = 0; + SIZE_T sockAddrSize = (pOriginalMetadata->originalDestination->sa_family == AF_INET) ? + sizeof(SOCKADDR_IN) : + sizeof(SOCKADDR_IN6); + + HLPR_NEW_ARRAY(pDestination, + BYTE, + sockAddrSize, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pDestination, + status); + + RtlCopyMemory(pMetadata->originalDestination, + pOriginalMetadata->originalDestination, + sockAddrSize); + + pMetadata->originalDestination = (SOCKADDR*)pDestination; + } + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_REDIRECT_RECORD_HANDLE)) + pMetadata->redirectRecords = pOriginalMetadata->redirectRecords; + + if(FWPS_IS_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_METADATA_FIELD_SUB_PROCESS_TAG)) + pMetadata->subProcessTag = pOriginalMetadata->subProcessTag; + + pMetadata->currentL2MetadataValues = pOriginalMetadata->currentL2MetadataValues; + pMetadata->l2Flags = pOriginalMetadata->l2Flags; + + if(FWPS_IS_L2_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_L2_METADATA_FIELD_ETHERNET_MAC_HEADER_SIZE)) + pMetadata->ethernetMacHeaderSize = pOriginalMetadata->ethernetMacHeaderSize; + + if(FWPS_IS_L2_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_L2_METADATA_FIELD_WIFI_OPERATION_MODE)) + pMetadata->wiFiOperationMode = pOriginalMetadata->wiFiOperationMode; + +#if(NDIS_SUPPORT_NDIS630) + + if(FWPS_IS_L2_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_PORT_ID)) + pMetadata->vSwitchSourcePortId = pOriginalMetadata->vSwitchSourcePortId; + + if(FWPS_IS_L2_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_NIC_INDEX)) + pMetadata->vSwitchSourceNicIndex = pOriginalMetadata->vSwitchSourceNicIndex; + + if(FWPS_IS_L2_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_L2_METADATA_FIELD_VSWITCH_DESTINATION_PORT_ID)) + pMetadata->vSwitchDestinationPortId = pOriginalMetadata->vSwitchDestinationPortId; + +#endif /// (NDIS_SUPPORT_NDIS630) + + /// Technically only need this if allocating and injecting new NBLs + if(FWPS_IS_L2_METADATA_FIELD_PRESENT(pOriginalMetadata, + FWPS_L2_METADATA_FIELD_VSWITCH_PACKET_CONTEXT)) + { + FwpsReferencevSwitchPacketContext(pOriginalMetadata->vSwitchPacketContext); + + pMetadata->vSwitchPacketContext = pOriginalMetadata->vSwitchPacketContext; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) +#endif /// (NTDDI_VERSION >= NTDDI_WIN6SP1) + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpsIncomingMetadataValuesPurgeLocalCopy(pMetadata); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingMetadataValuesPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpsIncomingMetadataValuesCreateLocalCopy + + Purpose: Allocate and populate a local copy of the FWPS_INCOMING_METADATA_VALUES. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsIncomingMetadataValuesDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552397.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPS_INCOMING_METADATA_VALUES* KrnlHlprFwpsIncomingMetadataValuesCreateLocalCopy(_In_ const FWPS_INCOMING_METADATA_VALUES* pOriginalMetadata) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsIncomingMetadataValuesCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalMetadata); + + NTSTATUS status = STATUS_SUCCESS; + FWPS_INCOMING_METADATA_VALUES* pMetadata = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pMetadata is expected to be cleaned up by caller using KrnlHlprFwpsIncomingMetadataValuesDestroyLocalCopy + + HLPR_NEW(pMetadata, + FWPS_INCOMING_METADATA_VALUES, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pMetadata, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpsIncomingMetadataValuesPopulateLocalCopy(pOriginalMetadata, + pMetadata); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pMetadata initialized with call to HLPR_NEW & KrnlHlprFwpsIncomingMetadataValuesPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pMetadata) + KrnlHlprFwpsIncomingMetadataValuesDestroyLocalCopy(&pMetadata); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsIncomingMetadataValuesCreateLocalCopy() [pMetadata: %#p]\n", + pMetadata); + +#endif /// DBG + + return pMetadata; + +#pragma warning(pop) +} + +#endif /// FWPS_INCOMING_METADATA_VALUES____ + +#ifndef FWPS_CLASSIFY_OUT____ +#define FWPS_CLASSIFY_OUT____ + +/** + @kernel_helper_function="KrnlHlprFwpsClassifyOutPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPS_CLASSIFY_OUT. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsClassifyOutPurgeLocalCopy(_Inout_ FWPS_CLASSIFY_OUT* pOriginalClassifyOut) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsClassifyOutPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalClassifyOut); + + RtlZeroMemory(pOriginalClassifyOut, + sizeof(FWPS_CLASSIFY_OUT)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsClassifyOutPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsClassifyOutDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPS_CLASSIFY_OUT. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> +*/ +_At_(*ppClassifyOut, _Pre_ _Notnull_) +_At_(*ppClassifyOut, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppClassifyOut == 0) +VOID KrnlHlprFwpsClassifyOutDestroyLocalCopy(_Inout_ FWPS_CLASSIFY_OUT** ppClassifyOut) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsClassifyOutDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppClassifyOut); + + if(*ppClassifyOut) + KrnlHlprFwpsClassifyOutPurgeLocalCopy(*ppClassifyOut); + + HLPR_DELETE(*ppClassifyOut, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsClassifyOutDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsClassifyOutPopulateLocalCopy" + + Purpose: Populate a local copy of the FWPS_CLASSIFY_OUT. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsClassifyOutPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsClassifyOutPopulateLocalCopy(_In_ const FWPS_CLASSIFY_OUT* pOriginalClassifyOut, + _Inout_ FWPS_CLASSIFY_OUT* pClassifyOut) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsClassifyOutPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalClassifyOut); + NT_ASSERT(pClassifyOut); + + RtlCopyMemory(pClassifyOut, + pOriginalClassifyOut, + sizeof(FWPS_CLASSIFY_OUT)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsClassifyOutPopulateLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsClassifyOutCreateLocalCopy" + + Purpose: Allocate and populate a local copy of the FWPS_CLASSIFY_OUT. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsClassifyOutDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551229.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPS_CLASSIFY_OUT* KrnlHlprFwpsClassifyOutCreateLocalCopy(_In_ const FWPS_CLASSIFY_OUT* pOriginalClassifyOut) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsClassifyOutCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalClassifyOut); + + NTSTATUS status = 0; + FWPS_CLASSIFY_OUT* pClassifyOut = 0; + + HLPR_NEW(pClassifyOut, + FWPS_CLASSIFY_OUT, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pClassifyOut, + status); + + KrnlHlprFwpsClassifyOutPopulateLocalCopy(pOriginalClassifyOut, + pClassifyOut); + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_ERROR_LEVEL, + " !!!! KrnlHlprFwpsClassifyOutCreateLocalCopy() [status: %#x]\n", + status); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsClassifyOutCreateLocalCopy() [pClassifyOut: %#p]\n", + pClassifyOut); + +#endif /// DBG + + return pClassifyOut; +} + +#endif /// FWPS_CLASSIFY_OUT____ + +#ifndef FWPS_STREAM_DATA____ +#define FWPS_STREAM_DATA____ + +/** + @kernel_helper_function="KrnlHlprFwpsStreamDataPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPS_STREAM_DATA. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552419.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsStreamDataPurgeLocalCopy(_Inout_ FWPS_STREAM_DATA* pStreamData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamDataPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pStreamData); + + BOOLEAN isDispatch = (KeGetCurrentIrql() == DISPATCH_LEVEL) ? TRUE : FALSE; + + for(NET_BUFFER_LIST* pNBL = pStreamData->netBufferListChain; + pNBL; + ) + { + NET_BUFFER_LIST* pNBLNext = NET_BUFFER_LIST_NEXT_NBL(pNBL); + + FwpsDereferenceNetBufferList(pNBL, + isDispatch); + + pNBL = pNBLNext; + } + + pStreamData->netBufferListChain = 0; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsStreamDataPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsStreamDataDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPS_STREAM_DATA. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552419.aspx <br> +*/ +_At_(*ppStreamData, _Pre_ _Notnull_) +_At_(*ppStreamData, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppStreamData == 0) +inline VOID KrnlHlprFwpsStreamDataDestroyLocalCopy(_Inout_ FWPS_STREAM_DATA** ppStreamData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamDataDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppStreamData); + + if(*ppStreamData) + KrnlHlprFwpsStreamDataPurgeLocalCopy(*ppStreamData); + + HLPR_DELETE(*ppStreamData, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsStreamDataDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsStreamDataPopulateLocalCopy + + Purpose: Populate a local copy of the FWPS_STREAM_DATA. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsStreamDataPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552419.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsStreamDataPopulateLocalCopy(_In_ const FWPS_STREAM_DATA* pOriginalStreamData, + _Inout_ FWPS_STREAM_DATA* pStreamData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamDataPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalStreamData); + NT_ASSERT(pStreamData); + + NTSTATUS status = STATUS_SUCCESS; + + for(NET_BUFFER_LIST* pNBL = pOriginalStreamData->netBufferListChain; + pNBL; + pNBL = NET_BUFFER_LIST_NEXT_NBL(pNBL)) + { + FwpsReferenceNetBufferList(pNBL, + TRUE); + } + + pStreamData->flags = pOriginalStreamData->flags; + pStreamData->dataOffset = pOriginalStreamData->dataOffset; + pStreamData->dataLength = pOriginalStreamData->dataLength; + pStreamData->netBufferListChain = pOriginalStreamData->netBufferListChain; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsStreamDataPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpsStreamDataCreateLocalCopy + + Purpose: Allocate and populate a local copy of the FWPS_STREAM_DATA. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsStreamDataDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552419.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPS_STREAM_DATA* KrnlHlprFwpsStreamDataCreateLocalCopy(_In_ const FWPS_STREAM_DATA* pOriginalStreamData) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamDataCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalStreamData); + + NTSTATUS status = STATUS_SUCCESS; + FWPS_STREAM_DATA* pStreamData = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pStreamData is expected to be cleaned up by caller using KrnlHlprFwpsStreamDataDestroyLocalCopy + + HLPR_NEW(pStreamData, + FWPS_STREAM_DATA, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pStreamData, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpsStreamDataPopulateLocalCopy(pOriginalStreamData, + pStreamData); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pStreamData initialized with call to HLPR_NEW & KrnlHlprFwpsStreamDataPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pStreamData) + KrnlHlprFwpsStreamDataDestroyLocalCopy(&pStreamData); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamDataCreateLocalCopy() [pStreamData: %#p]\n", + pStreamData); + +#endif /// DBG + + return pStreamData; + +#pragma warning(pop) +} + +#endif /// FWPS_STREAM_DATA____ + +#ifndef FWPS_STREAM_CALLOUT_IO_PACKET____ +#define FWPS_STREAM_CALLOUT_IO_PACKET____ + +/** + @kernel_helper_function="KrnlHlprFwpsStreamCalloutIOPacketPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPS_STREAM_CALLOUT_IO_PACKET. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552417.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsStreamCalloutIOPacketPurgeLocalCopy(_Inout_ FWPS_STREAM_CALLOUT_IO_PACKET* pIOPacket) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamCalloutIOPacketPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pIOPacket); + + KrnlHlprFwpsStreamDataDestroyLocalCopy(&(pIOPacket->streamData)); + + RtlZeroMemory(pIOPacket, + sizeof(FWPS_STREAM_CALLOUT_IO_PACKET)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsStreamCalloutIOPacketPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsStreamCalloutIOPacketDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPS_STREAM_CALLOUT_IO_PACKET. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552417.aspx <br> +*/ +_At_(*ppIOPacket, _Pre_ _Notnull_) +_At_(*ppIOPacket, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppIOPacket == 0) +inline VOID KrnlHlprFwpsStreamCalloutIOPacketDestroyLocalCopy(_Inout_ FWPS_STREAM_CALLOUT_IO_PACKET** ppIOPacket) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamCalloutIOPacketDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppIOPacket); + + if(*ppIOPacket) + KrnlHlprFwpsStreamCalloutIOPacketPurgeLocalCopy(*ppIOPacket); + + HLPR_DELETE(*ppIOPacket, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsStreamCalloutIOPacketDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsStreamCalloutIOPacketPopulateLocalCopy + + Purpose: Populate a local copy of the FWPS_STREAM_CALLOUT_IO_PACKET. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsStreamCalloutIOPacketPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552417.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsStreamCalloutIOPacketPopulateLocalCopy(_In_ const FWPS_STREAM_CALLOUT_IO_PACKET* pOriginalIOPacket, + _Inout_ FWPS_STREAM_CALLOUT_IO_PACKET* pIOPacket) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamCalloutIOPacketPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalIOPacket); + NT_ASSERT(pIOPacket); + + NTSTATUS status = STATUS_SUCCESS; + + pIOPacket->streamData = KrnlHlprFwpsStreamDataCreateLocalCopy(pOriginalIOPacket->streamData); + HLPR_BAIL_ON_NULL_POINTER_WITH_STATUS(pIOPacket->streamData, + status); + + pIOPacket->missedBytes = pOriginalIOPacket->missedBytes; + pIOPacket->countBytesRequired = pOriginalIOPacket->countBytesRequired; + pIOPacket->countBytesEnforced = pOriginalIOPacket->countBytesEnforced; + pIOPacket->streamAction = pOriginalIOPacket->streamAction; + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpsStreamCalloutIOPacketPurgeLocalCopy(pIOPacket); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsStreamCalloutIOPacketPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpsStreamCalloutIOPacketCreateLocalCopy + + Purpose: Allocate and populate a local copy of the FWPS_STREAM_CALLOUT_IO_PACKET. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsStreamCalloutIOPacketDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552417.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPS_STREAM_CALLOUT_IO_PACKET* KrnlHlprFwpsStreamCalloutIOPacketCreateLocalCopy(_In_ const FWPS_STREAM_CALLOUT_IO_PACKET* pOriginalIOPacket) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsStreamCalloutIOPacketCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalIOPacket); + + NTSTATUS status = STATUS_SUCCESS; + FWPS_STREAM_CALLOUT_IO_PACKET* pIOPacket = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pIOPacket is expected to be cleaned up by caller using KrnlHlprFwpsStreamCalloutIOPacketDestroyLocalCopy + + HLPR_NEW(pIOPacket, + FWPS_STREAM_CALLOUT_IO_PACKET, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pIOPacket, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpsStreamCalloutIOPacketPopulateLocalCopy(pOriginalIOPacket, + pIOPacket); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pIOPacket initialized with call to HLPR_NEW & KrnlHlprFwpsStreamCalloutIOPacketPopulateLocalCopy + + if(status != STATUS_SUCCESS) + KrnlHlprFwpsStreamCalloutIOPacketDestroyLocalCopy(&pIOPacket); + +#pragma warning(push) + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsStreamCalloutIOPacketCreateLocalCopy() [pIOPacket: %#p]\n", + pIOPacket); + +#endif /// DBG + + return pIOPacket; +} + +#endif /// FWPS_STREAM_CALLOUT_IO_PACKET____ + +#ifndef FWPM_PROVIDER_CONTEXT____ +#define FWPM_PROVIDER_CONTEXT____ + +/** + @kernel_helper_function="KrnlHlprFwpmProviderContextPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPM_PROVIDER_CONTEXT. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/HH447383.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744952.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364289.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpmProviderContextPurgeLocalCopy(_Inout_ FWPM_PROVIDER_CONTEXT* pContext) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmProviderContextPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pContext); + + switch(pContext->type) + { + case FWPM_IPSEC_KEYING_CONTEXT: + { + if(pContext->keyingPolicy) + { + HLPR_DELETE_ARRAY(pContext->keyingPolicy->keyModKeys, + WFPSAMPLER_SYSLIB_TAG); + } + + HLPR_DELETE(pContext->keyingPolicy, + WFPSAMPLER_SYSLIB_TAG); + + break; + } + case FWPM_IPSEC_IKE_QM_TRANSPORT_CONTEXT: + { + break; + } + case FWPM_IPSEC_IKE_QM_TUNNEL_CONTEXT: + { + break; + } + case FWPM_IPSEC_AUTHIP_QM_TRANSPORT_CONTEXT: + { + break; + } + case FWPM_IPSEC_AUTHIP_QM_TUNNEL_CONTEXT: + { + break; + } + case FWPM_IPSEC_IKE_MM_CONTEXT: + { + break; + } + case FWPM_IPSEC_AUTHIP_MM_CONTEXT: + { + break; + } + case FWPM_CLASSIFY_OPTIONS_CONTEXT: + { + KrnlHlprFwpmClassifyOptionsDestroyLocalCopy(&(pContext->classifyOptions)); + + break; + } + case FWPM_GENERAL_CONTEXT: + { + KrnlHlprFwpByteBlobDestroyLocalCopy(&(pContext->dataBuffer)); + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWPM_IPSEC_IKEV2_QM_TUNNEL_CONTEXT: + { + break; + } + case FWPM_IPSEC_IKEV2_MM_CONTEXT: + { + break; + } + case FWPM_IPSEC_DOSP_CONTEXT: + { + KrnlHlprIPsecDoSPOptionsDestroyLocalCopy(&(pContext->idpOptions)); + + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + } + + KrnlHlprFwpByteBlobPurgeLocalCopy(&(pContext->providerData)); + + HLPR_DELETE(pContext->providerKey, + WFPSAMPLER_SYSLIB_TAG); + + KrnlHlprFwpmDisplayDataPurgeLocalCopy(&(pContext->displayData)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmProviderContextPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmProviderContextDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPM_PROVIDER_CONTEXT. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/HH447383.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744952.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364289.aspx <br> +*/ +_At_(*ppContext, _Pre_ _Notnull_) +_At_(*ppContext, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppContext == 0) +inline VOID KrnlHlprFwpmProviderContextDestroyLocalCopy(_Inout_ FWPM_PROVIDER_CONTEXT** ppContext) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmProviderContextDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppContext); + + if(*ppContext) + KrnlHlprFwpmProviderContextPurgeLocalCopy(*ppContext); + + HLPR_DELETE(*ppContext, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmProviderContextDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmProviderContextPopulateLocalCopy + + Purpose: Populate a local copy of the FWPM_PROVIDER_CONTEXT. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpmProviderContextPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/HH447383.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744952.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364289.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpmProviderContextPopulateLocalCopy(_In_ const FWPM_PROVIDER_CONTEXT* pOriginalContext, + _Inout_ FWPM_PROVIDER_CONTEXT* pProviderContext) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmProviderContextPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalContext); + NT_ASSERT(pProviderContext); + + NTSTATUS status = STATUS_SUCCESS; + + pProviderContext->providerContextKey = pOriginalContext->providerContextKey; + pProviderContext->flags = pOriginalContext->flags; + pProviderContext->type = pOriginalContext->type; + pProviderContext->providerContextId = pOriginalContext->providerContextId; + + switch(pProviderContext->type) + { + case FWPM_IPSEC_KEYING_CONTEXT: + { + if(pOriginalContext->keyingPolicy) + { + HLPR_NEW(pProviderContext->keyingPolicy, + IPSEC_KEYING_POLICY, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pProviderContext->keyingPolicy, + status); + + if(pOriginalContext->keyingPolicy->numKeyMods) + { + pProviderContext->keyingPolicy->numKeyMods = pOriginalContext->keyingPolicy->numKeyMods; + + HLPR_NEW_ARRAY(pProviderContext->keyingPolicy->keyModKeys, + GUID, + pProviderContext->keyingPolicy->numKeyMods, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pProviderContext->keyingPolicy->keyModKeys, + status); + + RtlCopyMemory(pProviderContext->keyingPolicy->keyModKeys, + pOriginalContext->keyingPolicy->keyModKeys, + pProviderContext->keyingPolicy->numKeyMods * sizeof(GUID)); + } + } + + break; + } + case FWPM_IPSEC_IKE_QM_TRANSPORT_CONTEXT: + { + break; + } + case FWPM_IPSEC_IKE_QM_TUNNEL_CONTEXT: + { + break; + } + case FWPM_IPSEC_AUTHIP_QM_TRANSPORT_CONTEXT: + { + break; + } + case FWPM_IPSEC_AUTHIP_QM_TUNNEL_CONTEXT: + { + break; + } + case FWPM_IPSEC_IKE_MM_CONTEXT: + { + break; + } + case FWPM_IPSEC_AUTHIP_MM_CONTEXT: + { + break; + } + case FWPM_CLASSIFY_OPTIONS_CONTEXT: + { + break; + } + case FWPM_GENERAL_CONTEXT: + { + pProviderContext->dataBuffer = KrnlHlprFwpByteBlobCreateLocalCopy(pOriginalContext->dataBuffer); + HLPR_BAIL_ON_NULL_POINTER_WITH_STATUS(pProviderContext->dataBuffer, + status); + + break; + } + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + case FWPM_IPSEC_IKEV2_QM_TUNNEL_CONTEXT: + { + break; + } + case FWPM_IPSEC_IKEV2_MM_CONTEXT: + { + break; + } + case FWPM_IPSEC_DOSP_CONTEXT: + { + pProviderContext->idpOptions = KrnlHlprIPsecDoSPOptionsCreateLocalCopy(pOriginalContext->idpOptions); + HLPR_BAIL_ON_NULL_POINTER_WITH_STATUS(pProviderContext->idpOptions, + status); + break; + } + +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpmProviderContextPurgeLocalCopy(pProviderContext); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmProviderContextPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpmProviderContextCreateLocalCopy + + Purpose: Allocate and populate a local copy of the FWPM_PROVIDER_CONTEXT. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpmProviderContextDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/HH447383.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/DD744952.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Desktop/AA364289.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPM_PROVIDER_CONTEXT* KrnlHlprFwpmProviderContextCreateLocalCopy(_In_ const FWPM_PROVIDER_CONTEXT* pOriginalContext) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmProviderContextCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalContext); + + NTSTATUS status = STATUS_SUCCESS; + FWPM_PROVIDER_CONTEXT* pProviderContext = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pProviderContext is expected to be cleaned up by caller using KrnlHlprFwpmProviderContextDestroyLocalCopy + + HLPR_NEW(pProviderContext, + FWPM_PROVIDER_CONTEXT, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pProviderContext, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpmProviderContextPopulateLocalCopy(pOriginalContext, + pProviderContext); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pProviderContext initialized with call to HLPR_NEW & KrnlHlprFwpmProviderContextPopulateLocalCopy + + if(status != STATUS_SUCCESS) + KrnlHlprFwpmProviderContextDestroyLocalCopy(&pProviderContext); + +#pragma warning(pop) + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmProviderContextCreateLocalCopy() [pProviderContext: %#p]\n", + pProviderContext); + +#endif /// DBG + + return pProviderContext; +} + +#endif /// FWPS_PROVIDER_CONTEXT____ + +#ifndef FWPS_FILTER_CONDITION____ +#define FWPS_FILTER_CONDITION____ + +/** + @kernel_helper_function="KrnlHlprFwpsFilterConditionPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPS_FILTER_CONDITION. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552391.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsFilterConditionPurgeLocalCopy(_Inout_ FWPS_FILTER_CONDITION* pCondition) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterConditionPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pCondition); + + KrnlHlprFwpConditionValuePurgeLocalCopy(&(pCondition->conditionValue)); + + RtlZeroMemory(pCondition, + sizeof(FWPS_FILTER_CONDITION)); + + pCondition->matchType = FWP_MATCH_TYPE_MAX; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterConditionPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsFilterConditionDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPS_FILTER_CONDITION. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552391.aspx <br> +*/ +_At_(*ppConditions, _Pre_ _Notnull_) +_At_(*ppConditions, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppConditions == 0) +inline VOID KrnlHlprFwpsFilterConditionDestroyLocalCopy(_Inout_ FWPS_FILTER_CONDITION** ppConditions, + _In_ UINT32 numConditions) /* 1 */ +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterConditionDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppConditions); + + if(*ppConditions) + { + for(UINT32 conditionIndex = 0; + conditionIndex < numConditions; + conditionIndex++) + { + KrnlHlprFwpsFilterConditionPurgeLocalCopy(&((*ppConditions)[conditionIndex])); + } + } + + HLPR_DELETE_ARRAY(*ppConditions, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterConditionDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsFilterConditionPopulateLocalCopy" + + Purpose: Populate a local copy of an FWPS_FILTER_CONDITION. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpsFilterConditionPurgeLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552391.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsFilterConditionPopulateLocalCopy(_In_ const FWPS_FILTER_CONDITION* pOriginalCondition, + _Inout_ FWPS_FILTER_CONDITION* pCondition) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterConditionPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalCondition); + NT_ASSERT(pCondition); + + NTSTATUS status = STATUS_SUCCESS; + + pCondition->fieldId = pOriginalCondition->fieldId; + pCondition->reserved = pOriginalCondition->reserved; + pCondition->matchType = pOriginalCondition->matchType; + + status = KrnlHlprFwpConditionValuePopulateLocalCopy(&(pOriginalCondition->conditionValue), + &(pCondition->conditionValue)); + + if(status != STATUS_SUCCESS) + KrnlHlprFwpsFilterConditionPurgeLocalCopy(pCondition); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterConditionPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpsFilterConditionCreateLocalCopy" + + Purpose: Allocate and populate a local copy of an FWPS_FILTER_CONDITION. <br> + <br> + Notes: The caller is responsible for freeing any allocated memory using + KrnlHlprFwpsFilterConditionDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552391.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPS_FILTER_CONDITION* KrnlHlprFwpsFilterConditionCreateLocalCopy(_In_reads_(numConditions) const FWPS_FILTER_CONDITION* pOriginalConditions, + _In_ UINT32 numConditions) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterConditionCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalConditions); + NT_ASSERT(numConditions); + + NTSTATUS status = STATUS_SUCCESS; + FWPS_FILTER_CONDITION* pConditions = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pConditions is expected to be cleaned up by caller using KrnlHlprFwpsFilterConditionDestroyLocalCopy + + HLPR_NEW_ARRAY(pConditions, + FWPS_FILTER_CONDITION, + numConditions, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pConditions, + status); + +#pragma warning(pop) + + for(UINT32 conditionIndex = 0; + conditionIndex < numConditions; + conditionIndex++) + { + status = KrnlHlprFwpsFilterConditionPopulateLocalCopy(&(pOriginalConditions[conditionIndex]), + &(pConditions[conditionIndex])); + } + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pConditions initialized with call to HLPR_NEW_ARRAY & KrnlHlprFwpsFilterConditionPopulateLocalCopy + + if(status != STATUS_SUCCESS && + pConditions) + KrnlHlprFwpsFilterConditionDestroyLocalCopy(&pConditions); + +#pragma warning(pop) + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterConditionCreateLocalCopy() [pConditions: %#p]\n", + pConditions); + +#endif /// DBG + + return pConditions; +} + +#endif /// FWPS_FILTER_CONDITION____ + +#ifndef FWPS_FILTER____ +#define FWPS_FILTER____ + +/** + @kernel_helper_function="KrnlHlprFwpsFilterPurgeLocalCopy" + + Purpose: Cleanup a local copy of an FWPS_FILTER. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/EE220716.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +inline VOID KrnlHlprFwpsFilterPurgeLocalCopy(_Inout_ FWPS_FILTER* pFilter) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterPurgeLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pFilter); + + KrnlHlprFwpmProviderContextDestroyLocalCopy(&(pFilter->providerContext)); + + KrnlHlprFwpsFilterConditionDestroyLocalCopy(&(pFilter->filterCondition), + pFilter->numFilterConditions); + + KrnlHlprFwpValuePurgeLocalCopy(&(pFilter->weight)); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterPurgeLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsFilterDestroyLocalCopy" + + Purpose: Cleanup and free a local copy of an FWPS_FILTER. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/HH439768.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552389.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552387.aspx <br> +*/ +_At_(*ppFilter, _Pre_ _Notnull_) +_At_(*ppFilter, _Post_ _Null_ __drv_freesMem(Pool)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(*ppFilter == 0) +inline VOID KrnlHlprFwpsFilterDestroyLocalCopy(_Inout_ FWPS_FILTER** ppFilter) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterDestroyLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(ppFilter); + + if(*ppFilter) + KrnlHlprFwpsFilterPurgeLocalCopy(*ppFilter); + + HLPR_DELETE(*ppFilter, + WFPSAMPLER_SYSLIB_TAG); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterDestroyLocalCopy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsFilterPopulateLocalCopy + + Purpose: Populate a local copy of the FWPS_FILTER. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsFilterPurgeLocalCopy(). <br> + <br> + + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/HH439768.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552389.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552387.aspx <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsFilterPopulateLocalCopy(_In_ const FWPS_FILTER* pOriginalFilter, + _Inout_ FWPS_FILTER* pFilter) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterPopulateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalFilter); + NT_ASSERT(pFilter); + + NTSTATUS status = STATUS_SUCCESS; + + pFilter->filterId = pOriginalFilter->filterId; + pFilter->subLayerWeight = pOriginalFilter->subLayerWeight; + pFilter->flags = pOriginalFilter->flags; + pFilter->numFilterConditions = pOriginalFilter->numFilterConditions; + pFilter->action.type = pOriginalFilter->action.type; + pFilter->action.calloutId = pOriginalFilter->action.calloutId; + pFilter->context = pOriginalFilter->context; + + status = KrnlHlprFwpValuePopulateLocalCopy(&(pOriginalFilter->weight), + &(pFilter->weight)); + HLPR_BAIL_ON_FAILURE(status); + + if(pFilter->numFilterConditions) + { + pFilter->filterCondition = KrnlHlprFwpsFilterConditionCreateLocalCopy(pOriginalFilter->filterCondition, + pFilter->numFilterConditions); + HLPR_BAIL_ON_NULL_POINTER_WITH_STATUS(pFilter->filterCondition, + status); + } + + if(pOriginalFilter->providerContext) + { + pFilter->providerContext = KrnlHlprFwpmProviderContextCreateLocalCopy(pOriginalFilter->providerContext); + HLPR_BAIL_ON_ALLOC_FAILURE(pFilter->providerContext, + status); + } + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpsFilterPurgeLocalCopy(pFilter); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterPopulateLocalCopy() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpsFilterCreateLocalCopy + + Purpose: Allocate and populate a local copy of the FWPS_FILTER. <br> + <br> + Notes: The caller is responsible for freeing the allocated memory using + KrnlHlprFwpsFilterDestroyLocalCopy(). <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/HH439768.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552389.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF552387.aspx <br> +*/ +__drv_allocatesMem(Pool) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Must_inspect_result_ +_Success_(return != 0) +FWPS_FILTER* KrnlHlprFwpsFilterCreateLocalCopy(_In_ const FWPS_FILTER* pOriginalFilter) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsFilterCreateLocalCopy()\n"); + +#endif /// DBG + + NT_ASSERT(pOriginalFilter); + + NTSTATUS status = STATUS_SUCCESS; + FWPS_FILTER* pFilter = 0; + +#pragma warning(push) +#pragma warning(disable: 6014) /// pFilter is expected to be cleaned up by caller using KrnlHlprFwpsFilterDestroyLocalCopy + + HLPR_NEW(pFilter, + FWPS_FILTER, + WFPSAMPLER_SYSLIB_TAG); + HLPR_BAIL_ON_ALLOC_FAILURE(pFilter, + status); + +#pragma warning(pop) + + status = KrnlHlprFwpsFilterPopulateLocalCopy(pOriginalFilter, + pFilter); + + HLPR_BAIL_LABEL: + +#pragma warning(push) +#pragma warning(disable: 6001) /// pFilter initialized with call to HLPR_NEW & KrnlHlprFwpsFilterPopulateLocalCopy + + if(status != STATUS_SUCCESS) + KrnlHlprFwpsFilterDestroyLocalCopy(&pFilter); + +#pragma warning(pop) + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsFilterCreateLocalCopy() [pFilter: %p]\n", + pFilter); + +#endif /// DBG + + return pFilter; +} + +#endif /// FWPS_FILTER____ + +#ifndef FWPM_SESSION____ +#define FWPM_SESSION____ + +/** + @kernel_helper_function="KrnlHlprFwpmSessionReleaseHandle + + Purpose: Close an open handle to BFE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF550072.aspx <br> +*/ +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpmSessionReleaseHandle(_Inout_ HANDLE* pEngineHandle) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmSessionReleaseHandle()\n"); + +#endif /// DBG + + NT_ASSERT(pEngineHandle); + + NTSTATUS status = STATUS_SUCCESS; + + if(*pEngineHandle) + { + status = FwpmEngineClose(*pEngineHandle); + if(status != STATUS_SUCCESS) + { + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_ERROR_LEVEL, + " !!!! KrnlHlprFwpmSessionReleaseHandle : FwpmEngineClose() [status: %#x]\n", + status); + + HLPR_BAIL; + } + + *pEngineHandle = 0; + } + + HLPR_BAIL_LABEL: + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmSessionReleaseHandle() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpmSessionDestroyEngineHandle + + Purpose: Close an open handle to BFE and set the handle to 0. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: <br> +*/ +_At_(*ppEngineHandle, _Pre_ _Notnull_) +_At_(*ppEngineHandle, _Post_ _Null_) +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +_Success_(*ppEngineHandle == 0) +VOID KrnlHlprFwpmSessionDestroyEngineHandle(_Inout_ HANDLE** ppEngineHandle) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmSessionDestroyEngineHandle()\n"); + +#endif /// DBG + + NT_ASSERT(ppEngineHandle); + + if(*ppEngineHandle) + KrnlHlprFwpmSessionReleaseHandle(*ppEngineHandle); + + *ppEngineHandle = 0; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmSessionDestroyEngineHandle()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpmSessionAcquireHandle + + Purpose: Open a handle to BFE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF550083.aspx <br> + HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF550075.aspx <br> +*/ +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpmSessionAcquireHandle(_Inout_ HANDLE* pEngineHandle, + _In_ const GUID* pSessionKey) /* WFPSAMPLER_SESSION_KM */ +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmSessionAcquireHandle()\n"); + +#endif /// DBG + + NT_ASSERT(pEngineHandle); + NT_ASSERT(pSessionKey); + + NTSTATUS status = STATUS_SUCCESS; + FWPM_SESSION session = {0}; + + session.sessionKey = *pSessionKey; + session.displayData.name = L"Microsoft Corporation - WFPSampler's Session"; + session.displayData.description = L"Session created by WFPSampler"; + + status = FwpmEngineOpen(0, + RPC_C_AUTHN_WINNT, + 0, + &session, + pEngineHandle); + if(status != STATUS_SUCCESS || + *pEngineHandle == 0) + { + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_ERROR_LEVEL, + " !!!! KrnlHlprFwpmSessionAcquireHandle : FwpmEngineOpen() [status: %#x][*pEngineHandle: %#p]\n", + status, + *pEngineHandle); + + *pEngineHandle = 0; + } + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmSessionAcquireHandle() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpmSessionCreateEngineHandle + + Purpose: Open a handle to BFE. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: <br> +*/ +_When_(return != STATUS_SUCCESS, _At_(*ppEngineHandle, _Post_ _Null_)) +_When_(return == STATUS_SUCCESS, _At_(*ppEngineHandle, _Post_ _Notnull_)) +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpmSessionCreateEngineHandle(_Outptr_ HANDLE** ppEngineHandle, + _In_ const GUID* pSessionKey) /* WFPSAMPLER_SESSION_KM */ +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpmSessionCreateEngineHandle()\n"); + +#endif /// DBG + + NT_ASSERT(ppEngineHandle); + NT_ASSERT(pSessionKey); + + NTSTATUS status = STATUS_SUCCESS; + + *ppEngineHandle = 0; + + status = KrnlHlprFwpmSessionAcquireHandle(&g_EngineHandle, + pSessionKey); + HLPR_BAIL_ON_FAILURE(status); + + *ppEngineHandle = &g_EngineHandle; + + HLPR_BAIL_LABEL: + + if(status != STATUS_SUCCESS) + KrnlHlprFwpmSessionReleaseHandle(&g_EngineHandle); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpmSessionCreateEngineHandle() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +#endif /// FWPS_SESSION____ + +#ifndef FwpsInjection____ +#define FwpsInjection____ + +/** + @kernel_helper_function="KrnlHlprFwpsInjectionReleaseHandle + + Purpose: Destroy an opened injection handle and set it to 0. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551181.aspx <br> +*/ +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsInjectionReleaseHandle(_In_ HANDLE* pInjectionHandle) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsInjectionReleaseHandle()\n"); + +#endif /// DBG + + NT_ASSERT(pInjectionHandle); + + NTSTATUS status = STATUS_SUCCESS; + + status = FwpsInjectionHandleDestroy(*pInjectionHandle); + if(status != STATUS_SUCCESS) + { + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_ERROR_LEVEL, + " !!!! KrnlHlprFwpsInjectionReleaseHandle : FwpsInjectionHandleDestroy() [status: %#x]\n", + status); + + HLPR_BAIL; + } + + *pInjectionHandle = 0; + + HLPR_BAIL_LABEL: + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsInjectionReleaseHandle() {status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +/** + @kernel_helper_function="KrnlHlprFwpsInjectionAcquireHandle + + Purpose: Open injection handle for use with the various injection APIs. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/FF551180.aspx <br> +*/ +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsInjectionAcquireHandle(_Inout_ HANDLE* pInjectionHandle, + _In_ ADDRESS_FAMILY addressFamily, /* AF_UNSPEC */ + _In_ UINT32 injectionType) /* 0 */ +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsInjectionAcquireHandle()\n"); + +#endif /// DBG + + NT_ASSERT(pInjectionHandle); + + NTSTATUS status = STATUS_SUCCESS; + + status = FwpsInjectionHandleCreate(addressFamily, + injectionType, + pInjectionHandle); + if(status != STATUS_SUCCESS) + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_ERROR_LEVEL, + " !!!! KrnlHlprFwpsInjectionAcquireHandle : FwpsInjectionHandleCreate() [status: %#x]\n", + status); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsInjectionAcquireHandle() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +#endif /// FwpsInjection____ + +#if(NTDDI_VERSION >= NTDDI_WIN8) + +#ifndef FwpsRedirection____ +#define FwpsRedirection____ + +/** + @kernel_helper_function="KrnlHlprFwpsRedirectHandleDestroy + + Purpose: Destroy an opened redirection handle and set it to 0. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/HH439684.aspx <br> +*/ +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +VOID KrnlHlprFwpsRedirectHandleDestroy(_In_ HANDLE* pRedirectionHandle) +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsRedirectHandleDestroy()\n"); + +#endif /// DBG + + NT_ASSERT(pRedirectionHandle); + + FwpsRedirectHandleDestroy(*pRedirectionHandle); + + *pRedirectionHandle = 0; + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsRedirectHandleDestroy()\n"); + +#endif /// DBG + + return; +} + +/** + @kernel_helper_function="KrnlHlprFwpsRedirectHandleCreate + + Purpose: Open redirection handle for use with the various redirection APIs. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: HTTP://MSDN.Microsoft.com/En-US/Library/Windows/Hardware/HH439681.aspx <br> +*/ +_IRQL_requires_(PASSIVE_LEVEL) +_IRQL_requires_same_ +_Check_return_ +_Success_(return == STATUS_SUCCESS) +NTSTATUS KrnlHlprFwpsRedirectHandleCreate(_Inout_ HANDLE* pRedirectionHandle) /* 0 */ +{ +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " ---> KrnlHlprFwpsRedirectHandleCreate()\n"); + +#endif /// DBG + + NT_ASSERT(pRedirectionHandle); + + NTSTATUS status = STATUS_SUCCESS; + + status = FwpsRedirectHandleCreate(&WFPSAMPLER_PROVIDER, + 0, + pRedirectionHandle); + if(status != STATUS_SUCCESS) + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_ERROR_LEVEL, + " !!!! KrnlHlprFwpsRedirectHandleCreate : FwpsRedirectHandleCreate() [status: %#x]\n", + status); + +#if DBG + + DbgPrintEx(DPFLTR_IHVNETWORK_ID, + DPFLTR_INFO_LEVEL, + " <--- KrnlHlprFwpsRedirectHandleCreate() [status: %#x]\n", + status); + +#endif /// DBG + + return status; +} + +#endif /// FwpsRedirection____ + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + +#ifndef FwpsLayer____ +#define FwpsLayer____ + +/** + @helper function="KrnlHlprFwpsLayerGetDirection" + + Purpose: Determine the direction of the NBL based on the layer. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +FWP_DIRECTION KrnlHlprFwpsLayerGetDirection(_In_ UINT32 layerID) +{ + FWP_DIRECTION direction = FWP_DIRECTION_MAX; + + if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V4 || + layerID == FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_IPPACKET_V6 || + layerID == FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V4 || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V6 || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V4 || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V6 || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4 || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6 || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + || + layerID == FWPS_LAYER_INBOUND_MAC_FRAME_ETHERNET || + layerID == FWPS_LAYER_INBOUND_MAC_FRAME_NATIVE + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + ) + direction = FWP_DIRECTION_INBOUND; + else if(layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V4 || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V6 || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V4 || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V6 || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4 || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6 || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V4 || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V6 || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + || + layerID == FWPS_LAYER_OUTBOUND_MAC_FRAME_ETHERNET || + layerID == FWPS_LAYER_OUTBOUND_MAC_FRAME_NATIVE + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) + + ) + direction = FWP_DIRECTION_OUTBOUND; + + return direction; +} + +/** + @helper function="KrnlHlprFwpsLayerIsIPv4" + + Purpose: Determine if the layer is an IPv4 layer. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +BOOLEAN KrnlHlprFwpsLayerIsIPv4(_In_ UINT32 layerID) +{ + BOOLEAN isIPv4 = FALSE; + + if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V4 || + layerID == FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V4 || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD || + layerID == FWPS_LAYER_IPFORWARD_V4 || + layerID == FWPS_LAYER_IPFORWARD_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V4 || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V4 || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD || + layerID == FWPS_LAYER_STREAM_V4 || + layerID == FWPS_LAYER_STREAM_V4_DISCARD || + layerID == FWPS_LAYER_DATAGRAM_DATA_V4 || + layerID == FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V4 || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4 || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD || + layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 || + layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V4 || + layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V4 || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4 || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4 || + layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD || + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + layerID == FWPS_LAYER_NAME_RESOLUTION_CACHE_V4 || + layerID == FWPS_LAYER_ALE_RESOURCE_RELEASE_V4 || + layerID == FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V4 || + layerID == FWPS_LAYER_ALE_CONNECT_REDIRECT_V4 || + layerID == FWPS_LAYER_ALE_BIND_REDIRECT_V4 || + layerID == FWPS_LAYER_STREAM_PACKET_V4 || + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + layerID == FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V4 || + layerID == FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V4 || + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + layerID == FWPS_LAYER_IPSEC_KM_DEMUX_V4 || + layerID == FWPS_LAYER_IPSEC_V4 || + layerID == FWPS_LAYER_IKEEXT_V4) + isIPv4 = TRUE; + + return isIPv4; +} + +/** + @helper function="KrnlHlprFwpsLayerIsIPv6" + + Purpose: Determine if the layer is an IPv6 layer. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +BOOLEAN KrnlHlprFwpsLayerIsIPv6(_In_ UINT32 layerID) +{ + BOOLEAN isIPv6 = FALSE; + + if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V6 || + layerID == FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V6 || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD || + layerID == FWPS_LAYER_IPFORWARD_V6 || + layerID == FWPS_LAYER_IPFORWARD_V6_DISCARD || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V6 || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V6 || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD || + layerID == FWPS_LAYER_STREAM_V6 || + layerID == FWPS_LAYER_STREAM_V6_DISCARD || + layerID == FWPS_LAYER_DATAGRAM_DATA_V6 || + layerID == FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V6 || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6 || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD || + layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 || + layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V6 || + layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V6 || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6 || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD || + layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6 || + layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD || + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + layerID == FWPS_LAYER_NAME_RESOLUTION_CACHE_V6 || + layerID == FWPS_LAYER_ALE_RESOURCE_RELEASE_V6 || + layerID == FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V6 || + layerID == FWPS_LAYER_ALE_CONNECT_REDIRECT_V6 || + layerID == FWPS_LAYER_ALE_BIND_REDIRECT_V6 || + layerID == FWPS_LAYER_STREAM_PACKET_V6 || + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + layerID == FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V6 || + layerID == FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V6 || + +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + layerID == FWPS_LAYER_IPSEC_KM_DEMUX_V6 || + layerID == FWPS_LAYER_IPSEC_V6 || + layerID == FWPS_LAYER_IKEEXT_V6) + isIPv6 = TRUE; + + return isIPv6; +} + +/** + @helper function="KrnlHlprFwpsLayerIsDiscard" + + Purpose: Determine if the layer is a discard layer. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +BOOLEAN KrnlHlprFwpsLayerIsDiscard(_In_ UINT32 layerID) +{ + BOOLEAN isDiscard = FALSE; + + if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD || + layerID == FWPS_LAYER_IPFORWARD_V4_DISCARD || + layerID == FWPS_LAYER_IPFORWARD_V6_DISCARD || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD || + layerID == FWPS_LAYER_STREAM_V4_DISCARD || + layerID == FWPS_LAYER_STREAM_V6_DISCARD || + layerID == FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD || + layerID == FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD || + layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD || + layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD || + layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD || + layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD || + layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD || + layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD) + isDiscard = TRUE; + + return isDiscard; +} + +/** + @helper function="KrnlHlprFwpsLayerIDToString" + + Purpose: Return a string representation of the supplied layer. <br> + <br> + Notes: <br> + <br> + MSDN_Ref: <br> +*/ +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +_IRQL_requires_same_ +_Success_(return != 0) +PSTR KrnlHlprFwpsLayerIDToString(_In_ UINT32 layerID) +{ + PSTR pLayerString = 0; + + if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V4) + pLayerString = "FWPS_LAYER_INBOUND_IPPACKET_V4"; + else if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD) + pLayerString = "FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD"; + else if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V6) + pLayerString = "FWPS_LAYER_INBOUND_IPPACKET_V6"; + else if(layerID == FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD) + pLayerString = "FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD"; + else if(layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V4) + pLayerString = "FWPS_LAYER_OUTBOUND_IPPACKET_V4"; + else if(layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD) + pLayerString = "FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD"; + else if(layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V6) + pLayerString = "FWPS_LAYER_OUTBOUND_IPPACKET_V6"; + else if(layerID == FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD) + pLayerString = "FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD"; + else if(layerID == FWPS_LAYER_IPFORWARD_V4) + pLayerString = "FWPS_LAYER_IPFORWARD_V4"; + else if(layerID == FWPS_LAYER_IPFORWARD_V4_DISCARD) + pLayerString = "FWPS_LAYER_IPFORWARD_V4_DISCARD"; + else if(layerID == FWPS_LAYER_IPFORWARD_V6) + pLayerString = "FWPS_LAYER_IPFORWARD_V6"; + else if(layerID == FWPS_LAYER_IPFORWARD_V6_DISCARD) + pLayerString = "FWPS_LAYER_IPFORWARD_V6_DISCARD"; + else if(layerID == FWPS_LAYER_INBOUND_TRANSPORT_V4) + pLayerString = "FWPS_LAYER_INBOUND_TRANSPORT_V4"; + else if(layerID == FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD) + pLayerString = "FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD"; + else if(layerID == FWPS_LAYER_INBOUND_TRANSPORT_V6) + pLayerString = "FWPS_LAYER_INBOUND_TRANSPORT_V6"; + else if(layerID == FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD) + pLayerString = "FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD"; + else if(layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V4) + pLayerString = "FWPS_LAYER_OUTBOUND_TRANSPORT_V4"; + else if(layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD) + pLayerString = "FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD"; + else if(layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V6) + pLayerString = "FWPS_LAYER_OUTBOUND_TRANSPORT_V6"; + else if(layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD) + pLayerString = "FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD"; + else if(layerID == FWPS_LAYER_STREAM_V4) + pLayerString = "FWPS_LAYER_STREAM_V4"; + else if(layerID == FWPS_LAYER_STREAM_V4_DISCARD) + pLayerString = "FWPS_LAYER_STREAM_V4_DISCARD"; + else if(layerID == FWPS_LAYER_STREAM_V6) + pLayerString = "FWPS_LAYER_STREAM_V6"; + else if(layerID == FWPS_LAYER_STREAM_V6_DISCARD) + pLayerString = "FWPS_LAYER_STREAM_V6_DISCARD"; + else if(layerID == FWPS_LAYER_DATAGRAM_DATA_V4) + pLayerString = "FWPS_LAYER_DATAGRAM_DATA_V4"; + else if(layerID == FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD) + pLayerString = "FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD"; + else if(layerID == FWPS_LAYER_DATAGRAM_DATA_V6) + pLayerString = "FWPS_LAYER_DATAGRAM_DATA_V6"; + else if(layerID == FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD) + pLayerString = "FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD"; + else if(layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V4) + pLayerString = "FWPS_LAYER_INBOUND_ICMP_ERROR_V4"; + else if(layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD) + pLayerString = "FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD"; + else if(layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V6) + pLayerString = "FWPS_LAYER_INBOUND_ICMP_ERROR_V6"; + else if(layerID == FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD) + pLayerString = "FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD"; + else if(layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4) + pLayerString = "FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4"; + else if(layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD) + pLayerString = "FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD"; + else if(layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6) + pLayerString = "FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6"; + else if(layerID == FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD) + pLayerString = "FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4) + pLayerString = "FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4"; + else if(layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD) + pLayerString = "FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6) + pLayerString = "FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6"; + else if(layerID == FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD) + pLayerString = "FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V4) + pLayerString = "FWPS_LAYER_ALE_AUTH_LISTEN_V4"; + else if(layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD) + pLayerString = "FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V6) + pLayerString = "FWPS_LAYER_ALE_AUTH_LISTEN_V6"; + else if(layerID == FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD) + pLayerString = "FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4) + pLayerString = "FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4"; + else if(layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD) + pLayerString = "FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6) + pLayerString = "FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6"; + else if(layerID == FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD) + pLayerString = "FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V4) + pLayerString = "FWPS_LAYER_ALE_AUTH_CONNECT_V4"; + else if(layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD) + pLayerString = "FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V6) + pLayerString = "FWPS_LAYER_ALE_AUTH_CONNECT_V6"; + else if(layerID == FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD) + pLayerString = "FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4) + pLayerString = "FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4"; + else if(layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD) + pLayerString = "FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD"; + else if(layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6) + pLayerString = "FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6"; + else if(layerID == FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD) + pLayerString = "FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD"; + +#if(NTDDI_VERSION >= NTDDI_WIN7) + + else if(layerID == FWPS_LAYER_NAME_RESOLUTION_CACHE_V4) + pLayerString = "FWPS_LAYER_NAME_RESOLUTION_CACHE_V4"; + else if(layerID == FWPS_LAYER_NAME_RESOLUTION_CACHE_V6) + pLayerString = "FWPS_LAYER_NAME_RESOLUTION_CACHE_V6"; + else if(layerID == FWPS_LAYER_ALE_RESOURCE_RELEASE_V4) + pLayerString = "FWPS_LAYER_ALE_RESOURCE_RELEASE_V4"; + else if(layerID == FWPS_LAYER_ALE_RESOURCE_RELEASE_V6) + pLayerString = "FWPS_LAYER_ALE_RESOURCE_RELEASE_V6"; + else if(layerID == FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V4) + pLayerString = "FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V4"; + else if(layerID == FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V6) + pLayerString = "FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V6"; + else if(layerID == FWPS_LAYER_ALE_CONNECT_REDIRECT_V4) + pLayerString = "FWPS_LAYER_ALE_CONNECT_REDIRECT_V4"; + else if(layerID == FWPS_LAYER_ALE_CONNECT_REDIRECT_V6) + pLayerString = "FWPS_LAYER_ALE_CONNECT_REDIRECT_V6"; + else if(layerID == FWPS_LAYER_ALE_BIND_REDIRECT_V4) + pLayerString = "FWPS_LAYER_ALE_BIND_REDIRECT_V4"; + else if(layerID == FWPS_LAYER_ALE_BIND_REDIRECT_V6) + pLayerString = "FWPS_LAYER_ALE_BIND_REDIRECT_V6"; + else if(layerID == FWPS_LAYER_STREAM_PACKET_V4) + pLayerString = "FWPS_LAYER_STREAM_PACKET_V4"; + else if(layerID == FWPS_LAYER_STREAM_PACKET_V6) + pLayerString = "FWPS_LAYER_STREAM_PACKET_V6"; + +#if(NTDDI_VERSION >= NTDDI_WIN8) + + else if(layerID == FWPS_LAYER_INBOUND_MAC_FRAME_ETHERNET) + pLayerString = "FWPS_LAYER_INBOUND_MAC_FRAME_ETHERNET"; + else if(layerID == FWPS_LAYER_OUTBOUND_MAC_FRAME_ETHERNET) + pLayerString = "FWPS_LAYER_OUTBOUND_MAC_FRAME_ETHERNET"; + else if(layerID == FWPS_LAYER_INBOUND_MAC_FRAME_NATIVE) + pLayerString = "FWPS_LAYER_INBOUND_MAC_FRAME_NATIVE"; + else if(layerID == FWPS_LAYER_OUTBOUND_MAC_FRAME_NATIVE) + pLayerString = "FWPS_LAYER_OUTBOUND_MAC_FRAME_NATIVE"; + else if(layerID == FWPS_LAYER_INGRESS_VSWITCH_ETHERNET) + pLayerString = "FWPS_LAYER_INGRESS_VSWITCH_ETHERNET"; + else if(layerID == FWPS_LAYER_EGRESS_VSWITCH_ETHERNET) + pLayerString = "FWPS_LAYER_EGRESS_VSWITCH_ETHERNET"; + else if(layerID == FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V4) + pLayerString = "FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V4"; + else if(layerID == FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V6) + pLayerString = "FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V6"; + else if(layerID == FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V4) + pLayerString = "FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V4"; + else if(layerID == FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V6) + pLayerString = "FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V6"; + +#if(NTDDI_VERSION >= NTDDI_WINBLUE) + + else if(layerID == FWPS_LAYER_INBOUND_TRANSPORT_FAST) + pLayerString = "FWPS_LAYER_INBOUND_TRANSPORT_FAST"; + else if(layerID == FWPS_LAYER_OUTBOUND_TRANSPORT_FAST) + pLayerString = "FWPS_LAYER_OUTBOUND_TRANSPORT_FAST"; + else if(layerID == FWPS_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST) + pLayerString = "FWPS_LAYER_INBOUND_MAC_FRAME_NATIVE_FAST"; + else if(layerID == FWPS_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST) + pLayerString = "FWPS_LAYER_OUTBOUND_MAC_FRAME_NATIVE_FAST"; + +#endif /// (NTDDI_VERSION >= NTDDI_WINBLUE) +#endif /// (NTDDI_VERSION >= NTDDI_WIN8) +#endif /// (NTDDI_VERSION >= NTDDI_WIN7) + + return pLayerString; +} + +#endif /// FwpsLayer____ |