FWPS_CALLOUT_CLASSIFY_FN3 - NtDoc
Native API online documentation, based on the System Informer
(formerly Process Hacker) phnt
headers
// fwpsk.h
FWPS_CALLOUT_CLASSIFY_FN3 FwpsCalloutClassifyFn3;
void FwpsCalloutClassifyFn3(
const FWPS_INCOMING_VALUES0 *inFixedValues,
const FWPS_INCOMING_METADATA_VALUES0 *inMetaValues,
void *layerData,
const void *classifyContext,
const FWPS_FILTER3 *filter,
UINT64 flowContext,
FWPS_CLASSIFY_OUT0 *classifyOut
)
{...}
View the official Windows Driver Kit DDI referenceNo description available.
Version 3 of the callback function invoked during classification when a callout filter matches. The difference being that this callback returns an FWPS_FILTER3 structure.
inFixedValuesA pointer to an FWPS_INCOMING_VALUES0 structure. This structure contains the values for each of the data fields at the layer being filtered.
inMetaValuesA pointer to an FWPS_INCOMING_METADATA_VALUES0 structure. This structure contains the values for each of the metadata fields at the layer being filtered.
layerDataA pointer to a structure that describes the raw data at the layer being filtered. This parameter might be NULL, depending on the layer being filtered and the conditions under which the classifyFn3 callout function is called. For the stream layer, this parameter points to an FWPS_STREAM_CALLOUT_IO_PACKET0 structure. For all of the other layers, this parameter points to a NET_BUFFER_LIST structure if it is not NULL.
classifyContextA pointer to context data associated with the callout driver by the filter engine.
filterA pointer to an FWPS_FILTER3 structure. This structure describes the filter that specifies the callout for the filter's action.
flowContextA UINT64-typed variable that contains the context associated with the data flow. If no context is associated with the data flow, then this parameter is zero. If the callout is added to the filter engine at a filtering layer that does not support data flows, the classifyFn3 callout function should ignore this parameter.
classifyOutA pointer to an FWPS_CLASSIFY_OUT0 structure that receives any data that the classifyFn3 callout function returns to the caller.
A callout driver registers a callout's callout functions with the filter engine by calling the FwpsCalloutRegister2 function.
The filter engine calls a callout's classifyFn3 callout function with data to be processed whenever all of the test conditions are true for a filter in the filter engine that specifies the callout for the filter's action.
A callout's classifyFn1 callout function should clear the FWPS_RIGHT_ACTION_WRITE flag in the rights member of the FWPS_CLASSIFY_OUT0 structure in any of the following situations: