void
StreamEditUnregisterCallout(void)
{
FwpmEngineClose(gEngineHandle);
gEngineHandle = NULL;
FwpsCalloutUnregisterById(gCalloutIdV6);
FwpsCalloutUnregisterById(gCalloutIdV4);
}
NTSTATUS WallUnRegisterCallouts()
{
if( gEngineHandle != 0 )
{
//删除FilterId
FwpmFilterDeleteById( gEngineHandle,gAleConnectFilterId );
//删除CalloutId
FwpmCalloutDeleteById( gEngineHandle,gAleConnectCalloutId );
//清空FilterId
gAleConnectFilterId = 0;
//反注册CalloutId
FwpsCalloutUnregisterById( gAleConnectCalloutId );
//清空CalloutId
gAleConnectCalloutId = 0;
//关闭引擎
FwpmEngineClose( gEngineHandle );
gEngineHandle = 0;
}
return STATUS_SUCCESS;
}
NTSTATUS RegisterCalloutForLayer
(
IN const GUID* layerKey,
IN const GUID* calloutKey,
IN FWPS_CALLOUT_CLASSIFY_FN classifyFn,
IN FWPS_CALLOUT_NOTIFY_FN notifyFn,
IN FWPS_CALLOUT_FLOW_DELETE_NOTIFY_FN flowDeleteNotifyFn,
OUT UINT32* calloutId,
OUT UINT64* filterId
)
{
NTSTATUS status = STATUS_SUCCESS;
FWPS_CALLOUT sCallout = {0};
FWPM_FILTER mFilter = {0};
FWPM_FILTER_CONDITION mFilter_condition[1] = {0};
FWPM_CALLOUT mCallout = {0};
FWPM_DISPLAY_DATA mDispData = {0};
BOOLEAN bCalloutRegistered = FALSE;
sCallout.calloutKey = *calloutKey;
sCallout.classifyFn = classifyFn;
sCallout.flowDeleteFn = flowDeleteNotifyFn;
sCallout.notifyFn = notifyFn;
//要使用哪个设备对象注册
status = FwpsCalloutRegister( gDevObj,&sCallout,calloutId );
if( !NT_SUCCESS(status))
goto exit;
bCalloutRegistered = TRUE;
mDispData.name = L"WFP TEST";
mDispData.description = L"TESLA.ANGELA's WFP TEST";
//你感兴趣的内容
mCallout.applicableLayer = *layerKey;
//你感兴趣的内容的GUID
mCallout.calloutKey = *calloutKey;
mCallout.displayData = mDispData;
//添加回调函数
status = FwpmCalloutAdd( gEngineHandle,&mCallout,NULL,NULL);
if( !NT_SUCCESS(status))
goto exit;
mFilter.action.calloutKey = *calloutKey;
//在callout里决定
mFilter.action.type = FWP_ACTION_CALLOUT_TERMINATING;
mFilter.displayData.name = L"WFP TEST";
mFilter.displayData.description = L"TESLA.ANGELA's WFP TEST";
mFilter.layerKey = *layerKey;
mFilter.numFilterConditions = 0;
mFilter.filterCondition = mFilter_condition;
mFilter.subLayerKey = FWPM_SUBLAYER_UNIVERSAL;
mFilter.weight.type = FWP_EMPTY;
//添加过滤器
status = FwpmFilterAdd( gEngineHandle,&mFilter,NULL,filterId );
if( !NT_SUCCESS( status))
goto exit;
exit:
if( !NT_SUCCESS(status))
{
if( bCalloutRegistered )
{
FwpsCalloutUnregisterById( *calloutId );
}
}
return status;
}
NTSTATUS
RegisterCalloutForLayer(
const GUID* layerKey,
const GUID* calloutKey,
_Inout_ void* deviceObject,
_Out_ UINT32* calloutId
)
/* ++
This function registers callouts and filters that intercept TCP
traffic at WFP FWPM_LAYER_STREAM_V4 or FWPM_LAYER_STREAM_V6 layer.
-- */
{
NTSTATUS status = STATUS_SUCCESS;
FWPS_CALLOUT sCallout = {0};
FWPM_FILTER filter = {0};
FWPM_FILTER_CONDITION filterConditions[1] = {0};
FWPM_CALLOUT mCallout = {0};
FWPM_DISPLAY_DATA displayData = {0};
BOOLEAN calloutRegistered = FALSE;
sCallout.calloutKey = *calloutKey;
sCallout.classifyFn = (configEditInline ? StreamInlineEditClassify :
StreamOobEditClassify);
sCallout.notifyFn = StreamEditNotify;
status = FwpsCalloutRegister(
deviceObject,
&sCallout,
calloutId
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
calloutRegistered = TRUE;
displayData.name = L"Stream Edit Callout";
displayData.description = L"Callout that finds and replaces a token from a TCP stream";
mCallout.calloutKey = *calloutKey;
mCallout.displayData = displayData;
mCallout.applicableLayer = *layerKey;
status = FwpmCalloutAdd(
gEngineHandle,
&mCallout,
NULL,
NULL
);
if (!NT_SUCCESS(status))
{
goto Exit;
}
filter.layerKey = *layerKey;
filter.displayData.name = L"Stream Edit Filter";
filter.displayData.description = L"Filter that finds and replaces a token from a TCP stream";
filter.action.type = FWP_ACTION_CALLOUT_TERMINATING;
filter.action.calloutKey = *calloutKey;
filter.filterCondition = filterConditions;
filter.numFilterConditions = 1;
filter.subLayerKey = FWPM_SUBLAYER_UNIVERSAL;
filter.weight.type = FWP_EMPTY; // auto-weight.
filterConditions[0].fieldKey = (configInspectionOutbound ? FWPM_CONDITION_IP_REMOTE_PORT :
FWPM_CONDITION_IP_LOCAL_PORT);
filterConditions[0].matchType = FWP_MATCH_EQUAL;
filterConditions[0].conditionValue.type = FWP_UINT16;
filterConditions[0].conditionValue.uint16 = configInspectionPort;
status = FwpmFilterAdd(
gEngineHandle,
&filter,
NULL,
NULL);
if (!NT_SUCCESS(status))
{
goto Exit;
}
Exit:
if (!NT_SUCCESS(status))
{
if (calloutRegistered)
{
FwpsCalloutUnregisterById(*calloutId);
}
}
return status;
}
