3.1.4.13 RRPC_FWAddConnectionSecurityRule (Opnum 12)

  • Article

The RRPC_FWAddConnectionSecurityRule method requests the server to add the connection security rule in the policy contained in the policy store that is referenced by the specified opened policy store handle.

 ULONG RRPC_FWAddConnectionSecurityRule(
   [in] FW_CONN_HANDLE rpcConnHandle,
   [in] FW_POLICY_STORE_HANDLE hPolicy,
   [in] PFW_CS_RULE2_0 pRule
 );

rpcConnHandle: This parameter is an RPC binding handle that connects to the RPC interface of the Firewall and Advanced Security Protocol.

hPolicy: This input parameter is an FW_POLICY_STORE_HANDLE data type. The data type MUST contain an opened policy store handle that is successfully opened by using the RRPC_FWOpenPolicyStore (Opnum 0) method. The handle MUST have read/write access rights.

pRule: This parameter represents the connection security rule that the client wants to add to the store. The rule MUST be a valid rule, as specified in the definition of the FW_CS_RULE2_0 data type.

Return Values: This method returns 0 if successful; if it fails, it returns a nonzero error code. The field can take any specific error code value, as specified in [MS-ERREF]. The following return values are common.

Return value/code

Description

0x000000B7

ERROR_ALREADY_EXISTS

The specified rule has a rule ID that already exists in the specified store.

0x00000032

ERROR_NOT_SUPPORTED

The specified store does not support this method; the store might be read-only.

0x00000005

ERROR_ACCESS_DENIED

The hPolicy handle was not opened with read/write access rights. The error is also returned if the client does not have the required credentials to call the method.

0x00000057

ERROR_INVALID_PARAMETER

A parameter of this method is incorrect, or is required and not specified. This error can be returned because:

  • The pRule object did not pass the connection security rule validations specified in the definition of the FW_CS_RULE data type.

  • The rule has a phase 2 crypto set that specified FW_CRYPTO_PRPTOCOL_AUTH_NO_ENCAP (see section 2.2.69), and it is a tunnel mode rule, or it also has an AuthSet structure (section 2.2.65) that specifies a preshared key auth method.

  • A required value is not specified.

Exceptions Thrown: No exceptions are thrown except those that are thrown by the underlying RPC protocol, as specified in [MS-RPCE]. If any lower-layer errors are reported by RPC exception, this exception is converted to an error code and reported to higher-layer protocols via the return value.

This method adds a connection security rule in the connection security link list of the memory representation of the store being modified. It also writes through and saves the rule to disk. If called on an online store, the connection security rule is also enforced.

The server MUST validate that the client is authorized to perform the requested operation (as defined in section 3.1.4) before executing this method.