Expand Minimize

FwpsAcquireWritableLayerDataPointer0 function

The FwpsAcquireWritableLayerDataPointer0 function returns layer-specific data that can be inspected and changed.

Note  FwpsAcquireWritableLayerDataPointer0 is a specific version of FwpsAcquireWritableLayerDataPointer. See WFP Version-Independent Names and Targeting Specific Versions of Windows for more information.

Syntax


NTSTATUS NTAPI FwpsAcquireWritableLayerDataPointer0(
  _In_     UINT64 classifyHandle,
  _In_     UINT64 filterId,
  _In_     UINT32 flags,
  _Out_    PVOID *writableLayerData,
  _Inout_  FWPS_CLASSIFY_OUT0 *classifyOut
);

Parameters

classifyHandle [in]

A handle for the classify request. This handle is obtained by calling FwpsAcquireClassifyHandle0.

filterId [in]

The value of the FilterId member of the classifyFn function's filter parameter. For more information about the FilterId member, see FWPS_FILTER1.

flags [in]

Reserved for future use. Set to zero.

writableLayerData [out]

A data buffer that contains the modifiable data for the layer. The supported data types, which are listed in the following Remarks section, are defined as structures. On return, the data can be accessed by casting the void pointer to the appropriate structure type.

classifyOut [in, out]

Set to the classifyOut parameter of the callout driver's classifyFn function. The classifyOut parameter of classifyFn is listed as an output parameter in the header, but it contains enough information on input to be useful to the engine when passed to FwpsAcquireWritableLayerDataPointer0.

Return value

The FwpsAcquireWritableLayerDataPointer0 function returns one of the following NTSTATUS codes.

Return codeDescription
STATUS_SUCCESS

The callback function was successfully registered.

Other status codes

An error occurred.

 

Remarks

FwpsAcquireWritableLayerDataPointer0 sets the following members of the FWPS_CLASSIFY_OUT0 structure:

  • classifyOut->actionType = FWP_ACTION_BLOCK
  • classifyOut->rights = ~FWPS_RIGHT_ACTION_WRITE

For every call to this function, you must make a matching call to FwpsApplyModifiedLayerData0 to finalize the changes that were made, even if your callout driver didn't modify any data. If you do not make the call to FwpsApplyModifiedLayerData0, this could result in the classify not completing correctly.

The following structures are defined to contain modifiable layer data. The pointer set on output as the writableLayerData parameter can be cast to one of these types:

Requirements

Version

Available starting with Windows 7.

Header

Fwpsk.h (include Fwpsk.h)

IRQL

<= DISPATCH_LEVEL

See also

classifyFn
FWPS_BIND_REQUEST0
FWPS_CLASSIFY_OUT0
FWPS_CONNECT_REQUEST0
FWPS_FILTER1
FwpsAcquireClassifyHandle0
FwpsApplyModifiedLayerData0
FwpsReleaseClassifyHandle0

 

 

Send comments about this topic to Microsoft

Show:
© 2015 Microsoft