I have a question regarding the subject.
It's a very common task to delay decision on a WFP callout, such as Connect.
WFP provides the FwpsPend/CompleteOperation() for that purpose, but the design is very weird, to say the least.
First, there's no provision for even a single void* context to pass to the callout being completed.
Second, which is even stranger, there's no convenient way to associate the call to FwpsCompleteOperation() with the callout!
The Inspect sample uses the address 4-tuple for that purpose, but it has obvious deficiencies.
One example is a raw socket - which addresses does one use for it?
I never understood how such obvious things could be overlooked, especially when there exists a straightforward mechanism to pend/complete an IRP in the case of the general I/O manager (and the obsolete TDI interface, for that matter).
I noticed there exist the FwpsPend/CompleteClassify() alternative, which looks much better, but it seems to be limited to very specific layers, which defeats its purpose for me.
Thanks in advance,