Pending/completing WFP callout

Question

Hi,

I have a question regarding the subject.

It's a very common task to delay decision on a WFP callout, such as Connect.
WFP provides the FwpsPend/CompleteOperation() for that purpose, but the design is very weird, to say the least.
First, there's no provision for even a single void* context to pass to the callout being completed.
Second, which is even stranger, there's no convenient way to associate the call to FwpsCompleteOperation() with the callout!
The Inspect sample uses the address 4-tuple for that purpose, but it has obvious deficiencies.
One example is a raw socket - which addresses does one use for it?
I never understood how such obvious things could be overlooked, especially when there exists a straightforward mechanism to pend/complete an IRP in the case of the general I/O manager (and the obsolete TDI interface, for that matter).

I noticed there exist the FwpsPend/CompleteClassify() alternative, which looks much better, but it seems to be limited to very specific layers, which defeats its purpose for me.

Thanks in advance,
Greg

Answer 1

Hi,

Thanks for posting in Q&A platform.

Please kindly note that this forum is more focus on network connection issue and your issue is more related to WFP and Drive development, after discussed with our developer engineer, we would suggest you could post the issue in the following forum for getting more professional help:

https://learn.microsoft.com/en-us/answers/topics/windows-hardware-wdk.html

Thanks for your understanding.

Best Regards,
Sunny

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.