IFWXIOCompletion::CompleteAsyncIO method

Applies to: desktop apps only

The CompleteAsyncIO method receives a notification from the Microsoft Firewall service when an asynchronous I/O operation that was initiated on an IFWXSocket interface completes.

The CompleteAsyncIO method is where you should implement the logic of your filter, based on the protocol in which you are working.


HRESULT CompleteAsyncIO(
  [in]  BOOL fSuccess,
  [in]  DWORD Win32ErrorCode,
  [in]  IFWXIOBuffer *pIOBuffer,
  [in]  UserContextType UserData,
  [in]  LPSOCKADDR ExternalAddress,
  [in]  INT ExternalAddressLength


  • fSuccess [in]
    Success flag. If TRUE, the I/O operation succeeded. If FALSE, it failed.

  • Win32ErrorCode [in]
    Windows error code. This parameter is defined only if the fSuccess parameter is FALSE.

  • pIOBuffer [in]
    Pointer to the IFWXIOBuffer interface for the data buffer, if this is a completion for a receive method.

  • UserData [in]
    The UserData parameter that was passed to the I/O method.

  • ExternalAddress [in]
    Pointer to a sockaddr structure that contains the address of the external source or external destination of a UDP packet. This parameter is passed only for the IFWXSocket::Recv method on a UDP socket. The ExternalAddress parameter is NULL for TCP sockets.

    The address is the source when receiving from an external socket, and the target when receiving from an internal socket.

    Note that IP packets on the Internet can be made to appear as though they are authorized when they are not. Therefore, do not rely on this address for authentication.

  • ExternalAddressLength [in]
    Length, in bytes, of the ExternalAddress parameter.

Return value

Implementations of this method should return S_OK if the call is successful; otherwise, they should return an error code.


Completion of a send or sendto operation indicates only that the next filter in the chain of filters received the buffer and began processing it. The buffer cannot be recycled at this point.

The UserData parameter provides a context to the notification. You can use the same notification interface for completion notifications from distinct network socket objects and differentiate between them by using different values for the UserData parameter.


The following example implementation of the IFWXIOCompletion::CompleteAsyncIO method is taken from the Exeblock sample filter.

    IN BOOL         fSuccess,
    IN DWORD        Win32ErrorCode,
    IN IFWXIOBuffer *pIOBuffer,
    IN DWORD        dwUserData,
    IN PSOCKADDR    From,
    IN INT          FromLen
    DWORD DataLength = 0;
    HRESULT hr;
    PBYTE pbBuffer = NULL;
    if (pIOBuffer) 
        pIOBuffer->GetBufferAndSize(&pbBuffer, &DataLength);
    if (UserData == 0) 
        if (!fSuccess) 
            // The _Abort method closes and releases 
            // both sockets.
            return S_OK;
        if (DataLength == 0) 
            // The _ScanFile method scans the file, blocks it if it is 
            // an executable, and sends it to the client if it is OK.
            return S_OK;
        IFWXOverlapped * pOverlapped = NULL;
        hr = m_spCallBackInterface->CreateOverlapped(&pOverlapped);
        OVERLAPPED *pov = NULL;
        if (SUCCEEDED(hr)) 
            hr = pOverlapped->GetOverlapped(&pov);
        if (SUCCEEDED(hr)) 
            hr = pOverlapped->SetNotificationInterface(this, 0);
        if (FAILED(hr)) 
            if (pOverlapped) pOverlapped->Release();
            return hr;
        pov->Offset = m_FileSize;
        m_FileSize += DataLength;
        if (!WriteFile(
            pov) && GetLastError() != ERROR_IO_PENDING) 
        if (fSuccess) 
    return S_OK;


Minimum supported client

None supported

Minimum supported server

Windows Server 2008 R2, Windows Server 2008 with SP2 (64-bit only)


Forefront Threat Management Gateway (TMG) 2010



See also




Build date: 7/12/2010