IFWXSessionFilter::FirewallEventHandler method

Article
08/27/2012

Applies to: desktop apps only

The FirewallEventHandler method notifies the filter that the Microsoft Firewall service detected an event related to the user session to which the session filter is attached.

Syntax

HRESULT FirewallEventHandler(
  [in]  const FirewallEvent *pFirewallEvent
);

Parameters

pFirewallEvent [in]
Pointer to a FwxFirewallEvent structure that describes the event for which this method is called and that receives information about the event. For more information, see the documentation for each event type.

Return value

Implementations of this method should return S_OK if the call is successful; otherwise, they should return an error code.

Remarks

This method is called by the Firewall service when an event occurs for which the filter is registered after the user session has been attached to an instance of the filter's session filter object. The implementation of this method should select the appropriate action for each event based on the value of the EventType member of the FwxFirewallEvent structure provided by the Firewall service.

For an event of the fwx_AcceptedConnection, fwx_Bind_Udp, fwx_Connect_Tcp, or fwx_Udp_Destination type, the implementation of this method can create an instance of the filter's data filter object, obtain a pointer to the applicable IFWXConnection interface from the FwxFirewallEvent structure provided in the pFirewallEvent parameter, and then call the AttachDataFilter method on this interface to attach the data filter to it. The Firewall service responds by providing two sockets that implement the IFWXSocket interface in a call to the IFWXDataFilter::SetSockets method, and the filter can start pumping data and filtering for the specific connection.

Examples

The following is an example implementation of the FirewallEventHandler method.

HRESULT STDMETHODCALLTYPE CMySessionFilter::FwxFirewallEventHandler(
                          FirewallEvent *pEvent)
{
    switch (pEvent->EventType) {
    case fwx_Connect_Tcp:
        // Handle connect event.
    case fwx_Accept:
        // Handle accept event
....
    default:
        return E_NOTIMPL;
}

Requirements

Minimum supported client	None supported
Minimum supported server	Windows Server 2008 R2, Windows Server 2008 with SP2 (64-bit only)
Version	Forefront Threat Management Gateway (TMG) 2010
Header	Wspfwext.idl