FWPS_CALLOUT_CLASSIFY_FN2 callback function

The filter engine calls a callout's classifyFn2 callout function whenever there is data to be processed by the callout.

Note  classifyFn2 is the specific version of classifyFn used in Windows 8 and later. See WFP Version-Independent Names and Targeting Specific Versions of Windows for more information. For Windows 7, classifyFn1 is available. For Windows Vista, classifyFn0 is available.

 

Syntax

FWPS_CALLOUT_CLASSIFY_FN2 FwpsCalloutClassifyFn2;

void FwpsCalloutClassifyFn2(
  const FWPS_INCOMING_VALUES0 *inFixedValues,
  const FWPS_INCOMING_METADATA_VALUES0 *inMetaValues,
  void *layerData,
  const void *classifyContext,
  const FWPS_FILTER2 *filter,
  UINT64 flowContext,
  FWPS_CLASSIFY_OUT0 *classifyOut
)
{...}

Parameters

inFixedValues

inMetaValues

layerData

classifyContext

filter

flowContext

A UINT64-typed variable that contains the context associated with the data flow. If no context is associated with the data flow, then this parameter is zero. If the callout is added to the filter engine at a filtering layer that does not support data flows, the classifyFn2 callout function should ignore this parameter.

classifyOut

Return Value

None

Remarks

A callout driver registers a callout's callout functions with the filter engine by calling the FwpsCalloutRegister2 function.

The filter engine calls a callout's classifyFn2 callout function with data to be processed whenever all of the test conditions are true for a filter in the filter engine that specifies the callout for the filter's action.

A callout's classifyFn2 callout function should clear the FWPS_RIGHT_ACTION_WRITE flag in the rights member of the FWPS_CLASSIFY_OUT0 structure in any of the following situations:

  • When the classifyFn2 callout function sets the actionType member of the FWPS_CLASSIFY_OUT0 structure to FWP_ACTION_BLOCK.
  • When the classifyFn2 callout function sets the actionType member of the FWPS_CLASSIFY_OUT0 structure to FWP_ACTION_PERMIT and the FWPS_FILTER_FLAG_CLEAR_ACTION_RIGHT flag is set in the Flags member of the FWPS_FILTER2 structure.
  • When a callout has indicated that it intends to modify the clone net buffer list by setting the intendToModify parameter to TRUE in a call to the FwpsReferenceNetBufferList0 function.

    This function is essentially identical to the previous version, classifyFn1. However, the updated FWPS_FILTER2 structure is pointed to by the filter parameter and the layerData parameter is optional.

Requirements

   
Minimum supported client Available starting with Windows 8.
Target Platform Windows
Header fwpsk.h (include Fwpsk.h)
IRQL <= DISPATCH_LEVEL

See Also

Associating Context with a Data Flow

Callout Driver Callout Functions

Data Logging

FWPS_CLASSIFY_OUT0

FWPS_FILTER2

FWPS_INCOMING_METADATA_VALUES0

FWPS_INCOMING_VALUES0

FwpsCalloutRegister2

FwpsReferenceNetBufferList0

NET_BUFFER_LIST

Packet Modification Examples

Registering Callouts with the Filter Engine

Using a Callout for Deep Inspection of Stream Data

Using a Callout for Deep Inspection

classifyFn

classifyFn0

classifyFn1