FwpsAcquireWritableLayerDataPointer0 function (fwpsk.h)

Article
10/21/2021

The FwpsAcquireWritableLayerDataPointer0 function returns layer-specific data that can be inspected and changed.

Note FwpsAcquireWritableLayerDataPointer0 is a specific version of FwpsAcquireWritableLayerDataPointer. See WFP Version-Independent Names and Targeting Specific Versions of Windows for more information.

Syntax

NTSTATUS FwpsAcquireWritableLayerDataPointer0(
  [in]      UINT64             classifyHandle,
  [in]      UINT64             filterId,
  [in]      UINT32             flags,
  [out]     PVOID              *writableLayerData,
  [in, out] FWPS_CLASSIFY_OUT0 *classifyOut
);

Parameters

[in] classifyHandle

A handle for the classify request. This handle is obtained by calling FwpsAcquireClassifyHandle0.

[in] filterId

The value of the FilterId member of the classifyFn function's filter parameter. For more information about the FilterId member, see FWPS_FILTER1.

[in] flags

Reserved for future use. Set to zero.

[out] writableLayerData

A data buffer that contains the modifiable data for the layer. The supported data types, which are listed in the following Remarks section, are defined as structures. On return, the data can be accessed by casting the void pointer to the appropriate structure type.

[in, out] classifyOut

Set to the classifyOut parameter of the callout driver's classifyFn function. The classifyOut parameter of classifyFn is listed as an output parameter in the header, but it contains enough information on input to be useful to the engine when passed to FwpsAcquireWritableLayerDataPointer0.

Return value

The FwpsAcquireWritableLayerDataPointer0 function returns one of the following NTSTATUS codes.

Return code	Description
STATUS_SUCCESS	The callback function was successfully registered.
Other status codes	An error occurred.

Remarks

FwpsAcquireWritableLayerDataPointer0 sets the following members of the FWPS_CLASSIFY_OUT0 structure:

classifyOut->actionType = FWP_ACTION_BLOCK
classifyOut->rights &= ~FWPS_RIGHT_ACTION_WRITE

For every call to this function, you must make a matching call to FwpsApplyModifiedLayerData0 to finalize the changes that were made, even if your callout driver didn't modify any data. If you do not make the call to FwpsApplyModifiedLayerData0, this could result in the classify not completing correctly.

The following structures are defined to contain modifiable layer data. The pointer set on output as the writableLayerData parameter can be cast to one of these types:

Requirements

Requirement	Value
Minimum supported client	Available starting with Windows 7.
Target Platform	Universal
Header	fwpsk.h (include Fwpsk.h)
Library	Fwpkclnt.lib
IRQL	<= DISPATCH_LEVEL