IFWXSessionFilter

The filter implements the IFWXSessionFilter interface to monitor and react to events in a given session.

Notes to Implementers

This is the second interface for which you need to write code, and which must be implemented by each application filter. This is the interface typically used for attaching a data filter to a session.

The interface is implemented on each session filter object. A different combination of session filters can be attached to each user session. However, a session filter is usually attached to a single user session.

Remarks

In the IFWXSessionFilter::FwxFirewallEventHandler method select an action based on the event data provided by the Firewall service.

In IFWXSessionFilter::Detach you would typically release references to other objects.

ISA Samples that Use IFWXSessionFilter Methods

The method IFWXSessionFilter::FwxFirewallEventHandler is used in the following sample filters provided with ISA:

• ConnectorFilter
• DbgDump
• ExeBlock
• ServerSplit
• SMTPFLTR

The method IFWXSessionFilter::Detach is used in the following samples provided with ISA:

• ConnectorFilter
• DbgDump
• ExeBlock
• SMTPFLTR

Example Code

Following are examples of code to implement IFWXSessionFilter methods.

IFWXSessionFilter::FwxFirewallEventHandler

HRESULT
CMyFWXSessionFilter::FwxFirewallEventHandler(
					FirewallEvent *pEvent)
{
	switch (pEvent->EventType) {
	case fwx_Connect_Tcp:
		// Handle connect event
	case fwx_Accept:
		// Handle accept event
…
}

IFWXSessionFilter::Detach

	HRESULT
	CMyFWXSessionFilter::Detach()
{
	// Assuming that m_spSession is defined
	// as CComPtr<IFWXSession>, IFWXSession::Release() is called 
	// by the assignment operator.
	Lock();
	m_spSession = NULL;
	Unlock();
 
	return S_OK;
}