IFWXFilter

The Firewall service uses the IFWXFilter interface to load and initialize a filter and to create session filters. An IFWXFilter interface is called for each filter that is in ISA storage and is enabled.

Notes to Implementers

IFWXFilter is the first interface that you need to implement.

In IFWXFilter you define a port, or range of ports, to be monitored, and the events that will trigger a call to the IFWXFilter::AttachToSession method.

Note  There are situations where threading issues require caution in the implementation of IFWXFilter::FilterShutdown. For more information, see the Reference section.

ISA Samples that Use IFWXFilter Methods

The methods IFWXFilter::FilterInit, IFWXFilter::FilterShutdown, and IFWXFilter::AttachToSession are used in the following sample filters provided with ISA:

• ConnectorFilter
• DbgDump
• ExeBlock
• ServerSplit
• SMTPFLTR

Example Code

Following are examples of code to implement IFWXFilter methods:

IFWXFilter::FilterInit

HRESULT STDMETHODCALLTYPE
CMyFWXFilter::FilterInit(
IFWXFirewall		 * pFirewallInterface,
FwxFilterHookEvents ** ppFilterHookEvents)
{
	//Listening on port <range>
		m_FwxPortRangeEvents.StartPort=<start range>;
		m_FwxPortRangeEvents.EndPort=<end range>;

	//Initialize events
		m_FwxPortRangeEvents.dwSocketEvents=<FwxFirewallEventSource>
						| <FwxFirewallEventType>;
		m_FwxFilterHookEvents.dwGlobalEvents=<FwxFirewallEventSource>
						| <FwxFirewallEventType>;
		m_FwxFilterHookEvents.dwNumPortRanges = <No. of entries in	 FwxPortRangeEvents>;
		m_FwxFilterHookEvents.FwxPortRangeEvents = &m_FwxPortRangeEvents;
 
	m_spFirewall = pFirewallInterface;
	return m_spFirewall->DuplicateFilterHookEvents(
	&g_MyHookEvents,
	ppFilterHookEvents);
}

IFWXFilter::AttachToSession

HRESULT STDMETHODCALLTYPE AttachToSession( 
	/* [in] */ IFWXSession __RPC_FAR *piSession,
	/* [out] */ IFWXSessionFilter __RPC_FAR *__RPC_FAR *piSessionFilter,
	/* [out] */ PFwxFilterHookEvents __RPC_FAR *ppFilterHookEvents)
{
CComObject<CMyFWXSessionFilter> *pMySessionFltr;
CComObject<CMyFWXSessionFilter>::CreateInstance(
						&pMySessionFltr);
// Other initializations here.
 
pMySessionFltr->QueryInterface(
						IID_IFWXSessionFilter,
						ppISessionFilter);
 
m_spFirewall->DuplicateFilterHookEvents(
						&g_MySecondaryHookEvents,
						ppFilterHookEvents);
}