FWPS_CLASSIFY_OUT0 structure [Filtering]

The FWPS_CLASSIFY_OUT0 structure is used to return the outcome of classification to the shim.

typedef struct FWPS_CLASSIFY_OUT0_ {
  FWP_ACTION_TYPE actionType;
  UINT64 outContext;
  UINT64 filterId;
  UINT32 rights;
  UINT32 flags;
  UINT32 reserved;


  • actionType
    Suggests the action for the classification. FWP_ACTION_TYPE maps to UINT32

    Write access to this field is controlled by the rights member of this structure.

    Value Meaning
    FWP_ACTION_BLOCK Block the traffic.
    FWP_ACTION_PERMIT Permit the traffic.
    FWP_ACTION_CALLOUT_TERMINATING Invoke a callout that always returns block or permit.
    FWP_ACTION_CALLOUT_INSPECTION Invoke a callout that never returns block or permit.
    FWP_ACTION_CALLOUT_UNKNOWN Invoke a callout that may return block or permit.
  • outContext
    Opaque context data set by callout or terminating filter.

    Value Meaning
    FWPM_CONTEXT_ALE_ALLOW_LOOSE_SOURCE_MAPPING Enables loose source mapping for callout filters. This allows unicast responses from a remote peer to match only the port number, not the source address.
  • filterId
    FilterId of filter that set the final actionType.

  • rights
    Controls write access to fields within this structure.

    FWPS_RIGHT_ACTION_WRITE must be held to update the actionType unless executing a veto.

    Value Meaning
    FWPS_RIGHT_ACTION_WRITE Allows write access.
  • flags
    Possible values.


  • reserved
    Reserved for system use.


Note that setting actionType to FWP_ACTION_BLOCK when the rights member is not set to FWPS_RIGHT_ACTION_WRITE results in a veto.


Client Requires Windows Vista.
Server Requires Windows Server "Longhorn".

Declared in Fwpstypes.h.


Declared in Fwpstypes.idl.

See Also

Windows Filtering Platform API Structures