FirewallEventHandler Method of the IFWXSessionFilter Interface

Article
08/13/2010

The FirewallEventHandler method notifies the filter that the Microsoft Firewall service detected an event related to the user session to which the session filter is attached.

Syntax

HRESULT FirewallEventHandler(
  [in]  const FirewallEvent* pFirewallEvent
);

Parameters

pFirewallEvent
Pointer to a FwxFirewallEvent structure that describes the event for which this method is called and that receives information about the event. For more information, see the documentation for each event type.

Return Value

Implementations of this method should return S_OK if the call is successful; otherwise, they should return an error code.

Example Code

The following is an example implementation of the FirewallEventHandler method.

HRESULT STDMETHODCALLTYPE CMySessionFilter::FwxFirewallEventHandler(
                          FirewallEvent *pEvent)
{
    switch (pEvent->EventType) {
    case fwx_Connect_Tcp:
        // Handle connect event.
    case fwx_Accept:
        // Handle accept event
....
    default:
        return E_NOTIMPL;
}

Remarks

This method is called by the Firewall service when an event occurs for which the filter is registered after the user session has been attached to an instance of the filter's session filter object. The implementation of this method should select the appropriate action for each event based on the value of the EventType member of the FwxFirewallEvent structure provided by the Firewall service.

For an event of the fwx_AcceptedConnection, fwx_Bind_Udp, fwx_Connect_Tcp, or fwx_Udp_Destination type, the implementation of this method can create an instance of the filter's data filter object, obtain a pointer to the applicable IFWXConnection interface from the FwxFirewallEvent structure provided in the pFirewallEvent parameter, and then call the AttachDataFilter method on this interface to attach the data filter to it. The Firewall service responds by providing two sockets that implement the IFWXSocket interface in a call to the IFWXDataFilter::SetSockets method, and the filter can start pumping data and filtering for the specific connection.

Requirements

Server	Requires Windows Server 2008 R2 or Windows Server 2008 x64 Edition with SP2.
Version	Requires Forefront Threat Management Gateway (TMG) 2010.
Header	Declared in Wspfwext.idl.

Share via