FwpsNetBufferListAssociateContext1 function (fwpsk.h)

Article
10/21/2021

The FwpsNetBufferListAssociateContext1 function associates the callout driver's context with a network buffer list and configures notification for network buffer list events.

Note FwpsNetBufferListAssociateContext1 is the specific version of FwpsNetBufferListAssociateContext used in Windows 8 and later. See WFP Version-Independent Names and Targeting Specific Versions of Windows for more information. For Windows 7, FwpsNetBufferListAssociateContext0 is available.

Syntax

NTSTATUS FwpsNetBufferListAssociateContext1(
  [in, out] NET_BUFFER_LIST                 *netBufferList,
  [in]      UINT16                          layerId,
  [in]      UINT64                          context,
  [in]      UINT64                          contextTag,
            GUID                            *providerGuid,
  [in, out] void                            *deviceObject,
  [in]      FWPS_NET_BUFFER_LIST_NOTIFY_FN1 notifyFn,
  [in]      UINT32                          flags
);

Parameters

[in, out] netBufferList

A network buffer list that indicates one or more packets of interest to the callout driver.

[in] layerId

The identifier of the layer in which the context is being associated. When calling this function from the NDIS receive path, set this parameter to FWPS_LAYER_NON_WFP.

[in] context

Arbitrary context information set by the callout driver. The filter engine will pass this context to the callout driver's
FWPS_NET_BUFFER_LIST_NOTIFY_FN1 function.

[in] contextTag

A locally unique identifier obtained by calling the FwpsNetBufferListGetTagForContext0 function.

providerGuid

The provider GUID.

[in, out] deviceObject

A pointer to the callout driver's device object.

[in] notifyFn

A pointer to the callout driver's FWPS_NET_BUFFER_LIST_NOTIFY_FN1 function. The filter engine will send status notifications to this function.

[in] flags

This parameter is reserved for future use and is set to zero.

Return value

The FwpsNetBufferListAssociateContext1 function returns one of the following NTSTATUS codes.

Return code	Description
STATUS_SUCCESS	The association was successful.
Other status codes	An error occurred.

Remarks

The FwpsNetBufferListAssociateContext1 function associates groups of packets with the callout driver. Packets of interest can be tracked for inspection through multiple layers in the stack.

Before calling this function, the FwpsNetBufferListGetTagForContext0 function must be called to obtain a context tag.

This function is essentially identical to the previous version,

FwpsNetBufferListAssociateContext0. The only difference is the updated FWPS_NET_BUFFER_LIST_NOTIFY_FN1 function pointed to by the notifyFn parameter.

Requirements

Requirement	Value
Minimum supported client	Available starting with Windows 8.
Target Platform	Universal
Header	fwpsk.h (include Fwpsk.h)
Library	Fwpkclnt.lib
IRQL	<= DISPATCH_LEVEL