From 57bd882f8f7eb575e7fbafb1a80cd97eeee6f01f Mon Sep 17 00:00:00 2001
From: henrypp <support@henrypp.org>
Date: Tue, 9 Nov 2021 19:09:30 +0600
Subject: [PATCH] add _wfp_logsetoption

---
 src/log.c  | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 src/log.h  |  2 ++
 src/main.c |  8 ++++++++
 3 files changed, 59 insertions(+)

diff --git a/src/log.c b/src/log.c
index cb9c13fc..63480036 100644
--- a/src/log.c
+++ b/src/log.c
@@ -392,6 +392,55 @@ VOID _wfp_logunsubscribe (_In_ HANDLE engine_handle)
 	_app_loginit (FALSE); // destroy log file handle if present
 }
 
+VOID _wfp_logsetoption (_In_ HANDLE engine_handle)
+{
+	FWP_VALUE val;
+	UINT32 mask;
+	ULONG code;
+
+	if (!config.is_neteventset)
+		return;
+
+	// configure dropped packets logging (win8+)
+	if (!_r_sys_isosversiongreaterorequal (WINDOWS_8))
+		return;
+
+	mask = 0;
+
+	// add allowed connections monitor
+	if (!_r_config_getboolean (L"IsExcludeClassifyAllow", TRUE))
+		mask |= FWPM_NET_EVENT_KEYWORD_CLASSIFY_ALLOW;
+
+	// add inbound multicast and broadcast connections monitor
+	if (!_r_config_getboolean (L"IsExcludeInbound", FALSE))
+		mask |= FWPM_NET_EVENT_KEYWORD_INBOUND_MCAST | FWPM_NET_EVENT_KEYWORD_INBOUND_BCAST;
+
+	// add port scanning drop connections monitor (1903+)
+	if (_r_sys_isosversiongreaterorequal (WINDOWS_10_1903))
+	{
+		if (!_r_config_getboolean (L"IsExcludePortScanningDrop", FALSE))
+			mask |= FWPM_NET_EVENT_KEYWORD_PORT_SCANNING_DROP;
+	}
+
+	// the filter engine will collect wfp network events that match any supplied key words
+	val.type = FWP_UINT32;
+	val.uint32 = mask;
+
+	code = FwpmEngineSetOption (engine_handle, FWPM_ENGINE_NET_EVENT_MATCH_ANY_KEYWORDS, &val);
+
+	if (code != ERROR_SUCCESS)
+		_r_log (LOG_LEVEL_WARNING, NULL, L"FwpmEngineSetOption", code, L"FWPM_ENGINE_NET_EVENT_MATCH_ANY_KEYWORDS");
+
+	// enables the connection monitoring feature and starts logging creation and deletion events (and notifying any subscribers)
+	val.type = FWP_UINT32;
+	val.uint32 = !_r_config_getboolean (L"IsExcludeIPSecConnections", FALSE);
+
+	code = FwpmEngineSetOption (engine_handle, FWPM_ENGINE_MONITOR_IPSEC_CONNECTIONS, &val);
+
+	if (code != ERROR_SUCCESS)
+		_r_log (LOG_LEVEL_WARNING, NULL, L"FwpmEngineSetOption", code, L"FWPM_ENGINE_MONITOR_IPSEC_CONNECTIONS");
+}
+
 VOID CALLBACK _wfp_logcallback (_In_ PITEM_LOG_CALLBACK log)
 {
 	HANDLE engine_handle;
diff --git a/src/log.h b/src/log.h
index 84e54a4f..3fe91e8e 100644
--- a/src/log.h
+++ b/src/log.h
@@ -74,6 +74,8 @@ VOID _app_logwrite_ui (_In_ HWND hwnd, _In_ PITEM_LOG ptr_log);
 VOID _wfp_logsubscribe (_In_ HANDLE engine_handle);
 VOID _wfp_logunsubscribe (_In_ HANDLE engine_handle);
 
+VOID _wfp_logsetoption (_In_ HANDLE engine_handle);
+
 VOID CALLBACK _wfp_logcallback (_In_ PITEM_LOG_CALLBACK log);
 
 VOID CALLBACK _wfp_logcallback0 (_In_opt_ PVOID context, _In_ const FWPM_NET_EVENT1* event);
diff --git a/src/main.c b/src/main.c
index 02d20326..42e45947 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1506,7 +1506,15 @@ INT_PTR CALLBACK SettingsProc (_In_ HWND hwnd, _In_ UINT msg, _In_ WPARAM wparam
 
 				case IDC_EXCLUDECLASSIFYALLOW_CHK:
 				{
+					HANDLE hengine;
+
 					_r_config_setboolean (L"IsExcludeClassifyAllow", (IsDlgButtonChecked (hwnd, ctrl_id) == BST_CHECKED));
+
+					hengine = _wfp_getenginehandle ();
+
+					if (hengine)
+						_wfp_logsetoption (hengine);
+
 					break;
 				}