diff --git a/src/helper.cpp b/src/helper.cpp index aa5442cb..be0d320d 100644 --- a/src/helper.cpp +++ b/src/helper.cpp @@ -134,20 +134,6 @@ void _app_setinterfacestate (HWND hwnd) app.TrayToggle (hwnd, UID, nullptr, true); } -void _app_applycasestyle (LPWSTR buffer, size_t length) -{ - if (!app.ConfigGet (L"IsApplyCaseStyle", false).AsBool ()) - return; - - if (buffer && length && wcschr (buffer, OBJ_NAME_PATH_SEPARATOR)) - { - buffer[0] = _r_str_upper (buffer[0]); - - for (size_t i = 1; i < length; i++) - buffer[i] = _r_str_lower (buffer[i]); - } -} - void _app_explorefile (LPCWSTR path) { if (!path || !path[0]) @@ -1242,6 +1228,9 @@ rstring _app_getservicename (UINT16 port) case 5900: return L"vnc"; + case 5938: + return L"teamviewer"; + case 6000: case 6001: case 6002: @@ -1268,6 +1257,9 @@ rstring _app_getservicename (UINT16 port) case 7070: return L"realserver"; + case 7235: + return L"aspcoordination"; + case 8000: case 8443: return L"https-alt"; @@ -1510,11 +1502,7 @@ rstring _app_getnetworkpath (DWORD pid, ULONGLONG * pmodules, PINT picon_id, siz const BOOL res = QueryFullProcessImageName (hprocess, 0, proc_name.GetBuffer (size), &size); proc_name.ReleaseBuffer (); - if (res) - { - _app_applycasestyle (proc_name.GetBuffer (), proc_name.GetLength ()); // apply case-style - } - else + if (!res) { *phash = 0; *picon_id = config.icon_id; @@ -1824,9 +1812,9 @@ void _app_generate_packages () HKEY hkey = nullptr; HKEY hsubkey = nullptr; - LONG result = RegOpenKeyEx (HKEY_CLASSES_ROOT, L"Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages", 0, KEY_READ, &hkey); + LONG rc = RegOpenKeyEx (HKEY_CLASSES_ROOT, L"Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\Repository\\Packages", 0, KEY_READ, &hkey); - if (result == ERROR_SUCCESS) + if (rc == ERROR_SUCCESS) { DWORD index = 0; @@ -1838,23 +1826,35 @@ void _app_generate_packages () if (RegEnumKeyEx (hkey, index++, key_name, &size, 0, nullptr, nullptr, nullptr) != ERROR_SUCCESS) break; - result = RegOpenKeyEx (hkey, key_name, 0, KEY_READ, &hsubkey); + rc = RegOpenKeyEx (hkey, key_name, 0, KEY_READ, &hsubkey); - if (result == ERROR_SUCCESS) + if (rc == ERROR_SUCCESS) { - PSID package_sid[SECURITY_MAX_SID_SIZE] = {0}; + PBYTE package_sid = _r_reg_querybinary (hsubkey, L"PackageSid"); - size = _countof (package_sid) * sizeof (package_sid[0]); - result = RegQueryValueEx (hsubkey, L"PackageSid", nullptr, nullptr, (LPBYTE)package_sid, &size); - - if (result != ERROR_SUCCESS) + if (!package_sid) + { + RegCloseKey (hsubkey); continue; + } rstring package_sid_string = _r_str_fromsid (package_sid); + + SAFE_DELETE_ARRAY (package_sid); + + if (package_sid_string.IsEmpty ()) + { + RegCloseKey (hsubkey); + continue; + } + const size_t app_hash = _r_str_hash (package_sid_string); if (apps_helper.find (app_hash) != apps_helper.end ()) + { + RegCloseKey (hsubkey); continue; + } PITEM_APP_HELPER ptr_item = new ITEM_APP_HELPER; @@ -1862,11 +1862,9 @@ void _app_generate_packages () ptr_item->type = DataAppUWP; - WCHAR display_name[MAX_PATH] = {0}; - size = _countof (display_name) * sizeof (display_name[0]); - result = RegQueryValueEx (hsubkey, L"DisplayName", nullptr, nullptr, (LPBYTE)display_name, &size); + rstring display_name = _r_reg_querystring (hsubkey, L"DisplayName"); - if (result == ERROR_SUCCESS) + if (!display_name.IsEmpty ()) { if (display_name[0] == L'@') { @@ -1877,7 +1875,7 @@ void _app_generate_packages () WCHAR name[MAX_PATH] = {0}; if (SUCCEEDED (SHLoadIndirectString (display_name, name, _countof (name), nullptr))) - StringCchCopy (display_name, _countof (display_name), name); + display_name = name; if (SUCCEEDED (hrComInit)) CoUninitialize (); @@ -1885,18 +1883,17 @@ void _app_generate_packages () } } - WCHAR path[MAX_PATH] = {0}; - size = _countof (path) * sizeof (path[0]); - RegQueryValueEx (hsubkey, L"PackageRootFolder", nullptr, nullptr, (LPBYTE)path, &size); + rstring path = _r_reg_querystring (hsubkey, L"PackageRootFolder"); // query timestamp - FILETIME ft = {0}; + ptr_item->timestamp = _r_reg_querytimestamp (hsubkey); - if (RegQueryInfoKey (hsubkey, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, &ft) == ERROR_SUCCESS) - ptr_item->timestamp = _r_unixtime_from_filetime (&ft); + if (!display_name.IsEmpty ()) + _r_str_alloc (&ptr_item->display_name, _r_str_length (display_name), display_name); + + if (!path.IsEmpty ()) + _r_str_alloc (&ptr_item->real_path, _r_str_length (path), path); - _r_str_alloc (&ptr_item->display_name, _r_str_length (display_name), display_name); - _r_str_alloc (&ptr_item->real_path, _r_str_length (path), path); _r_str_alloc (&ptr_item->internal_name, package_sid_string.GetLength (), package_sid_string); if (!ConvertStringSidToSid (package_sid_string, &ptr_item->pdata)) @@ -1958,20 +1955,16 @@ void _app_generate_services () // now traverse each service to get information if (pBuffer) { - LPENUM_SERVICE_STATUS_PROCESS pServices = (LPENUM_SERVICE_STATUS_PROCESS)pBuffer; - for (DWORD i = 0; i < servicesReturned; i++) { - LPENUM_SERVICE_STATUS_PROCESS psvc = (pServices + i); + LPENUM_SERVICE_STATUS_PROCESS psvc = ((LPENUM_SERVICE_STATUS_PROCESS)pBuffer + i); time_t timestamp = 0; LPCWSTR display_name = psvc->lpDisplayName; LPCWSTR service_name = psvc->lpServiceName; - WCHAR real_path[MAX_PATH] = {0}; - - FILETIME ft = {0}; + rstring real_path; // query "ServiceDll" path { @@ -1979,58 +1972,43 @@ void _app_generate_services () if (RegOpenKeyEx (HKEY_LOCAL_MACHINE, _r_fmt (L"System\\CurrentControlSet\\Services\\%s\\Parameters", service_name), 0, KEY_READ, &hkey) == ERROR_SUCCESS) { - DWORD size = _countof (real_path) * sizeof (real_path[0]); + // query path + real_path = _r_reg_querystring (hkey, L"ServiceDll"); - if (RegQueryInfoKey (hkey, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, &ft) == ERROR_SUCCESS) - timestamp = _r_unixtime_from_filetime (&ft); - - RegQueryValueEx (hkey, L"ServiceDll", nullptr, nullptr, (LPBYTE)real_path, &size); + // query timestamp + timestamp = _r_reg_querytimestamp (hkey); RegCloseKey (hkey); } } - // query service path - if (!real_path[0] || !timestamp) + // fallback + if (real_path.IsEmpty () || !timestamp) { HKEY hkey = nullptr; if (RegOpenKeyEx (HKEY_LOCAL_MACHINE, _r_fmt (L"System\\CurrentControlSet\\Services\\%s", service_name), 0, KEY_READ, &hkey) == ERROR_SUCCESS) { - if (!real_path[0]) - { - DWORD size = _countof (real_path) * sizeof (real_path[0]); + // query path + if (real_path.IsEmpty ()) + real_path = _r_reg_querystring (hkey, L"ImagePath"); - RegQueryValueEx (hkey, L"ImagePath", nullptr, nullptr, (LPBYTE)real_path, &size); - } - - // query "lpftLastWriteTime" + // query timestamp if (!timestamp) - { - if (RegQueryInfoKey (hkey, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, &ft) == ERROR_SUCCESS) - timestamp = _r_unixtime_from_filetime (&ft); - } - + timestamp = _r_reg_querytimestamp (hkey); RegCloseKey (hkey); } + } - if (real_path[0]) - { - PathRemoveArgs (real_path); - PathUnquoteSpaces (real_path); + if (!real_path.IsEmpty ()) + { + PathRemoveArgs (real_path.GetBuffer ()); + PathUnquoteSpaces (real_path.GetBuffer ()); - for (size_t j = 0; j < _r_str_length (real_path); j++) - { - if (real_path[j] == L'%') - { - StringCchCopy (real_path, _countof (real_path), _r_path_expand (real_path)); - break; - } - } - } + real_path.ReleaseBuffer (); - _app_applycasestyle (real_path, _r_str_length (real_path)); // apply case-style + real_path = _r_path_dospathfromnt (real_path); } UNICODE_STRING serviceNameUs = {0}; @@ -3048,33 +3026,6 @@ bool _app_resolveaddress (ADDRESS_FAMILY af, LPVOID paddr, LPWSTR * pbuffer) return result; } -void _app_resolvefilename (rstring & path) -{ - // "\??\" refers to \GLOBAL??\. Just remove it. - if (_wcsnicmp (path, L"\\??\\", 4) == 0) - { - path.Mid (4); - } - // "\SystemRoot" means "C:\Windows". - else if (_wcsnicmp (path, L"\\SystemRoot", 11) == 0) - { - WCHAR systemRoot[MAX_PATH] = {0}; - GetSystemDirectory (systemRoot, _countof (systemRoot)); - - path.Mid (11 + 9); - path.Insert (0, systemRoot); - } - // "system32\" means "C:\Windows\system32\". - else if (_wcsnicmp (path, L"system32\\", 9) == 0) - { - WCHAR systemRoot[MAX_PATH] = {0}; - GetSystemDirectory (systemRoot, _countof (systemRoot)); - - path.Mid (8); - path.Insert (0, systemRoot); - } -} - INT _app_getlistview_id (EnumDataType type) { if (type == DataAppRegular || type == DataAppDevice || type == DataAppNetwork || type == DataAppPico) diff --git a/src/helper.hpp b/src/helper.hpp index bec127c1..3f6e0376 100644 --- a/src/helper.hpp +++ b/src/helper.hpp @@ -24,7 +24,6 @@ bool _app_initinterfacestate (HWND hwnd); void _app_restoreinterfacestate (HWND hwnd, bool is_enabled); void _app_setinterfacestate (HWND hwnd); -void _app_applycasestyle (LPWSTR buffer, size_t length); void _app_explorefile (LPCWSTR path); bool _app_formataddress (ADDRESS_FAMILY af, UINT8 proto, const PVOID ptr_addr, UINT16 port, LPWSTR* ptr_dest, DWORD flags); @@ -64,7 +63,6 @@ bool _app_parsenetworkstring (LPCWSTR network_string, NET_ADDRESS_FORMAT* format bool _app_parserulestring (rstring rule, PITEM_ADDRESS ptr_addr); bool _app_resolveaddress (ADDRESS_FAMILY af, LPVOID paddr, LPWSTR* pbuffer); -void _app_resolvefilename (rstring& path); INT _app_getlistview_id (EnumDataType type); diff --git a/src/log.cpp b/src/log.cpp index a31186c9..ee85b498 100644 --- a/src/log.cpp +++ b/src/log.cpp @@ -311,41 +311,25 @@ bool _wfp_logsubscribe () bool _wfp_logunsubscribe () { - bool result = false; - _app_loginit (false); // destroy log file handle if present if (config.hnetevent) { - const HMODULE hlib = LoadLibrary (L"fwpuclnt.dll"); + const DWORD rc = FwpmNetEventUnsubscribe (config.hengine, config.hnetevent); - if (hlib) + if (rc == ERROR_SUCCESS) { - typedef DWORD (WINAPI * FWPMNEU) (HANDLE, HANDLE); // FwpmNetEventUnsubscribe0 - - const FWPMNEU _FwpmNetEventUnsubscribe = (FWPMNEU)GetProcAddress (hlib, "FwpmNetEventUnsubscribe0"); - - if (_FwpmNetEventUnsubscribe) - { - const DWORD rc = _FwpmNetEventUnsubscribe (config.hengine, config.hnetevent); - - if (rc == ERROR_SUCCESS) - { - config.hnetevent = nullptr; - result = true; - } - } - - FreeLibrary (hlib); + config.hnetevent = nullptr; + return true; } } - return result; + return false; } void CALLBACK _wfp_logcallback (UINT32 flags, FILETIME const *pft, UINT8 *app_id, SID * package_id, SID * user_id, UINT8 proto, FWP_IP_VERSION ipver, UINT32 remote_addr4, FWP_BYTE_ARRAY16 const *remote_addr6, UINT16 remoteport, UINT16 layer_id, UINT64 filter_id, UINT32 direction, bool is_allow, bool is_loopback) { - if (!filter_id || !layer_id || _wfp_isfiltersapplying () || (is_allow && app.ConfigGet (L"IsExcludeClassifyAllow", true).AsBool ())) + if (!config.hengine || !filter_id || !layer_id || _wfp_isfiltersapplying () || (is_allow && app.ConfigGet (L"IsExcludeClassifyAllow", true).AsBool ())) return; // set allowed directions directions @@ -395,7 +379,7 @@ void CALLBACK _wfp_logcallback (UINT32 flags, FILETIME const *pft, UINT8 *app_id if (FwpmFilterGetById (config.hengine, filter_id, &ptr_filter) == ERROR_SUCCESS && ptr_filter) { - filter_name = ptr_filter->displayData.name ? ptr_filter->displayData.name : ptr_filter->displayData.description; + filter_name = ptr_filter->displayData.description ? ptr_filter->displayData.description : ptr_filter->displayData.name; if (ptr_filter->weight.type == FWP_UINT8) filter_weight = ptr_filter->weight.uint8; @@ -452,8 +436,6 @@ void CALLBACK _wfp_logcallback (UINT32 flags, FILETIME const *pft, UINT8 *app_id _r_str_alloc (&ptr_log->path, path.GetLength (), path); ptr_log->app_hash = path.Hash (); - - _app_applycasestyle (ptr_log->path, path.GetLength ()); // apply case-style } else { @@ -511,7 +493,7 @@ void CALLBACK _wfp_logcallback (UINT32 flags, FILETIME const *pft, UINT8 *app_id // remote address if ((flags & FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET) != 0 && remote_addr4) - ptr_log->addr.S_un.S_addr = ntohl (remote_addr4); + ptr_log->addr.S_un.S_addr = _byteswap_ulong (remote_addr4); } else if (ipver == FWP_IP_VERSION_V6) diff --git a/src/main.cpp b/src/main.cpp index 8a9f85e3..8b3cb3f6 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -346,7 +346,7 @@ UINT WINAPI ApplyThread (LPVOID lparam) else { if (_wfp_initialize (false)) - _wfp_destroyfilters (); + _wfp_destroyfilters (_wfp_getenginehandle ()); _wfp_uninitialize (true); } @@ -1257,7 +1257,7 @@ INT_PTR CALLBACK EditorProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) OBJECTS_VEC rules; rules.push_back (ptr_rule_object); - _wfp_create4filters (rules, __LINE__); + _wfp_create4filters (_wfp_getenginehandle (), rules, __LINE__); // note: do not needed! //_app_dereferenceobjects (rules, &_app_dereferencerule); @@ -1422,12 +1422,14 @@ void _app_config_apply (HWND hwnd, INT ctrl_id) if (new_val ? config.pacl_secure : config.pacl_default) { + const HANDLE hengine = _wfp_getenginehandle (); + GUIDS_VEC filter_all; - if (_wfp_dumpfilters (&GUID_WfpProvider, &filter_all)) + if (_wfp_dumpfilters (hengine, &GUID_WfpProvider, &filter_all)) { for (size_t i = 0; i < filter_all.size (); i++) - _wfp_setfiltersecurity (config.hengine, &filter_all.at (i), config.pusersid, new_val ? config.pacl_secure : config.pacl_default, __LINE__); + _wfp_setfiltersecurity (hengine, &filter_all.at (i), config.pusersid, new_val ? config.pacl_secure : config.pacl_default, __LINE__); } } @@ -1515,7 +1517,7 @@ void _app_config_apply (HWND hwnd, INT ctrl_id) } } - _wfp_create2filters (__LINE__); + _wfp_create2filters (_wfp_getenginehandle (), __LINE__); } INT_PTR CALLBACK SettingsProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) @@ -2326,15 +2328,15 @@ INT_PTR CALLBACK SettingsProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam } break; + } } - } break; + } } - } return FALSE; -} + } LONG gettoolbarwidth () { @@ -3442,7 +3444,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) _app_timer_reset (hwnd, ptr_app); rules.push_back (ptr_app_object); - _wfp_create3filters (rules, __LINE__); + _wfp_create3filters (_wfp_getenginehandle (), rules, __LINE__); is_changed = true; } @@ -3474,7 +3476,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) _r_fastlock_releaseshared (&lock_checkbox); rules.push_back (ptr_rule_object); - _wfp_create4filters (rules, __LINE__); + _wfp_create4filters (_wfp_getenginehandle (), rules, __LINE__); is_changed = true; } @@ -4064,7 +4066,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) OBJECTS_VEC rules; rules.push_back (ptr_rule_object); - _wfp_create4filters (rules, __LINE__); + _wfp_create4filters (_wfp_getenginehandle (), rules, __LINE__); } _r_obj_dereference (ptr_rule_object, &_app_dereferencerule); @@ -4112,7 +4114,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) } } - _wfp_create3filters (rules, __LINE__); + _wfp_create3filters (_wfp_getenginehandle (), rules, __LINE__); _app_freeobjects_vec (rules, &_app_dereferenceapp); _app_listviewsort (hwnd, listview_id); @@ -5007,7 +5009,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) if (is_changed) { - _wfp_create3filters (rules, __LINE__); + _wfp_create3filters (_wfp_getenginehandle (), rules, __LINE__); _app_freeobjects_vec (rules, &_app_dereferenceapp); } } @@ -5048,7 +5050,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) if (is_changed) { - _wfp_create4filters (rules, __LINE__); + _wfp_create4filters (_wfp_getenginehandle (), rules, __LINE__); _app_freeobjects_vec (rules, &_app_dereferencerule); } } @@ -5445,7 +5447,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) } } - _wfp_destroy2filters (guids, __LINE__); + _wfp_destroyfilters_array (_wfp_getenginehandle (), guids, __LINE__); _app_refreshstatus (hwnd); _app_profile_save (); @@ -5504,7 +5506,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) if (is_deleted) { - _wfp_destroy2filters (guids, __LINE__); + _wfp_destroyfilters_array (_wfp_getenginehandle (), guids, __LINE__); _app_refreshstatus (hwnd); _app_profile_save (); @@ -5545,7 +5547,7 @@ INT_PTR CALLBACK DlgProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) _r_fastlock_releaseshared (&lock_access); - _wfp_create3filters (rules, __LINE__); + _wfp_create3filters (_wfp_getenginehandle (), rules, __LINE__); _app_freeobjects_vec (rules, &_app_dereferenceapp); _app_listviewsort (hwnd, _app_gettab_id (hwnd)); @@ -5725,7 +5727,7 @@ INT APIENTRY wWinMain (HINSTANCE, HINSTANCE, LPWSTR, INT) if (app.IsAdmin () && _wfp_isfiltersinstalled () && _app_installmessage (nullptr, false)) { if (_wfp_initialize (false)) - _wfp_destroyfilters (); + _wfp_destroyfilters (_wfp_getenginehandle ()); _wfp_uninitialize (true); } diff --git a/src/notifications.cpp b/src/notifications.cpp index 5fb7c407..84f7b5df 100644 --- a/src/notifications.cpp +++ b/src/notifications.cpp @@ -226,7 +226,7 @@ bool _app_notifycommand (HWND hwnd, UINT button_id, time_t seconds) ptr_app->last_notify = _r_unixtime_now (); - _wfp_create3filters (rules, __LINE__); + _wfp_create3filters (_wfp_getenginehandle (), rules, __LINE__); _r_obj_dereference (ptr_app_object, &_app_dereferenceapp); @@ -502,11 +502,11 @@ void _app_notifyplaysound () if (RegOpenKeyEx (HKEY_CURRENT_USER, L"AppEvents\\Schemes\\Apps\\.Default\\" NOTIFY_SOUND_NAME L"\\.Default", 0, KEY_READ, &hkey) == ERROR_SUCCESS) { - DWORD size = _countof (notify_snd_path) * sizeof (WCHAR); + rstring path = _r_reg_querystring (hkey, nullptr); - if (RegQueryValueEx (hkey, nullptr, nullptr, nullptr, (LPBYTE)notify_snd_path, &size) == ERROR_SUCCESS) + if (!path.IsEmpty ()) { - const rstring path = _r_path_expand (notify_snd_path); + path = _r_path_expand (path); if (_r_fs_exists (path)) { @@ -989,7 +989,7 @@ LRESULT CALLBACK NotificationProc (HWND hwnd, UINT msg, WPARAM wparam, LPARAM lp OBJECTS_VEC rules; rules.push_back (ptr_rule_object); - _wfp_create4filters (rules, __LINE__); + _wfp_create4filters (_wfp_getenginehandle (), rules, __LINE__); if (listview_id == app_listview_id || listview_id == rule_listview_id) { diff --git a/src/profile.cpp b/src/profile.cpp index 0ce3a647..1b1cd234 100644 --- a/src/profile.cpp +++ b/src/profile.cpp @@ -88,8 +88,6 @@ size_t _app_addapplication (HWND hwnd, rstring path, time_t timestamp, time_t ti } } - _app_resolvefilename (path); - const size_t app_hash = path.Hash (); if (_app_isappfound (app_hash)) @@ -158,9 +156,6 @@ size_t _app_addapplication (HWND hwnd, rstring path, time_t timestamp, time_t ti } } - _app_applycasestyle (real_path.GetBuffer (), real_path.GetLength ()); // apply case-style - _app_applycasestyle (path.GetBuffer (), path.GetLength ()); // apply case-style - _r_str_alloc (&ptr_app->original_path, path.GetLength (), path); _r_str_alloc (&ptr_app->real_path, real_path.GetLength (), real_path); @@ -826,7 +821,7 @@ void _app_ruleblocklistset (HWND hwnd, INT spy_state, INT update_state, INT extr if (is_instantapply) { - _wfp_create4filters (rules, __LINE__); + _wfp_create4filters (_wfp_getenginehandle (), rules, __LINE__); _app_freeobjects_vec (rules, &_app_dereferencerule); } @@ -842,10 +837,7 @@ rstring _app_rulesexpand (PITEM_RULE ptr_rule, bool is_fordisplay, LPCWSTR delim { if (is_fordisplay && ptr_rule->is_forservices) { - rstring svchost_path = _r_path_expand (PATH_SVCHOST); - - _app_applycasestyle (svchost_path.GetBuffer (), svchost_path.GetLength ()); - svchost_path.ReleaseBuffer (); + static const rstring svchost_path = _r_path_expand (PATH_SVCHOST); result.AppendFormat (L"%s%s", PROC_SYSTEM_NAME, delimeter); result.AppendFormat (L"%s%s", svchost_path.GetString (), delimeter); diff --git a/src/timer.cpp b/src/timer.cpp index d41723f3..3cfd9a3a 100644 --- a/src/timer.cpp +++ b/src/timer.cpp @@ -5,7 +5,7 @@ bool _app_timer_set (HWND hwnd, PITEM_APP ptr_app, time_t seconds) { - if (!config.hengine || !ptr_app) + if (!ptr_app) return false; if (seconds <= 0) @@ -71,10 +71,7 @@ bool _app_timer_set (HWND hwnd, PITEM_APP ptr_app, time_t seconds) bool _app_timer_reset (HWND hwnd, PITEM_APP ptr_app) { - if (!config.hengine || !ptr_app) - return false; - - if (!_app_istimeractive (ptr_app)) + if (!ptr_app || !_app_istimeractive (ptr_app)) return false; ptr_app->is_haveerrors = false; @@ -164,7 +161,7 @@ void CALLBACK _app_timer_callback (PVOID lparam, BOOLEAN) rules.push_back (ptr_app_object); _app_timer_reset (hwnd, ptr_app); - _wfp_create3filters (rules, __LINE__); + _wfp_create3filters (_wfp_getenginehandle (), rules, __LINE__); const INT listview_id = _app_gettab_id (hwnd); diff --git a/src/wfp.cpp b/src/wfp.cpp index 67c5b63a..b3537e37 100644 --- a/src/wfp.cpp +++ b/src/wfp.cpp @@ -26,6 +26,11 @@ bool _wfp_isfiltersinstalled () return result; } +HANDLE _wfp_getenginehandle () +{ + return config.hengine; +} + bool _wfp_initialize (bool is_full) { bool result = true; @@ -59,9 +64,7 @@ bool _wfp_initialize (bool is_full) if (rc != ERROR_SUCCESS || !config.hengine) { _app_logerror (L"FwpmEngineOpen", rc, nullptr, false); - - if (config.hengine) - config.hengine = nullptr; + config.hengine = nullptr; } if (!config.hengine) @@ -299,14 +302,16 @@ bool _wfp_initialize (bool is_full) void _wfp_uninitialize (bool is_full) { + const HANDLE& hengine = _wfp_getenginehandle (); + SAFE_DELETE (config.psession); - if (!config.hengine) + if (!hengine) return; _r_fastlock_acquireshared (&lock_transaction); - DWORD result; + DWORD rc; FWP_VALUE val; @@ -315,56 +320,44 @@ void _wfp_uninitialize (bool is_full) { _wfp_logunsubscribe (); - // collect ipsec connection (win8+) if (_r_sys_validversion (6, 2)) { + // monitor ipsec connection (win8+) val.type = FWP_UINT32; val.uint32 = 0; - result = FwpmEngineSetOption (config.hengine, FWPM_ENGINE_MONITOR_IPSEC_CONNECTIONS, &val); + FwpmEngineSetOption (hengine, FWPM_ENGINE_MONITOR_IPSEC_CONNECTIONS, &val); - if (result != ERROR_SUCCESS) - _app_logerror (L"FwpmEngineSetOption", result, L"FWPM_ENGINE_MONITOR_IPSEC_CONNECTIONS", true); + // packet queuing (win8+) + val.type = FWP_UINT32; + val.uint32 = FWPM_ENGINE_OPTION_PACKET_QUEUE_NONE; + + FwpmEngineSetOption (hengine, FWPM_ENGINE_PACKET_QUEUING, &val); } val.type = FWP_UINT32; val.uint32 = 0; - result = FwpmEngineSetOption (config.hengine, FWPM_ENGINE_COLLECT_NET_EVENTS, &val); + rc = FwpmEngineSetOption (hengine, FWPM_ENGINE_COLLECT_NET_EVENTS, &val); - if (result != ERROR_SUCCESS) - _app_logerror (L"FwpmEngineSetOption", result, L"FWPM_ENGINE_COLLECT_NET_EVENTS", true); - - else + if (rc == ERROR_SUCCESS) config.is_neteventset = false; } - // packet queuing (win8+) - if (_r_sys_validversion (6, 2)) - { - val.type = FWP_UINT32; - val.uint32 = FWPM_ENGINE_OPTION_PACKET_QUEUE_NONE; - - result = FwpmEngineSetOption (config.hengine, FWPM_ENGINE_PACKET_QUEUING, &val); - - if (result != ERROR_SUCCESS) - _app_logerror (L"FwpmEngineSetOption", result, L"FWPM_ENGINE_PACKET_QUEUING", true); - } - if (is_full) { // set security information if (config.pusersid) { - FwpmProviderSetSecurityInfoByKey (config.hengine, &GUID_WfpProvider, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); - FwpmSubLayerSetSecurityInfoByKey (config.hengine, &GUID_WfpSublayer, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); + FwpmProviderSetSecurityInfoByKey (hengine, &GUID_WfpProvider, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); + FwpmSubLayerSetSecurityInfoByKey (hengine, &GUID_WfpSublayer, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); } if (config.pacl_default) { - FwpmProviderSetSecurityInfoByKey (config.hengine, &GUID_WfpProvider, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); - FwpmSubLayerSetSecurityInfoByKey (config.hengine, &GUID_WfpSublayer, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); + FwpmProviderSetSecurityInfoByKey (hengine, &GUID_WfpProvider, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); + FwpmSubLayerSetSecurityInfoByKey (hengine, &GUID_WfpSublayer, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); } const bool is_intransact = _wfp_transact_start (__LINE__); @@ -380,27 +373,27 @@ void _wfp_uninitialize (bool is_full) GUID_WfpListenCallout6_DEPRECATED }; - for (UINT i = 0; i < _countof (callouts); i++) - FwpmCalloutDeleteByKey (config.hengine, &callouts[i]); + for (size_t i = 0; i < _countof (callouts); i++) + FwpmCalloutDeleteByKey (hengine, &callouts[i]); } // destroy sublayer - result = FwpmSubLayerDeleteByKey (config.hengine, &GUID_WfpSublayer); + rc = FwpmSubLayerDeleteByKey (hengine, &GUID_WfpSublayer); - if (result != ERROR_SUCCESS && result != FWP_E_SUBLAYER_NOT_FOUND) - _app_logerror (L"FwpmSubLayerDeleteByKey", result, nullptr, false); + if (rc != ERROR_SUCCESS && rc != FWP_E_SUBLAYER_NOT_FOUND) + _app_logerror (L"FwpmSubLayerDeleteByKey", rc, nullptr, false); // destroy provider - result = FwpmProviderDeleteByKey (config.hengine, &GUID_WfpProvider); + rc = FwpmProviderDeleteByKey (hengine, &GUID_WfpProvider); - if (result != ERROR_SUCCESS && result != FWP_E_PROVIDER_NOT_FOUND) - _app_logerror (L"FwpmProviderDeleteByKey", result, nullptr, false); + if (rc != ERROR_SUCCESS && rc != FWP_E_PROVIDER_NOT_FOUND) + _app_logerror (L"FwpmProviderDeleteByKey", rc, nullptr, false); if (is_intransact) _wfp_transact_commit (__LINE__); } - FwpmEngineClose (config.hengine); + FwpmEngineClose (hengine); config.hengine = nullptr; _r_fastlock_releaseshared (&lock_transaction); @@ -408,17 +401,19 @@ void _wfp_uninitialize (bool is_full) void _wfp_installfilters () { + const HANDLE& hengine = _wfp_getenginehandle (); + // set security information if (config.pusersid) { - FwpmProviderSetSecurityInfoByKey (config.hengine, &GUID_WfpProvider, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); - FwpmSubLayerSetSecurityInfoByKey (config.hengine, &GUID_WfpSublayer, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); + FwpmProviderSetSecurityInfoByKey (hengine, &GUID_WfpProvider, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); + FwpmSubLayerSetSecurityInfoByKey (hengine, &GUID_WfpSublayer, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); } if (config.pacl_default) { - FwpmProviderSetSecurityInfoByKey (config.hengine, &GUID_WfpProvider, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); - FwpmSubLayerSetSecurityInfoByKey (config.hengine, &GUID_WfpSublayer, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); + FwpmProviderSetSecurityInfoByKey (hengine, &GUID_WfpProvider, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); + FwpmSubLayerSetSecurityInfoByKey (hengine, &GUID_WfpSublayer, DACL_SECURITY_INFORMATION, nullptr, nullptr, config.pacl_default, nullptr); } _wfp_clearfilter_ids (); @@ -427,13 +422,13 @@ void _wfp_installfilters () // dump all filters into array GUIDS_VEC filter_all; - const bool filters_count = _wfp_dumpfilters (&GUID_WfpProvider, &filter_all); + const bool filters_count = _wfp_dumpfilters (hengine, &GUID_WfpProvider, &filter_all); // restore filters security if (filters_count) { for (size_t i = 0; i < filter_all.size (); i++) - _wfp_setfiltersecurity (config.hengine, &filter_all.at (i), config.pusersid, config.pacl_default, __LINE__); + _wfp_setfiltersecurity (hengine, &filter_all.at (i), config.pusersid, config.pacl_default, __LINE__); } const bool is_intransact = _wfp_transact_start (__LINE__); @@ -442,11 +437,11 @@ void _wfp_installfilters () if (filters_count) { for (size_t i = 0; i < filter_all.size (); i++) - _wfp_deletefilter (config.hengine, &filter_all.at (i)); + _wfp_deletefilter (hengine, &filter_all.at (i)); } // apply internal rules - _wfp_create2filters (__LINE__, is_intransact); + _wfp_create2filters (hengine, __LINE__, is_intransact); // apply apps rules { @@ -471,7 +466,7 @@ void _wfp_installfilters () } } - _wfp_create3filters (rules, __LINE__, is_intransact); + _wfp_create3filters (hengine, rules, __LINE__, is_intransact); _app_freeobjects_vec (rules, &_app_dereferenceapp); } @@ -498,7 +493,7 @@ void _wfp_installfilters () } } - _wfp_create4filters (rules, __LINE__, is_intransact); + _wfp_create4filters (hengine, rules, __LINE__, is_intransact); _app_freeobjects_vec (rules, &_app_dereferencerule); } @@ -511,24 +506,24 @@ void _wfp_installfilters () if (is_secure ? config.pacl_secure : config.pacl_default) { - if (_wfp_dumpfilters (&GUID_WfpProvider, &filter_all)) + if (_wfp_dumpfilters (hengine, &GUID_WfpProvider, &filter_all)) { for (size_t i = 0; i < filter_all.size (); i++) - _wfp_setfiltersecurity (config.hengine, &filter_all.at (i), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, __LINE__); + _wfp_setfiltersecurity (hengine, &filter_all.at (i), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, __LINE__); } } // set security information if (config.pusersid) { - FwpmProviderSetSecurityInfoByKey (config.hengine, &GUID_WfpProvider, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); - FwpmSubLayerSetSecurityInfoByKey (config.hengine, &GUID_WfpSublayer, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); + FwpmProviderSetSecurityInfoByKey (hengine, &GUID_WfpProvider, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); + FwpmSubLayerSetSecurityInfoByKey (hengine, &GUID_WfpSublayer, OWNER_SECURITY_INFORMATION, (const SID*)config.pusersid, nullptr, nullptr, nullptr); } if (is_secure ? config.pacl_secure : config.pacl_default) { - FwpmProviderSetSecurityInfoByKey (config.hengine, &GUID_WfpProvider, DACL_SECURITY_INFORMATION, nullptr, nullptr, is_secure ? config.pacl_secure : config.pacl_default, nullptr); - FwpmSubLayerSetSecurityInfoByKey (config.hengine, &GUID_WfpSublayer, DACL_SECURITY_INFORMATION, nullptr, nullptr, is_secure ? config.pacl_secure : config.pacl_default, nullptr); + FwpmProviderSetSecurityInfoByKey (hengine, &GUID_WfpProvider, DACL_SECURITY_INFORMATION, nullptr, nullptr, is_secure ? config.pacl_secure : config.pacl_default, nullptr); + FwpmSubLayerSetSecurityInfoByKey (hengine, &GUID_WfpSublayer, DACL_SECURITY_INFORMATION, nullptr, nullptr, is_secure ? config.pacl_secure : config.pacl_default, nullptr); } } @@ -567,31 +562,37 @@ bool _wfp_transact_commit (UINT line) return false; } -bool _wfp_deletefilter (HANDLE engineHandle, const GUID * ptr_filter_id) +bool _wfp_deletefilter (HANDLE hengine, const GUID * ptr_filter_id) { - if (!engineHandle || !ptr_filter_id || *ptr_filter_id == GUID_NULL) + if (!hengine || !ptr_filter_id || *ptr_filter_id == GUID_NULL) return false; - const DWORD result = FwpmFilterDeleteByKey (config.hengine, ptr_filter_id); + const DWORD rc = FwpmFilterDeleteByKey (hengine, ptr_filter_id); - if (result != ERROR_SUCCESS && result != FWP_E_FILTER_NOT_FOUND) + if (rc != ERROR_SUCCESS && rc != FWP_E_FILTER_NOT_FOUND) { - _app_logerror (L"FwpmFilterDeleteByKey", result, _r_str_fromguid (*ptr_filter_id).GetString (), false); + _app_logerror (L"FwpmFilterDeleteByKey", rc, _r_str_fromguid (*ptr_filter_id).GetString (), false); return false; } return true; } -DWORD _wfp_createfilter (LPCWSTR name, FWPM_FILTER_CONDITION * lpcond, UINT32 const count, UINT8 weight, const GUID * layer, const GUID * callout, FWP_ACTION_TYPE action, UINT32 flags, GUIDS_VEC * ptr_filters) +DWORD _wfp_createfilter (HANDLE hengine, LPCWSTR name, FWPM_FILTER_CONDITION * lpcond, UINT32 const count, UINT8 weight, const GUID * layer, const GUID * callout, FWP_ACTION_TYPE action, UINT32 flags, GUIDS_VEC * ptr_filters) { + if (!hengine) + return RPC_S_INVALID_BINDING; + FWPM_FILTER filter = {0}; WCHAR fltr_name[128] = {0}; - StringCchCopy (fltr_name, _countof (fltr_name), name ? name : APP_NAME); + StringCchCopy (fltr_name, _countof (fltr_name), APP_NAME); + + WCHAR fltr_desc[128] = {0}; + StringCchCopy (fltr_desc, _countof (fltr_desc), name ? name : APP_NAME); filter.displayData.name = fltr_name; - filter.displayData.description = fltr_name; + filter.displayData.description = fltr_desc; // set filter flags if ((flags & FWPM_FILTER_FLAG_BOOTTIME) == 0) @@ -628,24 +629,24 @@ DWORD _wfp_createfilter (LPCWSTR name, FWPM_FILTER_CONDITION * lpcond, UINT32 co filter.action.type = action; UINT64 filter_id = 0; - const DWORD result = FwpmFilterAdd (config.hengine, &filter, nullptr, &filter_id); + const DWORD rc = FwpmFilterAdd (hengine, &filter, nullptr, &filter_id); // issue #229 //if (result == FWP_E_PROVIDER_NOT_FOUND) //{ //} - if (result == ERROR_SUCCESS) + if (rc == ERROR_SUCCESS) { if (ptr_filters) ptr_filters->push_back (filter.filterKey); } else { - _app_logerror (L"FwpmFilterAdd", result, name, false); + _app_logerror (L"FwpmFilterAdd", rc, name, false); } - return result; + return rc; } void _wfp_clearfilter_ids () @@ -681,9 +682,9 @@ void _wfp_clearfilter_ids () _r_fastlock_releaseexclusive (&lock_access); } -void _wfp_destroyfilters () +void _wfp_destroyfilters (HANDLE hengine) { - if (!config.hengine) + if (!hengine) return; _wfp_clearfilter_ids (); @@ -691,13 +692,17 @@ void _wfp_destroyfilters () // destroy all filters GUIDS_VEC filter_all; - if (_wfp_dumpfilters (&GUID_WfpProvider, &filter_all)) - _wfp_destroy2filters (filter_all, __LINE__); + _r_fastlock_acquireshared (&lock_transaction); + + if (_wfp_dumpfilters (hengine, &GUID_WfpProvider, &filter_all)) + _wfp_destroyfilters_array (hengine, filter_all, __LINE__); + + _r_fastlock_releaseshared (&lock_transaction); } -bool _wfp_destroy2filters (GUIDS_VEC & ptr_filters, UINT line) +bool _wfp_destroyfilters_array (HANDLE hengine, GUIDS_VEC & ptr_filters, UINT line) { - if (!config.hengine || ptr_filters.empty ()) + if (!hengine || ptr_filters.empty ()) return false; const bool is_enabled = _app_initinterfacestate (app.GetHWND ()); @@ -705,12 +710,12 @@ bool _wfp_destroy2filters (GUIDS_VEC & ptr_filters, UINT line) _r_fastlock_acquireshared (&lock_transaction); for (size_t i = 0; i < ptr_filters.size (); i++) - _wfp_setfiltersecurity (config.hengine, &ptr_filters.at (i), config.pusersid, config.pacl_default, line); + _wfp_setfiltersecurity (hengine, &ptr_filters.at (i), config.pusersid, config.pacl_default, line); const bool is_intransact = _wfp_transact_start (line); for (size_t i = 0; i < ptr_filters.size (); i++) - _wfp_deletefilter (config.hengine, &ptr_filters.at (i)); + _wfp_deletefilter (hengine, &ptr_filters.at (i)); ptr_filters.clear (); @@ -724,7 +729,7 @@ bool _wfp_destroy2filters (GUIDS_VEC & ptr_filters, UINT line) return true; } -bool _wfp_createrulefilter (LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, LPCWSTR rule_local, UINT8 protocol, ADDRESS_FAMILY af, FWP_DIRECTION dir, UINT8 weight, FWP_ACTION_TYPE action, UINT32 flag, GUIDS_VEC * pmfarr) +bool _wfp_createrulefilter (HANDLE hengine, LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, LPCWSTR rule_local, UINT8 protocol, ADDRESS_FAMILY af, FWP_DIRECTION dir, UINT8 weight, FWP_ACTION_TYPE action, UINT32 flag, GUIDS_VEC * pmfarr) { UINT32 count = 0; FWPM_FILTER_CONDITION fwfc[8] = {0}; @@ -941,7 +946,7 @@ bool _wfp_createrulefilter (LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, { for (size_t j = 0; j < arr2.size (); j++) { - if (!_wfp_createrulefilter (name, app_hash, arr2[j], nullptr, protocol, af, dir, weight, action, flag, pmfarr)) + if (!_wfp_createrulefilter (hengine, name, app_hash, arr2[j], nullptr, protocol, af, dir, weight, action, flag, pmfarr)) return false; } } @@ -995,18 +1000,18 @@ bool _wfp_createrulefilter (LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, { if (af == AF_INET || af == AF_UNSPEC) { - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, action, flag, pmfarr); // win7+ - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, action, flag, pmfarr); } if (af == AF_INET6 || af == AF_UNSPEC) { - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, action, flag, pmfarr); // win7+ - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, action, flag, pmfarr); } } @@ -1015,18 +1020,18 @@ bool _wfp_createrulefilter (LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, { if (af == AF_INET || af == AF_UNSPEC) { - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, action, flag, pmfarr); if (action == FWP_ACTION_BLOCK && (!is_remoteaddr_set && !is_remoteport_set)) - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4, nullptr, FWP_ACTION_PERMIT, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4, nullptr, FWP_ACTION_PERMIT, flag, pmfarr); } if (af == AF_INET6 || af == AF_UNSPEC) { - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, action, flag, pmfarr); if (action == FWP_ACTION_BLOCK && (!is_remoteaddr_set && !is_remoteport_set)) - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6, nullptr, FWP_ACTION_PERMIT, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6, nullptr, FWP_ACTION_PERMIT, flag, pmfarr); } } @@ -1035,10 +1040,10 @@ bool _wfp_createrulefilter (LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, if (!app.ConfigGet (L"AllowListenConnections2", true).AsBool () && !protocol && dir != FWP_DIRECTION_OUTBOUND && (!is_remoteaddr_set && !is_remoteport_set)) { if (af == AF_INET || af == AF_UNSPEC) - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_LISTEN_V4, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_LISTEN_V4, nullptr, action, flag, pmfarr); if (af == AF_INET6 || af == AF_UNSPEC) - _wfp_createfilter (name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_LISTEN_V6, nullptr, action, flag, pmfarr); + _wfp_createfilter (hengine, name, fwfc, count, weight, &FWPM_LAYER_ALE_AUTH_LISTEN_V6, nullptr, action, flag, pmfarr); } #endif // SW_USE_LISTEN_LAYER @@ -1048,9 +1053,9 @@ bool _wfp_createrulefilter (LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, return true; } -bool _wfp_create4filters (OBJECTS_VEC & ptr_rules, UINT line, bool is_intransact) +bool _wfp_create4filters (HANDLE hengine, OBJECTS_VEC & ptr_rules, UINT line, bool is_intransact) { - if (!config.hengine || ptr_rules.empty ()) + if (!hengine || ptr_rules.empty ()) return false; const bool is_enabled = _app_initinterfacestate (app.GetHWND ()); @@ -1081,14 +1086,14 @@ bool _wfp_create4filters (OBJECTS_VEC & ptr_rules, UINT line, bool is_intransact } for (size_t i = 0; i < ids.size (); i++) - _wfp_setfiltersecurity (config.hengine, &ids.at (i), config.pusersid, config.pacl_default, line); + _wfp_setfiltersecurity (hengine, &ids.at (i), config.pusersid, config.pacl_default, line); _r_fastlock_acquireshared (&lock_transaction); is_intransact = !_wfp_transact_start (line); } for (size_t i = 0; i < ids.size (); i++) - _wfp_deletefilter (config.hengine, &ids.at (i)); + _wfp_deletefilter (hengine, &ids.at (i)); for (size_t i = 0; i < ptr_rules.size (); i++) { @@ -1129,10 +1134,10 @@ bool _wfp_create4filters (OBJECTS_VEC & ptr_rules, UINT line, bool is_intransact // apply rules for services hosts if (ptr_rule->is_forservices) { - if (!_wfp_createrulefilter (ptr_rule->pname, config.ntoskrnl_hash, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) + if (!_wfp_createrulefilter (hengine, ptr_rule->pname, config.ntoskrnl_hash, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) is_haveerrors = true; - if (!_wfp_createrulefilter (ptr_rule->pname, config.svchost_hash, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) + if (!_wfp_createrulefilter (hengine, ptr_rule->pname, config.svchost_hash, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) is_haveerrors = true; } @@ -1143,13 +1148,13 @@ bool _wfp_create4filters (OBJECTS_VEC & ptr_rules, UINT line, bool is_intransact if (ptr_rule->is_forservices && (p.first == config.ntoskrnl_hash || p.first == config.svchost_hash)) continue; - if (!_wfp_createrulefilter (ptr_rule->pname, p.first, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) + if (!_wfp_createrulefilter (hengine, ptr_rule->pname, p.first, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) is_haveerrors = true; } } else { - if (!_wfp_createrulefilter (ptr_rule->pname, 0, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) + if (!_wfp_createrulefilter (hengine, ptr_rule->pname, 0, rule_remote, rule_local, ptr_rule->protocol, ptr_rule->af, ptr_rule->dir, ptr_rule->weight, ptr_rule->is_block ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT, 0, &guids)) is_haveerrors = true; } } @@ -1184,7 +1189,7 @@ bool _wfp_create4filters (OBJECTS_VEC & ptr_rules, UINT line, bool is_intransact if (ptr_rule && ptr_rule->is_enabled) { for (size_t j = 0; j < ptr_rule->guids.size (); j++) - _wfp_setfiltersecurity (config.hengine, &ptr_rule->guids.at (j), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, line); + _wfp_setfiltersecurity (hengine, &ptr_rule->guids.at (j), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, line); } _r_obj_dereference (ptr_rule_object, &_app_dereferencerule); @@ -1199,9 +1204,9 @@ bool _wfp_create4filters (OBJECTS_VEC & ptr_rules, UINT line, bool is_intransact return true; } -bool _wfp_create3filters (OBJECTS_VEC & ptr_apps, UINT line, bool is_intransact) +bool _wfp_create3filters (HANDLE hengine, OBJECTS_VEC & ptr_apps, UINT line, bool is_intransact) { - if (!config.hengine || ptr_apps.empty ()) + if (!hengine || ptr_apps.empty ()) return false; const bool is_enabled = _app_initinterfacestate (app.GetHWND ()); @@ -1234,14 +1239,14 @@ bool _wfp_create3filters (OBJECTS_VEC & ptr_apps, UINT line, bool is_intransact) } for (size_t i = 0; i < ids.size (); i++) - _wfp_setfiltersecurity (config.hengine, &ids.at (i), config.pusersid, config.pacl_default, line); + _wfp_setfiltersecurity (hengine, &ids.at (i), config.pusersid, config.pacl_default, line); _r_fastlock_acquireshared (&lock_transaction); is_intransact = !_wfp_transact_start (line); } for (size_t i = 0; i < ids.size (); i++) - _wfp_deletefilter (config.hengine, &ids.at (i)); + _wfp_deletefilter (hengine, &ids.at (i)); for (size_t i = 0; i < ptr_apps.size (); i++) { @@ -1259,7 +1264,7 @@ bool _wfp_create3filters (OBJECTS_VEC & ptr_apps, UINT line, bool is_intransact) if (ptr_app->is_enabled) { - if (!_wfp_createrulefilter (ptr_app->display_name, _r_str_hash (ptr_app->original_path), nullptr, nullptr, 0, AF_UNSPEC, FWP_DIRECTION_MAX, FILTER_WEIGHT_APPLICATION, action, 0, &guids)) + if (!_wfp_createrulefilter (hengine, ptr_app->display_name, _r_str_hash (ptr_app->original_path), nullptr, nullptr, 0, AF_UNSPEC, FWP_DIRECTION_MAX, FILTER_WEIGHT_APPLICATION, action, 0, &guids)) is_haveerrors = true; } @@ -1292,7 +1297,7 @@ bool _wfp_create3filters (OBJECTS_VEC & ptr_apps, UINT line, bool is_intransact) if (ptr_app) { for (size_t j = 0; j < ptr_app->guids.size (); j++) - _wfp_setfiltersecurity (config.hengine, &ptr_app->guids.at (j), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, line); + _wfp_setfiltersecurity (hengine, &ptr_app->guids.at (j), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, line); } _r_obj_dereference (ptr_app_object, &_app_dereferenceapp); @@ -1307,9 +1312,9 @@ bool _wfp_create3filters (OBJECTS_VEC & ptr_apps, UINT line, bool is_intransact) return true; } -bool _wfp_create2filters (UINT line, bool is_intransact) +bool _wfp_create2filters (HANDLE hengine, UINT line, bool is_intransact) { - if (!config.hengine) + if (!hengine) return false; const bool is_enabled = _app_initinterfacestate (app.GetHWND ()); @@ -1320,7 +1325,7 @@ bool _wfp_create2filters (UINT line, bool is_intransact) if (!is_intransact) { for (size_t i = 0; i < filter_ids.size (); i++) - _wfp_setfiltersecurity (config.hengine, &filter_ids.at (i), config.pusersid, config.pacl_default, line); + _wfp_setfiltersecurity (hengine, &filter_ids.at (i), config.pusersid, config.pacl_default, line); _r_fastlock_acquireshared (&lock_transaction); is_intransact = !_wfp_transact_start (line); @@ -1329,7 +1334,7 @@ bool _wfp_create2filters (UINT line, bool is_intransact) if (!filter_ids.empty ()) { for (size_t i = 0; i < filter_ids.size (); i++) - _wfp_deletefilter (config.hengine, &filter_ids.at (i)); + _wfp_deletefilter (hengine, &filter_ids.at (i)); filter_ids.clear (); } @@ -1352,22 +1357,22 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[0].conditionValue.uint32 |= FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; } - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine,nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); // win7+ - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); #ifdef SW_USE_LISTEN_LAYER - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_LISTEN_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_LISTEN_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_LISTEN_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_LISTEN_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); #endif // SW_USE_LISTEN_LAYER // ipv4/ipv6 loopback @@ -1425,14 +1430,14 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[1].conditionValue.v4AddrMask = &addr4; fwfc[1].fieldKey = FWPM_CONDITION_IP_REMOTE_ADDRESS; - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); // win7+ - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); fwfc[1].fieldKey = FWPM_CONDITION_IP_LOCAL_ADDRESS; - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); #ifdef SW_USE_LISTEN_LAYER _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_LISTEN_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); @@ -1444,14 +1449,14 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[1].conditionValue.v6AddrMask = &addr6; fwfc[1].fieldKey = FWPM_CONDITION_IP_REMOTE_ADDRESS; - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); // win7+ - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); fwfc[1].fieldKey = FWPM_CONDITION_IP_LOCAL_ADDRESS; - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); - _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); #ifdef SW_USE_LISTEN_LAYER _wfp_createfilter (nullptr, fwfc, 2, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_LISTEN_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); @@ -1471,7 +1476,7 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[0].conditionValue.type = FWP_UINT8; fwfc[0].conditionValue.uint8 = IPPROTO_IPV6; // ipv6 header - _wfp_createfilter (L"Allow6to4", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, L"Allow6to4", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); // allows icmpv6 router solicitation messages, which are required for the ipv6 stack to work properly fwfc[0].fieldKey = FWPM_CONDITION_ICMP_TYPE; @@ -1479,19 +1484,19 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[0].conditionValue.type = FWP_UINT16; fwfc[0].conditionValue.uint16 = 0x85; - _wfp_createfilter (L"AllowIcmpV6Type133", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, L"AllowIcmpV6Type133", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); // allows icmpv6 router advertise messages, which are required for the ipv6 stack to work properly fwfc[0].conditionValue.uint16 = 0x86; - _wfp_createfilter (L"AllowIcmpV6Type134", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, L"AllowIcmpV6Type134", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); // allows icmpv6 neighbor solicitation messages, which are required for the ipv6 stack to work properly fwfc[0].conditionValue.uint16 = 0x87; - _wfp_createfilter (L"AllowIcmpV6Type135", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, L"AllowIcmpV6Type135", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); // allows icmpv6 neighbor advertise messages, which are required for the ipv6 stack to work properly fwfc[0].conditionValue.uint16 = 0x88; - _wfp_createfilter (L"AllowIcmpV6Type136", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); + _wfp_createfilter (hengine, L"AllowIcmpV6Type136", fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, 0, &filter_ids); } // prevent port scanning using stealth discards and silent drops @@ -1513,34 +1518,34 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[1].conditionValue.type = FWP_UINT16; fwfc[1].conditionValue.uint16 = 0x03; // destination unreachable - _wfp_createfilter (L"BlockIcmpErrorV4", fwfc, 2, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_BLOCK, 0, &filter_ids); - _wfp_createfilter (L"BlockIcmpErrorV6", fwfc, 2, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_BLOCK, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockIcmpErrorV4", fwfc, 2, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_BLOCK, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockIcmpErrorV6", fwfc, 2, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_BLOCK, 0, &filter_ids); // blocks tcp port scanners (exclude loopback) fwfc[0].conditionValue.uint32 |= FWP_CONDITION_FLAG_IS_IPSEC_SECURED; - _wfp_createfilter (L"BlockTcpRstOnCloseV4", fwfc, 1, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD, &FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP, FWP_ACTION_CALLOUT_TERMINATING, 0, &filter_ids); - _wfp_createfilter (L"BlockTcpRstOnCloseV6", fwfc, 1, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD, &FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP, FWP_ACTION_CALLOUT_TERMINATING, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockTcpRstOnCloseV4", fwfc, 1, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD, &FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP, FWP_ACTION_CALLOUT_TERMINATING, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockTcpRstOnCloseV6", fwfc, 1, FILTER_WEIGHT_HIGHEST, &FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD, &FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP, FWP_ACTION_CALLOUT_TERMINATING, 0, &filter_ids); } // configure outbound layer { FWP_ACTION_TYPE action = app.ConfigGet (L"BlockOutboundConnections", true).AsBool () ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT; - _wfp_createfilter (L"BlockConnectionsV4", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, action, 0, &filter_ids); - _wfp_createfilter (L"BlockConnectionsV6", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, action, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockConnectionsV4", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_CONNECT_V4, nullptr, action, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockConnectionsV6", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_CONNECT_V6, nullptr, action, 0, &filter_ids); // win7+ - _wfp_createfilter (L"BlockConnectionsRedirectionV4", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, action, 0, &filter_ids); - _wfp_createfilter (L"BlockConnectionsRedirectionV6", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, action, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockConnectionsRedirectionV4", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V4, nullptr, action, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockConnectionsRedirectionV6", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_CONNECT_REDIRECT_V6, nullptr, action, 0, &filter_ids); } // configure inbound layer { FWP_ACTION_TYPE action = (app.ConfigGet (L"UseStealthMode", true).AsBool () || app.ConfigGet (L"BlockInboundConnections", true).AsBool ()) ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT; - _wfp_createfilter (L"BlockRecvAcceptConnectionsV4", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, action, 0, &filter_ids); - _wfp_createfilter (L"BlockRecvAcceptConnectionsV6", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, action, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockRecvAcceptConnectionsV4", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, action, 0, &filter_ids); + _wfp_createfilter (hengine, L"BlockRecvAcceptConnectionsV6", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, action, 0, &filter_ids); //_wfp_createfilter (L"BlockResourceAssignmentV4", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4, nullptr, action, 0, &filter_ids); //_wfp_createfilter (L"BlockResourceAssignmentV6", nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6, nullptr, action, 0, &filter_ids); @@ -1572,26 +1577,26 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[0].conditionValue.uint32 |= FWP_CONDITION_FLAG_IS_APPCONTAINER_LOOPBACK; } - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_IPFORWARD_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_IPFORWARD_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_IPFORWARD_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_IPFORWARD_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_INBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_INBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_INBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_INBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_HIGHEST_IMPORTANT, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_PERMIT, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_INBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_INBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_INBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_INBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, nullptr, 0, FILTER_WEIGHT_LOWEST, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); // win7+ boot-time features fwfc[0].fieldKey = FWPM_CONDITION_FLAGS; @@ -1599,8 +1604,8 @@ bool _wfp_create2filters (UINT line, bool is_intransact) fwfc[0].conditionValue.type = FWP_UINT32; fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_OUTBOUND_PASS_THRU | FWP_CONDITION_FLAG_IS_INBOUND_PASS_THRU; - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_APPLICATION, &FWPM_LAYER_IPFORWARD_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); - _wfp_createfilter (BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_APPLICATION, &FWPM_LAYER_IPFORWARD_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_APPLICATION, &FWPM_LAYER_IPFORWARD_V4, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); + _wfp_createfilter (hengine, BOOTTIME_FILTER_NAME, fwfc, 1, FILTER_WEIGHT_APPLICATION, &FWPM_LAYER_IPFORWARD_V6, nullptr, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, &filter_ids); } if (!is_intransact) @@ -1612,7 +1617,7 @@ bool _wfp_create2filters (UINT line, bool is_intransact) if (is_secure ? config.pacl_secure : config.pacl_default) { for (size_t i = 0; i < filter_ids.size (); i++) - _wfp_setfiltersecurity (config.hengine, &filter_ids.at (i), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, line); + _wfp_setfiltersecurity (hengine, &filter_ids.at (i), config.pusersid, is_secure ? config.pacl_secure : config.pacl_default, line); } _r_fastlock_releaseshared (&lock_transaction); @@ -1623,31 +1628,31 @@ bool _wfp_create2filters (UINT line, bool is_intransact) return true; } -void _wfp_setfiltersecurity (HANDLE engineHandle, const GUID * pfilter_id, const PSID psid, PACL pacl, UINT line) +void _wfp_setfiltersecurity (HANDLE hengine, const GUID * pfilter_id, const PSID psid, PACL pacl, UINT line) { - if (!engineHandle || !pfilter_id || *pfilter_id == GUID_NULL || (!psid && !pacl)) + if (!hengine || !pfilter_id || *pfilter_id == GUID_NULL || (!psid && !pacl)) return; if (psid) { - const DWORD result = FwpmFilterSetSecurityInfoByKey (engineHandle, pfilter_id, OWNER_SECURITY_INFORMATION, (const SID*)psid, nullptr, nullptr, nullptr); + const DWORD rc = FwpmFilterSetSecurityInfoByKey (hengine, pfilter_id, OWNER_SECURITY_INFORMATION, (const SID*)psid, nullptr, nullptr, nullptr); - if (result != ERROR_SUCCESS) - _app_logerror (L"FwpmFilterSetSecurityInfoByKey", result, _r_fmt (L"#%d", line), true); + if (rc != ERROR_SUCCESS && rc != FWP_E_FILTER_NOT_FOUND) + _app_logerror (L"FwpmFilterSetSecurityInfoByKey", rc, _r_fmt (L"#%d", line), true); } if (pacl) { - const DWORD result = FwpmFilterSetSecurityInfoByKey (engineHandle, pfilter_id, DACL_SECURITY_INFORMATION, nullptr, nullptr, pacl, nullptr); + const DWORD rc = FwpmFilterSetSecurityInfoByKey (hengine, pfilter_id, DACL_SECURITY_INFORMATION, nullptr, nullptr, pacl, nullptr); - if (result != ERROR_SUCCESS) - _app_logerror (L"FwpmFilterSetSecurityInfoByKey", result, _r_fmt (L"#%d", line), true); + if (rc != ERROR_SUCCESS && rc != FWP_E_FILTER_NOT_FOUND) + _app_logerror (L"FwpmFilterSetSecurityInfoByKey", rc, _r_fmt (L"#%d", line), true); } } -size_t _wfp_dumpfilters (const GUID * pprovider, GUIDS_VEC * ptr_filters) +size_t _wfp_dumpfilters (HANDLE hengine, const GUID * pprovider, GUIDS_VEC * ptr_filters) { - if (!config.hengine || !pprovider || !ptr_filters) + if (!hengine || !pprovider || !ptr_filters) return 0; ptr_filters->clear (); @@ -1655,7 +1660,7 @@ size_t _wfp_dumpfilters (const GUID * pprovider, GUIDS_VEC * ptr_filters) UINT32 count = 0; HANDLE henum = nullptr; - DWORD rc = FwpmFilterCreateEnumHandle (config.hengine, nullptr, &henum); + DWORD rc = FwpmFilterCreateEnumHandle (hengine, nullptr, &henum); if (rc != ERROR_SUCCESS) { @@ -1666,7 +1671,7 @@ size_t _wfp_dumpfilters (const GUID * pprovider, GUIDS_VEC * ptr_filters) { FWPM_FILTER** matchingFwpFilter = nullptr; - rc = FwpmFilterEnum (config.hengine, henum, UINT32_MAX, &matchingFwpFilter, &count); + rc = FwpmFilterEnum (hengine, henum, UINT32_MAX, &matchingFwpFilter, &count); if (rc != ERROR_SUCCESS) { @@ -1692,7 +1697,7 @@ size_t _wfp_dumpfilters (const GUID * pprovider, GUIDS_VEC * ptr_filters) } if (henum) - FwpmFilterDestroyEnumHandle (config.hengine, henum); + FwpmFilterDestroyEnumHandle (hengine, henum); return count; } diff --git a/src/wfp.hpp b/src/wfp.hpp index 1a2c5dc1..bffe5174 100644 --- a/src/wfp.hpp +++ b/src/wfp.hpp @@ -6,6 +6,8 @@ bool _wfp_isfiltersapplying (); bool _wfp_isfiltersinstalled (); +HANDLE _wfp_getenginehandle (); + bool _wfp_initialize (bool is_full); void _wfp_uninitialize (bool is_full); @@ -14,22 +16,22 @@ void _wfp_installfilters (); bool _wfp_transact_start (UINT line); bool _wfp_transact_commit (UINT line); -bool _wfp_deletefilter (HANDLE engineHandle, const GUID* ptr_filter_id); -DWORD _wfp_createfilter (LPCWSTR name, FWPM_FILTER_CONDITION* lpcond, UINT32 const count, UINT8 weight, const GUID* layer, const GUID* callout, FWP_ACTION_TYPE action, UINT32 flags, GUIDS_VEC* ptr_filters); +bool _wfp_deletefilter (HANDLE hengine, const GUID* ptr_filter_id); +DWORD _wfp_createfilter (HANDLE hengine, LPCWSTR name, FWPM_FILTER_CONDITION* lpcond, UINT32 const count, UINT8 weight, const GUID* layer, const GUID* callout, FWP_ACTION_TYPE action, UINT32 flags, GUIDS_VEC* ptr_filters); void _wfp_clearfilter_ids (); -void _wfp_destroyfilters (); -bool _wfp_destroy2filters (GUIDS_VEC& ptr_filters, UINT line); +void _wfp_destroyfilters (HANDLE hengine); +bool _wfp_destroyfilters_array (HANDLE hengine, GUIDS_VEC& ptr_filters, UINT line); -bool _wfp_createrulefilter (LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, LPCWSTR rule_local, UINT8 protocol, ADDRESS_FAMILY af, FWP_DIRECTION dir, UINT8 weight, FWP_ACTION_TYPE action, UINT32 flag, GUIDS_VEC* pmfarr); +bool _wfp_createrulefilter (HANDLE hengine, LPCWSTR name, size_t app_hash, LPCWSTR rule_remote, LPCWSTR rule_local, UINT8 protocol, ADDRESS_FAMILY af, FWP_DIRECTION dir, UINT8 weight, FWP_ACTION_TYPE action, UINT32 flag, GUIDS_VEC* pmfarr); -bool _wfp_create4filters (OBJECTS_VEC& ptr_rules, UINT line, bool is_intransact = false); -bool _wfp_create3filters (OBJECTS_VEC& ptr_apps, UINT line, bool is_intransact = false); -bool _wfp_create2filters (UINT line, bool is_intransact = false); +bool _wfp_create4filters (HANDLE hengine, OBJECTS_VEC& ptr_rules, UINT line, bool is_intransact = false); +bool _wfp_create3filters (HANDLE hengine, OBJECTS_VEC& ptr_apps, UINT line, bool is_intransact = false); +bool _wfp_create2filters (HANDLE hengine, UINT line, bool is_intransact = false); -void _wfp_setfiltersecurity (HANDLE engineHandle, const GUID* pfilter_id, const PSID psid, PACL pacl, UINT line); +void _wfp_setfiltersecurity (HANDLE hengine, const GUID* pfilter_id, const PSID psid, PACL pacl, UINT line); -size_t _wfp_dumpfilters (const GUID* pprovider, GUIDS_VEC* ptr_filters); +size_t _wfp_dumpfilters (HANDLE hengine, const GUID* pprovider, GUIDS_VEC* ptr_filters); bool _mps_firewallapi (bool* pis_enabled, const bool* pis_enable); void _mps_changeconfig2 (bool is_enable);