FWPS_STREAM_CALLOUT_IO_PACKET0 (Compact 7)

3/12/2014

This structure describes the data passed by the WFP Filter Engine to a callout's classifyFn callout function when filtering a data stream.

Syntax

typedef struct FWPS_STREAM_CALLOUT_IO_PACKET0_ {
  IN FWPS_STREAM_DATA0  *dataStream;
  IN SIZE_T  missedBytes;
  OUT UINT32  countBytesRequired;
  OUT SIZE_T  countBytesEnforced;
  OUT FWPS_STREAM_ACTION_TYPE  streamAction;
} FWPS_STREAM_CALLOUT_IO_PACKET0;

Members

• dataStream
  A pointer to an FWPS_STREAM_DATA0 structure that describes the section of the data stream available to the callout's classifyFn callout function for processing

• missedBytes
  The number of bytes in the data stream that are missing since the last time that the callout's classifyFn callout function was called. This member is nonzero if a higher weight filter in the filter engine prevented the callout's classifyFn callout function from processing a segment of the data stream

• countBytesRequired
  A value set by a callout's classifyFn callout function. This value specifies how many additional bytes of stream data is required by the callout function if it sets the streamAction member to FWPS_STREAM_ACTION_NEED_MORE_DATA. The filter engine waits until it receives at least this many additional bytes of stream data before recalling the callout's classifyFn callout function.

  If a callout's classifyFn callout function sets the streamAction member to a value other than FWPS_STREAM_ACTION_NEED_MORE_DATA, it should set this member to zero.

• countBytesEnforced
  A value set by a callout's classifyFn callout function. This value specifies the number of leading bytes of data in the segment of the data stream being processed to which the action specified by the streamAction member or by the action returned by the callout function applies. Any remaining data in the stream buffer is passed to the callout driver again the next time that the filter engine calls the callout's classifyFn function.

• streamAction
  A FWPS_STREAM_ACTION_TYPE value set by a callout's classifyFn callout function that specifies the action to be applied to the data stream. This action is independent of the action returned by the callout function. A callout's classifyFn function sets this member to one of the following:

  FWPS_STREAM_ACTION_NONE: No stream-specific action is required

  FWPS_STREAM_ACTION_NEED_MORE_DATA: More stream data is required by the callout function

  FWPS_STREAM_ACTION_DROP_CONNECTION: The stream connection should be dropped. A callout's classifyFn callout function should set the streamAction member to this value only if the action.type member of the FWPS_FILTER0 structure that the filter engine passed to the callout's classifyFn callout function contains the value FWP_ACTION_CALLOUT_UNKNOWN. If a callout's classifyFn callout function sets the streamAction member to this value when the action.type member of the FWPS_FILTER0 structure contains the value FWP_ACTION_CALLOUT_INSPECTION, the connection is not dropped.

  FWPS_STREAM_ACTION_DEFER: Processing of the stream data is deferred until the callout driver calls the FwpsStreamContinue0 function. This action can be set for an incoming data stream only.

  Deferring an incoming data stream will cause the network stack to stop acknowledging data received from the sender. This leads to a reduction in the size of the sliding TCP window. A callout driver can use this behavior to implement flow control to slow down the incoming data rate.

  The FWPS_STREAM_ACTION_TYPE_MAX value is a maximum value for testing.

  If a callout's classifyFn callout function sets this member to a value other than FWPS_STREAM_ACTION_NONE, the action returned by the callout function is ignored by the filter engine.

Remarks

When filtering a data stream, the filter engine passes a pointer as the layerData parameter to an FWPS_STREAM_CALLOUT_IO_PACKET0 structure to a callout's classifyFn callout function.

Requirements

See Also

Reference

WFP Callout Driver Structures
classifyFn
FWPS_STREAM_DATA0
FWPS_FILTER0
FwpsStreamContinue0
WFP Callout Driver Reference