是否有适用于Windows Filtring Platform的.NET包装器?我正在寻找在我的C#应用程序中使用WFP观察应用程序级网络流量。
谢谢!
我正在使用P/Invoke Interop Assistant编写自己的.NET封装器来使用WFP。这是我用来使其工作的线程。
http://social.msdn.microsoft.com/Forums/en-US/wfp/thread/a65bf197-937b-401e-b15f-0e1c3decdb14/
不,我不认为有这样的东西,尽管很多人似乎想要一个。我认为你必须退回到使用Win32 API。
[Test]
public void FwpmCalloutEnum0Test()
{
FWPM_CALLOUT_ENUM_TEMPLATE0 template = new() { layerKey = FWPM_LAYER_DATAGRAM_DATA_V4 };
using SafeCoTaskMemStruct<FWPM_CALLOUT_ENUM_TEMPLATE0> pTemplate = template;
FWPM_CALLOUT_SUBSCRIPTION0 subscr = new()
{
flags = FWPM_SUBSCRIPTION_FLAG.FWPM_SUBSCRIPTION_FLAG_NOTIFY_ON_ADD,
//sessionKey = Guid.NewGuid(),
enumTemplate = pTemplate
};
var changed = 0;
using var pchng = new PinnedObject(changed);
static void callback(IntPtr context, in FWPM_CALLOUT_CHANGE0 change) { unsafe { *(int*)context = 1; } }
Assert.That(FwpmCalloutSubscribeChanges0(fwpEngineHandle, subscr, callback, pchng, out HFWPCALLOUTCHANGE hChange), ResultIs.Successful);
Assert.That(FwpmCalloutSubscriptionsGet0(fwpEngineHandle, out SafeFwpmArray<FWPM_CALLOUT_SUBSCRIPTION0> subs), ResultIs.Successful);
Assert.That(subs.Count, Is.EqualTo(1));
FWPM_DISPLAY_DATA0 dd = new() { name = "Datagram-Data Proxy Callout", description = "Datagram-Data Proxy Callout" };
FWPM_CALLOUT0 callout = new() { calloutKey = Guid.NewGuid(), displayData = dd, applicableLayer = FWPM_LAYER_DATAGRAM_DATA_V4 };
Assert.That(FwpmCalloutAdd0(fwpEngineHandle, callout, default, out var id), ResultIs.Successful);
//System.Threading.Thread.SpinWait(200);
//Assert.That(changed, Is.Not.Zero);
Assert.That(FwpmCalloutUnsubscribeChanges0(fwpEngineHandle, hChange), ResultIs.Successful);
Assert.That(FwpmCalloutGetById0(fwpEngineHandle, id, out SafeFwpmStruct<FWPM_CALLOUT0> byId), ResultIs.Successful);
Assert.True(byId.Value.HasValue && byId.Value.Value.calloutId == id);
Assert.That(FwpmCalloutGetByKey0(fwpEngineHandle, callout.calloutKey, out SafeFwpmStruct<FWPM_CALLOUT0> byKey), ResultIs.Successful);
Assert.True(byKey.Value.HasValue && byKey.Value.Value.calloutId == id);
Assert.That(FwpmCalloutGetSecurityInfoByKey0(fwpEngineHandle, callout.calloutKey,
SECURITY_INFORMATION.OWNER_SECURITY_INFORMATION|SECURITY_INFORMATION.GROUP_SECURITY_INFORMATION|SECURITY_INFORMATION.DACL_SECURITY_INFORMATION,
out PSID sOwn, out PSID sGrp, out PACL dacl, out PACL sacl, out SafeFwpmMem sd), ResultIs.Successful);
Assert.True(!sOwn.IsNull && !sGrp.IsNull && !dacl.IsNull);
Assert.True(sOwn.IsValidSid() && sGrp.IsValidSid() && dacl.IsValidAcl());
Assert.That(FwpmCalloutDeleteById0(fwpEngineHandle, id), ResultIs.Successful);
//-----------------------------------------
// Get the events from enumeration
Assert.That(FwpmCalloutEnum0(fwpEngineHandle, out SafeFwpmArray<FWPM_CALLOUT0> h), ResultIs.Successful);
foreach (FWPM_CALLOUT0 e in h)
{
TestContext.WriteLine($"{e.calloutKey}=({e.flags})=========");
TestContext.WriteLine($"{e.displayData.name ?? nullStr} ({e.displayData.description ?? nullStr})");
TestContext.WriteLine($"Prov={GetNameOf(e.providerKey.Value.GetValueOrDefault()) ?? nullStr}; Layer={GetNameOf(e.applicableLayer)}");
}
}