locked
FwpmFilterCreateEnumHandle0() returns FWP_E_TYPE_MISMATCH (0x80320027) when adding filter condition of type FWP_SECURITY_DESCRIPTOR_TYPE RRS feed

  • Question

  • As it told here,
    Security descriptors cannot be null when used in filter conditions. Moreover, they need to be in self-relative format.
    I use the same function (which calls BuildSecurityDescriptor() that creates ALREADY a self-relative security descriptor) to fill in the condition for enumerating and adding filters, and it works for adding, but don't work for enumerating!

    bool FillUserIdCondition(FWPM_FILTER_CONDITION *pFC){
    	EXPLICIT_ACCESS ea;
    	FWP_BYTE_BLOB *pSDBLOB=new FWP_BYTE_BLOB;
    	pSDBLOB->size=SECURITY_MAX_SID_SIZE;
    	BuildExplicitAccessWithName(&ea,L"User",FWP_ACTRL_MATCH_FILTER,GRANT_ACCESS,0);
    	dwBytes=BuildSecurityDescriptor(0,0,1,&ea,0,0,0,(ULONG*)&pSDBLOB->size,(PSECURITY_DESCRIPTOR*)&pSDBLOB->data);
    	if(dwBytes){
    		//Handle an error
    		delete pSDBLOB;
    	}else{
    		pFC->fieldKey=FWPM_CONDITION_ALE_USER_ID;
    		pFC->matchType=FWP_MATCH_EQUAL;
    		pFC->conditionValue.type=FWP_SECURITY_DESCRIPTOR_TYPE;
    		pFC->conditionValue.sd=pSDBLOB;
    	}
    	return !dwBytes;
    }
    
    …
    
    FWPM_FILTER_CONDITION cond={};
    FWPM_FILTER_ENUM_TEMPLATE et={0,FWPM_LAYER_ALE_AUTH_CONNECT_V4,FWP_FILTER_ENUM_OVERLAPPING,FWP_FILTER_ENUM_FLAG_SORTED,0,1,&cond,FWP_ACTION_BLOCK};
    if(FillUserIdCondition(&cond)){
    	dwErr=FwpmFilterCreateEnumHandle(hEngine,&et,&hEnum);	//here it fails with FWP_E_TYPE_MISMATCH
    	…
    }

    Initially I forgot about setting FWP_SECURITY_DESCRIPTOR_TYPE in my FillUserIdCondition() function, so there was no error in FwpmFilterCreateEnumHandle() (but added filters weren't working because of incorrect condition type). But when I found an error and fixed it, filters started working, but FwpmFilterCreateEnumHandle() now returns that error.

    How to make it work correctly?


    If I fall I will arise on my way to paradise

    • Moved by Hart Wang Wednesday, August 2, 2017 7:17 AM
    Friday, July 28, 2017 2:56 PM

All replies

  • Hi apixosoft,

    Thank you for posting here.

    I think that your issue is related to Windows Desktop Development  > Windows Filtering Platform (WFP) .

    I will move the case to off-topic forum. you can post the issue on above forum.

    Best Regards,

    Hart


    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Monday, July 31, 2017 5:30 AM