windows过滤平台。网络包装器？

Question

是否有适用于 Windows 过滤平台的 .NET 包装器？我希望使用 WFP 来观察我的 C# 应用程序中的应用程序级别网络流量观察。

谢谢！

Answer 1

不，我不相信有，尽管很多人似乎都想要一个。我认为你必须退回到 Win32 API。

Answer 2

我正在使用 P/Invoke Interop Assistant 为 WFP 编写自己的 .net 包装器。这是我用来让它工作的线程。

http://social. msdn.microsoft.com/Forums/en-US/wfp/thread/a65bf197-937b-401e-b15f-0e1c3decdb14/

Answer 3

您可以使用 nuget 包 vanara.PInvoke 来执行此操作

看看他的 GitHub

实现可以受到单元测试的“启发”

[Test]
public void FwpmCalloutEnum0Test()
{
    FWPM_CALLOUT_ENUM_TEMPLATE0 template = new() { layerKey = FWPM_LAYER_DATAGRAM_DATA_V4 };
    using SafeCoTaskMemStruct<FWPM_CALLOUT_ENUM_TEMPLATE0> pTemplate = template;
    FWPM_CALLOUT_SUBSCRIPTION0 subscr = new()
    {
        flags = FWPM_SUBSCRIPTION_FLAG.FWPM_SUBSCRIPTION_FLAG_NOTIFY_ON_ADD,
        //sessionKey = Guid.NewGuid(),
        enumTemplate = pTemplate
    };
    var changed = 0;
    using var pchng = new PinnedObject(changed);

    static void callback(IntPtr context, in FWPM_CALLOUT_CHANGE0 change) { unsafe { *(int*)context = 1; } }
    Assert.That(FwpmCalloutSubscribeChanges0(fwpEngineHandle, subscr, callback, pchng, out HFWPCALLOUTCHANGE hChange), ResultIs.Successful);

    Assert.That(FwpmCalloutSubscriptionsGet0(fwpEngineHandle, out SafeFwpmArray<FWPM_CALLOUT_SUBSCRIPTION0> subs), ResultIs.Successful);
    Assert.That(subs.Count, Is.EqualTo(1));

    FWPM_DISPLAY_DATA0 dd = new() { name = "Datagram-Data Proxy Callout", description = "Datagram-Data Proxy Callout" };
    FWPM_CALLOUT0 callout = new() { calloutKey = Guid.NewGuid(), displayData = dd, applicableLayer = FWPM_LAYER_DATAGRAM_DATA_V4 };
    Assert.That(FwpmCalloutAdd0(fwpEngineHandle, callout, default, out var id), ResultIs.Successful);

    //System.Threading.Thread.SpinWait(200);
    //Assert.That(changed, Is.Not.Zero);
    Assert.That(FwpmCalloutUnsubscribeChanges0(fwpEngineHandle, hChange), ResultIs.Successful);

    Assert.That(FwpmCalloutGetById0(fwpEngineHandle, id, out SafeFwpmStruct<FWPM_CALLOUT0> byId), ResultIs.Successful);
    Assert.True(byId.Value.HasValue && byId.Value.Value.calloutId == id);
    Assert.That(FwpmCalloutGetByKey0(fwpEngineHandle, callout.calloutKey, out SafeFwpmStruct<FWPM_CALLOUT0> byKey), ResultIs.Successful);
    Assert.True(byKey.Value.HasValue && byKey.Value.Value.calloutId == id);
    Assert.That(FwpmCalloutGetSecurityInfoByKey0(fwpEngineHandle, callout.calloutKey,
        SECURITY_INFORMATION.OWNER_SECURITY_INFORMATION|SECURITY_INFORMATION.GROUP_SECURITY_INFORMATION|SECURITY_INFORMATION.DACL_SECURITY_INFORMATION,
        out PSID sOwn, out PSID sGrp, out PACL dacl, out PACL sacl, out SafeFwpmMem sd), ResultIs.Successful);
    Assert.True(!sOwn.IsNull && !sGrp.IsNull && !dacl.IsNull);
    Assert.True(sOwn.IsValidSid() && sGrp.IsValidSid() && dacl.IsValidAcl());

    Assert.That(FwpmCalloutDeleteById0(fwpEngineHandle, id), ResultIs.Successful);

    //-----------------------------------------
    // Get the events from enumeration
    Assert.That(FwpmCalloutEnum0(fwpEngineHandle, out SafeFwpmArray<FWPM_CALLOUT0> h), ResultIs.Successful);
    foreach (FWPM_CALLOUT0 e in h)
    {
        TestContext.WriteLine($"{e.calloutKey}=({e.flags})=========");
        TestContext.WriteLine($"{e.displayData.name ?? nullStr} ({e.displayData.description ?? nullStr})");
        TestContext.WriteLine($"Prov={GetNameOf(e.providerKey.Value.GetValueOrDefault()) ?? nullStr}; Layer={GetNameOf(e.applicableLayer)}");
    }
}