none
Questions about ALE_AUTH_CONNECT RRS feed

  • Question

  • Hi,

    In ALE_AUTH_CONNECT classify function, we have FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_APP_ID from inFixedValues and FWPS_METADATA_FIELD_PROCESS_PATH from inMetaValues with following explaination from WDK:

    FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_APP_ID : The full path of the application.
    FWPS_METADATA_FIELD_PROCESS_PATH : The full path to the process that owns the endpoint.

    My question is, do they always contain the same string? If not, then what's the difference ?
    Second question, does the classifyFn of ALE_AUTH_CONNECT always runs at passive level?

    Thank you very much.

    Tuesday, July 22, 2008 1:34 PM

Answers

  • ALE_APP_ID from inFixedValues and FWPS_METADATA_FIELD_PROCESS_PATH from inMetaValues points to the same value. (This does seem redundant).

     

    In general callout drivers must not assume the IRQL level at which classifyFn can be invoked.

     

    Hope this helps,

    Thanks,

    Biao.W.

    Wednesday, July 23, 2008 1:09 AM

All replies

  • ALE_APP_ID from inFixedValues and FWPS_METADATA_FIELD_PROCESS_PATH from inMetaValues points to the same value. (This does seem redundant).

     

    In general callout drivers must not assume the IRQL level at which classifyFn can be invoked.

     

    Hope this helps,

    Thanks,

    Biao.W.

    Wednesday, July 23, 2008 1:09 AM
  • This is very useful.

    Thanks Biao,
    Wednesday, July 23, 2008 2:30 AM