Initializing a Callout Driver

A callout driver initializes itself within its DriverEntry function. The main initialization tasks are as follows:

callout driver在DriverEntry函数中初始化自己，主要的初始化功能如下：

• Specifying an Unload Function
• Creating a Device Object
• Registering Callouts with the Filter Engine

Specifying an Unload Function

A callout driver must provide an unload function. The operating system calls this function when the callout driver is unloaded from the system. A callout driver's unload function must guarantee that the callout driver's callouts are unregistered from the filter engine before the callout driver is unloaded from system memory. A callout driver cannot be unloaded from the system if it does not provide an unload function.

callout driver必须提供卸载函数，否则无法卸载callout driver。另外必须在卸载函数中保证从过滤引擎反注册callouts。

How a callout driver specifies an unload function depends on whether the callout driver is based on the Windows Driver Model (WDM) or the Windows Driver Foundation (WDF).

WDM-Based Callout Drivers
If a callout driver is based on WDM, it specifies an Unload function in its DriverEntry function. For example:

VOID
  Unload(
    IN PDRIVER_OBJECT DriverObject
    );

NTSTATUS
  DriverEntry(
    IN PDRIVER_OBJECT DriverObject,
    IN PUNICODE_STRING RegistryPath
    )
{
  ...

  // Specify the callout driver's Unload function
  DriverObject->DriverUnload = Unload;

  ...
}

Creating a Device Object

A callout driver must create a device object before it can register its callouts with the filter engine. How a callout driver creates a device object depends on whether the callout driver is based on the Windows Driver Model (WDM) or the Windows Driver Foundation (WDF).

callout driver在注册它的callouts之前必须创建设备对象。

WDM-Based Callout Drivers
If a callout driver is based on WDM, it creates a device object by calling the IoCreateDevice function. For example:

PDEVICE_OBJECT deviceObject;

NTSTATUS
  DriverEntry(
    IN PDRIVER_OBJECT DriverObject,
    IN PUNICODE_STRING RegistryPath
    )
{
  NTSTATUS status;

  ...

  // Create a device object
  status =
    IoCreateDevice(
      DriverObject,
      0,
      NULL,
      FILE_DEVICE_UNKNOWN,
      FILE_DEVICE_SECURE_OPEN,
      FALSE,
      &deviceObject
      );

  ...

  return status;
}

Registering Callouts with the Filter Engine

After a callout driver has created a device object, it can then register its callouts with the filter engine. A callout driver can register its callouts with the filter engine at any time, even if the filter engine is currently not running. To register a callout with the filter engine, a callout driver calls the FwpsCalloutRegister0 function. For example:

callout driver在创建完设备对象后，就可以注册它的callouts了。callout driver可以在任意时候注册callouts，甚至在过滤引擎没有运行时。为了注册callout，驱动调用FwpsCalloutRegister0函数。

// Prototypes for the callout's callout functions
VOID NTAPI
  ClassifyFn(
    IN const FWPS_INCOMING_VALUES0  *inFixedValues,
    IN const FWPS_INCOMING_METADATA_VALUES0  *inMetaValues,
    IN OUT VOID  *layerData,
    IN const FWPS_FILTER0  *filter,
    IN UINT64  flowContext,
    OUT FWPS_CLASSIFY_OUT0  *classifyOut
    );

NTSTATUS NTAPI
  NotifyFn(
    IN FWPS_CALLOUT_NOTIFY_TYPE  notifyType,
    IN const GUID  *filterKey,
    IN const FWPS_FILTER0  *filter
    );

VOID NTAPI
  FlowDeleteFn(
    IN UINT16  layerId,
    IN UINT32  calloutId,
    IN UINT64  flowContext
    );

// Callout registration structure
const FWPS_CALLOUT0 Callout =
{
  { ... }, // GUID key identifying the callout
  0,       // Callout-specific flags (none set here)
  ClassifyFn,
  NotifyFn,
  FlowDeleteFn
};

// Variable for the run-time callout identifier
UINT32 CalloutId;

NTSTATUS
  DriverEntry(
    IN PDRIVER_OBJECT DriverObject,
    IN PUNICODE_STRING RegistryPath
    )
{
  PDEVICE_OBJECT deviceObject;
  NTSTATUS status;

  ...

  status =
    FwpsCalloutRegister0(
      deviceObject,
      &Callout,
      &CalloutId
      );

  ...

  return status;
}

If the call to the FwpsCalloutRegister0 function is successful, the variable pointed to by the last parameter contains the run-time identifier for the callout. This run-time identifier corresponds to the GUID that was specified for the callout key.

调用FwpsCalloutRegister0成功后，最后一个参数包含一个运行时标识符，这个运行时标识符于callout key对应。

A single callout driver can implement more than one callout. If a callout driver implements more than one callout, it calls the FwpsCalloutRegister0 function one time for each callout that it supports to register each callout with the filter engine.