/*
Copyright (c) Microsoft Corporation. All rights reserved.
Module Name:
ipfltdrv.h
Abstract:
Contains the IOCTLs and related data structures needed to interact with the IP
Filter Driver
Author:
Amritansh Raghav
Revision History:
amritanr 30th Nov 1995 Created
--*/
#ifndef __IPFLTDRV_H__
#define __IPFLTDRV_H__
#if _MSC_VER > 1000
#pragma once
#endif
#define IPHDRLEN 0xf // header length mask in iph_verlen
#define IPHDRSFT 2 // scaling value for the length
//
// Typedefs used in this file
//
#ifndef CTE_TYPEDEFS_DEFINED
#define CTE_TYPEDEFS_DEFINED 1
typedef unsigned long ulong;
typedef unsigned short ushort;
typedef unsigned char uchar;
typedef unsigned int uint;
#endif // CTE_TYPEDEFS_DEFINED
#include <pfhook.h>
//
// if you don't want these definitions, define the manifest in your sources file
//
#include <packon.h>
//
// Structure of an ICMP header.
//
#ifndef IP_H_INCLUDED
//* IP Header format.
struct IPHeader {
uchar iph_verlen; // Version and length.
uchar iph_tos; // Type of service.
ushort iph_length; // Total length of datagram.
ushort iph_id; // Identification.
ushort iph_offset; // Flags and fragment offset.
uchar iph_ttl; // Time to live.
uchar iph_protocol; // Protocol.
ushort iph_xsum; // Header checksum.
IPAddr iph_src; // Source address.
IPAddr iph_dest; // Destination address.
}; /* IPHeader */
typedef struct IPHeader IPHeader;
#endif
#ifndef ICMPHEADER_INCLUDED
typedef struct ICMPHeader {
UCHAR ich_type; // Type of ICMP packet.
UCHAR ich_code; // Subcode of type.
USHORT ich_xsum; // Checksum of packet.
ULONG ich_param; // Type-specific parameter field.
} ICMPHeader , *PICMPHeader;
#endif
#include <packoff.h>
#include <rtinfo.h>
#include <ipinfoid.h>
#include <ipfltinf.h>
#define IP_FILTER_DRIVER_VERSION_1 1
#define IP_FILTER_DRIVER_VERSION_2 1
#define IP_FILTER_DRIVER_VERSION IP_FILTER_DRIVER_VERSION_2
#define MAX_ADDRWORDS 1
//
// common flags
//
#define PF_GLOBAL_FLAGS_LOGON 0x80000000
#define PF_GLOBAL_FLAGS_ABSORB 0x40000000
//
// Log ID
//
typedef UINT_PTR PFLOGGER ;
//////////////////////////////////////////////////////////////////////////////
// //
// Service name - this is what the service is called //
// //
//////////////////////////////////////////////////////////////////////////////
#define IPFLTRDRVR_SERVICE_NAME "IPFilterDriver"
//
// The following definitions come from <pfhook.h> now.
//
//////////////////////////////////////////////////////////////////////////////
// //
// Device Name - this string is the name of the device. It is the name //
// that should be passed to NtOpenFile when accessing the device. //
// //
//////////////////////////////////////////////////////////////////////////////
//#define DD_IPFLTRDRVR_DEVICE_NAME L"\\Device\\IPFILTERDRIVER"
//////////////////////////////////////////////////////////////////////////////
// //
// IOCTL code definitions and related structures //
// All the IOCTLs are synchronous and need administrator privilege //
// //
//////////////////////////////////////////////////////////////////////////////
//#define FSCTL_IPFLTRDRVR_BASE FILE_DEVICE_NETWORK
//#define _IPFLTRDRVR_CTL_CODE(function, method, access) \
// CTL_CODE(FSCTL_IPFLTRDRVR_BASE, function, method, access)
//////////////////////////////////////////////////////////////////////////////
// //
// This IOCTL is used to to create an interface in the filter driver. It //
// takes in an index and an opaque context. It creates an interface, //
// associates the index and context with it and returns a context for this //
// created interface. All future IOCTLS require this context that is passed //
// out //
// //
//////////////////////////////////////////////////////////////////////////////
#define IOCTL_CREATE_INTERFACE \
_IPFLTRDRVR_CTL_CODE(0, METHOD_BUFFERED, FILE_WRITE_ACCESS)
typedef struct _FILTER_DRIVER_CREATE_INTERFACE
{
IN DWORD dwIfIndex;
IN DWORD dwAdapterId;
IN PVOID pvRtrMgrContext;
OUT PVOID pvDriverContext;
}FILTER_DRIVER_CREATE_INTERFACE, *PFILTER_DRIVER_CREATE_INTERFACE;
#define INVALID_FILTER_DRIVER_CONTEXT NULL
//////////////////////////////////////////////////////////////////////////////
// //
// This IOCTL is used to set filters for an interface. //
// The context used to identify the interface is the one that is passed out //
// by the CREATE_INTERFACE IOCTL //
// There can be two TOC entries, one for IP_FILTER_DRIVER_IN_FILTER_INFO //
// and the other for IP_FILTER_DRIVER_OUT_FILTER_INFO. //
// If a (in or out) TOC entry doesnt exist, no change is made to the //
// (in or out) filters. //
// If a (in or out) TOC exists and its size is 0, the (in or out) filters //
// are deleted and the default (in or out) action set to FORWARD. //
// If a TOC exists and its size is not 0 but the number of filters in the //
// FILTER_DESCRIPTOR is 0, the old filters are deleted and the default //
// action set to the one specified in the descriptor. //
// The last case is when the Toc exists, its size is not 0, and the //
// number of filters is also not 0. In this case, the old filters are //
// deleted, the default action set to the one specified in the descriptor //
// and the new filters are added. //
// //
//////////////////////////////////////////////////////////////////////////////
#define IOCTL_SET_INTERFACE_FILTERS \
_IPFLTRDRVR_CTL_CODE(1, METHOD_BUFFERED, FILE_WRITE_ACCESS)
//////////////////////////////////////////////////////////////////////////////
// //
// NOTE: These two IDs are reused but since they are used in different //
// namespaces, we can do that safely //
// //
//////////////////////////////////////////////////////////////////////////////
#define IP_FILTER_DRIVER_IN_FILTER_INFO IP_GENERAL_INFO_BASE + 1
#define IP_FILTER_DRIVER_OUT_FILTER_INFO IP_GENERAL_INFO_BASE + 2
typedef struct _FILTER_DRIVER_SET_FILTERS
{
IN PVOID pvDriverContext;
IN RTR_INFO_BLOCK_HEADER ribhInfoBlock;
}FILTER_DRIVER_SET_FILTERS, *PFILTER_DRIVER_SET_FILTERS;
//
//Definitions for logging and for filter defs.
//
typedef enum _pfEtype
{
PFE_FILTER = 1,
PFE_SYNORFRAG,
PFE_SPOOF,
PFE_UNUSEDPORT,
PFE_ALLOWCTL,
PFE_FULLDENY,
PFE_NOFRAG,
PFE_STRONGHOST,
PFE_FRAGCACHE
} PFETYPE, *PPFETYPE;
typedef struct _FILTER_INFO
{
DWORD dwSrcAddr;
DWORD dwSrcMask;
DWORD dwDstAddr;
DWORD dwDstMask;
DWORD dwProtocol;
DWORD fLateBound;
WORD wSrcPort;
WORD wDstPort;
}FILTER_INFO, *PFILTER_INFO;
typedef enum _AddrType
{
IPV4,
IPV6
}ADDRTYPE, *PADDRTYPE;
typedef struct _FILTER_INFO2
{
ADDRTYPE addrType;
DWORD dwaSrcAddr[MAX_ADDRWORDS];
DWORD dwaSrcMask[MAX_ADDRWORDS];
DWORD dwaDstAddr[MAX_ADDRWORDS];
DWORD dwaDstMask[MAX_ADDRWORDS];
DWORD dwProtocol;
DWORD fLateBound;
WORD wSrcPort;
WORD wDstPort;
WORD wSrcPortHigh;
WORD wDstPortHigh;
}FILTER_INFO2, *PFILTER_INFO2;
typedef struct _FILTER_DESCRIPTOR
{
DWORD dwVersion;
DWORD dwNumFilters;
FORWARD_ACTION faDefaultAction;
FILTER_INFO fiFilter[1];
}FILTER_DESCRIPTOR, *PFILTER_DESCRIPTOR;
//
// new filter definition
//
typedef struct _pfFilterInfoEx
{
PFETYPE type;
DWORD dwFlags;
DWORD dwFilterRule;
PVOID pvFilterHandle;
FILTER_INFO2 info;
} FILTER_INFOEX, *PFILTER_INFOEX;
#define FLAGS_INFOEX_NOSYN 0x1 // not implemented.
#define FLAGS_INFOEX_LOGALL 0x2
#define FLAGS_INFOEX_ALLOWDUPS 0x4
#define FLAGS_INFOEX_ALLFLAGS 0x7
#define FLAGS_INFOEX_ALLOWANYREMOTEADDRESS 0x8
#define FLAGS_INFOEX_ALLOWANYLOCALADDRESS 0x10
typedef struct _FILTER_DESCRIPTOR2
{
DWORD dwVersion; // must be 2
DWORD dwNumFilters;
FILTER_INFOEX fiFilter[1];
} FILTER_DESCRIPTOR2, *PFILTER_DESCRIPTOR2;
//////////////////////////////////////////////////////////////////////////////
// //
// The constants that should be used to set up the FILTER_INFO_STRUCTURE //
// //
//////////////////////////////////////////////////////////////////////////////
#define FILTER_PROTO(ProtoId) MAKELONG(MAKEWORD((ProtoId),0x00),0x00000)
#define FILTER_PROTO_ANY FILTER_PROTO(0x00)
#define FILTER_PROTO_ICMP FILTER_PROTO(0x01)
#define FILTER_PROTO_TCP FILTER_PROTO(0x06)
//#define FILTER_PROTO_TCP_ESTAB FILTER_PROTO(0x86)
#define FILTER_PROTO_UDP FILTER_PROTO(0x11)
#define FILTER_TCPUDP_PORT_ANY (WORD)0x0000
#define FILTER_ICMP_TYPE_ANY (BYTE)0xff
#define FILTER_ICMP_CODE_ANY (BYTE)0xff
//////////////////////////////////////////////////////////////////////////////
// //
// For WAN interfaces, the address is unknown at the time the filters are //
// set. Use these two constants two specify "Local Address". The address //
// and mask are set with IOCTL_INTERFACE_BOUND //
// //
//////////////////////////////////////////////////////////////////////////////
#define SRC_ADDR_USE_LOCAL_FLAG 0x00000001
#define SRC_ADDR_USE_REMOTE_FLAG 0x00000002
#define DST_ADDR_USE_LOCAL_FLAG 0x00000004
#define DST_ADDR_USE_REMOTE_FLAG 0x00000008
#define SRC_MASK_LATE_FLAG 0x00000010
#define DST_MASK_LATE_FLAG 0x00000020
#define SetSrcAddrToLocalAddr(pFilter) \
((pFilter)->fLateBound |= SRC_ADDR_USE_LOCAL_FLAG)
#define SetSrcAddrToRemoteAddr(pFilter) \
((pFilter)->fLateBound |= SRC_ADDR_USE_REMOTE_FLAG)
#define SetDstAddrToLocalAddr(pFilter) \
((pFilter)->fLateBound |= DST_ADDR_USE_LOCAL_FLAG)
#define SetDstAddrToRemoteAddr(pFilter) \
((pFilter)->fLateBound |= DST_ADDR_USE_REMOTE_FLAG)
#define SetSrcMaskLateFlag(pFilter) ((pFilter)->fLateBound |= SRC_MASK_LATE_FLAG)
#define SetDstMaskLateFlag(pFilter) ((pFilter)->fLateBound |= DST_MASK_LATE_FLAG)
#define AreAllFieldsUnchanged(pFilter) \
((pFilter)->fLateBound == 0x00000000)
#define DoesSrcAddrUseLocalAddr(pFilter) \
((pFilter)->fLateBound & SRC_ADDR_USE_LOCAL_FLAG)
#define DoesSrcAddrUseRemoteAddr(pFilter) \
((pFilter)->fLateBound & SRC_ADDR_USE_REMOTE_FLAG)
#define DoesDstAddrUseLocalAddr(pFilter) \
((pFilter)->fLateBound & DST_ADDR_USE_LOCAL_FLAG)
#define DoesDstAddrUseRemoteAddr(pFilter) \
((pFilter)->fLateBound & DST_ADDR_USE_REMOTE_FLAG)
#define IsSrcMaskLateBound(pFilter) ((pFilter)->fLateBound & SRC_MASK_LATE_FLAG)
#define IsDstMaskLateBound(pFilter) ((pFilter)->fLateBound & DST_MASK_LATE_FLAG)
//////////////////////////////////////////////////////////////////////////////
// //
// This IOCTL is used to specify address and mask information for WAN //
// interfaces at the time they bind. The driver goes through all the //
// filters for the interface specified by pvDriverContext and if the //
// fLateBind flag was sepecified for the filter, it changes the //
// any FILTER_ADDRESS_UNKNOWN fields in the source with dwSrcAddr and //
// those in the dest with dwDstAddr //
// //
//////////////////////////////////////////////////////////////////////////////
#define IOCTL_SET_LATE_BOUND_FILTERS \
_IPFLTRDRVR_CTL_CODE(2, METHOD_BUFFERED, FILE_WRITE_ACCESS)
typedef struct _FILTER_DRIVER_BINDING_INFO
{
IN PVOID pvDriverContext;
IN DWORD dwLocalAddr;
IN DWORD dwRemoteAddr;
IN DWORD dwMask;
}FILTER_DRIVER_BINDING_INFO, *PFILTER_DRIVER_BINDING_INFO;
//////////////////////////////////////////////////////////////////////////////
// //
// This IOCTL deletes an interface. Once this is called, one may not use //
// the context of this interface for either any of the IOCTLs or the //
// MatchFilter() function //
// //
//////////////////////////////////////////////////////////////////////////////
#define IOCTL_DELETE_INTERFACE \
_IPFLTRDRVR_CTL_CODE(3, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_DELETE_INTERFACEEX \
_IPFLTRDRVR_CTL_CODE(11, METHOD_BUFFERED, FILE_WRITE_ACCESS)
typedef struct _FILTER_DRIVER_DELETE_INTERFACE
{
IN PVOID pvDriverContext;
}FILTER_DRIVER_DELETE_INTERFACE, *PFILTER_DRIVER_DELETE_INTERFACE;
//////////////////////////////////////////////////////////////////////////////
// //
// This IOCTL is exposed so that a user mode test utility can test the //
// correctness of implementation of the driver //
// //
//////////////////////////////////////////////////////////////////////////////
#define IOCTL_TEST_PACKET \
_IPFLTRDRVR_CTL_CODE(4, METHOD_BUFFERED, FILE_READ_ACCESS)
typedef struct _FILTER_DRIVER_TEST_PACKET
{
IN PVOID pvInInterfaceContext;
IN PVOID pvOutInterfaceContext;
OUT FORWARD_ACTION eaResult;
IN BYTE bIpPacket[1];
}FILTER_DRIVER_TEST_PACKET, *PFILTER_DRIVER_TEST_PACKET;
//////////////////////////////////////////////////////////////////////////////
// //
// This IOCTL get the information associated with an interface. This //
// includes the filters set for the interface and statistics related to the //
// filters themselves. If the size of buffer passed to it is less than //
// sizeof(FILTER_DRIVER_GET_FILTERS), it returns STATUS_INSUFFICIENT_BUFFER.//
// If the size is >= sizeof(FILTER_DRIVER_GET_FILTERS) but less than what is//
// needed to fill in all the FILTER_STATS, then only the number of in and //
// out filters is written out (so that the user can figure out how much //
// memory is needed) and it return STATUS_SUCCESS. If the buffer passed is //
// large enough all the information is written out //
// //
//////////////////////////////////////////////////////////////////////////////
#define IOCTL_GET_FILTER_INFO \
_IPFLTRDRVR_CTL_CODE(5, METHOD_BUFFERED, FILE_READ_ACCESS)
typedef struct _FILTER_STATS_EX
{
DWORD dwNumPacketsFiltered;
FILTER_INFOEX info;
}FILTER_STATS_EX, *PFILTER_STATS_EX;
typedef struct _FILTER_STATS
{
DWORD dwNumPacketsFiltered;
FILTER_INFO info;
}FILTER_STATS, *PFILTER_STATS;
typedef struct _FILTER_IF
{
FORWARD_ACTION eaInAction;
FORWARD_ACTION eaOutAction;
DWORD dwNumInFilters;
DWORD dwNumOutFilters;
FILTER_STATS filters[1];
}FILTER_IF, *PFILTER_IF;
typedef struct _FILTER_DRIVER_GET_FILTERS
{
IN PVOID pvDriverContext;
OUT DWORD dwDefaultHitsIn;
OUT DWORD dwDefaultHitsOut;
OUT FILTER_IF interfaces;
}FILTER_DRIVER_GET_FILTERS, *PFILTER_DRIVER_GET_FILTERS;
//////////////////////////////////////////////////////////////////////////////
// //
// This IOCTL gets the performance information associated with the filter //
// driver. This information is only collected if the driver is built with //
// the DRIVER_PERF flag //
// //
//////////////////////////////////////////////////////////////////////////////
#define IOCTL_GET_FILTER_TIMES \
_IPFLTRDRVR_CTL_CODE(6, METHOD_BUFFERED, FILE_READ_ACCESS)
typedef struct _FILTER_DRIVER_GET_TIMES
{
OUT DWORD dwFragments;
OUT DWORD dwNumPackets;
OUT DWORD dwCache1;
OUT DWORD dwCache2;
OUT DWORD dwWalk1;
OUT DWORD dwWalk2;
OUT DWORD dwForw;
OUT DWORD dwWalkCache;
OUT LARGE_INTEGER liTotalTime;
}FILTER_DRIVER_GET_TIMES, *PFILTER_DRIVER_GET_TIMES;
typedef struct _MIB_IFFILTERTABLE
{
DWORD dwIfIndex;
DWORD dwDefaultHitsIn;
DWORD dwDefaultHitsOut;
FILTER_IF table;
}MIB_IFFILTERTABLE, *PMIB_IFFILTERTABLE;
#define SIZEOF_IFFILTERTABLE(X) \
(MAX_MIB_OFFSET + sizeof(MIB_IFFILTERTABLE) - sizeof(FILTER_STATS) + ((X) * sizeof(FILTER_STATS)) + ALIGN_SIZE)
typedef struct _FILTER_DRIVER_GET_TIMES MIB_IFFILTERTIMES, *PMIB_IFFILTERTIMES;
//
// New IOCTLs and definitions for creating interfaces and filters and
// retrieving information
//
#define IOCTL_PF_CREATE_AND_SET_INTERFACE_PARAMETERS \
_IPFLTRDRVR_CTL_CODE(9, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_PF_GET_INTERFACE_PARAMETERS \
_IPFLTRDRVR_CTL_CODE(14, METHOD_BUFFERED, FILE_WRITE_ACCESS)
typedef enum _PfBindingType
{
PF_BIND_NONE = 0,
PF_BIND_IPV4ADDRESS,
PF_BIND_IPV6ADDRESS,
PF_BIND_NAME,
PF_BIND_INTERFACEINDEX
} PFBINDINGTYPE, *PPFBINDINGTYPE;
typedef struct _pfSetInterfaceParameters
{
PFBINDINGTYPE pfbType;
DWORD dwBindingData;
FORWARD_ACTION eaIn;
FORWARD_ACTION eaOut;
FILTER_DRIVER_CREATE_INTERFACE fdInterface;
DWORD dwInterfaceFlags;
PFLOGGER pfLogId;
} PFINTERFACEPARAMETERS, *PPFINTERFACEPARAMETERS;
//
// flags for dwInterfaceFlags
//
#define PFSET_FLAGS_UNIQUE 0x1
//
// Structure used to fetch the interface parameters
//
typedef struct _pfGetInterfaceParameters
{
DWORD dwReserved;
PVOID pvDriverContext;
DWORD dwFlags;
DWORD dwInDrops;
DWORD dwOutDrops;
FORWARD_ACTION eaInAction;
FORWARD_ACTION eaOutAction;
DWORD dwNumInFilters;
DWORD dwNumOutFilters;
DWORD dwSynOrFrag;
DWORD dwSpoof;
DWORD dwUnused;
DWORD dwTcpCtl;
LARGE_INTEGER liSYN;
LARGE_INTEGER liTotalLogged;
DWORD dwLostLogEntries;
FILTER_STATS_EX FilterInfo[1];
} PFGETINTERFACEPARAMETERS, *PPFGETINTERFACEPARAMETERS;
//
// flags for above
//
#define GET_FLAGS_RESET 0x1 // reset all fetched counters
#define GET_FLAGS_FILTERS 0x2 // fetch filters as well
#define GET_BY_INDEX 0x4 // pvDriverContext is an
// interface index not
// an interface handle
//
// These IOCTL definitions are used to create, modify and delete
// log interfaces
//
#define IOCTL_PF_CREATE_LOG \
_IPFLTRDRVR_CTL_CODE(7, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_PF_DELETE_LOG \
_IPFLTRDRVR_CTL_CODE(8, METHOD_BUFFERED, FILE_WRITE_ACCESS)
//
// A logged frame.
//
typedef struct _pfLoggedFrame
{
LARGE_INTEGER Timestamp;
PFETYPE pfeTypeOfFrame;
DWORD dwTotalSizeUsed;
DWORD dwFilterRule;
WORD wSizeOfAdditionalData;
WORD wSizeOfIpHeader;
DWORD dwRtrMgrIndex;
DWORD dwIPIndex;
IPHeader IpHeader;
BYTE bData[1];
} PFLOGGEDFRAME, *PPFLOGGEDFRAME;
typedef struct _PfLog
{
PFLOGGER pfLogId;
HANDLE hEvent;
DWORD dwFlags; // see LOG_ flags below
} PFLOG, *PPFLOG;
typedef struct _PfDeleteLog
{
PFLOGGER pfLogId;
} PFDELETELOG, *PPFDELETELOG;
//
// set a new log buffer. Note dwSize is an in/out
//
typedef struct _PfSetBuffer
{
IN PFLOGGER pfLogId;
IN OUT DWORD dwSize;
OUT DWORD dwLostEntries;
OUT DWORD dwLoggedEntries;
OUT PBYTE pbPreviousAddress;
IN DWORD dwSizeThreshold;
IN DWORD dwEntriesThreshold;
IN DWORD dwFlags;
IN PBYTE pbBaseOfLog;
} PFSETBUFFER, *PPFSETBUFFER;
typedef struct _InterfaceBinding
{
PVOID pvDriverContext;
PFBINDINGTYPE pfType;
DWORD dwAdd;
DWORD dwEpoch;
} INTERFACEBINDING, *PINTERFACEBINDING;
typedef struct _InterfaceBinding2
{
PVOID pvDriverContext;
PFBINDINGTYPE pfType;
DWORD dwAdd;
DWORD dwEpoch;
DWORD dwLinkAdd;
} INTERFACEBINDING2, *PINTERFACEBINDING2;
//
// flags for above
//
#define LOG_LOG_ABSORB 0x1 // log is used to absorb frames
typedef struct _FIlterDriverGetSyncCount
{
LARGE_INTEGER liCount;
} FILTER_DRIVER_GET_SYN_COUNT, *PFILTER_DRIVER_GET_SYN_COUNT;
//
// IOCTL_PF_DELETE_BY_HANDLE input structure
//
typedef struct _PfDeleteByHandle
{
PVOID pvDriverContext;
PVOID pvHandles[1];
} PFDELETEBYHANDLE, *PPFDELETEBYHANDLE;
//
// IOCTL to do incremental filter setting and deleting. This IOCTL requires
// using the new filter info definitions. No mix and match matey.
//
#define IOCTL_SET_INTERFACE_FILTERS_EX \
_IPFLTRDRVR_CTL_CODE(10, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_DELETE_INTERFACE_FILTERS_EX \
_IPFLTRDRVR_CTL_CODE(12, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_SET_LOG_BUFFER \
_IPFLTRDRVR_CTL_CODE(13, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_SET_INTERFACE_BINDING \
_IPFLTRDRVR_CTL_CODE(15, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_CLEAR_INTERFACE_BINDING \
_IPFLTRDRVR_CTL_CODE(16, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_SET_LATE_BOUND_FILTERSEX \
_IPFLTRDRVR_CTL_CODE(17, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_GET_SYN_COUNTS \
_IPFLTRDRVR_CTL_CODE(18, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_PF_DELETE_BY_HANDLE \
_IPFLTRDRVR_CTL_CODE(19, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_PF_IP_ADDRESS_LOOKUP \
_IPFLTRDRVR_CTL_CODE(20, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#define IOCTL_SET_INTERFACE_BINDING2 \
_IPFLTRDRVR_CTL_CODE(21, METHOD_BUFFERED, FILE_WRITE_ACCESS)
#endif //__IPFLTDRV_H__