Win32 API 日本語リファレンス
ホーム › NetworkManagement.WindowsFilteringPlatform › FWPM_FILTER0

FWPM_FILTER0

構造体
📘 Microsoft Learn (日本語) · English
サイズx64: 200 バイト / x86: 152 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド型サイズx64x86説明
filterKeyGUID16+0+0フィルターを識別するGUID。GUID_NULL指定で自動生成。
displayDataFWPM_DISPLAY_DATA016/8+16+16フィルターの表示名と説明。
flagsFWPM_FILTER_FLAGS4+32+24フィルターの動作を制御するフラグ(永続化/ブートタイムなど)。
providerKeyGUID*8/4+40+28関連付くプロバイダーのGUIDへのポインター。NULL可。
providerDataFWP_BYTE_BLOB16/8+48+32プロバイダー固有のデータをバイトブロブで保持する。
layerKeyGUID16+64+40このフィルターを追加するレイヤーのGUID。
subLayerKeyGUID16+80+56このフィルターが属するサブレイヤーのGUID。
weightFWP_VALUE016/8+96+72フィルターの優先度を示す重み(FWP_VALUE0)。自動割当も可能。
numFilterConditionsDWORD4+112+80filterCondition配列の要素数。0なら全トラフィックに一致。
filterConditionFWPM_FILTER_CONDITION0*8/4+120+84適用条件の配列へのポインター。
actionFWPM_ACTION020+128+88条件一致時に実行する動作(許可/ブロックなど)。
Anonymous_Anonymous_e__Union16+152+112コンテキスト(プロバイダーコンテキスト等)を保持する共用体。
reservedGUID*8/4+168+128将来の使用のために予約されたGUIDポインター。
filterIdULONGLONG8+176+136実行時にフィルターへ割り当てられるID。読み取り専用。
effectiveWeightFWP_VALUE016/8+184+144実際に算出された有効な重み。読み取り専用。

共用体: _Anonymous_e__Union x64 16B / x86 16B

フィールド型サイズx64x86
rawContextULONGLONG8+0+0
providerContextKeyGUID16+0+0

各言語での定義

#include <windows.h>

// FWPM_DISPLAY_DATA0  (x64 16 / x86 8 バイト)
typedef struct FWPM_DISPLAY_DATA0 {
    LPWSTR name;
    LPWSTR description;
} FWPM_DISPLAY_DATA0;

// FWP_BYTE_BLOB  (x64 16 / x86 8 バイト)
typedef struct FWP_BYTE_BLOB {
    DWORD size;
    BYTE* data;
} FWP_BYTE_BLOB;

// FWP_VALUE0  (x64 16 / x86 8 バイト)
typedef struct FWP_VALUE0 {
    FWP_DATA_TYPE type;
    _Anonymous_e__Union Anonymous;
} FWP_VALUE0;

// FWPM_ACTION0  (x64 20 / x86 20 バイト)
typedef struct FWPM_ACTION0 {
    FWP_ACTION_TYPE type;
    _Anonymous_e__Union Anonymous;
} FWPM_ACTION0;

// FWPM_FILTER0  (x64 200 / x86 152 バイト)
typedef struct FWPM_FILTER0 {
    GUID filterKey;
    FWPM_DISPLAY_DATA0 displayData;
    FWPM_FILTER_FLAGS flags;
    GUID* providerKey;
    FWP_BYTE_BLOB providerData;
    GUID layerKey;
    GUID subLayerKey;
    FWP_VALUE0 weight;
    DWORD numFilterConditions;
    FWPM_FILTER_CONDITION0* filterCondition;
    FWPM_ACTION0 action;
    _Anonymous_e__Union Anonymous;
    GUID* reserved;
    ULONGLONG filterId;
    FWP_VALUE0 effectiveWeight;
} FWPM_FILTER0;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWPM_DISPLAY_DATA0
{
    public IntPtr name;
    public IntPtr description;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWP_BYTE_BLOB
{
    public uint size;
    public IntPtr data;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWP_VALUE0
{
    public int type;
    public _Anonymous_e__Union Anonymous;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWPM_ACTION0
{
    public uint type;
    public _Anonymous_e__Union Anonymous;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWPM_FILTER0
{
    public Guid filterKey;
    public FWPM_DISPLAY_DATA0 displayData;
    public uint flags;
    public IntPtr providerKey;
    public FWP_BYTE_BLOB providerData;
    public Guid layerKey;
    public Guid subLayerKey;
    public FWP_VALUE0 weight;
    public uint numFilterConditions;
    public IntPtr filterCondition;
    public FWPM_ACTION0 action;
    public _Anonymous_e__Union Anonymous;
    public IntPtr reserved;
    public ulong filterId;
    public FWP_VALUE0 effectiveWeight;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWPM_DISPLAY_DATA0
    Public name As IntPtr
    Public description As IntPtr
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWP_BYTE_BLOB
    Public size As UInteger
    Public data As IntPtr
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWP_VALUE0
    Public type As Integer
    Public Anonymous As _Anonymous_e__Union
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWPM_ACTION0
    Public type As UInteger
    Public Anonymous As _Anonymous_e__Union
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWPM_FILTER0
    Public filterKey As Guid
    Public displayData As FWPM_DISPLAY_DATA0
    Public flags As UInteger
    Public providerKey As IntPtr
    Public providerData As FWP_BYTE_BLOB
    Public layerKey As Guid
    Public subLayerKey As Guid
    Public weight As FWP_VALUE0
    Public numFilterConditions As UInteger
    Public filterCondition As IntPtr
    Public action As FWPM_ACTION0
    Public Anonymous As _Anonymous_e__Union
    Public reserved As IntPtr
    Public filterId As ULong
    Public effectiveWeight As FWP_VALUE0
End Structure
import ctypes
from ctypes import wintypes

class FWPM_DISPLAY_DATA0(ctypes.Structure):
    _fields_ = [
        ("name", ctypes.c_void_p),
        ("description", ctypes.c_void_p),
    ]

class FWP_BYTE_BLOB(ctypes.Structure):
    _fields_ = [
        ("size", wintypes.DWORD),
        ("data", ctypes.c_void_p),
    ]

class FWP_VALUE0(ctypes.Structure):
    _fields_ = [
        ("type", ctypes.c_int),
        ("Anonymous", _Anonymous_e__Union),
    ]

class FWPM_ACTION0(ctypes.Structure):
    _fields_ = [
        ("type", wintypes.DWORD),
        ("Anonymous", _Anonymous_e__Union),
    ]

class FWPM_FILTER0(ctypes.Structure):
    _fields_ = [
        ("filterKey", GUID),
        ("displayData", FWPM_DISPLAY_DATA0),
        ("flags", wintypes.DWORD),
        ("providerKey", ctypes.c_void_p),
        ("providerData", FWP_BYTE_BLOB),
        ("layerKey", GUID),
        ("subLayerKey", GUID),
        ("weight", FWP_VALUE0),
        ("numFilterConditions", wintypes.DWORD),
        ("filterCondition", ctypes.c_void_p),
        ("action", FWPM_ACTION0),
        ("Anonymous", _Anonymous_e__Union),
        ("reserved", ctypes.c_void_p),
        ("filterId", ctypes.c_ulonglong),
        ("effectiveWeight", FWP_VALUE0),
    ]
#[repr(C)]
pub struct FWPM_DISPLAY_DATA0 {
    pub name: *mut core::ffi::c_void,
    pub description: *mut core::ffi::c_void,
}

#[repr(C)]
pub struct FWP_BYTE_BLOB {
    pub size: u32,
    pub data: *mut core::ffi::c_void,
}

#[repr(C)]
pub struct FWP_VALUE0 {
    pub type: i32,
    pub Anonymous: _Anonymous_e__Union,
}

#[repr(C)]
pub struct FWPM_ACTION0 {
    pub type: u32,
    pub Anonymous: _Anonymous_e__Union,
}

#[repr(C)]
pub struct FWPM_FILTER0 {
    pub filterKey: GUID,
    pub displayData: FWPM_DISPLAY_DATA0,
    pub flags: u32,
    pub providerKey: *mut core::ffi::c_void,
    pub providerData: FWP_BYTE_BLOB,
    pub layerKey: GUID,
    pub subLayerKey: GUID,
    pub weight: FWP_VALUE0,
    pub numFilterConditions: u32,
    pub filterCondition: *mut core::ffi::c_void,
    pub action: FWPM_ACTION0,
    pub Anonymous: _Anonymous_e__Union,
    pub reserved: *mut core::ffi::c_void,
    pub filterId: u64,
    pub effectiveWeight: FWP_VALUE0,
}
import "golang.org/x/sys/windows"

type FWPM_DISPLAY_DATA0 struct {
	name uintptr
	description uintptr
}

type FWP_BYTE_BLOB struct {
	size uint32
	data uintptr
}

type FWP_VALUE0 struct {
	type int32
	Anonymous _Anonymous_e__Union
}

type FWPM_ACTION0 struct {
	type uint32
	Anonymous _Anonymous_e__Union
}

type FWPM_FILTER0 struct {
	filterKey windows.GUID
	displayData FWPM_DISPLAY_DATA0
	flags uint32
	providerKey uintptr
	providerData FWP_BYTE_BLOB
	layerKey windows.GUID
	subLayerKey windows.GUID
	weight FWP_VALUE0
	numFilterConditions uint32
	filterCondition uintptr
	action FWPM_ACTION0
	Anonymous _Anonymous_e__Union
	reserved uintptr
	filterId uint64
	effectiveWeight FWP_VALUE0
}
type
  FWPM_DISPLAY_DATA0 = record
    name: Pointer;
    description: Pointer;
  end;

  FWP_BYTE_BLOB = record
    size: DWORD;
    data: Pointer;
  end;

  FWP_VALUE0 = record
    type: Integer;
    Anonymous: _Anonymous_e__Union;
  end;

  FWPM_ACTION0 = record
    type: DWORD;
    Anonymous: _Anonymous_e__Union;
  end;

  FWPM_FILTER0 = record
    filterKey: TGUID;
    displayData: FWPM_DISPLAY_DATA0;
    flags: DWORD;
    providerKey: Pointer;
    providerData: FWP_BYTE_BLOB;
    layerKey: TGUID;
    subLayerKey: TGUID;
    weight: FWP_VALUE0;
    numFilterConditions: DWORD;
    filterCondition: Pointer;
    action: FWPM_ACTION0;
    Anonymous: _Anonymous_e__Union;
    reserved: Pointer;
    filterId: UInt64;
    effectiveWeight: FWP_VALUE0;
  end;
const FWPM_DISPLAY_DATA0 = extern struct {
    name: ?*anyopaque,
    description: ?*anyopaque,
};

const FWP_BYTE_BLOB = extern struct {
    size: u32,
    data: ?*anyopaque,
};

const FWP_VALUE0 = extern struct {
    type: i32,
    Anonymous: _Anonymous_e__Union,
};

const FWPM_ACTION0 = extern struct {
    type: u32,
    Anonymous: _Anonymous_e__Union,
};

const FWPM_FILTER0 = extern struct {
    filterKey: GUID,
    displayData: FWPM_DISPLAY_DATA0,
    flags: u32,
    providerKey: ?*anyopaque,
    providerData: FWP_BYTE_BLOB,
    layerKey: GUID,
    subLayerKey: GUID,
    weight: FWP_VALUE0,
    numFilterConditions: u32,
    filterCondition: ?*anyopaque,
    action: FWPM_ACTION0,
    Anonymous: _Anonymous_e__Union,
    reserved: ?*anyopaque,
    filterId: u64,
    effectiveWeight: FWP_VALUE0,
};
type
  FWPM_DISPLAY_DATA0 {.bycopy.} = object
    name: pointer
    description: pointer

  FWP_BYTE_BLOB {.bycopy.} = object
    size: uint32
    data: pointer

  FWP_VALUE0 {.bycopy.} = object
    type: int32
    Anonymous: _Anonymous_e__Union

  FWPM_ACTION0 {.bycopy.} = object
    type: uint32
    Anonymous: _Anonymous_e__Union

  FWPM_FILTER0 {.bycopy.} = object
    filterKey: GUID
    displayData: FWPM_DISPLAY_DATA0
    flags: uint32
    providerKey: pointer
    providerData: FWP_BYTE_BLOB
    layerKey: GUID
    subLayerKey: GUID
    weight: FWP_VALUE0
    numFilterConditions: uint32
    filterCondition: pointer
    action: FWPM_ACTION0
    Anonymous: _Anonymous_e__Union
    reserved: pointer
    filterId: uint64
    effectiveWeight: FWP_VALUE0
struct FWPM_DISPLAY_DATA0
{
    void* name;
    void* description;
}

struct FWP_BYTE_BLOB
{
    uint size;
    void* data;
}

struct FWP_VALUE0
{
    int type;
    _Anonymous_e__Union Anonymous;
}

struct FWPM_ACTION0
{
    uint type;
    _Anonymous_e__Union Anonymous;
}

struct FWPM_FILTER0
{
    GUID filterKey;
    FWPM_DISPLAY_DATA0 displayData;
    uint flags;
    void* providerKey;
    FWP_BYTE_BLOB providerData;
    GUID layerKey;
    GUID subLayerKey;
    FWP_VALUE0 weight;
    uint numFilterConditions;
    void* filterCondition;
    FWPM_ACTION0 action;
    _Anonymous_e__Union Anonymous;
    void* reserved;
    ulong filterId;
    FWP_VALUE0 effectiveWeight;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; FWPM_FILTER0 サイズ: 152 バイト(x86)
dim st, 38    ; 4byte整数×38(構造体サイズ 152 / 4 切り上げ)
; filterKey : GUID (+0, 16byte)  varptr(st)+0 を基点に操作(16byte:入れ子/配列)
; displayData : FWPM_DISPLAY_DATA0 (+16, 8byte)  varptr(st)+16 を基点に操作(8byte:入れ子/配列)
; flags : FWPM_FILTER_FLAGS (+24, 4byte)  st.6 = 値  /  値 = st.6   (lpoke/lpeek も可)
; providerKey : GUID* (+28, 4byte)  varptr(st)+28 を基点に操作(4byte:入れ子/配列)
; providerData : FWP_BYTE_BLOB (+32, 8byte)  varptr(st)+32 を基点に操作(8byte:入れ子/配列)
; layerKey : GUID (+40, 16byte)  varptr(st)+40 を基点に操作(16byte:入れ子/配列)
; subLayerKey : GUID (+56, 16byte)  varptr(st)+56 を基点に操作(16byte:入れ子/配列)
; weight : FWP_VALUE0 (+72, 8byte)  varptr(st)+72 を基点に操作(8byte:入れ子/配列)
; numFilterConditions : DWORD (+80, 4byte)  st.20 = 値  /  値 = st.20   (lpoke/lpeek も可)
; filterCondition : FWPM_FILTER_CONDITION0* (+84, 4byte)  varptr(st)+84 を基点に操作(4byte:入れ子/配列)
; action : FWPM_ACTION0 (+88, 20byte)  varptr(st)+88 を基点に操作(20byte:入れ子/配列)
; Anonymous : _Anonymous_e__Union (+112, 16byte)  varptr(st)+112 を基点に操作(16byte:入れ子/配列)
; reserved : GUID* (+128, 4byte)  varptr(st)+128 を基点に操作(4byte:入れ子/配列)
; filterId : ULONGLONG (+136, 8byte)  qpoke st,136,値 / qpeek(st,136)  ※IronHSPのみ。3.7/3.8は lpoke st,136,下位 : lpoke st,140,上位
; effectiveWeight : FWP_VALUE0 (+144, 8byte)  varptr(st)+144 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; FWPM_FILTER0 サイズ: 200 バイト(x64)
dim st, 50    ; 4byte整数×50(構造体サイズ 200 / 4 切り上げ)
; filterKey : GUID (+0, 16byte)  varptr(st)+0 を基点に操作(16byte:入れ子/配列)
; displayData : FWPM_DISPLAY_DATA0 (+16, 16byte)  varptr(st)+16 を基点に操作(16byte:入れ子/配列)
; flags : FWPM_FILTER_FLAGS (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; providerKey : GUID* (+40, 8byte)  varptr(st)+40 を基点に操作(8byte:入れ子/配列)
; providerData : FWP_BYTE_BLOB (+48, 16byte)  varptr(st)+48 を基点に操作(16byte:入れ子/配列)
; layerKey : GUID (+64, 16byte)  varptr(st)+64 を基点に操作(16byte:入れ子/配列)
; subLayerKey : GUID (+80, 16byte)  varptr(st)+80 を基点に操作(16byte:入れ子/配列)
; weight : FWP_VALUE0 (+96, 16byte)  varptr(st)+96 を基点に操作(16byte:入れ子/配列)
; numFilterConditions : DWORD (+112, 4byte)  st.28 = 値  /  値 = st.28   (lpoke/lpeek も可)
; filterCondition : FWPM_FILTER_CONDITION0* (+120, 8byte)  varptr(st)+120 を基点に操作(8byte:入れ子/配列)
; action : FWPM_ACTION0 (+128, 20byte)  varptr(st)+128 を基点に操作(20byte:入れ子/配列)
; Anonymous : _Anonymous_e__Union (+152, 16byte)  varptr(st)+152 を基点に操作(16byte:入れ子/配列)
; reserved : GUID* (+168, 8byte)  varptr(st)+168 を基点に操作(8byte:入れ子/配列)
; filterId : ULONGLONG (+176, 8byte)  qpoke st,176,値 / qpeek(st,176)  ※IronHSPのみ。3.7/3.8は lpoke st,176,下位 : lpoke st,180,上位
; effectiveWeight : FWP_VALUE0 (+184, 16byte)  varptr(st)+184 を基点に操作(16byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global GUID, pack=1
    #field int Data1
    #field short Data2
    #field short Data3
    #field byte Data4 8
#endstruct

#defstruct global FWPM_DISPLAY_DATA0
    #field intptr name
    #field intptr description
#endstruct

#defstruct global FWP_BYTE_BLOB
    #field int size
    #field intptr data
#endstruct

#defstruct global FWP_VALUE0
    #field int type
    #field byte Anonymous 8
#endstruct

#defstruct global FWPM_ACTION0
    #field int type
    #field byte Anonymous 16
#endstruct

#defstruct global FWPM_FILTER0
    #field GUID filterKey
    #field FWPM_DISPLAY_DATA0 displayData
    #field int flags
    #field intptr providerKey
    #field FWP_BYTE_BLOB providerData
    #field GUID layerKey
    #field GUID subLayerKey
    #field FWP_VALUE0 weight
    #field int numFilterConditions
    #field intptr filterCondition
    #field FWPM_ACTION0 action
    #field byte Anonymous 16
    #field intptr reserved
    #field int64 filterId
    #field FWP_VALUE0 effectiveWeight
#endstruct

stdim st, FWPM_FILTER0        ; NSTRUCT 変数を確保
st->flags = 100
mes "flags=" + st->flags
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。