private static bool IsValidCondition(FirewallFilterCondition condition)
{
Guid key = condition.FieldKey;
return(key == FirewallConditionGuids.FWPM_CONDITION_IP_PROTOCOL ||
key == FirewallConditionGuids.FWPM_CONDITION_IP_LOCAL_ADDRESS ||
key == FirewallConditionGuids.FWPM_CONDITION_IP_REMOTE_ADDRESS ||
key == FirewallConditionGuids.FWPM_CONDITION_IP_LOCAL_PORT ||
key == FirewallConditionGuids.FWPM_CONDITION_IP_REMOTE_PORT ||
key == FirewallConditionGuids.FWPM_CONDITION_ALE_APP_ID ||
key == FirewallConditionGuids.FWPM_CONDITION_NET_EVENT_TYPE ||
key == FirewallConditionGuids.FWPM_CONDITION_ALE_USER_ID);
}
private static FirewallFilterCondition ConvertUserId(FirewallFilterCondition condition)
{
if (condition.FieldKey != FirewallConditionGuids.FWPM_CONDITION_ALE_USER_ID)
{
return(condition);
}
if (condition.Value.Type == FirewallDataType.Sid)
{
return(condition);
}
if (!(condition.Value.Value is FirewallTokenInformation token_info))
{
throw new ArgumentException("Must specify a SID or FirewallTokenInformation for FWPM_CONDITION_ALE_USER_ID.");
}
if (token_info.UserSid == null)
{
throw new ArgumentException("Must specify a user SID for the TokenInformation for FWPM_CONDITION_ALE_USER_ID.");
}
return(new FirewallFilterCondition(condition.MatchType, condition.FieldKey, FirewallValue.FromSid(token_info.UserSid)));
}
private bool CheckUserId(FirewallFilter filter, Guid condition_guid, AuthZContext context)
{
if (!filter.HasCondition(condition_guid))
{
return(true);
}
FirewallFilterCondition condition = filter.GetCondition(condition_guid);
if (!(condition.Value.Value is SecurityDescriptor sd))
{
return(false);
}
switch (condition.MatchType)
{
case FirewallMatchType.Equal:
case FirewallMatchType.NotEqual:
break;
default:
return(false);
}
if (sd.Owner == null || sd.Group == null)
{
sd = sd.Clone();
if (sd.Owner == null)
{
sd.Owner = new SecurityDescriptorSid(KnownSids.LocalSystem, true);
}
if (sd.Group == null)
{
sd.Group = new SecurityDescriptorSid(KnownSids.LocalSystem, true);
}
}
bool result = context.AccessCheck(sd, null, FirewallFilterAccessRights.Match,
null, null, FirewallUtils.FirewallFilterType).First().IsSuccess;
return(condition.MatchType == FirewallMatchType.Equal ? result : !result);
}
