ExtendedTools: Ignore loopback firewall events, Fix hostname status for inaddr_any
@@ -274,6 +274,9 @@ BOOLEAN FwProcessEventType(
{
FWPM_NET_EVENT_CLASSIFY_DROP* fwDropEvent = FwEvent->classifyDrop;
+ if (fwDropEvent->isLoopback)
+ return FALSE;
+
switch (fwDropEvent->msFwpDirection)
{
case FWP_DIRECTION_IN:
@@ -305,6 +308,9 @@ BOOLEAN FwProcessEventType(
{
FWPM_NET_EVENT_CLASSIFY_ALLOW* fwAllowEvent = FwEvent->classifyAllow;
+ if (fwAllowEvent->isLoopback)
+ return FALSE;
+
switch (fwAllowEvent->msFwpDirection)
{
case FWP_DIRECTION_IN:
@@ -669,6 +675,10 @@ VOID PhpQueryHostnameForEntry(
EtFwQueueNetworkItemQuery(Entry, FALSE);
}
}
+ else
+ {
+ Entry->LocalHostnameString = PhReferenceEmptyString();
+ }
// Remote
if (!PhIsNullIpAddress(&Entry->RemoteEndpoint.Address))
@@ -687,6 +697,10 @@ VOID PhpQueryHostnameForEntry(
EtFwQueueNetworkItemQuery(Entry, TRUE);
}
}
+ else
+ {
+ Entry->RemoteHostnameString = PhReferenceEmptyString();
+ }
}
PPH_PROCESS_ITEM EtFwFileNameToProcess(
