Imports System
Imports System.Collections
Imports System.Runtime.InteropServices
Imports System.Runtime.InteropServices.CustomMarshalers
Partial Public Module FirewallApi
Friend Const Lib_Firewallapi As String = "firewallapi.dll"
'''
''' The PAC_CHANGES_CALLBACK_FN function is used to add custom behavior to the app container change notification process.
'''
''' TOptional context pointer.
'''
''' Call NetworkIsolationRegisterForAppContainerChanges to register this callback function.
Public Delegate Sub PAC_CHANGES_CALLBACK_FN(<[In], Out, [Optional]> ByVal context As IntPtr, <[In]> ByRef pChange As INET_FIREWALL_AC_CHANGE)
''' Callback used by .
''' TOptional context pointer.
''' The WSZ enterprise identifier.
''' The dw error.
Public Delegate Sub PNETISO_EDP_ID_CALLBACK_FN(<[In], Out, [Optional]> ByVal context As IntPtr, <[In], [Optional], MarshalAs(UnmanagedType.LPWStr)> ByVal wszEnterpriseId As String, ByVal dwErr As Win32Error)
'''
''' The INET_FIREWALL_AC_CREATION_TYPE enumeration specifies the type of app container creation events for which notifications
''' will be delivered.
'''
Public Enum INET_FIREWALL_AC_CREATION_TYPE
''' This value is reserved for system use.
INET_FIREWALL_AC_NONE = &H0
''' Notifications will be delivered when an app container is created with a package identifier.
INET_FIREWALL_AC_PACKAGE_ID_ONLY = &H1
''' Notifications will be delivered when an app container is created with a binary path.
INET_FIREWALL_AC_BINARY = &H2
''' Maximum value for testing purposes.
INET_FIREWALL_AC_MAX = &H4
End Enum
''' The NETISO_ERROR_TYPE enumerated type specifies the type of error related to a network isolation operation.
Public Enum NETISO_ERROR_TYPE
''' No error.
NETISO_ERROR_TYPE_NONE
''' The failure was caused because the privateNetworkClientServer capability is missing.
NETISO_ERROR_TYPE_PRIVATE_NETWORK
''' The failure was caused because the internetClient capability is missing.
NETISO_ERROR_TYPE_INTERNET_CLIENT
''' The failure was caused because the internetClientServer capability is missing.
NETISO_ERROR_TYPE_INTERNET_CLIENT_SERVER
''' Maximum value for testing purposes.
NETISO_ERROR_TYPE_MAX
End Enum
''' The NETISO_FLAG enumerated type specifies whether binaries should be returned for app containers.
'''
''' By default, binaries are not returned. NETISO_FLAG_FORCE_COMPUTE_BINARIES must be set in order for these to be returned.
'''
Public Enum NETISO_FLAG
'''
''' Specifies that all binaries will be computed before the app container is returned.This flag should be set if the caller requires
''' up-to-date and complete information on app container binaries. If this flag is not set, returned data may be stale or incomplete.
'''
NETISO_FLAG_FORCE_COMPUTE_BINARIES = &H1
''' Maximum value for testing purposes.
NETISO_FLAG_MAX = &H2
End Enum
''' A bitmask value of control flags which specify the context of .
Public Enum NETISO_GEID
'''
''' Default API behavior. Returns the Enterprise ID for Enterprise resources. Returns NULL for Personal resources. For Neutral
''' resources, returns Enterprise ID if it is called from an Enterprise context, or returns NULL if it is called from a Personal context.
'''
NETISO_GEID_DEFAULT = &H0
''' Used in the context of the Windows Defender Application Guard (WDAG) scenario.
NETISO_GEID_FOR_WDAG = &H1
'''
''' Used by applications that are aware of neutral resources. For Neutral resources the API will return L”*”. For Enterprise
''' resources the API will return the Enterprise ID. For Personal resources the API will return NULL.
'''
NETISO_GEID_FOR_NEUTRAL_AWARE = &H2
'''
''' Forces API to check the resource even in cases when neither Windows Information Protection nor Windows Defender Application
''' Guard are enabled.
'''
NETISO_GEID_FORCE_TO_CHECK = &H4
End Enum
'''
''' The NetworkIsolationEnumAppContainers function enumerates all of the app containers that have been created in the system.
'''
'''
''' Type: DWORD
'''
''' May be set to NETISO_FLAG_FORCE_COMPUTE_BINARIES to ensure that all binaries are computed before the app container is
''' returned. This flag should be set if the caller requires up-to-date and complete information on app container binaries. If this flag
''' is not set, returned data may be stale or incomplete.
'''
''' See NETISO_FLAG for more information.
'''
'''
''' Type: DWORD*
''' The number of app containers in the ppPublicAppCs member.
'''
'''
''' Type: PINET_FIREWALL_APP_CONTAINER*
''' The list of app container structure elements.
'''
'''
''' Type: DWORD
''' Returns ERROR_SUCCESS if successful, or an error value otherwise.
''' ERROR_OUTOFMEMORY will be returned if memory is unavailable.
'''
''' If no app containers are installed on the system, ERROR_SUCCESS will still be returned (and ppPublicAppCs will be empty).
Public Function NetworkIsolationEnumAppContainers(ByVal Flags As NETISO_FLAG, ByRef pdwNumPublicAppCs As UInteger, ByRef ppPublicAppCs As IntPtr) As Win32Error
End Function
''' The NetworkIsolationEnumerateAppContainerRules function enumerates all of the rules related to app containers.
'''
''' Type: IEnumVARIANT**
''' Enumerator interface of an INetFwRule3 object that represents the rules enforcing app containers.
'''
'''
''' Type: HRESULT
''' If this function succeeds, it returns S_OK. Otherwise, it returns an HRESULT error code.
'''
Public Function NetworkIsolationEnumerateAppContainerRules( ByRef newEnum As IEnumerable) As HRESULT
End Function
'''
'''
''' Gets the Enterprise ID based on Network Isolation endpoints in the context of the Windows Information Protection (WIP) or the
''' Windows Defender Application Guard (WDAG) scenarios. If neither WIP nor WDAG are on, the API returns NULL, unless the flag
''' NETISO_GEID_FORCE_TO_CHECK is passed. The Enterprise ID can be any string different from NULL or “*”.
'''
''' Example of NetworkIsolationGetEnterpriseIdAsync usage: https://github.com/microsoft/EnterpriseStateClassify
'''
''' The name of the Enterprise Data Protection Server.
'''
''' A bitmask value of control flags which specify the context of the API call. May contain one or more of the following flags.
'''
'''
''' Value
''' Meaning
'''
''' -
''' NETISO_GEID_DEFAULT 0x00
'''
''' Default API behavior. Returns the Enterprise ID for Enterprise resources. Returns NULL for Personal resources. For Neutral
''' resources, returns Enterprise ID if it is called from an Enterprise context, or returns NULL if it is called from a Personal context.
'''
'''
''' -
''' NETISO_GEID_FOR_WDAG 0x01
''' Used in the context of the Windows Defender Application Guard (WDAG) scenario.
'''
''' -
''' NETISO_GEID_FOR_NEUTRAL_AWARE 0x02
'''
''' Used by applications that are aware of neutral resources. For Neutral resources the API will return L”*”. For Enterprise resources
''' the API will return the Enterprise ID. For Personal resources the API will return NULL.
'''
'''
''' -
''' NETISO_GEID_FORCE_TO_CHECK 0x04
'''
''' Forces API to check the resource even in cases when neither Windows Information Protection nor Windows Defender Application Guard
''' are enabled.
'''
'''
'''
'''
''' Optional context pointer.
''' Function pointer that will be invoked when a notification is ready for delivery.
''' The handle for the Enterprise Data Protection Server endpoints.
''' Returns ERROR_SUCCESS if successful, or an error value otherwise.
Public Function NetworkIsolationGetEnterpriseIdAsync( ByVal wszServerName As String, ByVal dwFlags As NETISO_GEID,
<[In], [Optional]> ByVal context As IntPtr, ByVal callback As PNETISO_EDP_ID_CALLBACK_FN, ByRef hOperation As HANDLE) As Win32Error
End Function
'''
'''
''' This API is used for closing the handle returned by NetworkIsolationGetEnterpriseIdAsync as well as for synchronizing the operation.
'''
''' Example of NetworkIsolationGetEnterpriseIdClose usage: https://github.com/microsoft/EnterpriseStateClassify
'''
''' The handle to release.
''' Indicates whether to wait for synchronization.
''' Returns ERROR_SUCCESS if successful, or an error value otherwise.
Public Function NetworkIsolationGetEnterpriseIdClose(ByVal hOperation As HANDLE, ByVal bWaitForOperation As Boolean) As Win32Error
End Function
''' The NetworkIsolationSetAppContainerConfig function is used to set the configuration of one or more app containers.
'''
''' Type: DWORD
''' The number of app containers in the appContainerSids member.
'''
'''
''' Type: PSID_AND_ATTRIBUTES
''' The security identifiers (SIDs) of app containers that are allowed to send loopback traffic. Used for debugging purposes.
'''
'''
''' Type: DWORD
''' Returns ERROR_SUCCESS if successful, or an error value otherwise.
'''
'''
''' Note that it is the calling program's responsibility to first call the NetworkIsolationGetAppContainerConfig function in
''' order to retrieve and preserve the app container SIDs already configured to send loopback traffic.
'''
Public Function NetworkIsolationSetAppContainerConfig(ByVal dwNumPublicAppCs As UInteger, <[In]> ByVal appContainerSids As IntPtr) As Win32Error
End Function
'''
''' The NetworkIsolationSetupAppContainerBinaries function is used by software installers to provide information about the image
''' paths of applications that are running in an app container. This information is provided to third-party firewall applications about
''' the applications in order to enhance user experience and security decisions.
'''
'''
''' Type: PSID
''' The package identifier of the app container.
'''
'''
''' Type: LPCWSTR
'''
''' A string representing the package identity of the app that owns this app container. Contains the 5-part tuple as individual fields
''' (name, version, architecture, resourceid, publisher).
'''
'''
'''
''' Type: LPCWSTR
''' The file location of the app that owns this app container.
'''
'''
''' Type: LPCWSTR
''' The friendly name of the app container.
'''
'''
''' Type: BOOL
''' True if the binary files are being provided by the caller; otherwise, false.
'''
'''
''' Type: LPCWSTR*
''' An array of paths to the applications running in the app container.
'''
'''
''' Type: DWORD
''' The number of paths contained in the binaries parameter.
'''
'''
''' Type: HRESULT
''' If the function succeeds, it returns S_OK.
'''
''' If the function fails, it returns an HRESULT value that indicates the error. For a list of common error codes, see Common
''' HRESULT Values.
'''
'''
'''
''' Applications creating an app container can use NetworkIsolationSetupAppContainerBinaries to provide third-party firewall
''' applications with the direct path to applications running inside that app container.
'''
Public Function NetworkIsolationSetupAppContainerBinaries(ByVal applicationContainerSid As PSID, ByVal packageFullName As String,
ByVal packageFolder As String,
ByVal displayName As String,
ByVal bBinariesFullyComputed As Boolean,
<[In], MarshalAs(UnmanagedType.LPArray, ArraySubType:=UnmanagedType.LPWStr)> ByVal binaries As String(),
ByVal binariesCount As UInteger) As HRESULT
End Function
''' The INET_FIREWALL_AC_BINARIES structure contains the binary paths to applications running in an app container.
Public Structure INET_FIREWALL_AC_BINARIES
''' The number of paths in the binaries member.
Public count As UInteger
''' Paths to the applications running in the app container.
Public binaries As IntPtr
End Structure
''' The INET_FIREWALL_AC_CHANGE structure contains information about a change made to an app container.
Public Structure INET_FIREWALL_AC_CHANGE
'''
''' Type: INET_FIREWALL_AC_CHANGE_TYPE
''' The type of change made.
'''
Public changeType As INET_FIREWALL_AC_CHANGE_TYPE
'''
''' Type: INET_FIREWALL_AC_CREATION_TYPE
''' The method by which the app container was created.
'''
Public createType As INET_FIREWALL_AC_CREATION_TYPE
'''
''' Type: SID*
''' The package identifier of the app container
'''
Public appContainerSid As PSID
'''
''' Type: SID*
''' The security identifier (SID) of the user to whom the app container belongs.
'''
Public userSid As PSID
'''
''' Type: LPWSTR
''' Friendly name of the app container.
'''
Public displayName As String
'''
Public union As UNIONType
'''
Public Structure UNIONType
'''
''' Type: INET_FIREWALL_AC_CAPABILITIES
''' Information about the capabilities of the changed app container.
'''
Public capabilities As INET_FIREWALL_AC_CAPABILITIES
'''
''' Type: INET_FIREWALL_AC_BINARIES
''' Binary paths to the applications running in the changed app container.
'''
Public binaries As INET_FIREWALL_AC_BINARIES
End Structure
End Structure
End Module