from this link https://msdn.microsoft.com/en-us/windows/hardware/drivers/network/callout-driver-programming-considerations
the classify function should execute as soon as possible. I filtering plackets at layer 2 but I want to wait for the user app to reply with allow or block action and in my classify function I will only wait for 5 seconds and if the user app delays then it continues by the block action but I want to know if 5 seconds is too much for the classify function running at dispatch_level to wait or I should just proceed
You won’t be able to block directly within your classify function at
dispatch level, at least not waiting for a user mode response. You’ll
need to queue these requests up to a worker and then process them
asynchronously, similar to how the stream edit (stmedit) sample in the
DDK functions.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
------ Original Message ------
From: xxxxx@gmail.com
To: “Windows System Software Devs Interest List”
Sent: 3/16/2017 10:25:22 AM
Subject: [ntdev] Windows filtering platform callout execution time
>from this link
>https://msdn.microsoft.com/en-us/windows/hardware/drivers/network/callout-driver-programming-considerations
>the classify function should execute as soon as possible. I filtering
>plackets at layer 2 but I want to wait for the user app to reply with
>allow or block action and in my classify function I will only wait for
>5 seconds and if the user app delays then it continues by the block
>action but I want to know if 5 seconds is too much for the classify
>function running at dispatch_level to wait or I should just proceed
>
>—
>NTDEV is sponsored by OSR
>
>Visit the list online at:
>http:
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:></http:>