77#include < windows.h>
88#include " ctWmiInitialize.hpp"
99
10+ #include < wil/com.h>
11+ #include < wil/resource.h>
12+
13+ // MOF of MSFT_NetFirewallProfile
14+ //
15+ // uint16 Enabled;
16+ // uint16 DefaultInboundAction;
17+ // uint16 DefaultOutboundAction;
18+ // uint16 AllowInboundRules;
19+ // uint16 AllowLocalFirewallRules;
20+ // uint16 AllowLocalIPsecRules;
21+ // uint16 AllowUserApps;
22+ // uint16 AllowUserPorts;
23+ // uint16 AllowUnicastResponseToMulticast;
24+ // uint16 NotifyOnListen;
25+ // string LogFileName;
26+ // uint64 LogMaxSizeKilobytes;
27+ // uint16 LogAllowed;
28+ // uint16 LogBlocked;
29+ // uint16 LogIgnored;
30+ // string DisabledInterfaceAliases[];
31+ // uint16 EnableStealthModeForIPsec;
32+
1033PCWSTR PrintFwBooleanFlag (int32_t flag) noexcept
1134{
1235 switch (flag)
@@ -24,82 +47,156 @@ PCWSTR PrintFwBooleanFlag(int32_t flag) noexcept
2447
2548PCWSTR PrintNetFwAction (int32_t flag) noexcept
2649{
27- switch (flag)
28- {
29- case 0 :
50+ switch (flag)
51+ {
52+ case 0 :
3053 return L" Not Configured (default)"
31- case 2 :
54+ case 2 :
3255 return L" Allow"
33- case 4 :
56+ case 4 :
3457 return L" Block"
35- default :
58+ default :
3659 return L" Unexpected value"
37- }
60+ }
3861}
3962
40- int __cdecl main ( )
63+ int __cdecl wmain ( int argc, wchar_t ** argv )
4164try
4265{
66+ // by default write out the effective policy - from ActiveStore
67+ // allow for -PolicyStore (string)
68+ // ... following the Powershell command
69+ //
70+ // valid stores are:
71+ // ActiveStore
72+ // PersistentStore
73+ // RSOP
74+
4375 const auto co_init = wil::CoInitializeEx ();
4476
45- ctl::ctWmiEnumerate firewall_profile_enumerator{ ctl::ctWmiService{ L" ROOT \\ StandardCimv2 " } } ;
46- for ( const auto & profile : firewall_profile_enumerator. query ( L" SELECT * FROM MSFT_NetFirewallProfile " ) )
77+ PCWSTR policyStoreValue = L" ActiveStore "
78+ if (argc == 3 )
4779 {
48- std::wstring profile_name;
49- bool property_exists = profile.get (L" Name"
50- if (!property_exists)
80+ if (0 == lstrcmpiW (L" -PolicyStore" 1 ]))
5181 {
52- // this should never happen: NetFirewallProfile::Name should always exist
53- wprintf (L" *** something is wrong - the Name string property should exist in NetFirewallProfile\n "
54- continue ;
82+ policyStoreValue = argv[2 ];
5583 }
84+ }
85+ ctl::ctWmiEnumerate firewall_profile_enumerator{ ctl::ctWmiService{L" ROOT\\ StandardCimv2"
86+
87+ wprintf (L" Enumerating NetFirewallProfile from the policy store %ws\n "
88+
89+ // PolicyStore is a context object to be passed to MSFT_NetFirewallProfile
90+ // analogous to the powershell command: Get-NetFirewallProfile -PolicyStore ActiveStore
91+ wil::com_ptr<IWbemContext> policyStoreContext = wil::CoCreateInstance<WbemContext, IWbemContext>();
92+ THROW_IF_FAILED (policyStoreContext->SetValue (
93+ L" PolicyStore"
94+ 0 ,
95+ wil::make_variant_bstr (policyStoreValue).addressof ()));
96+
97+ bool instances_returned = false ;
98+ for (const auto & profile : firewall_profile_enumerator.query (L" SELECT * FROM MSFT_NetFirewallProfile"
99+ {
100+ instances_returned = true ;
101+
102+ std::wstring profile_name;
103+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" Name"
56104
57105 int32_t is_enabled{};
58- property_exists = profile.get (L" Enabled"
59- if (!property_exists)
60- {
61- wprintf (L" *** something is wrong - the Enabled INT32 property should exist in NetFirewallProfile\n "
62- continue ;
63- }
106+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" Enabled"
64107
65108 int32_t default_inbound_action{};
66- property_exists = profile.get (L" DefaultInboundAction"
67- if (!property_exists)
68- {
69- wprintf (L" *** something is wrong - the DefaultInboundAction INT32 property should exist in NetFirewallProfile\n "
70- continue ;
71- }
109+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" DefaultInboundAction"
72110
73111 int32_t default_outbound_action{};
74- property_exists = profile.get (L" DefaultOutboundAction"
75- if (!property_exists)
76- {
77- wprintf (L" *** something is wrong - the DefaultOutboundAction INT32 property should exist in NetFirewallProfile\n "
78- continue ;
79- }
112+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" DefaultOutboundAction"
113+
114+ int32_t inbound_rules_allowed{};
115+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" AllowInboundRules"
80116
81117 int32_t local_rules_allowed{};
82- property_exists = profile.get (L" AllowLocalFirewallRules"
83- if (!property_exists)
84- {
85- wprintf (L" *** something is wrong - the AllowLocalFirewallRules INT32 property should exist in NetFirewallProfile\n "
86- continue ;
87- }
118+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" AllowLocalFirewallRules"
119+
120+ int32_t local_ipsec_rules_allowed{};
121+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" AllowLocalIPsecRules"
122+
123+ int32_t user_apps_allowed{};
124+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" AllowUserApps"
125+
126+ int32_t user_ports_allowed{};
127+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" AllowUserPorts"
128+
129+ int32_t unicast_response_to_multicast_allowed{};
130+ THROW_HR_IF (E_UNEXPECTED,
131+ !profile.get (L" AllowUnicastResponseToMulticast"
132+
133+ int32_t notify_on_listen{};
134+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" NotifyOnListen"
135+
136+ wil::unique_bstr log_file_name;
137+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" LogFileName"
138+
139+ uint64_t log_file_max_size{};
140+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" LogMaxSizeKilobytes"
141+
142+ int32_t log_allowed{};
143+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" LogAllowed"
144+
145+ int32_t log_blocked{};
146+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" LogBlocked"
147+
148+ int32_t log_ignored{};
149+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" LogIgnored"
150+
151+ int32_t enable_ipsec_stealth_mode{};
152+ THROW_HR_IF (E_UNEXPECTED, !profile.get (L" EnableStealthModeForIPsec"
153+
154+ // string DisabledInterfaceAliases[];
88155
89156 wprintf (
90- L" Profile %ws\n "
157+ L" \n Profile %ws\n "
91158 L" Enabled : %ws\n "
92159 L" Default Inbound Action: %ws\n "
93160 L" Default Outbound Action: %ws\n "
94- L" Allow Local Firewall Rules: %ws\n "
161+ L" Allow Inbound Rules: %ws\n "
162+ L" Allow Local Firewall Rules: %ws\n "
163+ L" Allow Local IPsec Rules: %ws\n "
164+ L" Allow User Apps: %ws\n "
165+ L" Allow User Ports: %ws\n "
166+ L" Allow Unicast Response To Multicast: %ws\n "
167+ L" Notify On Listen: %ws\n "
168+ L" Log File Name: %ws\n "
169+ L" Log File Max Size (KB): %llu\n "
170+ L" Log Allowed: %ws\n "
171+ L" Log Blocked: %ws\n "
172+ L" Log Ignored: %ws\n "
173+ L" Enable Stealth Mode For IPsec: %ws\n "
95174 profile_name.c_str (),
96175 PrintFwBooleanFlag (is_enabled),
97176 PrintNetFwAction (default_inbound_action),
98177 PrintNetFwAction (default_outbound_action),
99- PrintFwBooleanFlag (local_rules_allowed));
178+ PrintFwBooleanFlag (inbound_rules_allowed),
179+ PrintFwBooleanFlag (local_rules_allowed),
180+ PrintFwBooleanFlag (local_ipsec_rules_allowed),
181+ PrintFwBooleanFlag (user_apps_allowed),
182+ PrintFwBooleanFlag (user_ports_allowed),
183+ PrintFwBooleanFlag (unicast_response_to_multicast_allowed),
184+ PrintFwBooleanFlag (notify_on_listen),
185+ log_file_name.get (),
186+ log_file_max_size,
187+ PrintFwBooleanFlag (log_allowed),
188+ PrintFwBooleanFlag (log_blocked),
189+ PrintFwBooleanFlag (log_ignored),
190+ PrintFwBooleanFlag (enable_ipsec_stealth_mode)
191+ );
192+ }
193+
194+ if (!instances_returned)
195+ {
196+ wprintf (L" \n ** No policy objects returned for the specified policy store **\n "
100197 }
101198}
102199catch (const std::exception& e)
103200{
104201 wprintf (L" Failure : %hs\n " what ());
105- }
202+ }
0 commit comments