Method AddFilter

PeaceMaker Kernel/StringFilters.cpp:103–176

Add a filter to the linked list of filters. @param MatchString - The string to filter with. @param OperationFlag - Specifies what operations this filter should be used for. @param SaveFilters - Whether or not to save filters. @return A random identifier required for future operations with the new filter. */

	@return A random identifier required for future operations with the new filter.
*/
ULONG
StringFilters::AddFilter (
	_In_ WCHAR* MatchString,
	_In_ ULONG OperationFlag,
	_In_ BOOLEAN SaveFilters
	)
{
	PFILTER_INFO_LINKED newFilter;
	LARGE_INTEGER currentTime;
	ULONG epochSeconds;

	if (this == NULL || this->destroying)
	{
		return NULL;
	}

	//
	// Get an exclusive lock because we're modifying the filters linked list.
	//
	FltAcquirePushLockExclusive(&this->filtersLock);

	//
	// Allocate space for the new filter.
	//
	newFilter = RCAST<PFILTER_INFO_LINKED>(ExAllocatePoolWithTag(NonPagedPool, sizeof(FILTER_INFO_LINKED), FILTER_INFO_TAG));
	if (newFilter == NULL)
	{
		DBGPRINT("Failed to allocate space for filter info.");
		goto Exit;
	}

	memset(RCAST<PVOID>(newFilter), 0, sizeof(FILTER_INFO_LINKED));

	InsertTailList(RCAST<PLIST_ENTRY>(this->filtersHead), RCAST<PLIST_ENTRY>(newFilter));

	this->filtersCount++;

	//
	// Generate a pseudo-random ID for the filter using the system time.
	//
	KeQuerySystemTime(&currentTime);
	RtlTimeToSecondsSince1970(&currentTime, &epochSeconds);
	newFilter->Filter.Id = RtlRandomEx(&epochSeconds);
	newFilter->Filter.Type = this->filterType;

	//
	// Copy the filter string to the new filter.
	//
	wcsncpy_s(newFilter->Filter.MatchString, MatchString, MAX_PATH);

	//
	// Set the operation flags for this filter.
	//
	newFilter->Filter.Flags = OperationFlag;
Exit:
	//
	// New filter has been initialized, release the lock.
	//