Expose init function that also applies the blocked policy

3 files changed, 69 insertions, 0 deletions

diff --git a/windows/winfw/src/winfw/winfw.cpp b/windows/winfw/src/winfw/winfw.cpp
index 6f61cb212b..d47139cb7d 100644
--- a/windows/winfw/src/winfw/winfw.cpp
+++ b/windows/winfw/src/winfw/winfw.cpp
@@ -62,6 +62,53 @@ WinFw_Initialize(
 	return true;
 }
 
+extern "C"
+WINFW_LINKAGE
+bool
+WINFW_API
+WinFw_InitializeBlocked(
+	uint32_t timeout,
+	const WinFwSettings &settings,
+	WinFwErrorSink errorSink,
+	void *errorContext
+)
+{
+	if (nullptr != g_fwContext)
+	{
+		//
+		// This is an error.
+		// The existing instance may have a different timeout etc.
+		//
+		return false;
+	}
+
+	// Convert seconds to milliseconds.
+	g_timeout = timeout * 1000;
+
+	g_errorSink = errorSink;
+	g_errorContext = errorContext;
+
+	try
+	{
+		g_fwContext = new FwContext(g_timeout, settings);
+	}
+	catch (std::exception &err)
+	{
+		if (nullptr != g_errorSink)
+		{
+			g_errorSink(err.what(), g_errorContext);
+		}
+
+		return false;
+	}
+	catch (...)
+	{
+		return false;
+	}
+
+	return true;
+}
+
 WINFW_LINKAGE
 bool
 WINFW_API
diff --git a/windows/winfw/src/winfw/winfw.def b/windows/winfw/src/winfw/winfw.def
index e8ef663dae..20d59bb4c8 100644
--- a/windows/winfw/src/winfw/winfw.def
+++ b/windows/winfw/src/winfw/winfw.def
@@ -2,6 +2,7 @@ LIBRARY winfw
 EXPORTS
 
 WinFw_Initialize
+WinFw_InitializeBlocked
 WinFw_Deinitialize
 WinFw_ApplyPolicyConnecting
 WinFw_ApplyPolicyConnected
diff --git a/windows/winfw/src/winfw/winfw.h b/windows/winfw/src/winfw/winfw.h
index f0c1adb2dc..69014ee615 100644
--- a/windows/winfw/src/winfw/winfw.h
+++ b/windows/winfw/src/winfw/winfw.h
@@ -73,6 +73,27 @@ WinFw_Initialize(
 );
 
 //
+// WinFw_InitializeBlocked
+//
+// Same as `WinFw_Initialize` with the addition that the blocked policy is
+// immediately applied, within the same initialization transaction.
+//
+// This function is preferred rather than first initializing and then applying
+// the blocked policy. Using two separate operations leaves a tiny window
+// for traffic to leak out.
+//
+extern "C"
+WINFW_LINKAGE
+bool
+WINFW_API
+WinFw_InitializeBlocked(
+	uint32_t timeout,
+	const WinFwSettings &settings,
+	WinFwErrorSink errorSink,
+	void *errorContext
+);
+
+//
 // Deinitialize:
 //
 // Call this function once before unloading WINFW or exiting the process.