c# - 检查机器上的第三方防火墙

Question

我正在检查防火墙。以下代码很容易检查默认 Windows 防火墙的状态:

    INetFwMgr manager = GetFireWallManager();
    bool isFirewallEnabled = manager.LocalPolicy.CurrentProfile.FirewallEnabled;
    if (isFirewallEnabled == false)
    {
      Console.WriteLine("Firewall is not enabled.");
    }
    else
    {
      Consoe.WriteLine("Firewall is enabled.");
    }
    Console.ReadLine();

   private static INetFwMgr GetFireWallManager()
   {
     Type objectType = Type.GetTypeFromCLSID(new Guid(firewallGuid));
     return Activator.CreateInstance(objectType) as INetFwMgr;
   }

那么问题就变成了:如何找到非 Windows 防火墙的状态？如果防火墙正确集成，上述检查是否同样有效，或者是否有更好的方法？我查过这个帖子:C# Windows Security Center Settings和这篇文章:C# - How to chceck if external firewall is enabled?但两者都证明相对无用。

我一直在研究 WMI API，但到目前为止它相当困惑，而且通过 MSDN 提供的文档也不太乐观。我也试过弄乱 SelectQuery但到目前为止，我一直没有成功。任何人都可以在新的起点上帮助我，或者我在哪里可以找到有关第 3 方防火墙的更好的文档/说明？

编辑:目前我正在进一步探索 WMI，特别是帖子建议的 FirewallProduct 类。

更新 2:我一直在测试以下代码段:

  string wmiNameSpace = "SecurityCenter2";
  ManagementScope scope;
  scope = new ManagementScope(String.Format("\\\\{0}\\root\\{1}", "localhost", wmiNameSpace), null);
  scope.Connect();
  ObjectQuery query = new ObjectQuery("SELECT * FROM FirewallProduct");
  ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query);

但是运行它会导致以下错误:Exception Invalid namespace 并且它指向第 39 行 (scope.Connect())。如果我只是错过了一个参数或格式不正确，我一点也不会感到惊讶，我只是不知道它是什么。

更新 3 从 SecurityCenter2 切换到 SecurityCenter 仍然会产生相同的 invalid namespace 错误。

更新 4 我将控制台应用程序移到了另一个盒子(win7 而不是 winserver08r2)，它按预期正确地返回了报告。因此，这可能是我目前正在测试的 VM 的问题。下一步是解析事件/非事件状态

UPDATE 5 在另一个 Server08 机器上进行测试，出现同样的 invalid namespace 错误。使用 SecurityCenter 而不是 SecurityCenter2 不能解决问题。 Windows Server 操作系统是否使用了一些底层安全功能来防止篡改防火墙，或者服务器操作系统是否没有附带一组特定的关键 WMI 功能？

Answer 1

According to Microsoft Q: How does WindowsSecurity Center detect third-party products and their status?

A:Windows Security Center uses a two-tiered approach for detectionstatus. One tier is manual, and the other tier is automatic throughWindows Management Instrumentation (WMI). In manual detection mode,Windows Security Center searches for registry keys and files that areprovided to Microsoft by independent software manufacturers. Theseregistry keys and files let Windows Security Center detect the statusof independent software. In WMI mode, software manufacturers determinetheir own product status and report that status back to WindowsSecurity Center through a WMI provider. In both modes, WindowsSecurity Center tries to determine whether the following is true:

• An antivirus program is present.
• The antivirus signatures are up-to-date.
• Real-time scanning or on-access scanning is turned on for antivirus programs.
• For firewalls, Windows Security Centerdetects whether a third-party firewall is installed and whether thefirewall is turned on or not.

所以你可以使用 WMI 来确定是否安装了第三方防火墙，使用 FirewallProduct 类，前段时间我写了一篇关于这个主题的文章，解释了如何使用 WMI 获取这个信息.

• Getting the installed Antivirus, AntiSpyware and Firewall software using Delphi and the WMI .

尝试使用此示例 C# 获取当前安装的第三方防火墙名称和状态。

using System;
using System.Collections.Generic;
using System.Management;
using System.Text;

namespace GetWMI_Info
{
    class Program
    {
        
        static void Main(string[] args)
        {
            try
            {
                //select the proper wmi namespace depending of the windows version
                string WMINameSpace = System.Environment.OSVersion.Version.Major > 5 ? "SecurityCenter2" : "SecurityCenter";
 
                ManagementScope Scope;
                Scope = new ManagementScope(String.Format("\\\\{0}\\root\\{1}", "localhost", WMINameSpace), null);

                Scope.Connect();
                ObjectQuery Query = new ObjectQuery("SELECT * FROM FirewallProduct");
                ManagementObjectSearcher Searcher = new ManagementObjectSearcher(Scope, Query);

                foreach (ManagementObject WmiObject in Searcher.Get())
                {
                    
                    Console.WriteLine("{0,-35} {1,-40}","Firewall Name",WmiObject["displayName"]);                      
                    if (System.Environment.OSVersion.Version.Major < 6) //is XP ?
                    {
                    Console.WriteLine("{0,-35} {1,-40}","Enabled",WmiObject["enabled"]);    
                    }
                    else
                    {
                        Console.WriteLine("{0,-35} {1,-40}","State",WmiObject["productState"]); 
                    }   
                }
            }
            catch (Exception e)
            {
                Console.WriteLine(String.Format("Exception {0} Trace {1}",e.Message,e.StackTrace));
            }
            Console.WriteLine("Press Enter to exit");
            Console.Read();
        }
    }
}