NFEXT_RULE¶

A rule defines the filtering flag for network activity described by the other rule fields.

// Port range [from:to] for rules. Port numbers must be in host format!
typedef struct _NFEXT_PORT_RANGE
{
        unsigned short from;
        unsigned short to;
} NFEXT_PORT_RANGE, *PNFEXT_PORT_RANGE;

typedef enum _NFEXT_FILTERING_FLAG
{
        NFEXT_BYPASS = 0,               // Bypass connection/packet
        NFEXT_REDIRECT = 1,             // Redirect outgoing TCP connection to local proxy
        NFEXT_BLOCK = 2,                // Block connection/packet
} NFEXT_FILTERING_FLAG;

typedef enum _NFEXT_RULE_FIELDS
{
        NFEXT_USE_DST_IP = 1,           // Use dstIp
        NFEXT_USE_DST_PORTS = 2,        // Use dstPorts
        NFEXT_USE_SRC_IP = 4,           // Use srcIp
        NFEXT_USE_SRC_PORTS = 8,        // Use srcPorts
        NFEXT_USE_UID = 16,             // Use uid
        NFEXT_USE_GID = 32,             // Use gid
} NFEXT_RULE_FIELDS;

typedef enum _NFEXT_RULE_TYPE
{
        NFEXT_REDIRECT_RULE = 0,        // Redirection and access control on translation level
        NFEXT_PACKET_RULE = 1,          // Access control on packet level
} NFEXT_RULE_TYPE;

typedef struct _NFEXT_RULE
{
        // See NFEXT_RULE_TYPE
        int             ruleType;
        // Protocol (IPPROTO_TCP, IPPROTO_UDP)
        int             protocol;
        // Direction (NF_D_IN, NF_D_OUT, NF_D_BOTH or zero)
        int             direction;
        // AF_INET for IPv4 and AF_INET6 for IPv6
        unsigned short  ip_family;
        // See NFEXT_RULE_FIELDS
        unsigned int    fieldsMask;

        // Destination IP or network
        char    dstIp[NFEXT_MAX_IP_ADDRESS_LENGTH];
        // Destination IP mask
        unsigned char   dstIpMask;
        // Destination ports
        NFEXT_PORT_RANGE        dstPorts;

        // Source IP or network
        char    srcIp[NFEXT_MAX_IP_ADDRESS_LENGTH];
        // Source IP mask
        unsigned char   srcIpMask;
        // Source ports
        NFEXT_PORT_RANGE        srcPorts;

        // User id
        pid_t                   uid;

        // Group id
        pid_t                   gid;

        // See NFEXT_FILTERING_FLAG
        unsigned long   filteringFlag;
} NFEXT_RULE, *PNFEXT_RULE;

ruleType: NFEXT_REDIRECT_RULE=0 for filtering outgoing TCP by redirecting to a local proxy. NFEXT_PACKET_RULE=1 for allowing/blocking any IP network traffic at the packet level.
protocol: Network protocol (IPPROTO_TCP or IPPROTO_UDP). Zero means any protocol.
direction: The direction of network activity. Specify NF_D_IN for inbound packets/connections, NF_D_OUT for outbound packets/connections. Zero or NF_D_BOTH means any direction.
ip_family: Describes the family of IP addresses in the rule. Specify AF_INET for IPv4 and AF_INET6 for IPv6.
fieldsMask: Specify the used structure fields as a bitmask of identifiers defined in NFEXT_RULE_FIELDS.
dstIp: Destination IPv4 or IPv6 address. Zero means any address.
dstIpMask: If dstIpMask is not zero, dstIp and dstIpMask define a network.
dstPorts: Destination port range in host format as an NFEXT_PORT_RANGE structure.
srcIp: Source IPv4 or IPv6 address. Zero means any address.
srcIpMask: If srcIpMask is not zero, srcIp and srcIpMask define a network.
srcPorts: Source port range in host format as an NFEXT_PORT_RANGE structure.
uid: User identifier of the process owner.
gid: Group identifier of the process owner.
filteringFlag: A value from NFEXT_FILTERING_FLAG enumeration.

Remarks¶

All IP addresses in a rule must be in network byte order. Use the fieldsMask field to specify the bits for the used fields of the NFEXT_RULE structure.

The following values are allowed for filteringFlag:

NFEXT_BYPASS = 0: Allow the activity without filtering the packets.
NFEXT_REDIRECT = 1: Filter outgoing TCP connections by redirecting them to a local proxy. The packets will be indicated via the NF_EventHandler methods.
NFEXT_BLOCK = 2: Block the activity.