How to get inBytes & outBytes as part of Content Filter simple firewall extension

Question

Created Dec ’20

Replies 3

Boosts 0

Participants 1

Hi,
I have Content Filter Simple Firewall extension app. I want to get read bytes for inbound data, write bytes for outbound data.

Following is sample handleNewFlow() API. Please help me to get read(inBytes) and write(outBytes) bytes from following example.

Code Block  override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict {
    guard let socketFlow = flow as? NEFilterSocketFlow,
      let remoteEndpoint = socketFlow.remoteEndpoint as? NWHostEndpoint,
      let localEndpoint = socketFlow.localEndpoint as? NWHostEndpoint else {
        return .allow()
    }
      var bytes :Int32 = 0
   
      if socketFlow.direction.rawValue == 1 {
        // bytes = inBytes
      }else {
        //bytes = outBytes
      }
  }

Boost

Answer 1

nagendrar OP

Dec ’20

Currently I am using NEFilterDataProvider extension.

0

Answer 2

nagendrar OP

Dec ’20

Looks like https://developer.apple.com/documentation/networkextension/nefilterreport gives read & write Bytes. But how to use this to get bytesInboundCount & bytesOutboundCount? Please help.

Code Block override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict {     
    guard let socketFlow = flow as? NEFilterSocketFlow,      
        let remoteEndpoint = socketFlow.remoteEndpoint as? NWHostEndpoint,     
        let localEndpoint = socketFlow.localEndpoint as? NWHostEndpoint else { return .allow()    
    }
    DispatchQueue.global(qos: .default).async {         
         
        var bytes :Int32 = 0         
        if socketFlow.direction.rawValue == 1 {        
            // bytes = inBytes      
        }else {        
            //bytes = outBytes      
        }
        
        let userVerdict: NEFilterNewFlowVerdict
        var error = customAPIToDecideAllowOrDrop()
        userVerdict = error == 0 ? .allow() : .drop()         
        self.resumeFlow(flow, with: userVerdict)    
    }    
    return .pause()
}

0

Answer 3

nagendrar OP

Dec ’20

I got some help on NEFilterReport from https://developer.apple.com/forums/thread/665784?answerId=645327022#645327022.

Looks like, able to get in & out Bytes after allowing/dropping the connection. I want to get this data before allowing/dropping the connection, So that I can send in & out bytes to my custom API to evaluate the rule & to prepare the report and then decide allow/drop.

So, Is it possible to get the in & out Bytes data before allow/drop the connection?

Thanks.

0