Struct FilterBuilder 

pub struct FilterBuilder;

WFP Filter builder

Translates FilterRule into WFP filter structures and manages filter lifecycle.

Examples

use windows_wfp::{WfpEngine, FilterBuilder, FilterRule, Direction, Action, FilterWeight, initialize_wfp};

let engine = WfpEngine::new()?;
initialize_wfp(&engine)?;

let rule = FilterRule::new("Block curl", Direction::Outbound, Action::Block)
    .with_weight(FilterWeight::UserBlock)
    .with_app_path(r"C:\Windows\System32\curl.exe");

let filter_id = FilterBuilder::add_filter(&engine, &rule)?;
// Later: remove the filter
FilterBuilder::delete_filter(&engine, filter_id)?;

Implementations

impl FilterBuilder

pub fn add_filter(engine: &WfpEngine, rule: &FilterRule) -> WfpResult<u64>

Add filter to WFP engine

Translates a FilterRule and adds it to the WFP engine.

Errors

Returns WfpError::FilterAddFailed if the filter cannot be added.

Examples

use windows_wfp::{WfpEngine, FilterBuilder, FilterRule, Direction, Action, FilterWeight, initialize_wfp};

let engine = WfpEngine::new()?;
initialize_wfp(&engine)?;

let rule = FilterRule::new("Allow all outbound", Direction::Outbound, Action::Permit)
    .with_weight(FilterWeight::DefaultPermit);
let filter_id = FilterBuilder::add_filter(&engine, &rule)?;

Examples found in repository

examples/simple_block.rs (line 42)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Simple Block Demo\n");

    // Initialize WFP
    println!("Opening WFP Engine...");
    let engine = WfpEngine::new()?;
    println!("Engine opened\n");

    println!("Registering provider...");
    initialize_wfp(&engine)?;
    println!("Provider registered\n");

    // Block notepad.exe outbound connections
    println!("Adding block filter for notepad.exe...");
    let notepad_rule = FilterRule::new("Block Notepad", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(r"C:\Windows\System32\notepad.exe");

    let filter_id = FilterBuilder::add_filter(&engine, &notepad_rule)?;
    println!("Filter added (ID: {})\n", filter_id);

    println!("Filter active for 10 seconds...");
    println!("   (Try opening notepad.exe and accessing network)\n");

    for i in (1..=10).rev() {
        println!("   {} seconds remaining...", i);
        thread::sleep(Duration::from_secs(1));
    }

    println!("\nRemoving filter...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("Filter removed\n");

    println!("Demo complete!");
    Ok(())
}

examples/live_demo.rs (line 70)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Live WFP Demo");
    println!("================================\n");

    // Check for admin privileges
    if !is_elevated() {
        eprintln!("ERROR: This demo requires Administrator privileges!");
        eprintln!("   Please run: cargo run --example live_demo --release");
        eprintln!("   from an Administrator command prompt.\n");
        std::process::exit(1);
    }

    println!("Running with Administrator privileges\n");

    // Step 1: Initialize WFP Engine
    println!("Step 1: Opening WFP Engine session...");
    let engine = WfpEngine::new()?;
    println!("   Engine session opened\n");

    // Step 2: Register Provider & Sublayer
    println!("Step 2: Registering WFP provider & sublayer...");
    initialize_wfp(&engine)?;
    println!("   Provider & sublayer registered\n");

    // Step 3: Subscribe to network events
    println!("Step 3: Subscribing to network events...");
    let event_subscription = WfpEventSubscription::new(&engine)?;
    println!("   Event subscription active\n");

    // Step 4: Add blocking filter for curl.exe
    println!("Step 4: Adding block filter for curl.exe...");
    let curl_path = find_curl_path();
    println!("   Target: {}", curl_path.display());

    let block_rule = FilterRule::new("Block curl.exe", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(curl_path.clone());

    let filter_id = FilterBuilder::add_filter(&engine, &block_rule)?;
    println!("   Filter added (ID: {})\n", filter_id);

    // Step 5: Monitor events
    println!("Step 5: Monitoring network events...");
    println!("   Press Ctrl+C to stop\n");
    println!("TIP: In another terminal, run:");
    println!("   > curl https://google.com");
    println!("   You should see the connection BLOCKED below!\n");
    println!("===================================================\n");

    let start_time = std::time::Instant::now();
    let mut event_count = 0;

    loop {
        match event_subscription.try_recv() {
            Ok(event) => {
                event_count += 1;
                print_event(&event, event_count);
            }
            Err(std::sync::mpsc::TryRecvError::Empty) => {
                thread::sleep(Duration::from_millis(100));
            }
            Err(std::sync::mpsc::TryRecvError::Disconnected) => {
                println!("\nEvent channel disconnected!");
                break;
            }
        }

        // Auto-stop after 60 seconds for demo
        if start_time.elapsed() > Duration::from_secs(60) {
            println!("\nDemo timeout (60s) - stopping...");
            break;
        }
    }

    // Cleanup
    println!("\nCleaning up...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("   Filter removed");
    drop(event_subscription);
    println!("   Event subscription closed");
    drop(engine);
    println!("   Engine session closed\n");

    println!("Demo complete! {} events captured.", event_count);
    Ok(())
}

pub fn delete_filter(engine: &WfpEngine, filter_id: u64) -> WfpResult<()>

Delete filter from WFP engine by ID

Removes a previously added filter using its unique ID.

Errors

Returns WfpError::FilterDeleteFailed if the filter cannot be deleted.

Examples

use windows_wfp::{WfpEngine, FilterBuilder, FilterRule, Direction, Action, FilterWeight, initialize_wfp};

let engine = WfpEngine::new()?;
initialize_wfp(&engine)?;

let rule = FilterRule::new("Allow all", Direction::Outbound, Action::Permit)
    .with_weight(FilterWeight::DefaultPermit);
let filter_id = FilterBuilder::add_filter(&engine, &rule)?;

// Later: remove the filter
FilterBuilder::delete_filter(&engine, filter_id)?;

Examples found in repository

examples/simple_block.rs (line 54)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Simple Block Demo\n");

    // Initialize WFP
    println!("Opening WFP Engine...");
    let engine = WfpEngine::new()?;
    println!("Engine opened\n");

    println!("Registering provider...");
    initialize_wfp(&engine)?;
    println!("Provider registered\n");

    // Block notepad.exe outbound connections
    println!("Adding block filter for notepad.exe...");
    let notepad_rule = FilterRule::new("Block Notepad", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(r"C:\Windows\System32\notepad.exe");

    let filter_id = FilterBuilder::add_filter(&engine, &notepad_rule)?;
    println!("Filter added (ID: {})\n", filter_id);

    println!("Filter active for 10 seconds...");
    println!("   (Try opening notepad.exe and accessing network)\n");

    for i in (1..=10).rev() {
        println!("   {} seconds remaining...", i);
        thread::sleep(Duration::from_secs(1));
    }

    println!("\nRemoving filter...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("Filter removed\n");

    println!("Demo complete!");
    Ok(())
}

examples/live_demo.rs (line 108)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Live WFP Demo");
    println!("================================\n");

    // Check for admin privileges
    if !is_elevated() {
        eprintln!("ERROR: This demo requires Administrator privileges!");
        eprintln!("   Please run: cargo run --example live_demo --release");
        eprintln!("   from an Administrator command prompt.\n");
        std::process::exit(1);
    }

    println!("Running with Administrator privileges\n");

    // Step 1: Initialize WFP Engine
    println!("Step 1: Opening WFP Engine session...");
    let engine = WfpEngine::new()?;
    println!("   Engine session opened\n");

    // Step 2: Register Provider & Sublayer
    println!("Step 2: Registering WFP provider & sublayer...");
    initialize_wfp(&engine)?;
    println!("   Provider & sublayer registered\n");

    // Step 3: Subscribe to network events
    println!("Step 3: Subscribing to network events...");
    let event_subscription = WfpEventSubscription::new(&engine)?;
    println!("   Event subscription active\n");

    // Step 4: Add blocking filter for curl.exe
    println!("Step 4: Adding block filter for curl.exe...");
    let curl_path = find_curl_path();
    println!("   Target: {}", curl_path.display());

    let block_rule = FilterRule::new("Block curl.exe", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(curl_path.clone());

    let filter_id = FilterBuilder::add_filter(&engine, &block_rule)?;
    println!("   Filter added (ID: {})\n", filter_id);

    // Step 5: Monitor events
    println!("Step 5: Monitoring network events...");
    println!("   Press Ctrl+C to stop\n");
    println!("TIP: In another terminal, run:");
    println!("   > curl https://google.com");
    println!("   You should see the connection BLOCKED below!\n");
    println!("===================================================\n");

    let start_time = std::time::Instant::now();
    let mut event_count = 0;

    loop {
        match event_subscription.try_recv() {
            Ok(event) => {
                event_count += 1;
                print_event(&event, event_count);
            }
            Err(std::sync::mpsc::TryRecvError::Empty) => {
                thread::sleep(Duration::from_millis(100));
            }
            Err(std::sync::mpsc::TryRecvError::Disconnected) => {
                println!("\nEvent channel disconnected!");
                break;
            }
        }

        // Auto-stop after 60 seconds for demo
        if start_time.elapsed() > Duration::from_secs(60) {
            println!("\nDemo timeout (60s) - stopping...");
            break;
        }
    }

    // Cleanup
    println!("\nCleaning up...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("   Filter removed");
    drop(event_subscription);
    println!("   Event subscription closed");
    drop(engine);
    println!("   Engine session closed\n");

    println!("Demo complete! {} events captured.", event_count);
    Ok(())
}