How do I implement a Network Filter by process (path/id)?

Question

Created Jun ’20

Replies 1

Boosts 0

Participants 2

Hi, in almost all network filters there is the possibility to set a rule to allow or deny all network traffic coming from or going to a particular process, it can be done using the program path most of the time, or the boundle id in mac. Guess what... I need to implement such a filter. The problem comes when I try to use some of the new System Network Extension filtering classes. Mac provides the following options:

NEDataProvider. Using this filter I can get the process path, pid, boundle-id, what looks great, but... it only filters TCP/UDP protocols. What about all the remaining Layer 4 protocols??? It does not make any sense to me!!! And ups... wait a moment... this only works for new connections, you cannot filter existing connections!!!

NEPacketProvider. Using this filter I can filter all protocols above Layer 2 at any time, fantastic! Until... you realize that you cannot get the path, pid, boundle-id of the process generating/receiving the packet.

So, is there a way to implement such a filter?

Regards!

Boost

Answer 1

Systems Engineer OP

Apple

Jun ’20

Yes, you can use TCP, UDP, or any to get both TCP and UDP.
@const NENetworkRuleProtocolAny Matches TCP and UDP traffic

NEDataProvider. Using this filter I can get the process path, pid, boundle-id, what looks great, but... it only filters TCP/UDP protocols. What about all the remaining Layer 4 protocols??? It does not make any sense to me!!! And ups... wait a moment... this only works for new connections, you cannot filter existing connections!!!

Yes, you can try and delay the packet and attempt to access the NEPacket metadata property to try and get the sourceAppAuditToken, but this is property is not consistently available.

NEPacketProvider. Using this filter I can filter all protocols above Layer 2 at any time, fantastic! Until... you realize that you cannot get the path, pid, boundle-id of the process generating/receiving the packet.

I would recommend opening an enhancement request for the following features. Please follow up with the Feedback id so I can copy myself on it for future updates.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0