"(null") Would Like to Filter Network Content.

Yeah deriving this information can be a pain in some cases. In the context of NEFilterDataProvider, to grab specific information on the application the network traffic came from your best bet is to try and reach the sourceAppAuditToken on the flow object provided in handleNewFlow. If this token is null then getting the app identifier or anything tangible related to the app is lost. In some cases I have seen the sourceAppAuditToken be null, but the URL from the NEFilterFlow be populated.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

I'm referring to the system dialog that pops up to ask the user to allow a Network Extension.

Not a Network Extension trying to figure out which application "owns" a flow (which I would tend to do through the pid on macOS since most of the properties for the source app are not available on macOS, which is a pity but makes some sense).

I'm referring to the system dialog that pops up to ask the user to allow a Network Extension.

Ah, I see. Yeah, I recently did some testing on this and experienced this issue. I am tracking a bug for this but I would suggest opening on on your end if you are seeing this too.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

FB8251066

For the record, this issue seems to be solved (or at least not to appear immediately) in macOS BS beta3.

I was running an unrelated test on a fresh virtual machine of macOS Catalina 10.15.5 this morning and did see this working there as well.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com 

Well, it does not work on 10.15.6 here.