Filtering IPPROTO_ICMP and IPPROTO_RAW using NetworkExtension

Question

Created Oct ’20

Replies 12

Boosts 0

Views 1.9k

Participants 5

Hi,
I am trying to create an app that filters network events - whether to collect statistics, or to even block some specific flows.

I see that using NEFilterDataProvider I am able to only filter UDP or TCP protocols (when filtering by .any, I see I only receive UDP/TCP). For example, I wish to see the flow of a simple ping 1.1.1.1.
This of course makes the statistics partial (without ICMP packet/raw socket packets), or the flow block being bypass-able (even if with some effort), by using Raw sockets.

Is there a way to add to the filtering also ICMP and RAW flows? Should I use a different provider for those?

Answered by DTS Engineer in 638834022

Filter data providers only see TCP and UDP flows. Filter packet providers see all packets.

Also, in what way can I get packet type in PacketProvider?

Your packet handler function is called with a pointer and length (the packetBytes and packetLength parameters) that denote the entire packet, including link-level header and, assuming it’s IP, the IP header.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Oct ’20

I am trying to create an app that filters network events

What platform are you working on?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

obenshalom OP

Oct ’20

Sorry, I forgot to mention that part - macOS

0

Answer 3

tartempion OP

Oct ’20

AFAIK, NEFilterPacketProvider should allow you to see all the IPPROTO_ you want.

0

Answer 4

obenshalom OP

Oct ’20

Thought that too, but I do not see any new flow when calling ping.
Same as with raw sockets.

EDIT: saw you wrote NEFilterPacketProvider. It is not possible using DataProvider?
Also, in what way can I get packet type in PacketProvider?

0

Answer 5

DTS Engineer OP

Apple

Oct ’20

Accepted Answer

Filter data providers only see TCP and UDP flows. Filter packet providers see all packets.

Also, in what way can I get packet type in PacketProvider?

Your packet handler function is called with a pointer and length (the packetBytes and packetLength parameters) that denote the entire packet, including link-level header and, assuming it’s IP, the IP header.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

1

Answer 6

obenshalom OP

Oct ’20

Thanks! That will solve our issues with that. Is there a way to extract source app for a packet with packet filter? I see there is a context, but I'm not sure what and how we can extract from it.

0

Answer 7

DTS Engineer OP

Apple

Oct ’20

Is there a way to extract source app for a packet with packet filter?

I’m not sure.

I see there is a context

Indeed. The context parameter will not give you packet metadata directly. However, you can use it to delay the packet. This results in an NEPacket object and you can try getting metadata from that. However, based on this thread I suspect that won’t help you.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 8

Nickkk OP

Oct ’23

Filter data providers only see TCP and UDP flows.

Is this really the case? I also have a NEFilterDataProvider and until now I got ICMP (remote endpoint 192.168.1.1), ICMP6 (remote endpoint ff02::2), TCP and UDP flows.

0

Answer 9

DTS Engineer OP

Apple

Oct ’23

Presumably these are NEFilterSocketFlow. What values do you see in socketFamily, socketType, and socketProtocol?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 10

Nickkk OP

Nov ’23

Sorry for my late reply, again I wasn't notified of your response despite watching this thread.

Yes, they are NEFilterSocketFlow. I just got 2 outbound flows from local :: to remote ff02::2 (both port 0) by /usr/libexec/configd: socketType = SOCK_RAW, socketFamily = AF_INET6, socketProtocol = IPPROTO_ICMPV6.

0

Answer 11

Nickkk OP

Nov ’23

While I was writing my earlier answer I just got 10 new flows from 0.0.0.0 to 192.168.1.1 by /sbin/ping: socketType = SOCK_RAW, socketFamily = AF_INET, socketProtocol = IPPROTO_ICMP.

0

Answer 12

AndriiSulimenko OP

Apr ’24

Filter data providers only see TCP and UDP flows. Filter packet providers see all packets.

I am working on the similar project but for iOS and so far I was able to intercept all UDP/TCP flows, however ICMP packets are still going through (I am using Network Tools app to send ping requests).
Is it possible to intercept all packets on iOS as well?

0