Pausing/Resuming NEFilter*Provider filtering

Question

Created Feb ’21

Replies 2

Boosts 0

Participants 2

Hi!

I've already got everything up and running in my Firewall application using NEFilterDataProvider and NEFilterPacketProvider.

There are some times when I would like to disable filtering (just allow all traffic), and then re-enable it at a later time (mainly for preventing an unnecessary performance hit). I could, of course, just return the allow verdict in the newFlow/packet handlers, but I was wondering if there's any way to dynamically start/stop the filter (without requiring asking the user for approval again) and not have the handlers called at all. There are the methods stopFilter and startFilter, but according to the documentation those are supposed to be called by the system, not sure if I should be using them for this purpose.

Thanks!

Best regards,
Darío

Boost

Answer 1

Systems Engineer OP

Apple

Feb ’21

There are some times when I would like to disable filtering (just allow all traffic), and then re-enable it at a later time (mainly for preventing an unnecessary performance hit). I could, of course, just return the allow verdict in the newFlow/packet handlers

Right. This would be the first thing I would evaluate; adding logic to always allow, as opposed to evaluating the flow details and then making a decision.

I was wondering if there's any way to dynamically start/stop the filter (without requiring asking the user for approval again) and not have the handlers called at all.

I did a quick test with this today, and there's nothing that's technically stopping you from setting up logic to dynamically start and stop the filter. However, I suspect that you would see better results with just adding in logic to determine when to allow and when to evaluate the filter.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0

Answer 2

dlipicar OP

Feb ’21

Allright! I imagined I would get better performance if I could get the filter to not capture the packets/flows at all. I might do some tests later, for the time being I'll just quickly return an allow verdict at the top of the handler.

Thanks!

0