How to trigger SimpleFirewall.SimpleFirewallExtension.FilterDataProvider.handleNewFlow

Question

c4m3l OP

Created Sep ’22

Replies 1

Boosts 0

Participants 2

i use the: https://developer.apple.com/documentation/networkextension/filtering_network_traffic

I want to study networkextension framework.i already installed the SimpleFirewallExtension systemeextension, and i have the entitlements, but i don't know how to trigger the handleNewFlow function.

What should I do to trigger this function?

Boost

Answer 1

DTS Engineer OP

Apple

Sep ’22

If you look in FilterDataProvider.swift you’ll see this code:

// Filter incoming TCP connections on port 8888
let filterRules = ["0.0.0.0", "::"].map { address -> NEFilterRule in
    let localNetwork = NWHostEndpoint(hostname: address, port: FilterDataProvider.localPort)
    let inboundNetworkRule = NENetworkRule(remoteNetwork: nil,
                                           remotePrefix: 0,
                                           localNetwork: localNetwork,
                                           localPrefix: 0,
                                           protocol: .TCP,
                                           direction: .inbound)
    return NEFilterRule(networkRule: inboundNetworkRule, action: .filterData)
}

This is what sets up the filtering rules. As you can see, it filters any incoming connections on port 8888. So, to trigger the filter, you have to:

Make an incoming connection on that port. I usually do this with nc, using the -l option to listen for incoming connections. See the nc man page for more.
Change the code that sets up the rules.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0