NEFilterDataProvider on macOS doesn't provide URL details on new flow

Question

Created Nov ’22

Replies 3

Boosts 0

Participants 2

I was evaluating NEFilterDataProvider through Network Extension on macOS what details are available for inbound and outbound traffic. I see the following behaviour with Safari browser,

For a new flow : There is no URL details available. For Inbound and outbound traffic: There is no URL details and I don't see data bytes that are received or sent.

I am not sure what exactly is supported there on macOS through NEFilterDataProvider. If someone has already used NEFilterDataProvider to monitor network traffic please provide some pointers here.

Boost

Answer 1

DTS Engineer OP

Apple

Nov ’22

You are correct that NE filter providers don’t have WebKit integration on macOS. Consider this:

@property BOOL filterBrowsers API_DEPRECATED("filterBrowsers is not supported on macOS", macos(10.11, 10.15)) API_AVAILABLE(ios(9.0)) …

I don’t think we’ve ever officially explained the rationale for that, but keep in mind that WebKit integration on macOS would be less useful than on iOS because many third-party macOS browsers don’t use WebKit (or even NSURLSession!).

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

MacDelta OP

Nov ’22

when we access any website and access its page content or try to post content through that web page, what exactly we should expect in readBytes in the following callbacks,

override func handleInboundData(from flow: NEFilterFlow, readBytesStartOffset offset: Int, readBytes: Data) -> NEFilterDataVerdict override func handleOutboundData(from flow: NEFilterFlow, readBytesStartOffset offset: Int, readBytes: Data) -> NEFilterDataVerdict

do we get inbound and outbound content in readable/unencrypted format?

0

Answer 3

DTS Engineer OP

Apple

Nov ’22

do we get inbound and outbound content in … unencrypted format?

Not an macOS.

Being able to see plaintext TLS traffic is predicated on two things:

WebKit integration, as I mentioned previously.
A split filter data provider and filter control provider, where the data provider is tightly sandboxed.

Both of these are available on iOS but not on macOS.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0