Hello,
I'm developing a transparent proxy which only intercepts traffic coming from certain apps.
I'm having a problem when there are other transparent proxies active where the flow.metaData.sourceApplicationSigningIdentifier property is whichever provider intercepted the traffic before my provider did.
To verify this, I have implemented a small application that installs two transparent proxy profiles which handle the flows only coming from Safari.
Here's the is the bit of the code where the provider determines that:
open override func handleNewFlow(_ flow: NEAppProxyFlow) -> Bool {
guard let flow = flow as? NEAppProxyTCPFlow else { return false }
let sourceApp = flow.metaData.sourceAppSigningIdentifier
NSLog("[TransparentProxyProvider] Received flow from: \(sourceApp)")
guard sourceApp == "com.apple.Safari" else { return false }
// Create NWConnection and handle flow copying as needed
return true
}
As you can see from the following screenshots, when both profiles are active are the same time, the logs show that the second profile sees that the source application is the first profile:
From what I understand, that happens because the Transparent Proxy Provider creates a TCP connection and therefore, from the Operating System's perspective, is initiating a new separate flow which is what is then intercepted by the second provider.
My questions are:
- Is this expected behavior?
- Is there a way to find what the actual source application was?
- How does the Operating System determine which profile receives the traffic first?
From what I understand, that happens because the Transparent Proxy Provider creates a TCP connection and therefore, from the Operating System's perspective, is initiating a new separate flow which is what is then intercepted by the second provider.
That sounds about right. However, there is a way for a transparent proxy to correctly reflect the source of the flow. The way you do this depends on the API you’re using in your proxy:
-
If you’re using the Network framework Swift API, call the
setMetadata(on:)method to apply the appropriate metadata to theNWParametersyou use for your connection. This is new in macOS 15. -
If you’re using the Network framework C API, call the
setMetadata(_:)method to apply the appropriate metadata to thenw_parameters_tyou use for your connection. This has been around since macOS 10.15.4.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"