I am in the middle of investigating an issue arising in the call to setsockopt
syscall where it returns an undocumented and unexpected errno
. As part of that, I'm looking for a way to list any socket content filters or any such extensions are in play on the system where this happens.
To do that, I ran:
systemextensionsctl list
That retuns the following output:
0 extension(s)
which seems to indicate there's no filters or extensions in play.
However, when I do:
netstat -s
among other things, it shows:
net_api:
2 interface filters currently attached
2 interface filters currently attached by OS
2 interface filters attached since boot
2 interface filters attached since boot by OS
...
4 socket filters currently attached
4 socket filters currently attached by OS
4 socket filters attached since boot
4 socket filters attached since boot by OS
What would be the right command/tool/options that I could use to list all the socket filters/extensions (and their details) that are in use and applicable when a call to setsockopt
is made from an application on that system?
Edit: This is on a macosx-aarch64 with various different OS versions - 13.6.7, 14.3.1 and even 14.4.1.
I am in the middle of investigating an issue arising in the call to setsockopt syscall where it returns an undocumented and unexpected errno.
What’s that value?
which seems to indicate there's no filters or extensions in play.
No third-party filters in play. TN3134 Network Extension provider deployment explains that a content filter must be packaged as a sysex on macOS, and thus no sysexes means there are no content filters. Or DNS proxies or packet filters. But there are other provider types that might be relevant and can be packaged as an appex, most notably, a transparent proxy.
Having said that, the netstat
output you posted makes it clear that all the filters currently attached were attached by the OS. You are not dealing with third-party code here.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"