Is it feasible to overlap webfilterproxyd with other proxies running locally?

Question

Created Oct ’22

Replies 1

Boosts 0

Views 1.5k

Participants 2

Hi,

I have developed a simple web proxy application in order to block/allow connections based in some user-defined criteria. HTTP/S traffic is being injected into this proxy by means of PF rules.

I have noticed that when I enable Screen Time -> Content & Privacy Restrictions -> Limit Adult Websites, then two things happen:

A network kernel extension is loaded
- com.apple.nke.webcontentfilter
A user-mode proxy is launched
- com.apple.webcontentfilter.dns
- com.apple.webcontentfilter.proxy

It seems that the NKE is setting a socket filter globally in order to redirect traffic to that user-mode proxy (/System/Library/PrivateFrameworks/WebContentAnalysis.framework/Resources/webfilterproxyd)

I have observed that with Safari, the PF rules still have effect and my simple web proxy is feeded with traffic (checked with wireshark, pfctl & lsof)

On the other hand, that behaviour is not reproduced using other browsers (e.g. Chrome & Firefox).

I would need assistance/advice in order to understand why Safari is behaving differently.

Thank you in advance.

--- Test env ---

OSX 12.6
Safari 16.0
Chrome 106
Firefox 106

Boost

Answer 1

DTS Engineer OP

Apple

Oct ’22

HTTP/S traffic is being injected into this proxy by means of PF rules.

PF is not a developer API on macOS. It’s used by various system features and it’s available to be used by the user (well, more likely the site administrator) but it’s not meant to be used by third-party products. That’s because there’s no good way to arbitrate between the system and your product or, worse yet, between multiple third-party products

I have developed a simple web proxy application in order to block/allow connections based in some user-defined criteria.

If you want to build a product like this, use a Network Extension provider. You have two options:

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0