Content filter providers seem to block all requests during startup on iOS 16 or 17

Hi,

Consider a content filter app that allows most requests. While running, it handles requests and determine what to do. It does not affect any request while it is not running.

However, during startup, it seems to block all requests, on iOS 16 or 17.

On iOS 15, the behavior is bit different. Show the picture below:

Questions

• Is this the expected behavior?
• Is this documented?

Steps to reproduce

1. Create content filter app with filter data provider with lengthy startup, something like the following:

   import NetworkExtension
   
   class FilterDataProvider: NEFilterDataProvider {
       override func startFilter(completionHandler: @escaping ((any Error)?) -> Void) {
           Task {
               try await Task.sleep(nanoseconds: 10 * 1_000_000_000)
               completionHandler(nil)
           }
       }
   
       override func stopFilter(with reason: NEProviderStopReason) async {}
   
       override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict {
           guard let url: String = flow.url?.absoluteString else {
               return .allow()
           }
   
           if url.contains("example.net/") {
               return .drop()
           }
   
           if url.contains("example.org/") {
               exit(42)
           }
   
           return .allow()
       }
   }
   

2. Install the app on a supervised iPhone or iPad.

3. Install a WebContentFilter profile.

4. Wait for the content filter to start. You can check the status in Settings > General > VPN & Device Management > Content Filter.

5. Open Safari app.

6. Request http://example.net/ and confirm that it is blocked.

7. Request the other URLs and confirm that it is allowed.

8. Request http://example.org. It kills the filter data provider.

9. Request some URLs quickly.

Background to the questions

We offer a content filter app that might be stopped during the device sleeps. When a non-our-app’s push notification is received, the device wakes up, and the content filter starts up. Then the push notification seems to be lost. It is observed on iOS 16 and 17, not on iOS 15.