Hi Apple Developer Team,
We have an iOS app using Network Extension URL Filtering for content filtering. The filtering works, but we need to maintain statistics such as:
- Number of blocked/allowed URLs
- Blocked domains/URLs
- Browser-specific statistics
We don't currently see an API from the URL Filter that reliably provides the blocked URL event/details, we already say the latest introduction of reportEndPoint https://developer.apple.com/documentation/networkextension/neurlfiltermanager/reportendpoint?changes=_3,_3, we do not need it for supervised devices and that is mainly designed for supervised devices.
We are considering using NEPacketTunnelProvider alongside the URL Filter to collect network-level statistics while keeping the URL Filter responsible for the actual blocking.
Our concern is that
Could you please clarify:
- Is it supported to use URL/Content Filter +
NEPacketTunnelProvidertogether for this purpose? - Would using Packet Tunnel to collect statistics/network telemetry be considered a misuse of
NEPacketTunnelProvider, since it is primarily intended for VPN functionality? - Does adding the
packet-tunnel-providerNetwork Extension entitlement require separate Apple approval? - Could this architecture create an App Store review/distribution issue?
- Is there an Apple-supported API for obtaining the URL/domain and block decision directly from the URL/Content Filter, which would be preferable to monitoring packets?
Our goal is not to replace the content filter with Packet Tunnel. We want to keep filtering in the appropriate Network Extension and use the appropriate mechanism to maintain browser-specific blocked/allowed statistics.
Thank you.
We don't currently see an API from the URL Filter that reliably provides the blocked URL event/details
That’s right.
1- Is it supported to use [these providers] together for this purpose?
That depends on what you mean by “supported”. DTS certainly won’t support this. TN3120 Expected use cases for Network Extension packet tunnel providers explains that we only support you using a packet tunnel provider to implement VPN. If you use it for ‘off-label’ purposes like this, you’re on your own.
There are two other common uses of the term supported:
- Will it work? — I’ve no idea. Because this isn’t supported I don’t maintain expertise in it. My experience with folks who try to use a packet tunnel provider for things other than VPN is that they inevitably run into weird problems, which is the main reason why DTS doesn’t support this.
- Will it be approved by App Review? — I don’t work for App Review and can’t comment on their policies.
2- Would using Packet Tunnel to collect statistics/network telemetry be considered a misuse of NEPacketTunnelProvider … ?
But DTS, yes.
3- Does adding the packet-tunnel-provider Network Extension entitlement require separate Apple approval?
No. That entitlement is available to all paid developers.
4- Could this architecture create an App Store review/distribution issue?
See my comments above.
5- Is there an Apple-supported API for obtaining the URL/domain and block decision … ?
No.
Well, yes, and it’s the reportEndpoint facility you’ve found already. The fact that this only works on supervised devices is an important signal. It’s telling you that your overall goal is not compatible with Apple’s privacy goals for general users.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
