CODEWITHSUNDEEP
network-programmingfilteringfirewallmacos-catalinakernel-extension
DevShark
DevShark

Reputation: 9122

Network extension framework versus kernel extension

I am looking to implement firewall/network filtering functionalities for macOS.

I am looking at the most secure way to do this, i.e. trying to make sure no network traffic is missed, and that my filtering cannot easily be by-passed.

After searching around, I can see that Apple has deprecated Network Kernel Extension. They recommend now to use the Network Extension framework.

However, I can see that firewalls for mac, for example Lulu and Little Snitch have moved to using Kernel Extension, and not the Network Extension framework.

Is there a good reason to do so? Do Kernel Extension allow a deeper, more secure filtering?

Upvotes: 0

Views: 557

Answers (1)

pmdj
pmdj

Reputation: 23438

for example Lulu and Little Snitch have moved to using Kernel Extension

I can't speak for Lulu, but Little Snitch at least was developed long before the "Network Extension" API was introduced, it certainly didn't "move to" the NKE API. According to an article on their own blog it looks like they're actively investigating moving to Network Extensions. I suspect that as long as NKEs work without restrictions on all macOS versions they support, they'll keep using those, in order not to have to ship different back-ends simultaneously. But they probably have some kind of internal prototype using the newer APIs already to make sure they're prepared for when NKE APIs are finally removed from the OS.

If Network Extensions support your use case, you should probably go with them. If they don't, you should file Enhancement Requests with Apple, or you will be out of options when NKEs stop working.

Edit: To deploy NKEs, you will essentially need a kext signing certificate (Developer ID Application + Kext) if you don't already have one. The alternative is forcing your users to disable SIP's kext signing requirement, which is neither sensible nor reasonable in most cases. I hear Apple has made it much harder to obtain such a certificate in recent years.

Upvotes: 1

Related Questions