Query Regarding NEFilterDataProvider's Hostname Resolution Across Different Browsers

PLATFORM AND VERSION

macOS Development environment: Xcode 15.0, macOS 15.0.1 Run-time configuration: macOS 15.0.1

DESCRIPTION OF PROBLEM

We are currently developing a macOS app using the NEFilterDataProvider in the Network Extension framework, and we've encountered an issue regarding hostname resolution that we would like your guidance on.

In our implementation, we need to drop network flows based on the hostname. The app successfully receives the remoteHostname or remoteEndpoint.hostname for browsers such as Safari and Mozilla Firefox. However, for other browsers like Chrome, Opera Mini, Arc, Brave, and Edge, we only receive the IP address instead of the hostname.

We are particularly looking for a way to retrieve the hostname for all browsers to apply our filtering logic consistently. Could you please advise whether there is any additional configuration or API we can use to ensure that we receive hostnames for these browsers as well? Alternatively, is this a limitation of the browsers themselves, and should we expect to only receive IP addresses for certain cases?

STEPS TO REPRODUCE

For Chrome, Brave, Edge, and Arc browsers you won't receive the hostname in NEFilterFlow.

Using the same sample project provided in WWDC 2019 https://developer.apple.com/documentation/networkextension/filtering_network_traffic

import NetworkExtension
import os.log
import Network

/**
 The FilterDataProvider class handles connections that match the installed rules by prompting
 the user to allow or deny the connections.
 */
class FilterDataProvider: NEFilterDataProvider {
    
    // MARK: NEFilterDataProvider
    
    override func startFilter(completionHandler: @escaping (Error?) -> Void) {
        
        completionHandler(nil)
    }
    
    override func stopFilter(with reason: NEProviderStopReason, completionHandler: @escaping () -> Void) {
        completionHandler()
    }
    
    override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict {
        
        guard let socketFlow = flow as? NEFilterSocketFlow,
              let remoteEndpoint = socketFlow.remoteEndpoint as? NWHostEndpoint,
              let localEndpoint = socketFlow.localEndpoint as? NWHostEndpoint else {
            return .allow()
        }
        
        var hostName: String? = nil
        
        // Attempt to use the URL host for native apps (e.g., Safari)
        if let url = socketFlow.url {
            hostName = url.host
            os_log("URL-based Host: %@", hostName ?? "No host found")
        }
        
        // Fallback: Use remote hostname for third-party browsers like Chrome
        if hostName == nil {
            if #available(macOS 11.0, *), let remoteHostname = socketFlow.remoteHostname {
                hostName = remoteHostname
                os_log("Remote Hostname: %@", hostName ?? "No hostname found")
            } else {
                hostName = remoteEndpoint.hostname
                os_log("IP-based Hostname: %@", hostName ?? "No hostname found")
            }
        }
        
        let flowInfo = [
            FlowInfoKey.localPort.rawValue: localEndpoint.port,
            FlowInfoKey.remoteAddress.rawValue: remoteEndpoint.hostname,
            FlowInfoKey.hostName.rawValue: hostName ?? "No host found"
        ]
        
        // Ask the app to prompt the user
        let prompted = IPCConnection.shared.promptUser(aboutFlow: flowInfo, rawFlow: flow) { allow in
            let userVerdict: NEFilterNewFlowVerdict = allow ? .allow() : .drop()
            self.resumeFlow(flow, with: userVerdict)
        }
        
        guard prompted else {
            return .allow()
        }
        
        return .pause()
    }
    
    // Helper function to check if a string is an IP address
    func isIPAddress(_ hostName: String) -> Bool {
        var sin = sockaddr_in()
        var sin6 = sockaddr_in6()
        if hostName.withCString({ inet_pton(AF_INET, $0, &sin.sin_addr) }) == 1 {
            return true
        } else if hostName.withCString({ inet_pton(AF_INET6, $0, &sin6.sin6_addr) }) == 1 {
            return true
        }
        return false
    }
}