Hello,
I am wondering about the egress addresses of the Oblivious HTTP relay that Apple runs for Network Extension URL filters.
I am building an iOS app that uses NEURLFilterManager. The app builds a Bloom filter from the block lists a user picks. The system only asks our server about a site when that filter has a hit. Each lookup is encrypted with keyword PIR and carries a Privacy Pass token instead of anything tied to the user. It reaches our server through your relay, which strips the device's address. We run our own PIR server, Privacy Pass issuer and OHTTP gateway instead of a hosted service.
The gateway is the one part of the setup that should only ever hear from your relay. Since every real lookup comes through the relay, I would really like to drop all other traffic to it at the firewall. Right now I can't do that. I also can't rate limit by address because every legitimate request shares the relay's addresses. As a result the gateway just has to stay open to everyone and rely on global limits, which is a far cry from what I'd want for a service that only one client is meant to reach.
I have three questions about this.
1) Are the relay's egress address ranges published somewhere, or can they be shared with developers who have been onboarded?
2) If they are shared, how would we find out when they change and how much notice there is?
3) If the addresses can't be shared, is there another way to tell that a request came from the relay, such as a header or a client certificate?
Please let me know if any of this is unclear or if there is a better place to ask.
Thank you in advance,
Alexander