{"id":1188,"date":"2022-09-27T10:45:48","date_gmt":"2022-09-27T15:45:48","guid":{"rendered":"https:\/\/www.brunerd.com\/blog\/?p=1188"},"modified":"2025-02-04T14:47:19","modified_gmt":"2025-02-04T19:47:19","slug":"determining-icloud-private-relay-and-limit-ip-tracking-status-in-macos","status":"publish","type":"post","link":"https:\/\/www.brunerd.com\/blog\/2022\/09\/27\/determining-icloud-private-relay-and-limit-ip-tracking-status-in-macos\/","title":{"rendered":"Determining “iCloud Private Relay” and “Limit IP tracking” status in macOS"},"content":{"rendered":"\n

If you are a Mac admin you might have noticed some Apple plists are more complex than others these days. As evidenced in my post Don’t Be a Jerk<\/a>, getting the status of Do Not Disturb in Big Sur<\/strong> was a multi-step exercise. Check out this modified code excerpt from doNotDisturb<\/a>‘s Big Sur<\/strong> handling<\/p>\n\n\n\n

#!\/bin\/sh\n\n#Big Sur DnD status, returns \"true\" or [blank] (to be run as console user)\ndndStatus=\"$(\/usr\/libexec\/PlistBuddy -c \"print :userPref:enabled\" \/dev\/stdin 2>\/dev\/null <<< \"$(plutil -extract dnd_prefs xml1 -o - \/dev\/stdin <<< \"$(defaults export com.apple.ncprefs.plist -)\" | xmllint --xpath \"string(\/\/data)\" - | base64 --decode | plutil -convert xml1 - -o -)\")\"\n\n#if we have ANYTHING it is ON (return 0) otherwise fail (return 1)\n[ -n \"${dndStatus}\" ] && { echo ON; exit 0; } || { echo OFF; exit 1; }\n<\/code><\/pre>\n\n\n\n
Why is it so complex? Well because with the user preference domain of com.apple.ncprefs<\/code> there is a base64 encoded plist embedded in<\/em> the dnd_prefs<\/code> key and requires some massaging to get it to a state where PlistBuddy<\/code> can read and then extract the status from the :userPref:enabled<\/code> key. See it’s just that easy! \ud83d\ude05<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
In macOS Monterey and higher Apple is now using JSON for Focus status which is great<\/strong> because it can can be parsed much<\/em> easier (perhaps using my ljt<\/a> or jpt<\/a> tools) but sometimes not even that<\/em> is needed! Sometimes file presence or awking is sufficient to get a reliable result too. See the evolution of doNotDisturb.sh<\/a> for macOS for the myriad techniques one can use.<\/p>\n\n\n\n
Now, here we are at Monterey on the verge of Ventura and not all areas of macOS have seen the JSON light and are still using nested base64-encoded Plist blobs to store the states of new<\/em> features like iCloud Private Relay<\/strong> but luckily not<\/em> the per interface setting of Limit IP Tracking<\/strong>.<\/p>\n\n\n\n
iCloud Private Relay Status<\/h2>\n\n\n\n
Now why would you want to know these statuses? Perhaps you have a VPN product that doesn’t work when Private Relay is turned on or if Limit IP Tracking is turned on for a particular interface and you need to alert the user. Additionally maybe there’s an issue if your VPN browser handshake fails when Safari is used, if so see: Determining URL scheme handlers in macOS<\/a>. Back to the task at hand though let’s turn some prefs inside out and look at iCloud Relay<\/strong> status with iCloudPrivateRelayStatus.sh<\/a><\/p>\n\n\n\n
#!\/bin\/bash\n: <<-LICENSE_BLOCK\niCloud Private Relay Status Checker (20250204) - (https:\/\/github.com\/brunerd)\nCopyright (c) 2025 Joel Bruner (https:\/\/github.com\/brunerd)\nLicensed under the MIT License\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and\/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\nLICENSE_BLOCK\n\n#############\n# FUNCTIONS #\n#############\n\n#include this self-contained function in your script\nfunction iCloudPrivateRelay()(\n\n\t#only for Moneterey and up, 11 and under need not apply\n\t[ \"$(sw_vers -productVersion | cut -d. -f1)\" -le 11 ] && return 1\n\t\n\t#parent pref domain\n\tdomain=\"com.apple.networkserviceproxy\"\n\t#key that contains base64 encoded Plist within parent domain\n\tkey=\"NSPServiceStatusManagerInfo\"\n\t#path within base64 embedded plist, there are multiple PrivacyProxyServiceStatus entries but this one seems primary\n\ttargetPath=':$objects:1:PrivacyProxyServiceStatus'\n\n\t#get the top level data from the main domain\n\tparentData=$(launchctl asuser \"$(stat -f %u \/dev\/console)\" sudo -u \"$(stat -f %Su \/dev\/console)\" defaults export \"${domain}\" -)\n\n\t#if domain does not exist, fail\n\t[ -z \"${parentData}\" ] && return 1\n\n\t#export and decode the base64 data as plist XML and look for \n\tkeyStatusCF=$(\/usr\/libexec\/PlistBuddy -c \"print '${targetPath}'\" \/dev\/stdin 2>\/dev\/null <<< \"$(plutil -extract \"${key}\" xml1 -o - \/dev\/stdin <<< \"${parentData}\" | xmllint --xpath \"string(\/\/data)\" - | base64 --decode | plutil -convert xml1 - -o -)\")\n\t#if no value, fail\n\t[ -z \"${keyStatusCF}\" ] && return 1\n\t\n\t#if true\/1 it is on, 0\/off (value is integer not boolean BTW)\n\t[ \"${keyStatusCF}\" = \"1\" ] && return 0 || return 1\n)\n\n########\n# MAIN #\n########\n\n#example - multi-line if\/else calling\nif iCloudPrivateRelay; then\n\techo \"iCloud Private Relay is: ON\"\nelse\n\techo \"iCloud Private Relay is: OFF\"\nfi<\/code><\/pre>\n\n\n\n
Even though we work really hard to get the plist data extracted we don’t need to walk the entire XML document (you will find PlistBuddy balks at exporting JSON for a number of reasons). Instead we look for the presence of the key name PrivacyProxyServiceStatus<\/code> and that is sufficient to reliably detect the state.<\/s> UPDATE: This ambiguity has been resolved and it will now look at the path :$objects:1:PrivacyProxyServiceStatus<\/code> for the status, which seems to be consistent (LMK otherwise). I have 2 versions in my GitHub iCloudPrivateRelayStatus.sh<\/a> and the minified one line version iCloudPrivateRelayStatus.min.sh<\/a><\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
Limit IP Tracking Status<\/h2>\n\n\n\n
Limit IP Tracking, is a per-interface setting that is on<\/strong> by default, however has no effect unless Private Relay is enabled. For this we will use ljt<\/a> my Little JSON Tool to retrieve the value from the massaged JSON conversion of com.apple.wifi.known-networks.plist<\/code> if on WiFi or if on Ethernet ...\/SystemConfiguration\/preferences.plist<\/code>. (Update: Now macOS Sequoia compatible after Apple broke the usual way of getting the SSID name for WiFi connections)<\/p>\n\n\n\n
#!\/bin\/bash\n: <<-LICENSE_BLOCK\nLimit IP Tracking Status Checker (20250204) - (https:\/\/github.com\/brunerd)\nCopyright (c) 2025 Joel Bruner (https:\/\/github.com\/brunerd)\nLicensed under the MIT License\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and\/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\nLICENSE_BLOCK\n\n#############\n# FUNCTIONS #\n#############\n\n#include this self-contained function in your script\nfunction limitIPTracking()(\n\n\t#only for Moneterey and up, 11 and under need not apply\n\t[ \"$(sw_vers -productVersion | cut -d. -f1)\" -le 11 ] && return 1\n\n\t#Little JSON Tool (ljt) - https:\/\/github.com\/brunerd\/ljt - MIT License\n\tfunction ljt () ( #v1.0.8 ljt [query] [file]\n\t{ set +x; } &> \/dev\/null; read -r -d '' JSCode <<-'EOT'\n\ttry{var query=decodeURIComponent(escape(arguments[0]));var file=decodeURIComponent(escape(arguments[1]));if(query===\".\")query=\"\";else if(query[0]===\".\"&&query[1]===\"[\")query=\"$\"+query.slice(1);if(query[0]===\"\/\"||query===\"\"){if(\/~[^0-1]\/g.test(query+\" \"))throw new SyntaxError(\"JSON Pointer allows ~0 and ~1 only: \"+query);query=query.split(\"\/\").slice(1).map(function(f){return\"[\"+JSON.stringify(f.replace(\/~1\/g,\"\/\").replace(\/~0\/g,\"~\"))+\"]\"}).join(\"\")}else if(query[0]===\"$\"||query[0]===\".\"&&query[1]!==\".\"||query[0]===\"[\"){if(\/[^A-Za-z_$\\d\\.\\[\\]'\"]\/.test(query.split(\"\").reverse().join(\"\").replace(\/([\"'])(.*?)\\1(?!\\\\)\/g,\"\")))throw new Error(\"Invalid path: \"+query);}else query=query.replace(\"\\\\.\",\"\\udead\").split(\".\").map(function(f){return\"[\"+JSON.stringify(f.replace(\"\\udead\",\".\"))+\"]\"}).join(\"\");if(query[0]===\"$\")query=query.slice(1);var data=JSON.parse(readFile(file));try{var result=eval(\"(data)\"+query)}catch(e){}}catch(e){printErr(e);quit()}if(result!==undefined)result!==null&&result.constructor===String?print(result):print(JSON.stringify(result,null,2));else printErr(\"Path not found.\")\n\tEOT\n\tqueryArg=\"${1}\"; fileArg=\"${2}\";jsc=$(find \"\/System\/Library\/Frameworks\/JavaScriptCore.framework\/Versions\/Current\/\" -name 'jsc');[ -z \"${jsc}\" ] && jsc=$(which jsc);[ -f \"${queryArg}\" -a -z \"${fileArg}\" ] && fileArg=\"${queryArg}\" && unset queryArg;if [ -f \"${fileArg:=\/dev\/stdin}\" ]; then { errOut=$( { { \"${jsc}\" -e \"${JSCode}\" -- \"${queryArg}\" \"${fileArg}\"; } 1>&3 ; } 2>&1); } 3>&1;else [ -t '0' ] && echo -e \"ljt (v1.0.8) - Little JSON Tool (https:\/\/github.com\/brunerd\/ljt)\\nUsage: ljt [query] [filepath]\\n  [query] is optional and can be JSON Pointer, canonical JSONPath (with or without leading $), or plutil-style keypath\\n  [filepath] is optional, input can also be via file redirection, piped input, here doc, or here strings\" >\/dev\/stderr && exit 0; { errOut=$( { { \"${jsc}\" -e \"${JSCode}\" -- \"${queryArg}\" \"\/dev\/stdin\" <<< \"$(cat)\"; } 1>&3 ; } 2>&1); } 3>&1; fi;if [ -n \"${errOut}\" ]; then \/bin\/echo \"$errOut\" >&2; return 1; fi\n\t)\n\t\n\t#sequoia broke the old ways of getting SSID\n\tfunction getCurrentWiFiSSIDforInterface(){\n\t\t#no interface, error\n\t\t[ -z \"${1}\" ] && return 1\n\n\t\t#get the SSID _quickly_ thanks MacAdmins @jby\n\t\tlocal currrent_SSID=$(ipconfig getsummary \"${1}\" | awk -F ' SSID : ' '\/ SSID : \/ {print $2}')\n\t\t\n\t\t[ -z \"${currrent_SSID}\" ] && return 1\n\t\t\n\t\techo \"${currrent_SSID}\"; return 0\n\t}\n\n\t#test interface specified or fallback to default interface\n\tinterfaceID=${1:-$(route get 0.0.0.0 2>\/dev\/null | awk '\/interface: \/ {print $2}')}\n\n\t#WIFI: key: PrivacyProxyEnabled, file: \/Library\/Preferences\/com.apple.wifi.known-networks.plist\n\t#if no error getting WiFi SSID, then we are WiFi\n\tif wifiSSID=$(getCurrentWiFiSSIDforInterface \"${interfaceID}\"); then\n\n\t\t#key name inside plist\n\t\tkeyName=\"wifi.network.ssid.${wifiSSID}\"\n\n\t\t#oddly this file is only read-able by root\n\t\tif [ ! -r \/Library\/Preferences\/com.apple.wifi.known-networks.plist ]; then\n\t\t\techo \"Insufficient preferences to determine WiFi state, run as root\" >\/dev\/stderr\n\t\t\texit 1\n\t\tfi\n\n\t\t#get JSON version, so much easier to get around, convert date and data types to strings\n\t\twifiKnownNetworks_JSON=$(defaults export \/Library\/Preferences\/com.apple.wifi.known-networks.plist - | sed -e 's,<date>,<string>,g' -e 's,<\/date>,<\/string>,g' -e 's,<data>,<string>,g' -e 's,<\/data>,<\/string>,g' | plutil -convert json -o - -)\n\t\t\n\t\t#if there is NO entry, then it is active, it is opt-out designed\n\t\tPrivacyProxyEnabled=$(ljt \"\/wifi.network.ssid.${wifiSSID}\/PrivacyProxyEnabled\" 2>\/dev\/null <<< \"${wifiKnownNetworks_JSON}\")\n\t\t\n\t\tif [ \"${PrivacyProxyEnabled}\" = \"false\" ]; then\n\t\t\treturn 1\n\t\tfi\n\t#ETHERNET: key: DisablePrivateRelay, file: \/Library\/Preferences\/SystemConfiguration\/preferences.plist, \n\telse\n\t\t#get JSON, easily converts with not data or date types within\n\t\tsystemConfigPrefsJSON=$(plutil -convert json -o - \/Library\/Preferences\/SystemConfiguration\/preferences.plist)\n\t\t#get current set UUID\n\t\tcurrentSet=$(echo \"${systemConfigPrefsJSON}\" | ljt \/CurrentSet 2>\/dev\/null)\n\t\t#get value for current default interface of current Location set\n\t\tDisablePrivateRelay=$(ljt \"${currentSet}\"\/Network\/Interface\/${interfaceID}\/DisablePrivateRelay  2>\/dev\/null <<< \"${systemConfigPrefsJSON}\")\n\n\t\t#if it is TRUE we are Disabled, then we are NOT ON, return fail code\n\t\tif [ \"${DisablePrivateRelay}\" = \"1\" ]; then\n\t\t\treturn 1\n\t\tfi\n\tfi\n)\n\n########\n# MAIN #\n########\n\nif [ ! -r \/Library\/Preferences\/com.apple.wifi.known-networks.plist ]; then\n\techo \"Insufficient privileges to determine WiFi state, run as root\" >\/dev\/stderr\n\texit 1\nfi\n\n#use default interface if nothing is specified for argument $1\ninterface=${1:-$(route get 0.0.0.0 2>\/dev\/null | awk '\/interface: \/ {print $2}')}\n\n#returns 0 if ON and 1 if OFF, you may supply an interface or it will fall back to the default\nlimitIPTracking \"${interface}\" && echo \"Limit IP tracking is ON for: ${interface}\" || echo \"Limit IP tracking is OFF for: ${interface}\"\n<\/code><\/pre>\n\n\n\n
You can specify an interface or it will use the default interface (there’s a good one-liner to use route get 0.0.0.0<\/code> to figure that out). plutil<\/code> is not initially used to convert com.apple.wifi.known-networks.plist<\/code> to JSON as it will fail due to XML\/plist data types like <date><\/code> and <data><\/code> that do not have JSON equivalents. First we use sed<\/code> to change them to <string><\/code> types then<\/em> plutil<\/code> can convert to JSON. After that it’s a cake walk for ljt<\/a> to get the value and report back. If the interface is not WiFi then \/Library\/Preferences\/SystemConfiguration\/preferences.plist<\/code> has none of those conversion issues. Check out limitIPTrackingStatus.sh<\/a> and the minified limitIPTrackingStatus.min.sh<\/a> at my GitHub. <\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
Thanks for reading! P.S. I won’t be at JNUC 2022, better luck next year!<\/p>\n","protected":false},"excerpt":{"rendered":"
If you are a Mac admin you might have noticed some Apple plists are more complex than others these days. As evidenced in my post Don’t Be a Jerk, getting the status of Do Not Disturb in Big Sur was a multi-step exercise. Check out this modified code excerpt from doNotDisturb‘s Big Sur handling Why […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,19,51,53,12],"tags":[20,34,54,25,22,24],"class_list":["post-1188","post","type-post","status-publish","format-standard","hentry","category-apple","category-bash","category-json","category-ljt","category-scripting","tag-bash","tag-json","tag-ljt","tag-macos","tag-scripting","tag-shell"],"_links":{"self":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/comments?post=1188"}],"version-history":[{"count":18,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1188\/revisions"}],"predecessor-version":[{"id":1604,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/1188\/revisions\/1604"}],"wp:attachment":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/media?parent=1188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/categories?post=1188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/tags?post=1188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}