How to bypass traffic in AppProxyP… | Apple Developer Forums

Hi,

I am doing a POC with AppProxyProvider in MacOS catallina where I have intercepted superset of ipv4 traffic for port 80 in my handleNewFlow() using below include rule:

let endpoint = NWHostEndpoint(hostname: "0.0.0.0", port: "80")

includedNetworks = NENetworkRule(destinationNetwork: endpoint, prefix: 0, protocol: .TCP)

Now at run time in handleNewFlow() I have a requirement bypass many flows based on different business logic. Note these rules are discovered at run time which i cannot configure in exculde rules of NENetworkRule; like I have a DNS cache (already) and I need to do a reverse lookup on my traffic and based on domain name I need to bypass the traffic. So basically a very small subset of traffic i will need to proxy in my handleNewFlow(), but most of them I need to return to kernel to bypass the traffic without dropping them.

To do this I dont see that option in AppProxyProvider::handleNewFlow() to notify kernel that I am not interested in this flow and bypass it:

from 'https://developer.apple.com/documentation/networkextension/neappproxyprovider/1405085-handlenewflow'

Return Value of handleNewFlow()

Return

true

to indicate that the App Proxy Provider will handle the flow. Return

false

to indicate that the flow should be closed.

So question is why do I need to unnecessarily handle (implement a copier to copy flows transparently) when in most of the cases I might be interested in a very small set traffic at runtime. How can I return from handleNewFlow() indicating kernel to bypass this traffic?

How to bypass traffic in AppProxyProvider