Monterey Beta 8 appproxy when block QUIC traffic, no network!

Question

richard_wang OP

Created Oct ’21

Replies 1

Boosts 0

Participants 2

Hi there,

Encountered something weird when doing beta test on Monterey Beta 8 while all good with Monterey Beta 6:

We use system extension for NETransparentProxyProvider and we block QUIC traffics by below codes:

override func handleNewUDPFlow(_ flow: NEAppProxyUDPFlow, initialRemoteEndpoint remoteEndpoint: NWEndpoint) -> Bool {
	let ep = remoteEndpoint as! NWHostEndpoint
	flow.open(withLocalEndpoint: nil) { [unowned self] error in
			guard error == nil else {
				flow.closeReadWithError(error)
				flow.closeWriteWithError(error)
				return
			}
	}
	if ep.port == "80" || ep.port == "443" {
		flow.closeReadWithError(nil)
		flow.closeWriteWithError(nil)
		return
	}
	...
}

That works pretty well all through Big Sur to Monterey Beta 6. But when I upgraded to Beta 8 with the same, the system suffers:

Chrome has no network access anymore.
System extension get stuck when first time removed (need a second time to be removed)
Sometimes the whole macOS has no network access at all.

All these can be recovered by simply let QUIC traffics through or not capturing them. But we need to block such traffic in order that Chrome browser falls back to TCP mode.

Thanks in advance for any suggestion!

Regards Richard

Boost

Answer 1

Systems Engineer OP

Apple

Oct ’21

That works pretty well all through Big Sur to Monterey Beta 6. But when I upgraded to Beta 8 with the same, the system suffers: Chrome has no network access anymore. System extension get stuck when first time removed (need a second time to be removed)

What you are describing sounds symptomatic of another bug that was recently found in Monterey Beta 7/8 for NETransparentProxyProvider where there was a potential hang in the provider during the flow divert process (r. 83648240). This should be fixed in an upcoming release, but I cannot exactly say when.

Now, if you still experience this issue with QUIC traffic in upcoming releases, please open a TSI and DTS can take a deeper look at what is going on specifically with QUIC traffic and your provider.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0