Mixing NEDNSProxyProvider and NEAppProxyProvider create problems sending DNS requests

Question

chapo213 OP

Created Apr ’23

Replies 2

Boosts 0

Participants 2

Hi, I'm using 2 separated providers, each derived from dns and application providers respectively.

in the application provider I use the object NETunnelNetworkSettings as input in method to setTunnelNetworkSettings to catch all network data originated from some specific applications (including dns packets).

in the dns provider I'd like to catch all dns traffic in general disregarding any specific application where the request was originated from.

in my experiment, If I avoid setting the DNS server addresses in DNSSettings inside NETunnelNetworkSettings, than all DNS originated from the specific application I set using the app proxy tunnel, will be destined to address 10.0.0.10 by default (and not the default DNS address).

However, If I do set this DNSSettings value, I get the following block (in my example I set the app proxy to catch the traffic of zoom.us application)

2023-04-19 11:34:45.493033+0300 0x1206     Default     0x0                  501    0    mDNSResponder: [com.apple.mDNSResponder:Default] [Q36288] ShouldSuppressUnicastQuery: Query suppressed for zoom.us. Addr (blocked by policy)
2023-04-19 11:34:45.493582+0300 0x1206     Default     0x0                  501    0    mDNSResponder: [com.apple.mDNSResponder:Default] [Q14787] ShouldSuppressUnicastQuery: Query suppressed for zoom.us. AAAA (blocked by policy)

my desire is to catch the application connections using the app proxy provider, and leave the dns requests/responses for the dns proxy provider.

I know this might not be the best approach, but perhaps there's a way to "tell" my application proxy provider to "ignore" DNS packets on udp connection, and let the DNS proxy handle it (without getting blocked by policy error, which happen before the packet reaches any of the proxy providers.)

thanks !

Boost

Answer 1

Systems Engineer OP

Apple

Apr ’23

my desire is to catch the application connections using the app proxy provider, and leave the dns requests/responses for the dns proxy provider.

I am assuming that this is macOS so based on your workflow above, are you able to only use NETransparentProxyProvider instead of having two providers? You should be able to capture both sets of packets in NETransparentProxyProvider.

0

Answer 2

chapo213 OP

Apr ’23

Hi Meaton,

Perhaps you can guide me how to distinguish DNS packets/responses and other traffic (TCP/UDP) from NETransparentProxyProvider.

I know how to use handleNewFlow and handleNewUDPFlow to catch all tcp/udp traffic, I guess that in order to extract the DNS packets I need to add the completion of handleNewUDPFlow a check if the dest port is 53, right?

Also, how can I get the process name initiating the connection in NETransparentProxyProvider ? I want to get callbacks for certain apps only. do I need to check all connections or can I configure the transparent provider to forward the connections in app resolution ? If so, How can I configure it in saveToPreference from the manager side ?

thanks

0