Setting up a DNS Proxy Provider to collect DNS Traffic

Hello,

I've tried setting up a DNS Proxy Provider using a NEDNSProxyProvider, but every time I get the extension to run, it merely blocks internet traffic. Any ideas on what I'm doing wrong? Thanks?

 override func startProxy(options:[String: Any]? = nil, completionHandler: @escaping (Error?) -> Void) {
    os_log("DNSProxyProvider: startProxy")
     
    Logging.log("DNSProxyProvider: startProxy")
     
     
      completionHandler(nil)
  }

  override func stopProxy(with reason: NEProviderStopReason, completionHandler: @escaping () -> Void) {
    os_log("DNSProxyProvider: stopProxy")
     
    Logging.log("DNSProxyProvider: stopProxy")
      completionHandler()
  }

  override func sleep(completionHandler: @escaping () -> Void) {
    os_log("DNSProxyProvider: sleep")
     
    Logging.log("DNSProxyProvider: sleep")
      completionHandler()
  }

  override func wake() {
    os_log("DNSProxyProvider: wake")
     
    Logging.log("DNSProxyProvider: wake")
  }

  override func handleNewFlow(_ flow: NEAppProxyFlow) -> Bool {
         
    os_log("DNSProxyProvider: handleFlow")
     
    Logging.log("DNSProxyProvider: handleFlow")
       
      if let udpFlow = flow as? NEAppProxyUDPFlow {
        let localHost = (udpFlow.localEndpoint as! NWHostEndpoint).hostname
        let localPort = (udpFlow.localEndpoint as! NWHostEndpoint).port
        if #available(OSX 11.0, *) {
          let remoteHost = udpFlow.remoteHostname
          os_log("DNSProxyProvider TCP HOST : %@", remoteHost as! CVarArg)
        } else {
          // Fallback on earlier versions
        }
                 
        let remotePort = 53
         
        os_log("DNSProxyProvider TCP PORT : %@", remotePort)
        os_log("DNSProxyProvider UDP HOST : %@", localHost)
        os_log("DNSProxyProvider UDP PORT : %@", localPort)
         
         
        let flowInfo = [
          FlowInfoKey.localPort.rawValue: localPort,
          FlowInfoKey.remoteAddress.rawValue: localHost
        ]
         
        IPCConnection.shared.logFlow(flowInfo, at: Date(), userAllowed: true)
      }
      return true 
  }

it merely blocks internet traffic. Any ideas on what I'm doing wrong?

The reason your internet is blocked is because you are not flow copying any of the new flows coming in from handleNewFlow or handleNewUDPFlow. Once you perform the flow copying process you should see the traffic pick back up. See this process discussed here on another post.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

It says in the article that you need to have a connection. (NWConnection)

Right, NWConnection would be the recommended path to use as a transport here.

Regarding:

How would I be able to do a flow copy without a DNS Server?

If you are not using your own DNS server, is there a reason you need to implement a NEDNSProxyProvider?

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

The reason that I'm trying to implement a NEDNSProxyProvider is so that I can collect all DNS traffic on the system locally.

Gathering all DNS traffic is not a supported workflow unless your plan to actually proxy the traffic downstream a specified DNS server, or if you plan to secure the DNS traffic with your own DoH or DoT protocol.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Setting up a DNS Proxy Provider to collect DNS Traffic
 
 
Q