confirmedcode / Lockdown-iOS

GNU General Public License v3.0
885 stars 85 forks source link

Apple policy - unsupported use of packet tunnel providers #156

Open paillardf opened 3 months ago

paillardf commented 3 months ago

Hey Devs, I was curious to know if you had any difficulty to validate the app on Apple store. When I read policy around packet tunnel on the official documentation it seems that it is not allowed to do what you do in the app. We can read:

Unsupported uses of packet tunnel providers

Do not use a packet tunnel provider to implement a network content filter. Packets that are read from NEPacketTunnelFlow are meant to be sent over a tunnel connection to a remote server for injection into a remote network. They are not meant to be dropped or re-injected back into the system. Doing so is a content filter action, as supported by one of the Network Extension Content Filter APIs. On iOS, implement a connection-based content filter using NEFilterDataProvider and NEFilterControlProvider. On macOS, implement a connection-based content filter with NEFilterDataProvider or a packet-based content filter with NEFilterPacketProvider. On macOS, using both providers at the same time is supported.

Do not use a packet tunnel provider to intercept all DNS traffic on the system. For small sets of DNS traffic inside your isolated network, this is reasonable. However, trying to intercept all DNS traffic on the system can result in endless edge cases and problems during development and deployment. As an alternative use the NEDNSProxyProvider or the DNS Settings APIs. These APIs were built for handling all DNS traffic on the system.

Thanks in advance for your feedback.