Proxy DNS lookups through a local resolver on macOS

CHANGELOG.md

@@ -37,6 +37,13 @@ Line wrap the file at 100 chars.                                              Th
 - Don't hijack DNS when localhost is configured. This is more in line with other platforms.
   Unexpected DNS traffic is still blocked when leaving the host.
 - Enable IPv6 by default. This fixes DNS and routing being broken on some platforms.
+- Proxy DNS queries through a local resolver.
+
+### Fixed
+#### macOS
+- Fix Apple leak toggle not working. The issue was that DNS queries to the tunnel resolver were
+  being sent on the physical interface.
+
 
 ## [2024.6-beta1] - 2024-09-26
 ### Added

Cargo.toml

@@ -29,6 +29,7 @@ members = [
     "talpid-core",
     "talpid-dbus",
     "talpid-future",
+    "talpid-macos",
     "talpid-net",
     "talpid-openvpn",
     "talpid-openvpn-plugin",

talpid-core/Cargo.toml

@@ -56,9 +56,10 @@ talpid-platform-metadata = { path = "../talpid-platform-metadata" }
 pcap = { version = "2.1", features = ["capture-stream"] }
 pnet_packet = "0.34"
 tun = { version = "0.5.5", features = ["async"] }
-nix = { version = "0.28", features = ["socket"] }
+nix = { version = "0.28", features = ["socket", "signal"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+talpid-macos = { path = "../talpid-macos" }
 talpid-net = { path = "../talpid-net" }
 
 [target.'cfg(windows)'.dependencies]

talpid-core/src/firewall/macos.rs

@@ -98,6 +98,17 @@ impl Firewall {
         let remote_address = state.remote_address()?;
         let proto = state.proto()?;
 
+        if local_address.ip().is_loopback() || remote_address.ip().is_loopback() {
+            // Ignore connections to localhost
+            return Ok(false);
+        }
+
+        if [5353, 53].contains(&remote_address.port()) {
+            // Ignore DNS states. The local resolver takes care of everything,
+            // and PQ seems to timeout if these states are flushed
+            return Ok(false);
+        }
+
         let Some(peer) = policy.peer_endpoint().map(|endpoint| endpoint.endpoint) else {
             // If there's no peer, there's also no tunnel. We have no states to preserve
             return Ok(true);
@@ -177,6 +188,12 @@ impl Firewall {
         let redirect_rules = match policy {
             FirewallPolicy::Blocked {
                 dns_redirect_port, ..
+            }
+            | FirewallPolicy::Connecting {
+                dns_redirect_port, ..
+            }
+            | FirewallPolicy::Connected {
+                dns_redirect_port, ..
             } => {
                 vec![pfctl::RedirectRuleBuilder::default()
                     .action(pfctl::RedirectRuleAction::Redirect)
@@ -186,7 +203,6 @@ impl Firewall {
                     .redirect_to(pfctl::Port::from(*dns_redirect_port))
                     .build()?]
             }
-            _ => vec![],
         };
         Ok(redirect_rules)
     }
@@ -204,6 +220,7 @@ impl Firewall {
                 allowed_tunnel_traffic,
                 redirect_interface,
                 apple_services_bypass,
+                dns_redirect_port: _,
             } => {
                 let mut rules = vec![self.get_allow_relay_rule(peer_endpoint)?];
                 rules.push(self.get_allowed_endpoint_rule(allowed_endpoint)?);
@@ -253,6 +270,7 @@ impl Firewall {
                 dns_config,
                 redirect_interface,
                 apple_services_bypass,
+                dns_redirect_port: _,
             } => {
                 let mut rules = vec![];
 

talpid-core/src/firewall/mod.rs

@@ -98,6 +98,10 @@ pub enum FirewallPolicy {
         /// Flag setting if we should leak traffic to apple services.
         #[cfg(target_os = "macos")]
         apple_services_bypass: bool,
+        /// Destination port for DNS traffic redirection. Traffic destined to `127.0.0.1:53` will
+        /// be redirected to `127.0.0.1:$dns_redirect_port`.
+        #[cfg(target_os = "macos")]
+        dns_redirect_port: u16,
     },
 
     /// Allow traffic only to server and over tunnel interface
@@ -118,6 +122,10 @@ pub enum FirewallPolicy {
         /// Flag setting if we should leak traffic to apple services.
         #[cfg(target_os = "macos")]
         apple_services_bypass: bool,
+        /// Destination port for DNS traffic redirection. Traffic destined to `127.0.0.1:53` will
+        /// be redirected to `127.0.0.1:$dns_redirect_port`.
+        #[cfg(target_os = "macos")]
+        dns_redirect_port: u16,
     },
 
     /// Block all network traffic in and out from the computer.

talpid-core/src/lib.rs

@@ -41,4 +41,4 @@ mod linux;
 
 /// A resolver that's controlled by the tunnel state machine
 #[cfg(target_os = "macos")]
-pub mod resolver;
+pub(crate) mod resolver;