Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by eptcyka on Tuesday October 20, 2020 @12:23PM
(#24839239)
I should've clarified - it only does this if there is a default route. Funnily enough, whilst the firewalls in the original twitter post would possibly fail to catch this traffic, PF will block it just fine.
[ Parent
| on HN ]
Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by joshspankit on Tuesday October 20, 2020 @12:43PM
(#24839522)
This mindset probably explains why I have such issues with Apple products when my connection to the internet goes down, but the internal network infrastructure (including DNS server) are perfectly fine.
Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by xenospn on Tuesday October 20, 2020 @12:26PM
(#24839282)
Having a default route does not mean the internet is reachable.
Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by eptcyka on Tuesday October 20, 2020 @12:30PM
(#24839342)
I wish Apple agreed.
But on the other hand, there are use cases where checking for the existence of a default route is the best heuristic.
Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by Spivak on Tuesday October 20, 2020 @02:10PM
(#24840572)
I mean that's what a default route is supposed to mean, right? That this machine can route to any address. It might not get there because of a firewall, or because nothing is at a given address but you're at least claiming to know what to do with a packet destined for anywhere.
Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by ryukafalz on Tuesday October 20, 2020 @02:59PM
(#24841111)
I think that’s a reasonable assumption for applications to make. I think that’s a less reasonable assumption for your keyboard to make.
Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by easton on Tuesday October 20, 2020 @12:31PM
(#24839363)
Probably why the other discussed function exists:
> Similarly, all macOS machines will test a DHCP supplied default route before applying it by trying to reach something on the internet. So if you happen to have some firewall rules that block internet access, no default route will be applied until the internet check times out.
So if the default route doesn't exist yet since it's still checking for internet, it would let you use the keyboard. DHCP probably runs every time the NIC is turned on (like from sleep), and they could just disable this function if you've set a static default route (since they may not be able to reach their NTP server on that route).
Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ...
by eptcyka on Tuesday October 20, 2020 @12:37PM
(#24839425)
The default route verification is separate from the keyboard issue. I don't know exactly what is going on here, but in the above post what I mean by the system applying a default route is that the route isn't propagated to the system configration's dynamic store and whatever macOS uses for netlink, i.e. the route doesn't show up in `route monitor` until the check finishes. However, I do believe it would still be used at some level, either on the T2 or in the kernel to do the NTP stuff.