Improve DNS security for apps and servers

RSS for tag

Discuss the WWDC22 Session Improve DNS security for apps and servers

Posts under wwdc2022-10079 tag

3 Posts
Sort by:
Post not yet marked as solved
5 Replies
1.6k Views
This is happening Mac M1 Monterey OS .Environment supports both IPv4 and IPV6. When a http client calls gettaddrinfo() it is returning both IPv6,IPv4 IPs . first v6 IPs and then v4 IPs. We need to have a way to sort gettaddrinfo() output to get v4 ip first and then v6. We tried changing DNS order with scutil by putting v4 DNS first , but still getaddrInfo() listing v6 IPs first . In linux there is a way to control gettaddrinfo() o/p with /etc/gai.conf https://man7.org/linux/man-pages/man5/gai.conf.5.html . In Mac I did not find any option like this , scutil changing order DNS is not effective . can you tell us what is way to do this in MAC OSx ?
Posted Last updated
.
Post not yet marked as solved
3 Replies
628 Views
Hi community: I'm trying to discover how the dnssec api works, but I cannot get a sample that works with it. Maybe I'm wrong with the requirements; if it is please, clarify it to me. So what I understood. All DNS zones (which respond to TLS listed here https://manage.whois.com/kb/answer/2998) have a way to say, hey I'm who I am. So without any extra configuration, we can use the new API. Is that right? So the code that I did, see the next code let urlSession = URLSession.init(configuration: .ephemeral) if #available(iOS 16.0, *) { urlSession.configuration.requiresDNSSECValidation = true } var request = URLRequest(url: URL(string: "https://www.apple.com")!) if #available(iOS 16.1, *) { request.requiresDNSSECValidation = true } cancellable = urlSession .dataTaskPublisher(for: request) .retryWithDelay(retries: 2, delay: 2, scheduler: DispatchQueue.global(qos: .background)) .sink(receiveCompletion: { result in if case let .failure(error) = result { print("Error \(error)") } }, receiveValue: { (data: Data, response: URLResponse) in print("It Works") Result: Task finished with error [-1001] Error Domain=NSURLErrorDomain Code=-1001, UserInfo={_kCFStreamErrorCodeKey=-2102, NSUnderlyingError=0x600003d86130 {Error Domain=kCFErrorDomainCFNetwork Code=-1001 "(null)" UserInfo={_kCFStreamErrorCodeKey=-2102, _kCFStreamErrorDomainKey=4}}, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask <040AB9E7-EFCB-4072-8357-E0149769BB9D>.<2>, _NSURLErrorRelatedURLSessionTaskErrorKey=(``` "LocalDataTask <040AB9E7-EFCB-4072-8357-E0149769BB9D>.<2>" ), NSErrorFailingURLStringKey=https://apple.com/, NSErrorFailingURLKey=https://apple.com/, _kCFStreamErrorDomainKey=4} The DNS I'm using is 8.8.8.8. Do you know any other DNS server that supports DNSSEC? If I remove requiresDNSSECValidation from request it works. Also, it's curious that even failing the receiveCompletion is never called. But if I use the dataTask` with completion it's called with the error. Thanks for the clarifications.
Posted
by JesusMG.
Last updated
.