essandess/easylist-pac-privoxy

Appstore

JuliusBairaktaris opened this issue · 14 comments

When running easylist_pac.py the IOS Appstore gets blocked. Probably there is a whitelist rule needed

This shouldn’t happen—the last few commits explicitly allow all connections to Apple specified in https://support.apple.com/en-us/HT210060.

I confirm that have no such issues either on macOS or iOS.

Please update to the latest commit and then please check your proxy.pac file to make sure that it’s using the latest rules, which bypass the proxy for these Apple domains and CIDRs. Also, if you’re using a squid proxy, please make sure that squid.conf file also has the acl for Apple these destinations.

I just ran the easylist script as it is, and uploaded the Proxy.pac to my github repository. It is a fork of your repository so you can check the proxy.pac on my repo. But I don’t find any blacklist rules for Apple servers but AppStore and Apple Music are blocked.

I just ran the easylist script as it is, and uploaded the Proxy.pac to my github repository. It is a fork of your repository so you can check the proxy.pac on my repo. But I don’t find any blacklist rules for Apple servers but AppStore and Apple Music are blocked.

If this code isn’t in your proxy.pac and proxy.pac.orig then you’ll need to merge upstream and run it again, or troubleshoot why it’s not being added:

// Apple Enterprise Network Domains; https://support.apple.com/en-us/HT210060
(host == "albert.apple.com") || dnsDomainIs(host, "albert.apple.com") ||
(host == "captive.apple.com") || dnsDomainIs(host, "captive.apple.com") ||
(host == "gs.apple.com") || dnsDomainIs(host, "gs.apple.com") ||
(host == "humb.apple.com") || dnsDomainIs(host, "humb.apple.com") ||
(host == "static.ips.apple.com") || dnsDomainIs(host, "static.ips.apple.com") ||
(host == "tbsc.apple.com") || dnsDomainIs(host, "tbsc.apple.com") ||
(host == "time-ios.apple.com") || dnsDomainIs(host, "time-ios.apple.com") ||
(host == "time.apple.com") || dnsDomainIs(host, "time.apple.com") ||
(host == "time-macos.apple.com") || dnsDomainIs(host, "time-macos.apple.com") ||
dnsDomainIs(host, ".push.apple.com") ||
(host == "gdmf.apple.com") || dnsDomainIs(host, "gdmf.apple.com") ||
(host == "deviceenrollment.apple.com") || dnsDomainIs(host, "deviceenrollment.apple.com") ||
(host == "deviceservices-external.apple.com") || dnsDomainIs(host, "deviceservices-external.apple.com") ||
(host == "identity.apple.com") || dnsDomainIs(host, "identity.apple.com") ||
(host == "iprofiles.apple.com") || dnsDomainIs(host, "iprofiles.apple.com") ||
(host == "mdmenrollment.apple.com") || dnsDomainIs(host, "mdmenrollment.apple.com") ||
(host == "setup.icloud.com") || dnsDomainIs(host, "setup.icloud.com") ||
(host == "appldnld.apple.com") || dnsDomainIs(host, "appldnld.apple.com") ||
(host == "gg.apple.com") || dnsDomainIs(host, "gg.apple.com") ||
(host == "gnf-mdn.apple.com") || dnsDomainIs(host, "gnf-mdn.apple.com") ||
(host == "gnf-mr.apple.com") || dnsDomainIs(host, "gnf-mr.apple.com") ||
(host == "gs.apple.com") || dnsDomainIs(host, "gs.apple.com") ||
(host == "ig.apple.com") || dnsDomainIs(host, "ig.apple.com") ||
(host == "mesu.apple.com") || dnsDomainIs(host, "mesu.apple.com") ||
(host == "oscdn.apple.com") || dnsDomainIs(host, "oscdn.apple.com") ||
(host == "osrecovery.apple.com") || dnsDomainIs(host, "osrecovery.apple.com") ||
(host == "skl.apple.com") || dnsDomainIs(host, "skl.apple.com") ||
(host == "swcdn.apple.com") || dnsDomainIs(host, "swcdn.apple.com") ||
(host == "swdist.apple.com") || dnsDomainIs(host, "swdist.apple.com") ||
(host == "swdownload.apple.com") || dnsDomainIs(host, "swdownload.apple.com") ||
(host == "swpost.apple.com") || dnsDomainIs(host, "swpost.apple.com") ||
(host == "swscan.apple.com") || dnsDomainIs(host, "swscan.apple.com") ||
(host == "updates-http.cdn-apple.com") || dnsDomainIs(host, "updates-http.cdn-apple.com") ||
(host == "updates.cdn-apple.com") || dnsDomainIs(host, "updates.cdn-apple.com") ||
(host == "xp.apple.com") || dnsDomainIs(host, "xp.apple.com") ||
dnsDomainIs(host, ".itunes.apple.com") ||
dnsDomainIs(host, ".apps.apple.com") ||
dnsDomainIs(host, ".mzstatic.com") ||
(host == "ppq.apple.com") || dnsDomainIs(host, "ppq.apple.com") ||
(host == "lcdn-registration.apple.com") || dnsDomainIs(host, "lcdn-registration.apple.com") ||
(host == "crl.apple.com") || dnsDomainIs(host, "crl.apple.com") ||
(host == "crl.entrust.net") || dnsDomainIs(host, "crl.entrust.net") ||
(host == "crl3.digicert.com") || dnsDomainIs(host, "crl3.digicert.com") ||
(host == "crl4.digicert.com") || dnsDomainIs(host, "crl4.digicert.com") ||
(host == "ocsp.apple.com") || dnsDomainIs(host, "ocsp.apple.com") ||
(host == "ocsp.digicert.com") || dnsDomainIs(host, "ocsp.digicert.com") ||
(host == "ocsp.entrust.net") || dnsDomainIs(host, "ocsp.entrust.net") ||
(host == "ocsp.verisign.net") || dnsDomainIs(host, "ocsp.verisign.net") ||

Oh sorry, the old file was still uploaded. I added the new one

Why did the issue get closed when it didnt get fixed?

How is it not fixed?

28439 commented

Can confirm that I am having the same issue. I am using the latest easy list_pac.py with those apple domains in that bypass. If I revert back to the easy list_pac.py file from April 3 (commit 3a2651f), I am then able to use the App Store again. I looked through the commit you made after and I still cannot figure out what is causing this.

If the PAC file you’re using explicitly goes direct to Apple and bypasses the proxy completely, why is the App Store being blocked?

Well to be honest I also dont know whats causing this issue. Maybe you should investigate it.

Well to be honest I also dont know whats causing this issue. Maybe you should investigate it.

Access to all Apple services including the App store has already been addressed here and in the squid configuration:

// Apple Enterprise Network Domains; https://support.apple.com/en-us/HT210060
(host == "albert.apple.com") || dnsDomainIs(host, "albert.apple.com") ||
(host == "captive.apple.com") || dnsDomainIs(host, "captive.apple.com") ||
(host == "gs.apple.com") || dnsDomainIs(host, "gs.apple.com") ||
(host == "humb.apple.com") || dnsDomainIs(host, "humb.apple.com") ||
(host == "static.ips.apple.com") || dnsDomainIs(host, "static.ips.apple.com") ||
(host == "tbsc.apple.com") || dnsDomainIs(host, "tbsc.apple.com") ||
(host == "time-ios.apple.com") || dnsDomainIs(host, "time-ios.apple.com") ||
(host == "time.apple.com") || dnsDomainIs(host, "time.apple.com") ||
(host == "time-macos.apple.com") || dnsDomainIs(host, "time-macos.apple.com") ||
dnsDomainIs(host, ".push.apple.com") ||
(host == "gdmf.apple.com") || dnsDomainIs(host, "gdmf.apple.com") ||
(host == "deviceenrollment.apple.com") || dnsDomainIs(host, "deviceenrollment.apple.com") ||
(host == "deviceservices-external.apple.com") || dnsDomainIs(host, "deviceservices-external.apple.com") ||
(host == "identity.apple.com") || dnsDomainIs(host, "identity.apple.com") ||
(host == "iprofiles.apple.com") || dnsDomainIs(host, "iprofiles.apple.com") ||
(host == "mdmenrollment.apple.com") || dnsDomainIs(host, "mdmenrollment.apple.com") ||
(host == "setup.icloud.com") || dnsDomainIs(host, "setup.icloud.com") ||
(host == "appldnld.apple.com") || dnsDomainIs(host, "appldnld.apple.com") ||
(host == "gg.apple.com") || dnsDomainIs(host, "gg.apple.com") ||
(host == "gnf-mdn.apple.com") || dnsDomainIs(host, "gnf-mdn.apple.com") ||
(host == "gnf-mr.apple.com") || dnsDomainIs(host, "gnf-mr.apple.com") ||
(host == "gs.apple.com") || dnsDomainIs(host, "gs.apple.com") ||
(host == "ig.apple.com") || dnsDomainIs(host, "ig.apple.com") ||
(host == "mesu.apple.com") || dnsDomainIs(host, "mesu.apple.com") ||
(host == "oscdn.apple.com") || dnsDomainIs(host, "oscdn.apple.com") ||
(host == "osrecovery.apple.com") || dnsDomainIs(host, "osrecovery.apple.com") ||
(host == "skl.apple.com") || dnsDomainIs(host, "skl.apple.com") ||
(host == "swcdn.apple.com") || dnsDomainIs(host, "swcdn.apple.com") ||
(host == "swdist.apple.com") || dnsDomainIs(host, "swdist.apple.com") ||
(host == "swdownload.apple.com") || dnsDomainIs(host, "swdownload.apple.com") ||
(host == "swpost.apple.com") || dnsDomainIs(host, "swpost.apple.com") ||
(host == "swscan.apple.com") || dnsDomainIs(host, "swscan.apple.com") ||
(host == "updates-http.cdn-apple.com") || dnsDomainIs(host, "updates-http.cdn-apple.com") ||
(host == "updates.cdn-apple.com") || dnsDomainIs(host, "updates.cdn-apple.com") ||
(host == "xp.apple.com") || dnsDomainIs(host, "xp.apple.com") ||
dnsDomainIs(host, ".itunes.apple.com") ||
dnsDomainIs(host, ".apps.apple.com") ||
dnsDomainIs(host, ".mzstatic.com") ||
(host == "ppq.apple.com") || dnsDomainIs(host, "ppq.apple.com") ||
(host == "lcdn-registration.apple.com") || dnsDomainIs(host, "lcdn-registration.apple.com") ||
(host == "crl.apple.com") || dnsDomainIs(host, "crl.apple.com") ||
(host == "crl.entrust.net") || dnsDomainIs(host, "crl.entrust.net") ||
(host == "crl3.digicert.com") || dnsDomainIs(host, "crl3.digicert.com") ||
(host == "crl4.digicert.com") || dnsDomainIs(host, "crl4.digicert.com") ||
(host == "ocsp.apple.com") || dnsDomainIs(host, "ocsp.apple.com") ||
(host == "ocsp.digicert.com") || dnsDomainIs(host, "ocsp.digicert.com") ||
(host == "ocsp.entrust.net") || dnsDomainIs(host, "ocsp.entrust.net") ||
(host == "ocsp.verisign.net") || dnsDomainIs(host, "ocsp.verisign.net") ||

I cannot replicate the issue and without further information believe that this issue is specific to your own network, configuration, or possibly iOS version.

@starraiderx @28439 I was running into the App Store not working issue as well, I fixed it by changing the "PROXY localhost:3128" to "DIRECT" at the end of proxy.pac.

This should fix many other issues as well for jailbroken iOS devices using this approach, as critical system services will be able to directly connect instead of being proxied.

All those services work fine through a properly configured proxy.

Do you have a proxy running on localhost:3128? If not, then that’d be the issue.

If you’re not using a proxy, then just use a simple proxy.pac.orig with the flag --PAC-original:

function FindProxyForURL(url, host)
{
    return "DIRECT";
}