Thanks Matt for the reply!
When we add/update IMAP account settings and save, then the flow is going through accountsd (either 993 or 143) which can not be captured by transparent proxy.
Once the mail account is configured and saved (either it is 143 or 993), if we send a mail from Mail.app, then Mail app is making connection to Mail Server and that is being captured.
So in brief, Mail.app makes connection (any SMTP or IMAP ports) => proxy catches that flow.
Steps to reproduce the specific scenario are:
#1: Add an IMAP mail account on IMAP SSL port 993 and SMTP non-SSL port 25 and save it.
#2: Install transparent proxy and it is running with the configured network rules to catch any SMTP and IMAP traffic.
#3. Send mail from Mail.app and it gets captured.
#4: While transparent proxy is up and running, open IMAP mail account settings and edit settings of IMAP from SSL to nonSSL and port from 993 to 143 and click Save. When Save is clicked, the connection which goes out is from accountsd and not from Mail.app. This is not being captured.
My network rules are as below:
(NENetworkRule *)createNeRuleFor:(NSString *)port {
[[NENetworkRule alloc] initWithRemoteNetwork:[NWHostEndpoint endpointWithHostname:@"0.0.0.0" port:port]
remotePrefix:0
localNetwork:nil
localPrefix:0
protocol:NENetworkRuleProtocolTCP
direction:NETrafficDirectionOutbound];
}
settings.includedNetworkRules = @[
[self createNeRuleFor:@"25"],
[self createNeRuleFor:@"587"],
[self createNeRuleFor:@"110"],
[self createNeRuleFor:@"995"],
[self createNeRuleFor:@"143"],
[self createNeRuleFor:@"993"],
];
Query#1: Is there any restriction on the ability of network transparent proxies on catching network traffic from some system processes such as accountsd process?
