Observation:
We observed that when multiple Transparent Proxies (NETransparentProxyProvider) are active and enabled, only one will handle the flow, and each proxy is given an opportunity to handleNewFlow() in a strict ordering.
We also observed that any connections (NWConnection) created by a transparent proxy will not be intercepted by other transparent proxies eariler in the ordering.
We further observed that this ordering is dependent on the ordering in which the Network Extensions are installed.
Question: Is there a way to control the order in which each transparent proxy has an opportunity to handle the flow?
Is the following observed scenario correct or expected?
Observed Scenario:
Safari -- Transparent Proxy Provider A -- Transparent Proxy Provider B -- Destination (Web)
When a connection is created by Safari: Proxy A is called with handleNewFlow() if Proxy A decides to handle the flow, then Proxy B would not be called for this flow if Proxy A decides not to handle the flow, then Proxy B would be called with handleNewFlow()
When a connection is created by Proxy A: Proxy B will be called with handleNewFlow() for Proxy A's connection.
When a connection is created by Proxy B: Proxy A would not be called with handleNewFlow() for Proxy B's connection.
Context:
In general, security software would want to be first in the ordering while VPN software would want to be last in the case where both VPN and security software are installed.