Hi, I am implementing a transparent proxy for macOS, while most of the TCP connections are able to tunnel without any issue except for samba connection with port 445 or 135. When the finder trying to connect to samba server, the system will crash and reboot. From the code, system is crashing when calling system extension's handleNewFlow. Below is the part of the source code: override func handleNewFlow(_ flow: NEAppProxyFlow) -> Bool {         if let TCPFlow = flow as? NEAppProxyTCPFlow {             guard let remoteEndpoint = TCPFlow.remoteEndpoint as? NWHostEndpoint else {                 Logger.error("AppProxyProvider.handleNewFlow: Failed to get remote endpoint")                 return false             }             if Int(remoteEndpoint.port) == 445 || Int(remoteEndpoint.port) == 135 {                 return false // system crash after return             } }

From the documentation, when the NEAppProxyTCPFlow.readData returned data with length 0, no more can be subsequently read from the flow. In this situation, can I assume the flow is closed and proceed to close the flow? Or should I wait for more data coming in to handle NEAppProxyTCPFlow.write?

I would like to enforce to encrypt a certain type of email. With MEMessageSecurityHandler, AFAIK, there is no way to enforce encryption as the encode method will be called when sender enable the encryption.

When the mail extension invoke allowMessageSendForSession func, the error prompt did not show the error description. What am I missing? Below is the code:     enum ComposeSessionError: LocalizedError {         case invalidRecipientDomain                  var errorDescription: String? {             switch self {             case .invalidRecipientDomain:                 return "example.com is not a valid recipient domain"             }         }     }          func allowMessageSendForSession(_ session: MEComposeSession) async throws {         // Before Mail sends a message, your extension can validate the         // contents of the compose session. If the message isn't ready to be         // sent, throw an error.         throw ComposeSessionError.invalidRecipientDomain     }

Hello, When my system DNS is set to DoH/DoT enabled DNS server i.e. 8.8.8.8 or 1.1.1.1, the NEDNSProxyProvider.handleNewFlow will not get called. What am I missing or is it the limitation? Also, the NEDNSProxyProvider.systemDNSSettings always return nil. PS: The network extension is running on macOS 13.3.1 (a)