AppProxyProvder:: VPN connect works when I install the extension twice

Hi,

I am able to run a sample AppProxyProvder::Transparent Proxy sample project on my MacOS (10.15.4). Below are the logs from instance when I open a connection with remote server 192.168.1.10 at port 8080:


2020-04-10 22:15:40.798787+0530 0x56105 Default 0x0 1939 0 com.mcafee.endpointsystemextension: (NetworkExtension) [com.apple.networkextension:] (0): Flow 3001203496 is connecting

2020-04-10 22:15:40.799064+0530 0x56105 Default 0x0 1939 0 com.mcafee.endpointsystemextension: (NetworkExtension) [com.apple.networkextension:] (3001203496): New flow: NEFlow type = stream, app = com.apple.nc, name = , address = 192.168.1.10, port = 8080, filter_id = , interface = en0

2020-04-10 22:15:40.799619+0530 0x65b9a Default 0x0 1939 0 com.mcafee.endpointsystemextension: (NetworkExtension) [com.apple.networkextension:] [Extension com.mcafee.endpointsystemextension]: Calling handleNewFlow with TCP com.apple.nc[{length = 20, bytes = 0xc8801506101bbbdcdbe2ad03caad7c0692daf201}] remote: 192.168.1.10:8080

2020-04-10 22:15:40.800194+0530 0x65b9a Default 0x0 1939 0 com.mcafee.endpointsystemextension: (libnetwork.dylib) [com.apple.network:] [C9 569452C0-0AC1-43F1-AFCE-D965FD6F66D3 IPv4#bb0bd150:8080 tcp, indefinite] start

2020-04-10 22:15:40.800659+0530 0x65b9a Default 0x0 1939 0 com.mcafee.endpointsystemextension: (libnetwork.dylib) [com.apple.network:] nw_connection_report_state_with_handler_on_nw_queue [C9] reporting state preparing

2020-04-10 22:15:40.802872+0530 0x65b9a Default 0x0 1939 0 com.mcafee.endpointsystemextension: (libnetwork.dylib) [com.apple.network:] nw_socket_handle_socket_event [C9:1] Socket received CONNECTED event

2020-04-10 22:15:40.802969+0530 0x65b9a Default 0x0 1939 0 com.mcafee.endpointsystemextension: (libnetwork.dylib) [com.apple.network:] nw_flow_connected [C9 IPv4#bb0bd150:8080 in_progress socket-flow (satisfied (Path is satisfied), interface: en0, ipv4, dns)] Output protocol connected

2020-04-10 22:15:40.803162+0530 0x65b9a Default 0x0 1939 0 com.mcafee.endpointsystemextension: (libnetwork.dylib) [com.apple.network:] nw_connection_report_state_with_handler_on_nw_queue [C9] reporting state ready


=====================================================================================================
Though there was one issue which I couldn’t debug, where I need to install the system extension twice to successfully connect the VPN. Otherwise VPN connect is failing with error [Domain=NEAgentErrorDomain Code=2 "(null)"]

Below are the related logs:


NSWorkspaceApplicationKey = "<NSRunningApplication: 0x600000f03b80 (com.mcafee.mcpdev - 10607) LSASN:{hi=0x0;lo=0x34f34f}>";

2020-04-09 14:59:47.498327+0530 0x115148 Default 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] Found 1 (1 active) registrations for com.mcafee.mcpdev.systemextension (com.apple.networkextension.app-proxy)

2020-04-09 14:59:47.498676+0530 0x115148 Default 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] NEFlowDivertPlugin(com.mcafee.mcpdev[inactive]): Sending start command

2020-04-09 14:59:47.504034+0530 0x115148 Error 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] Failed to launch com.mcafee.mcpdev

2020-04-09 14:59:47.504388+0530 0x115148 Default 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] NESMTransparentProxySession[Primary Tunnel:PassThroughProxy:14F3737C-C06B-4DCE-B180-A91BD43723FF:(null)] in state NESMVPNSessionStateStarting: plugin NEFlowDivertPlugin(com.mcafee.mcpdev[inactive]) started with PID 0 error Error Domain=NEAgentErrorDomain Code=2 "(null)"

2020-04-09 14:59:47.507447+0530 0x115148 Default 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] com.mcafee.mcpdev[inactive]: disposing

2020-04-09 14:59:47.507889+0530 0x115148 Default 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] NESMTransparentProxySession[Primary Tunnel:PassThroughProxy:14F3737C-C06B-4DCE-B180-A91BD43723FF:(null)] in state NESMVPNSessionStateDisposing: plugin NEFlowDivertPlugin(com.mcafee.mcpdev[inactive]) dispose complete


What could be thet issue that VPN connect is failing after 1st system extension install?

Accepted Reply

Based on:

2020-04-09 14:59:47.498327+0530 0x115148 Default 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] Found 1 (1 active) registrations for com.mcafee.mcpdev.systemextension (com.apple.networkextension.app-proxy


It looks like your first attempt on 4-9-2020 did not find the NEProviderClasses your App Proxy is using. If these classes were assigned correctly on the second attempt, that would possibly explain why your second attempt succeeded.


Here is a quick reference on the NEProviderClasses.


Matt Eaton

DTS Engineering, CoreOS

meaton3@apple.com

Replies

Based on:

2020-04-09 14:59:47.498327+0530 0x115148 Default 0xb0623 692 0 nesessionmanager: [com.apple.networkextension:] Found 1 (1 active) registrations for com.mcafee.mcpdev.systemextension (com.apple.networkextension.app-proxy


It looks like your first attempt on 4-9-2020 did not find the NEProviderClasses your App Proxy is using. If these classes were assigned correctly on the second attempt, that would possibly explain why your second attempt succeeded.


Here is a quick reference on the NEProviderClasses.


Matt Eaton

DTS Engineering, CoreOS

meaton3@apple.com