XPC with multiple System Extension instances

We're writing a VPN system extension for use with Big Sur. As far as I know, there may be several instances of our system extension if we're running multiple connections.

I've reached a point were I need to set up XPC communication. I managed to get it working like it's demonstrated in the Filtering Network Traffic sample project. So far so good, that works fine with one instance running: the UI is able to create an XPCConnection to the system extension, which is then able to communicate back.

But how are we supposed to handle multiple system extension instances? All instances would have the same Mach service name as it's hard-coded in Info.plist using the NEMachServiceName entry, right? Thus the only way I see to communicate with a specific instance seems to be sendProviderMessage(_:responseHandler:). I tried serializing a NSXPCListenerEndpoint in handleAppMessage(_:completionHandler:), but that doesn't work as only NSXPCCoder may encode the endpoint.

So, how should I set up bidirectional communication with the System Extension instances? I can also do old-school Mach IPC communication if that's what needs to be done, by the way.

As far as I know, there may be several instances of our system extension if we're running multiple connections.

That depends on what you mean by “instances”. If you’re creating a sysex, there will be a single sysex process and multiple instances of your provider class within that process.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
That's great, so a singleton/global variable would be seen by all instances. Is there some documentation or other "guarantee" about there only being a single system extension process? That is, can we rely on this behaviour?
XPC with multiple System Extension instances
 
 
Q