In-app purchase doesn't work with Network Extension?

Hi guys,

When playing with the Network Extension sample code, I find that, if the data-filter requests to filter TCP outbound traffic on port 443, apps using StoreKit for in-app purchase cannot get items for purchase.

A process named "appstoreagent" reports "failed to retrieve client crypto key" and then NSURLErrorDomain Code=-1005 "The network connection was lost."

If the network extension is disabled or explicitly allows https traffic in NEFilterSettings, this issue won't appear.

I have tested from macOS 10.15.0 to 10.15.6 along with 11.0 beta 3, the issue can be reproduced on all the macs that I have tested.

Ref FB7740498

Best regards,
Shay
Thank you for reporting. I am actually investigating this in another context. My latest testing concluded that filtering TCP .outbound on IPv4 traffic did allow for the appstoreagent to receive network traffic that receives In-App purchases, but I will follow up on this as I uncover more.

If you are reading this and experiencing the same thing, please mention this on the thread and include a bug report ID if you have not already.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Further testing on this incident this morning uncovered that using .any or .outbound on the IPv4 filter works if an IAP request for the good is run first before the content filter is turned on. After the content filter is turned on the request should succeed. I will keep this thread updated if I learn more.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Seems fixed in macOS 11.0 beta 4, but more system processes report the same "failed to retrieve client crypto key" error, including diagnosticextensiond, itunescloudd and mapspushd.

:-/
Thanks for the response regarding your issue. Please keep the bug report update with these details and any logs you may have as you uncover them.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
In-app purchase doesn't work with Network Extension?
 
 
Q