Multiple Network Extension on the same machine

Question

Created Nov ’20

Replies 1

Boosts 0

Participants 2

Hi Experts,

If multiple NEFilterDataProvider/NEFilterPacketProvider(s) are on the machine and all are active at the same time.

which provider will receive the TCP/UDP segment first?
If one of network extension drops the flow or packet, then there is no chance for others to parse it?
which is instantiated first or instantiated last if no earlyboot?

Thanks a lot!

Boost

Answer 1

Systems Engineer OP

Apple

Nov ’20

The best way to know for sure is to run a some tests.

For example, with a FilterPacketProvider and a FilterDataProvider both running on one of my test machines I observed a UDP flow where FilterPacketProvider started receiving ~185 bytes first before the flow hit handleNewFlow in FilterDataProvider. With TCP the same thing, but with less bytes. Once you have setup this test, you should be able to answer number 2 and 3.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0