macOS network transparent proxy goes to disconnected state after reboot

I am working on developing network transparent proxy for macOS using NETransparentProxyManager and NEAppProxyProvider.

I am doing systtm extension activation and proxy config addition and starting tunnel through the container app of the system extension. I made it as a launchagent in /Library/LaunchAgents.

I wanted the proxy to be always in connected state in network preferences even after restart or manual disconnect or manual deletion of the proxy. What I did was I made the container app of system extension as a lunchagent. The task of this launchagent is to check for the proxy configuration and add/update and start the connection. It is working, but it needs a user session to launch that agent.

But I am looking for other methods to remove dependency on user session (for VPN tunnel start automatically), something at system level so that when user logs in everything is all ready (like NKE behavior)

After restart also, it must go to connected state automatically. I was looking at sleep and wake calls, but they seem to be not getting called at the restart.
  1. How to ensure the connected state of network transparent proxy after restart without depending on user session?

Another query which is irrelevant to this is:
2. We have a mach service in the system extension. And we have a launchagent which communicates with this mach service. Sometimes, by the time launchagent is launched, mach service is not coming up. How to synchronize these two. How to wait in launchagent until the mach service is ready?



You should not need to configure a launch agent to keep a Network System Extension running. A Network System Extension should run ever when there is no user logged in. The container app and a launch agent will have different lifecycles.

You are doing the right thing by checking the checking the sleep / wake cycles in your extension. Make sure to also check startProxy(options) as well to see if this is called upon restart. Use the os_log framework to evaluate this behavior.

Regarding you communication with a launchagent from the Network System Extension, I would look at using a system daemon so that you know that both the daemon and the Network System Extension can communicate when the user is logged out.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
macOS network transparent proxy goes to disconnected state after reboot
 
 
Q