Multiple network extension unexpected behaviour

Hey! Some time ago I've asked about the pipelining of network extensions, and it appears that it is possible: https://developer.apple.com/forums/thread/705292

It seems from previous thread, that Network Extensions should receive the traffic in the order they activated. There also mentioned, that the processing order should not depend on the type of the network extensions activated.

However, that is not what I see in my experiments.

I have two network extensions: one transparent proxy provider, one packet tunnel provider, configured in a per-app manner.

While the Transparent proxy is the only one active network extension, I can see the traffic from the apps going through its methods. This changes once I activate second network extension.

The transparent proxy is activated first, the packet tunnel is activated second. What I see then: the traffic from the app, configured in the profile for the second network extension (which is packet tunnel provider) is completely missed from the Transparent proxy network extension.

It seems, that packet tunnel intercepts the traffic earlier than it appears in the transparent proxy, and does not give it back to transparent proxy after processing.

What I expect, basing on a previous thread, is the traffic should appear in transparent proxy, then in packet tunnel provider. I also expect the traffic in packet tunnel provider to looks like originated from the transparent proxy, not the real origin app - which is OK for me now.

So, my questions are:

  1. Why the packet tunnel provider "steals" the traffic from the transparent proxy, despite transparent proxy was registered first?
  2. Is this an expected behaviour I described?
  3. Could I, by any chances, create a pipeline from these two kinds of network extensions, to point the traffic from the app firstly in transparent proxy, then in packet tunnel?
  4. If (3) is true, what changes should I perform to achieve that?

I think there are a few points that are important here. The first is that this behavior is not documented and so they way it is intended to work is really based on what your testing reflects based on the version of the OS that you are running. Now, I realize that this doesn't paint a great picture for your development strategy, but why do you need to run multiple Network Extensions on the system at one time? Do you need to run a NETransparentProxyProvider and NEPacketTunnelProvider on the system at the same time? The second is that if you see some irregular behavior like this then I would encourage you to open a bug report.

Well, I want to build more complex rules to process my internet traffic, than one provider offers, so I've decided to compose several providers. For example, to route some apps traffic into the packet tunnel provider, and route some other out, but more flexible, than only bundle-based rules could do. Based on previous thread, I hoped that it could be possible, and I can claim some traffic in Transparent proxy, then see it in the Packet Tunnel, and do smth with it, because its origin now a Transparent proxy. In the same time, traffic I've not claimed in Transparent Proxy will have its real origin, and could be processed in some other way.

I've created a separate NE for each provider because it seems the right way for me, however now I see that I can combine several providers in one network extension - will check, if it helps me to have traffic trigger both providers.

I've created a bug FB11481970 (for some reason link does not include last zero, mb another bug :) )

Thank you for opening the bug report. Is your NEPacketTunnelProvider a per-app VPN or a destination IP based VPN? See the configuration options here.

I've tried both options for NEPacketTunnelProvider with the same result, but my target option is a per-app VPN.

I've tried both options for NEPacketTunnelProvider with the same result, but my target option is a per-app VPN.

Okay, in the multiple Network Extension scenario, a per-App VPN configuration is expected to take precedence over another provider (Network Extension) running on the system.

Multiple network extension unexpected behaviour
 
 
Q