Dealing with blocking nature of method handleNewFlow of NETransparentProxyProvider

Question

faisalIkwal OP

Created Aug ’24

Replies 3

Boosts 0

Participants 2

NETransparentProxyProvider have below method:

override func handleNewFlow(_ flow: NEAppProxyFlow) -> Bool

This method is blocking. Until we returns value from this method, next flow will be blocked, macOS doesn’t calls it on new thread.

for example: if we take 10 second to check what to do with this flow, whether to handle it(true) or return to kernel(false), another flow will be block for 10 sec.

how to not block future flow while it is taking longer to process current flow?

Answered by DTS Engineer in 802290022

As per this trick, lets say we returns true to allow the flow, later on different queue/thread we decided to handover the flow to kernel, that's not possible right?

Correct.

… in a transparent proxy provider. In a content filter provider you can do that.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Aug ’24

how to not block future flow while it is taking longer to process current flow?

The trick is to allow the flow and then block all of its traffic until you’ve decided what to do.

The is often easier if you use a content filter where, once you decide to allow the flow, you can return an .allow() verdict and then get out of the loop.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

faisalIkwal OP

Aug ’24

The trick is to allow the flow and then block all of its traffic until you’ve decided what to do.

@DTS Engineer As per this trick, lets say we returns true to allow the flow, later on different queue/thread we decided to handover the flow to kernel, that's not possible right?

in this case, only options left are to close the flow, or send it to actual destination, or send it to proxy. No way it can be handed over to kernel which happens after returning false from this method.

0

Answer 3

DTS Engineer OP

Apple

Sep ’24

Accepted Answer

As per this trick, lets say we returns true to allow the flow, later on different queue/thread we decided to handover the flow to kernel, that's not possible right?

Correct.

… in a transparent proxy provider. In a content filter provider you can do that.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0