User Profile

Posts

Posts

Post not yet marked as solved
5 Replies
404 Views

`NEVPNProtocol.includeAllNetworks` and `NEPacketTunnelProvider.createTCPConnectionThroughTunnel`

The .includeAllNetworks flag on the NEVPNProtocol object seems suitable for use as a vpn "kill switch." At the very least, the documentation specifies that "if this value is true and the tunnel is unavailable, the system drops all network traffic." Our application has a UI element that allows the user to toggle this setting, for the purposes of ensuring that all of their traffic is sent through the VPN connection. We're encountering an issue, however: it appears that, with this setting enabled, any NWTCPConnection returned by NEPacketTunnelProvider.createTCPConnectionThroughTunnel will never connect. It stays in the .connecting state and never advances to the .connected state. The documentation for this method states that this method can be used "to create a TCP connection to an endpoint inside the private network." Does this mean that the remote endpoint being connected to by createTCPConnectionThroughTunnel must reside inside the private network being connected to by the tunnel in order for it to work properly with the .includeAllNetworks setting? Or is the documentation simply suggesting that the TCP connection is tunneled through the private network? Other web pages seem to be loading just fine while this tunnel is active, it is just the connections returned by this function that seem to be timing out with .includeAllNetworks set to true. If I set it to false, the NWTCPConnection objects returned by this function transition to the .connected state just fine and data can be passed through them with no problems. Is this expected behavior, or is this a possible manifestation of something misconfigured in the VPN profile? Edit: I tested a bit more and it looks like even local connections over the private network seem to time out; I set up an endpoint within the VPN at 10.1.0.1 and createTCPConnectionThroughTunnel was still unable to connect with .includeAllNetworks set to true.
Posted
by jckbiggs.
Last updated
.
Post marked as solved
1 Replies
151 Views

Errors that can occur with `NEProviderTunnelSession.sendProviderMessage`

The documentation for NEProviderTunnelSession.sendProviderMessage says the following: If this method can’t start sending the message it reports an error in the returnError parameter. If an error occurs while sending the message or returning the result, nil should be sent to the response handler as notification. My question is, what sorts of errors can occur that would result in this function calling the completion handler with a nil value? When I'm returning an error explicitly to the client from my network extension, I call back with a specific piece of data that indicates an error condition (beginning with the byte 255.) However, I still occasionally get a callback with a nil value, which results in the app sometimes getting confused. I don't notice anything wrong from the extension's side when I check its logs. What issue in the message sending layer might be causing this? Is there a process whose logs I can monitor that might shine some light on the problem and show me what problem I need to avoid?
Posted
by jckbiggs.
Last updated
.
Post marked as solved
1 Replies
138 Views

NWTCPConnection and URLSession

NEPacketTunnelProvider lets you open a TCP connection with or without TLS through the extension's tunnel using the createTCPConnectionThroughTunnel function. However, this function returns a NWTCPConnection, which only has affordances for reading and writing raw data over the connection. Is there any way for me to construct a URLSession or URLRequest that can use this existing connection, so that I can send and receive HTTP data over it without having to roll my own HTTP request/response parsing?
Posted
by jckbiggs.
Last updated
.
Post not yet marked as solved
1 Replies
161 Views

Exclude Apps from NetworkExtension VPN by Bundle ID

I know it's already possible to inclusively establish a VPN connection with NETunnelPacketProvider by instantiating an NEAppRule for each of the processes I want included in the network connection, and setting that list as the appRules property (documented here). I'd like to know if there's a way to include all apps/processes by default, and only specify the processes that I'd like to exclude from the VPN connection.
Posted
by jckbiggs.
Last updated
.