Search results | Apple Developer Forums

Reply to Crash on "Dispatch queue: NEFlow queue" when __88-[NEExtensionAppProxyProviderContext setInitialFlowDivertControlSocket:extraValidation:]_block_invoke.90

Correction — the transparent proxy should already be stopped. @eskimo.

Programming Languages General

1d

Crash on "Dispatch queue: NEFlow queue" when __88-[NEExtensionAppProxyProviderContext setInitialFlowDivertControlSocket:extraValidation:]_block_invoke.90

I observed the following crash: Code Type: ARM-64 (Native) Parent Process: launchd [1] User ID: 0 Date/Time: 2025-10-07 13:48:29.082 OS Version: macOS 15.6 (24G84) Report Version: 12 Anonymous UUID: 8B651788-4B2E-7869-516B-1DA0D60F3744 Crashed Thread: 3 Dispatch queue: NEFlow queue Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000054 ... Thread 3 Crashed: Dispatch queue: NEFlow queue 0 libdispatch.dylib 0x000000019af6da34 dispatch_async + 192 1 libnetworkextension.dylib 0x00000001b0cf8580 __flow_startup_block_invoke.216 + 124 2 com.apple.NetworkExtension 0x00000001adf97da8 __88-[NEExtensionAppProxyProviderContext setInitialFlowDivertControlSocket:extraValidation:]_block_invoke.90 + 860 3 libnetworkextension.dylib 0x00000001b0cf8140 __flow_startup_block_invoke.214 + 172 4 libdispatch.dylib 0x000000019af67b2c _dispatch_call_block_and_release + 32 5 libdispatch.dylib 0x000000019af8185c _dispatch_client_callout + 16 6 libdispatch.dylib 0x000000019af70350 _dispatch_l

Programming Languages General

1

0

316

3d

Reply to Building macOS apps with Xcode 26 on macOS 26 VM

[quote='861299022, chockenberry, /thread/787500?answerId=861299022#861299022, /profile/chockenberry'] not being passive aggressive here [/quote] Understood. I’m about to head out for a few weeks, and I won’t have a chance to post updates here in the interim. So it’s definitely worth continuing to test. Keep in mind my earlier comment: [quote='855659022, DTS Engineer, /thread/787500?answerId=855659022#855659022'] It’s possible that this might end up being a Developer website change. [/quote] That’s looking more and more likely. And if it is such a change, that will roll out independently of the macOS 26.x beta cycle. We don’t have a standard way of notifying folks of Developer website changes, but if you keep testing on the betas it’s likely you’ll eventually notice it (-: Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Code Signing Certificates, Identifiers & Profiles

1w

Reply to Securely passing credentials from Installer plug-in to newly installed agent — how to authenticate the caller?

[quote='861279022, siddhant-mac, /thread/799002?answerId=861279022#861279022, /profile/siddhant-mac'] then run the child process manually with their own parameters? [/quote] Yep. You might be able to prevent that using launch constraints. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Privacy & Security General

1w

Reply to Example of DNS Proxy Provider Network Extension

[quote='861238022, GlacierSec, /thread/802691?answerId=861238022#861238022, /profile/GlacierSec'] So then it seems we would have to implement DNS Proxy to do what we want? [/quote] I don’t think that’ll actually work. Because of the DNS proxy deployment limitations [1], the ability to modify the proxy configuration is limited to development-signed apps. Once you sign your app for distribution, it’ll lose its ability to modify its DNS proxy configurations. Rather, the site admin is expected to configure the proxy using MDM payloads. Or at least that’s how it works with content filters. I can’t remember whether I’ve ever actually tested this with DNS proxies. However, both occupy a similarly privileged networking position and so I expect them to follow the same rules. A DNS proxy can (more or less) go into pass through mode by leaning in to the systemDNSSettings property. [quote='861238022, GlacierSec, /thread/802691?answerId=861238022#861238022, /profile/GlacierSec'] Or do you have other thoughts now on how to

App & System Services Networking

1w

Reply to DNS Proxy Provider remains active after app uninstall | iOS

[quote='861349022, da-kami, /thread/772657?answerId=861349022#861349022, /profile/da-kami'] I may be able to answer my own question [/quote] Yep. While the specific method you’re using has not documentation )-: that method is an obvious descendent of the readDatagrams(completionHandler:) method and its documentation is pretty clear about this: If the datagrams and remoteEndpoints arrays are non-nil but are empty, then no more datagrams can be subsequently read from the flow. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

App & System Services Networking

1w

Reply to "Application damaged and can't be opened' error prompt on 15.6.1 Sequoia

[quote='861351022, oddeyed, /thread/799110?answerId=861351022#861351022, /profile/oddeyed'] Yes, that is correct. [/quote] OK. That certainly does raise a world of possibilities. The approach I usually recommend for incremental Apple installers is to copy the app and then update the copy. See this post. However, I don’t think that’s feasible for an installer package, and I’m not 100% sure what the best option here is. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Code Signing General

1w

Reply to NEPacketTunnelProvider Start Issue on macOS 14.5

[quote='861284022, dylandylandylan, /thread/757444?answerId=861284022#861284022, /profile/dylandylandylan'] Is there any way that startVPNTunnel() can fail, without an error being thrown? [/quote] Well, I think you’ve answered your own question there (-: Obviously this shouldn’t happen. A successful call to startVPNTunnel(…) isn’t guaranteed to bring up the tunnel, but it should at least get it into the .connecting state. If that’s not happening, I think it’d be reasonable to file a bug about it. Please post your bug number, just for the record. Your bug will need a sysdiagnose log taken after seeing the problem. Ideally this sysdiagnose log would be: Taken on a device with the VPN (Network Extension) debug profile installed; see our Bug Reporting > Profiles and Logs page for more on that. Taken immediately after seeing the problem. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

App & System Services Networking

1w

Reply to security add-trusted-cert asks password twice in some cases: The authorization was denied since no user interaction was possible

I’m going to close out this thread. Lemme explain my rationale… The primary issue being discussed here is installing a root certificate without explicit approval from the user such that it’s trusted system wide. There are two different cases: Doing this programmatically Doing this from Terminal or from a shell script For the programmatic case, there’s no supported solution. This isn’t a bug but a deliberate security hardening, as I explained in this post. For the Terminal and shell script case, DevForums isn’t the right place to have that discussion because: Our focus here is primarily on APIs, not device management. Many of the workarounds suggested on this thread rely on implementation details, which is counter to the forums’ focus on APIs. If you want to continue exploring device management options, I encourage you to pop over to the Apple Support Community, run by Apple Support, and specifically the Business and Education topic area. Finally, there’s one very clear path forward here: Install the root cert

Code Signing Entitlements

1w

Reply to OS 26.0 mDNSResponder suppresses DNS queries ("blocked by policy") for some devices until reboot

[quote='803114021, trustdben, /thread/803114, /profile/trustdben'] until the device is rebooted. [/quote] I recommend that you file a bug about this. Things that need a restart to clear are almost always a bug in one layer on the system or another. Please post your bug number, just for the record. For your bug to get traction it’ll need to have a sysdiagnose log attached, one that was taken on the affected device after you see the problem. I realise that this might be hard to get due to the intermittent nature of the bug. I have some hints and tips about this in Using a Sysdiagnose Log to Debug a Hard-to-Reproduce Problem. Ideally this sysdiagnose log would be: Taken on a device with both the Network Diagnostics and VPN (Network Extension) debug profile installed; see our Bug Reporting > Profiles and Logs page for more on that. Taken immediately after seeing the problem. That’s hard if you’re investigating this based on reporting coming in from the field, but keep that in mind if you’re making a concerted

App & System Services Networking

1w

Reply to for the Tahoe host and guest: does guest login to app store work, and does xcode in guest work

The thread referenced by RickMaddy has a lot of backstory here, but I want to address this bit specifically: [quote='803112021, sincos2007, /thread/803112, /profile/sincos2007'] does xcode in guest work? [/quote] Xcode does work in the guest but with one significant limitation: You can’t run Mac apps that use restricted entitlements [1]. For some folks that’s a complete showstopper. For others it’s a non-issue. If this a problem for you, I recommend that you watch the above-mentioned thread where I’ve been posting updates about new developments in this space. Oh, and all of the above is assuming you’re on Apple silicon. The story for Intel-based Macs is very different. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com [1] Those that must be authorised by a provisioning profile. See TN3125 Inside Code Signing: Provisioning Profiles.

App & System Services Core OS

1w

Reply to [iOS 26] Unable to start TLS handshake connection to devices with self-signed certificates

[quote='803127021, development, /thread/803127, /profile/development'] Added the NSAppTransportSecurity key to the Info.plist file [/quote] Just FYI, ATS only applies to high-level APIs, so URLSession and things layered on top of it. It’s irrelevant to folks using lower-level APIs, like Network framework and BSD Sockets. Still, it doesn’t hurt to turn it off temporarily during testing (-: [quote='803127021, development, /thread/803127, /profile/development'] These are the prints made during the procedure. [/quote] My best guess here is that the remote peer is closing the connection immediately on receiving the Client Hello message. I’ve seen problems like that in the past, where a TLS implementation sees a newer version of the protocol, or a new TLS extension, and fails to handle it properly [1]. I recommend that you use a use a packet trace to see what’s happening on the ‘wire’. If my theory is connect, you’ll see: The SYN / SYN-ACK / ACK handshake, setting up the TCP connection. The TLS ClientHello coming f

App & System Services Networking

1w

Reply to "Application damaged and can't be opened' error prompt on 15.6.1 Sequoia

[quote='859432022, oddeyed, /thread/799110?answerId=859432022#859432022, /profile/oddeyed'] we were unable to replicate this problem. [/quote] Just to be clear, you were testing the fresh install and upgrade install paths, right? Because the upgrade install path leads straight to this… [quote='859432022, oddeyed, /thread/799110?answerId=859432022#859432022, /profile/oddeyed'] We have also added some additional information in the FB20104614 which we are considering as a potential root cause … [/quote] What comments are you referring to here? The stuff about your preinstall script? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Code Signing General

1w

Reply to When I run my app for Mac on XCode register .app takes more than 15 minutes

It’s better to reply as a reply, rather than in the comments; see Quinn’s Top Ten DevForums Tips for this and other titbits. although Apple is my customer on this project I’d like to clarify what you mean by that. Please drop me a line via email (my address is in my signature). Make sure to reference this thread, because I get a lot of email |-: Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

Developer Tools & Services Xcode

1w

Reply to Wifi Aware iOS devices authentication fails after a period of time

[quote='861192022, nikiizvorski, /thread/800457?answerId=861192022#861192022, /profile/nikiizvorski'] no a sample project in general. [/quote] I’m confused. We have an iOS-to-iOS sample, namely Building peer-to-peer apps. And I know you know about it because you referenced it in your earlier message on this thread. Did you perhaps miss the Download button at the top of that page? Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = eskimo + 1 + @ + apple.com

App & System Services Networking

1w

eskimo

Post

Replies

Boosts

Views

Activity