Unable to start Transparent Proxy

Question

Created May ’21

Replies 1

Boosts 0

Participants 2

Hi

I am building a transparent proxy using NETransparentProxyProvider

When I try to "enable" the proxy, I get the following error

TansparentProxy[6293:14201007] save error: Missing protocol or protocol has invalid type

My code is available here on github

If, instead of using

Code Block let manager = NETransparentProxyManager.shared()

, i use

Code Block let manager = NETransparentProxyManager()

I don't get an error while saving preferences, but I don't see any messages in log from the proxy. I am using the following command to see the logs.

Code Block sudo log stream

Also, i don't see any process running in the activity monitor for the extension

I have been looking at other's code and it seems like one has to call

Code Block let session = manager.connection as! NETunnelProviderSession
session.startTunnel()

but, in my case session is an instance of NEVPNConnection

One more question... There are two ways to add the proxy extension. One as an app extension (with .appex extension) and the other as a system extension (with .systemextension extension). I am using the second approach.
What is the difference between the two? Is there any right way to build the network extensions?

regards
waqqas

Boost

Answer 1

Systems Engineer OP

Apple

May ’21

What is the difference between the two? Is there any right way to build the network extensions?

The appex is only supported for deployment via the Mac App Store. A Network System Extension can be deployed via the Mac App Store or independently using Developer ID.

The two are closely related but they are not the same code. You cannot transform from one to the other using just code signing; you actually have to tweak the code in significant ways. Most notably is the entitlement for com.apple.developer.system-extension.install and the API that installs the System Extension, OSSystemExtensionManager. The Network System Extension also runs with elevated privileges and can run while no user is logged into the machine at all. So, to answer your question, there is a big difference between the two and the right way to build these extensions matters on which one is required for your project.

As for your code level issue; it looks like you have an issue in enableConfiguration. Your completion handler is being called and then your NETunnelProviderProtocol options are being built while saveToPreferences is being called. I would split that into sequential steps:

1) manager.loadFromPreferences
2) Build NETunnelProviderProtocol
3) Call saveToPreferences

Lastly, call NETransparentProxyManager.loadAllFromPreferences again and then on your manager call try manager.connection.startVPNTunnel(options: options) to reach over into the provider and start the proxy.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0