Network Extension freezes in a .disconnecting state when there is no internet connection

Question

Created Apr ’23

Replies 1

Boosts 1

Participants 2

Hi, everyone!

Our application has the ability to run the Network Extension when there is no internet connection. While testing our application, we found incorrect behavior in the Network Extension disconnect process when there is no internet connection, sometimes the Network Extension hangs in a .disconnecting state when it finishes.

In most cases, the work in this case finishes correctly. So for example.

We monitor changes in the Network Extension connection status using NEVPNStatusDidChange notifications.

We turn off the Internet and try to connect to the VPN tunnel using next NETunnelProviderManager configuration:

{
    localizedDescription = &lt;description>
    enabled = YES
    protocolConfiguration = {
        serverAddress = &lt;13-char-str>
        disconnectOnSleep = NO
        includeAllNetworks = NO
        excludeLocalNetworks = YES
        enforceRoutes = NO
        providerBundleIdentifier = &lt;bundle_identifier>
    }
    onDemandEnabled = NO
}

Next, we get the configuration and try to start the Network Extension via NEVPNConnection.startVPNTunnel(options:). When call finished, we get a notification .NEVPNStatusDidChange to change the NEVPNStatus to .disconnecting.

After a failed connection, we get .NEVPNStatusDidChange to change the NEVPNStatus to .disconnected. This behavior is correct because we could not connect to the Network Extension without internet. But this is not always the case, as it turns out the Network Extension may not return to .disconnected and hangs in .disconnecting.

After trying to connect again, a situation may occur where NEVPNStatus remains in the .disconnecting state. This does not seem to be the correct behavior for the system Network Extension and it should not hang in an intermediate state and not terminate with the final value (.connected or .disconnected).

Issue FB11934787 has been created for this problem, where we have attached both the application logs at the time of the problem and the system logs with the VPN Extension keyed logging.

Boost

Answer 1

Systems Engineer OP

Apple

Apr ’23

Thank you for opening the bug report. It looks like there is a lot going on in your provider. To try and first start eliminating pieces of functionality to see where the issue could be taking place are you able to create a vanilla version of your packet tunnel that just connects to the VPN server and transparently routes packets? So essentially removing any custom DNS or HTTP functionality? If you do this are you able to reproduce the issue? This will help eliminate any custom code that may be the culprit and let us focus on any of the provider machinery here being the possible issue. If you have bare bones packet tunnel and you can still reproduce the issue, can you update the bug report with another set of logs and sysdiagnose, please.

If you are able to reproduce the issue then are you still able to reproduce the issue once a network request is initiated that your tunnel claims? Essentially does this update the status out of disconnected?

0