The environment:
- macOS 12.0 ~ 15.6
- A NetworkExtension NEFilterDataProvider configured with
filterSockets = YES,filterPackets = NO,and it doesn't actually block any network connection. - QQMusic (download: https://y.qq.com/n/ryqq/download_detail/mac?ADTAG=YQQ) is constantly playing.
Any of the following operations can reproduce the issue:
- Kill the NetworkExtension process and then restarted by the system.
- Disable the NEFilterDataProvider, and then enable it.
When this problem occurs, there are two different phenomena on the NetworkExtension process:
- It is zombie, or is in high CPU state (100%).
When the NetworkExtension process is zombie, obviously, the new network connections will enter it, and they can't be disposed by the old zombie process, so the network is disconnected.
When the NetworkExtension process is in high CPU state, its thread DispatchQueue "NEFilterExtensionProviderContext queue" is blocked in the kernel when calling close.
In most cases, the network will recover after stopping QQ Music, that is the suspended zombie NetworkExtension process will exist or the cpu of it return to normal.
To reproduce the issue in a simple environment, I have tried many ways to simulate the network behavior of QQMusic, but all failed.
It seems that this issue is caused by UDP traffic of QQMusic, because everything is ok after blocking the UDP connections of QQMusic (the music is still playing at this time) in the NEFilterDataProvider.