Hi @DTS Engineer , Thank you very much for your responses, really helpful.
For the past two weeks, I've been experimenting with a macOS System Extension application that manages three different Network Extension providers (NEFilterDataProvider, NETransparentProxyProvider, and NEDNSProxyProvider) housed within a single systemext bundle (Xcode target2), all managed and activated by a single main application(Xcode target1).
My goal is to reliably capture comprehensive network activity logs from all three extensions simultaneously, particularly under high-traffic conditions. I've run into a few architectural questions regarding prioritization, concurrency, and logging reliability.
Part 1: Extension Activation Order and Execution Predictability
When multiple Network Extensions are active, how does the system process traffic, and is there a guaranteed order of execution?
Q1: Given that all three extensions are active, is there a predictable order in which the network traffic will hit the providers? For example, should I assume the NEFilterDataProvider processes the socket/flow before the NETransparentProxyProvider or NEDNSProxyProvider handles the connection attempt?
Q2: Is there a recommended or "safe" sequence for activating these three specific managers (NEFilterManager, NETransparentProxyManager, NEDNSProxyManager) from the main application to ensure the system applies them correctly and avoids conflicts?
Q3: When the network is under high load, is there a risk that one provider (e.g., the DNS Proxy) might experience delays or resource starvation, potentially causing it to miss network events or logs while the others continue to process traffic?
Part 2: Bidirectional Inter-Process Communication (IPC/XPC)
I am using a single, bidirectional NSXPCConnection channel (IPCConnection) to send logs from all three providers back to the main application for processing.
My Current IPC Setup (Simplified):
/// App --> Provider IPC (Implemented by Provider)
@objc protocol ProviderCommunication {
func register(_ completionHandler: @escaping (Bool) -> Void)
}
/// Provider --> App IPC (Implemented by Main App)
@objc protocol AppCommunication {
func handleLogs(logData: Data)
}
And then in IPCConnection, I call the above function after receiving the logs from extension:
func sendLogs(logData: Data) {
if let logString = String(data: logData, encoding: .utf8) {
os_log("IPCConnection: Log entry received: %{public}@", logString)
}
// Use remoteAppConnection (captured from app via register()) instead of currentConnection
guard let appProxy = remoteAppConnection else {
os_log("IPCConnection: No remote app proxy")
return
}
appProxy.handleLogs(logData: logData)
}
Each extension sends the log to IPCConnection class/file by calling sendLogs function like:
private let ipcConnection: IPCConnection
.......
ipcConnection.sendLogs(logData: logEntry)
or
IPCConnection.shared.sendLogs(logData: logEntry)
Q4: Since all three extensions (which run in the same Xcode target) will be asynchronously calling sendLogs(logData:) simultaneously during high network traffic, is it safe to use a single XPC connection?
Any guidance on the interaction between these three types of network extensions and best practices for robust, concurrent XPC communication would be greatly appreciated.
Please let me know if more clarifications needed from my end.
Thank you
Topic:
App & System Services
SubTopic:
Networking
Tags: