Networking

RSS for tag

Explore the networking protocols and technologies used by the device to connect to Wi-Fi networks, Bluetooth devices, and cellular data services.

Networking Documentation

Posts under Networking subtopic

Post

Replies

Boosts

Views

Activity

NWConnectionGroup with Both Datagram and Non-datagram streams
I want to know the right way/API/usage to use NWConnectionGroup to send both datagram and non-datagram stream. I am currently working on an P2P video streaming app. I want to leverage NWConnectionGroup over QUIC to handle both message channel (traditionally handled by a TCP connection) and media channel (traditionally handled by sth. over UDP) to transmit SRT packets back and forth. I created a NWConnectionGroup and it worked fine on non-datagram parts. The problems are with datagram part. I tried extracting a connection with datagram = true either from the group or from message, doesn't and in some cases it breaks other non-datagram connections. I currently send datagram directly using the NWConnectionGroup.send(content:completion). It kinda works but I keep seeing it canceled a lot of messages, which breaks SRT shortly after start. The warnings belong flooded my console. (Seems like want me to create a connection to transmit datagram, how?) nw_connection_create_with_connection [C1600] Original connection not yet connected nw_connection_group_create_connection_for_endpoint_and_parameters [G1] failed to create connection with parameters quic, local: fe80::439:68b4:6ec2:694%en0.60517, definite, attribution: developer, server I must use it in wrong way. What should I do to fix it?
10
0
805
1w
Potential Network Extension memory leak
I've been investigating memory consumption issues with a network extension. It seems as though the "leak" exists within the network extension framework. Looking at a memory graph, there appears to be a _socketFlows dictionary or similar in the network extension framework that holds all of the flows and they continue to pile up and consume memory. The problem seems to be particularly bad when I leave my MacBook plugged in and running over the weekend and come back on Monday. For instance, in that time period, the memory consumption grew from <100MB to >1GB. To try to narrow this down to see if it was an "us" problem or truly in the framework, I installed Objective-See Foundation's Lulu tool, which also uses a network extension. It similarly saw memory grow from around 30MB or less to 600MB in the same time frame. Has anyone else seen this? We do have an open feedback ticket FB18731867 that might be related that has to do with seeing multiple instances of the same data filter provider started and maybe running in a network extension.
3
0
361
1w
iphone device initiates data path termination in 2.5 seconds while trying to connect our wifi device via wifiaware peer to peer app
model : iphone 17 ios version: 26.2 app used: https://developer.apple.com/documentation/wifiaware/building-peer-to-peer-apps Here is our observation when we tried to make wifi aware connection between iphone and our wifi device. note : we used iphone as subscriber ( view simulation) 1.pairing & bootstrapping was successfully done 2.Data path was successfully established between iphone and our device. after data path establishment ,within few seconds , DATA PATH TERMINATION was sent from iphone which leads to pairing verification with new NMI address. Same behaviour is noticed even when we try to establish connection between two iphone devices. Here we have few questions. Once we establish data path , Why iphone initiates data path termination instead using the same service for data path exchange. 2.Why do we go for PAIRING VERIFICATION everytime.
6
0
648
1w
TLS 1.2 session ID 不复用
We have an iOS app (Alamofire 5.9+, backed by URLSession) that talks to a LAN dashcam: HTTP/1.1 TLS 1.2 The device runs an embedded C HTTPS server Responses commonly include Connection: close (a new TCP connection is opened for each request) From Wireshark, looking at Client Hello, we observe: First connection: full handshake; a Session ID is negotiated Next new TCP connection: Client Hello carries that Session ID and completes an abbreviated handshake (resumption succeeds) After that: the same Session ID is not reused again Questions we want to confirm For TLS 1.2 Session ID resumption (RFC 5246), does iOS / URLSession intentionally allow a cached session to be resumed at most once? Or can the same Session ID be resumed multiple times until it expires / is evicted from the cache? Without changing the overall LAN dashcam product model, how should the server be configured—e.g. moving to TLS 1.3 and/or HTTP/2—so that iOS clients can resume via Session Ticket and/or Session ID multiple times? What we have already ruled out / observed The client already uses a shared long-lived URLSession / Alamofire Session (we do not create a new session per request) The server often returns Connection: close, so each request uses a new TCP connection; we are discussing TLS session resumption across connections, not HTTP keep-alive We occasionally see TLS time of only ~10–20 ms, which suggests at least one successful session resumption has occurred
2
0
336
1w
IOS Can't assign requested address, errno = 49
userlog.txt We've run into some HTTP request errors, details as follows: We're currently at a loss because restarting the app doesn't help, only rebooting the phone restores things to normal. Based on tracking data, the occurrence rate for users is about 0.033%, and it's only happening on iOS, Android is fine. iOS operating system versions: 14-27 are all affected. The same issue appears in Rust, Flutter, and C/C++. Rust: 2026-07-11-19:39:22.252+0800|F4E26069-2D7E-4D5F-8B53-664E012B2CA7|UPLogDefaultLogger|DEBUG|测试模式|1023629905|[userdomain_rust/rust_userdomain/src/operator/device_ops/refresh_device_list_op.rs:61]query_device_list error: HttpRequstFaild(Reqwest(reqwest::Error { kind: Request, url: "https://zj.haier.net/api-gw/wisdomdevice/device/v11/family/devices?familyId=ALL&filterFlag=false", source: hyper_util::client::legacy::Error(Connect, ConnectError("tcp connect error", 36.156.179.34:443, Os { code: 49, kind: AddrNotAvailable, message: "Can't assign requested address" })) })) Flutter: 2026-07-11-15:29:02.718371+0800|b2257ae8-f7d8-41d0-8811-2ff1824f95d9|UpPlugins|ERROR|正常模式|1023629905|level:error tag:smart_home msg:getWholeHousePreferenceSetting err: DioException [unknown]: null Error: SocketException: Connection failed (OS Error: Can't assign requested address, errno = 49), address = zj.haier.net, port = 443 C/C++: 2026-07-11-19:39:15.247588+0800|a991af96-bf02-4b94-a437-d4f7efc249ff|uSDK|ERROR|正常模式|1023629905|[CAE][[cae_sock_no_ssl_last_err:869][connect fd 122 ret -1 err 49: Can't assign requested address] ] Native iOS HTTP interface requests work fine, for example when using AFNetworking. Looking for your help~
3
0
419
2w
startProxy delegate for NETransparentProxyProvider class is being called twice for the same pid extension sometimes
We have an application which is written in Swift, which activates Transparent Proxy network extension. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) Sometimes we have observed that on starting the transparent proxy extension, the startProxy overridden delegate method(override func startProxy(options: [String : Any]?, completionHandler: @escaping (Error?) -> Void) {) in our AppProxyProvider class which is derived from NETransparentProxyProvider being called more than once for the same extension(pid). This leads to Over-resume of an object crash as we invoke setTunnelNetworkSettings inside the startProxy delegate. As this is controlled by the system, we are not sure why this delegate being called more than once sometimes even if we call the start TransparentProxy only once. Note that, this issue is seen only in Mac OS Tahoe. Apple Feedback ticket: FB21464147 (startProxy delegate for NETransparentProxyProvider class is being called twice for the same pid extension sometimes)
6
0
726
2w
Local Network Connection is still working even after denied the permission when asked
I've a iOT companion app, in which I'll connect to iOT's Wi-Fi and then communicate the device with APIs, for the above functionality we needed local network permission So we enabled neccessary keys in info.plist and at the time of App Launch we trigger local network permission using the following code info.plist <string>This app needs local network access permission to connect with your iOT device and customize its settings</string> <key>NSBonjourServices</key> <array> <string>_network-perm._tcp</string> <string>_network-perm._udp</string> </array> Network Permission Trigger Methods import Foundation import MultipeerConnectivity class NetworkPermissionManager: NSObject { static let shared = NetworkPermissionManager() private var session: MCSession? private var advertiser: MCNearbyServiceAdvertiser? private var browser: MCNearbyServiceBrowser? private var permissionCallback: ((String) -> Void)? func requestPermission(callback: @escaping (String) -> Void) { self.permissionCallback = callback do { let peerId = MCPeerID(displayName: UUID().uuidString) session = MCSession(peer: peerId, securityIdentity: nil, encryptionPreference: .required) session?.delegate = self advertiser = MCNearbyServiceAdvertiser( peer: peerId, discoveryInfo: nil, serviceType: "network-perm" ) advertiser?.delegate = self browser = MCNearbyServiceBrowser( peer: peerId, serviceType: "network-perm" ) browser?.delegate = self advertiser?.startAdvertisingPeer() browser?.startBrowsingForPeers() // Stop after delay DispatchQueue.main.asyncAfter(deadline: .now() + 1.0) { [weak self] in self?.stopAll() // If no error occurred until now, consider permission triggered self?.permissionCallback?("granted") self?.permissionCallback = nil } } catch { permissionCallback?("error: \(error.localizedDescription)") permissionCallback = nil } } func stopAll() { advertiser?.stopAdvertisingPeer() browser?.stopBrowsingForPeers() session?.disconnect() } } extension NetworkPermissionManager: MCSessionDelegate { func session(_: MCSession, peer _: MCPeerID, didChange _: MCSessionState) {} func session(_: MCSession, didReceive _: Data, fromPeer _: MCPeerID) {} func session(_: MCSession, didReceive _: InputStream, withName _: String, fromPeer _: MCPeerID) {} func session(_: MCSession, didStartReceivingResourceWithName _: String, fromPeer _: MCPeerID, with _: Progress) {} func session(_: MCSession, didFinishReceivingResourceWithName _: String, fromPeer _: MCPeerID, at _: URL?, withError _: Error?) {} } extension NetworkPermissionManager: MCNearbyServiceAdvertiserDelegate { func advertiser(_: MCNearbyServiceAdvertiser, didReceiveInvitationFromPeer _: MCPeerID, withContext _: Data?, invitationHandler: @escaping (Bool, MCSession?) -> Void) { invitationHandler(false, nil) } func advertiser(_: MCNearbyServiceAdvertiser, didNotStartAdvertisingPeer error: Error) { print("❌ Advertising failed: \(error)") if let nsError = error as NSError?, nsError.domain == NetService.errorDomain, nsError.code == -72008 { permissionCallback?("denied") } else { permissionCallback?("error: \(error.localizedDescription)") } permissionCallback = nil stopAll() } } extension NetworkPermissionManager: MCNearbyServiceBrowserDelegate { func browser(_: MCNearbyServiceBrowser, foundPeer _: MCPeerID, withDiscoveryInfo _: [String: String]?) {} func browser(_: MCNearbyServiceBrowser, lostPeer _: MCPeerID) {} func browser(_: MCNearbyServiceBrowser, didNotStartBrowsingForPeers error: Error) { print("❌ Browsing failed: \(error)") if let nsError = error as NSError?, nsError.domain == NetService.errorDomain, nsError.code == -72008 { permissionCallback?("denied") } else { permissionCallback?("error: \(error.localizedDescription)") } permissionCallback = nil stopAll() } }``` I want to satisfy this following cases but it's not working as expected # Case1 Working App launches --> trigger permission using above code --> user granted permission --> connect to iOT's Wi-Fi using app --> Communicate via Local API ---> should return success response # Case2 Not working App launches --> trigger permission using above code --> user denied permission --> connect to iOT's Wi-Fi using app --> Communicate via Local API ---> should throw an error I double checked the permission status in the app settings there also showing disabled state In my case case 2 is also return success, even though user denied the permission I got success response. I wonder why this happens the same above 2 cases working as expected in iOS 17.x versions
5
0
732
2w
NWConnection cancel: Do we need to wait for pending receive callbacks to be cancelled?
Hi, I’m using Network Framework to implement a UDP client via NWConnection, and I’m looking for clarification about the correct and fully safe shutdown procedure, especially regarding resource release. I have initiated some pending receive calls on the NWConnection (using receive). After calling connection.cancel(), do we need to wait for the cancellation of these pending receives? As mentioned in this thread, NWConnection retains references to the receive closures and releases them once they are called. If a receive closure holds a reference to the NWConnection itself, do we need to wait for these closures to be called to avoid memory leaks? Or, if there are no such retained references, we don't need to wait for the cancellation of the pending I/O and cancelled state for NWConnection?
7
0
705
2w
Supported architecture and organization requirement for an on-device iOS domain blocker
I am planning an iOS security and content-blocking app for unmanaged consumer iPhones. The app would not provide a traditional VPN service. It would not offer: Remote VPN servers Geographic location switching Access to a private corporate network IP-address masking as a service Anonymous browsing Instead, the app would allow the user to: View destination domains contacted by the device Classify destinations such as trackers, advertising, analytics, or potentially malicious domains Manually block selected domains Keep connection history and filtering decisions on the device I understand that NEFilterDataProvider and NEFilterControlProvider are the APIs intended for network content filtering. However, according to TN3134, these providers are not generally deployable for an unmanaged adult consumer iPhone. I also understand that TN3120 says NEPacketTunnelProvider should not be used as a general-purpose local content filter. This appears to leave a gap for an unmanaged consumer security app whose core feature is user-controlled, system-wide domain blocking. I am considering whether NETunnelProviderManager with an NEPacketTunnelProvider could support the feature, but I do not want to use the packet-tunnel API outside its supported purpose. My questions are: Is there currently a supported Network Extension architecture for system-wide, user-controlled domain blocking on an unmanaged adult consumer iPhone? Can an app with this purpose use NEPacketTunnelProvider, or would that necessarily be considered the unsupported general-purpose filtering use described in TN3120? If such an architecture is supported, could an app with this purpose be treated as an approved security or content-blocking provider under Guideline 5.4 rather than as an app offering a traditional VPN service? App Review Guideline 5.4 states that apps offering VPN services must be submitted by developers enrolled as organizations. It also states that parental-control, content-blocking, and security apps from approved providers may use NEVPNManager. For an app that does not provide a remote VPN service but uses Apple’s VPN configuration infrastructure only for local security and user-controlled blocking, must the developer still enroll as an organization, or may an individual Apple Developer Program member submit it?
1
0
417
2w
iOS Wi-Fi Aware: Throughput Comparison of Real-Time vs. Bulk Mode
Hello Apple Developer Technical Support / Engineering Team, We are currently developing an iOS application that utilizes Wi-Fi Aware (NAN) for peer-to-peer data transfer between iOS devices. We are in the process of optimizing our data transmission performance and are evaluating the different data path configurations available. Specifically, we would like to understand the performance characteristics and throughput differences between the Real-Time mode and the Bulk mode in the iOS Wi-Fi Aware implementation. Could you please provide clarification on the following points? Maximum Throughput: Between Real-Time mode and Bulk mode, which one is designed to provide a higher maximum throughput for continuous data transfer?
1
0
247
2w
Issue with Native Socket Connection (Error 65) over WiFi Aware on iOS
Dear Apple: 1、We want to create a socket application using the C language interface on the WiFi Aware channel, utilizing native socket APIs such as socket, connect, bind, etc., to transmit data through the established WiFi Aware channel. However, we wrote a demo and tested it. On the iOS side, when initiating a socket connect, we received error code 65. We also used the IPv6 protocol. We would like to ask for help: Is it impossible to use native socket APIs for programming on the WiFi Aware channel? 2、If native sockets are not available, which interfaces are recommended for WiFi Aware communication on iOS? Thanks.
4
0
468
2w
Is HTTPCookieStorage.shared.setCookies(_:for:mainDocumentURL:) synchronous or asynchronous?
Hi Team, I'm trying to understand the behavior of the following API: HTTPCookieStorage.shared.setCookies(_:for:mainDocumentURL:) Specifically, does this API persist cookies synchronously, or does it perform the storage asynchronously in the background? Our use case is storing FCAP (frequency capping) cookies so they persist across app sessions. We call setCookies(_:for:mainDocumentURL:) and want to know whether the cookies are guaranteed to be written before the method returns, or if the actual persistence happens asynchronously. I couldn't find documentation describing the persistence semantics of this API, so I'd appreciate any clarification or guidance from Apple or anyone familiar with its implementation. Thanks
1
0
360
2w
macOS 27 beta (26A5378n): kernel clamps TCP receive window to 5,440 bytes & doubles it once per second on USB Ethernet; Wi-Fi on the same Mac unaffected
Filed as FB23904785 with pcaps, a mid-episode sysdiagnose, & a userspace test harness. Posting here because the behavior localizes to the receive-window computation in xnu & I'd value a sanity check from anyone who knows what changed in this area for 27. On 26A5378n (MacBook Air M2, RTL8156B 2.5GbE via the in-kernel AppleUSBNCM driver), TCP downloads on the wired interface intermittently drop to 6-10 Mbps for stretches of minutes to 40 minutes, then recover on their own. Wi-Fi on the same machine pulls 50-70 Mbps from the same servers in the same seconds. Packet captures show why: during these stretches the kernel advertises a 5,440-byte receive window from the first post-handshake ACK & doubles it on 1.000 s ± 0.01 s wall-clock boundaries, seven doublings in a row, in two separate connections started 6.5 minutes apart, while bytes-per-interval varied 16x. Byte-count triggers can't produce byte-rate-invariant timing; that's a clock. What I ruled out inside a live occurrence: SO_RCVBUF of 4 MB (getsockopt-verified; identical staircase, so it isn't autotuning), ECN on/off (three toggles, no change), both link_heuristics sysctls, the WAN (during one occurrence ICMP loss was WORSE on Wi-Fi, 20% vs 10%, yet Wi-Fi ran 5x faster), & the wire itself (0.1% retransmissions, ACK timestamp-echo p50 43 ms, zero zero-window advertisements). TCP_CONNECTION_INFO confirms the on-wire numbers: tcpi_rcv_wnd 10,880 at t=2 s against a 4 MB buffer that stays 97% empty, tcpi_srtt 41 ms. The throttled flow itself hit 32.7 Mbps at t=7 s once the staircase reached 347 KB, so path capacity was there the whole time. The signature resembles a receiver-side LEDBAT governor (RFC 9840 describes exposing a reduced window through the receive window; tcp_rledbat.c in published xnu clamps recwin for sockets flagged receive-background). Two things don't add up though. First, I ported the published tcp_rledbat.c to userspace & drove it with the exact packet timeline from my capture: no parameterization reproduces constant 2x steps on one-second boundaries, because every growth law in that file counts bytes or RTTs, not seconds. Second, kern.ipc.throttle_best_effort reads 1 on a clean boot of this beta with no sysctl.conf, no profiles, & no third-party launch items, while published xnu initializes it to 0. That switch arms the demotion of best-effort sockets to receive-background on interfaces that recently carried realtime-marked traffic. Questions: did the receive-window governor change in 27, & did the throttle_best_effort default flip intentionally? And is there a supported way to see which sockets carry SOF1_TRAFFIC_MGT_TCP_RECVBG at runtime, to pin down what's marking these flows? Happy to attach anything from the evidence set to the FB or run diagnostics on request; the fault reproduces several times a day here.
2
0
346
3w
Transparent proxy breaks apps on macOS 15.7.8 RC 5
Hello! Users of my app observed behaviour that some apps stopped working after update to 15.7.8 via Beta channel with transparent proxy network extension on. The app receives Protocol not available error, and I see setsockopt SO_FLOW_DIVERT_TOKEN failed [42: Protocol not available] error in Console. To reproduce, create two rules in basic NETransparentProxyProvider: [[NENetworkRule alloc] initWithDestinationNetwork:nil prefix:0 protocol:NENetworkRuleProtocolTCP], [[NENetworkRule alloc] initWithDestinationNetwork:nil prefix:0 protocol:NENetworkRuleProtocolUDP], You may even return NO in handleNewFlow, it does not matter. After that, Safari won't open some sites, and Weather app will work unreliably. Do anyone knows any workaround for this problem? I've also create a relevant FB23788740.
7
0
642
3w
A very serious problem about NetworkExtension NETransparentProxyProvider
Version: MacOS 12.1 When I was using NETransparentProxyProvider, I overrive handleNewFlow, handleNewUDPFlow , and return true for some process, and then call - (void)openWithLocalEndpoint:(NWHostEndpoint *)localEndpoint completionHandler:(void (^)(NSError *error))completionHandler; at the beginning, work fine, buy sometime, when I visited qiye.163.com website, I often got an error when I do code below: - (void)writeData:(NSData *)data withCompletionHandler:(void (^)(NSError *error))completionHandler; Error Domain=NEAppProxyFlowErrorDomain Code=1 "The operation could not be completed because the flow is not connected" UserInfo={NSLocalizedDescription=The operation could not be completed because the flow is not connected , and the whole computer could not access the Internet , handleNewFlow and handleNewUDPFlow both are no longer called, unless I turn off the VPN. Turn off VPN and then Internet can be access
11
0
3.1k
3w
Thread topology data: no API path for parent-child relationships
I'm building a HomeKit app that discovers Thread devices and visualizes the mesh topology. I can detect device roles (Router vs End Device via characteristic 0x0703) and identify Border Routers (via _meshcop._udp), but I cannot determine which Router is the parent of a given End Device. Any Thread device can act as a Router (a Nanoleaf bulb, an Eve plug, not just HomePods), and End Devices attach to these Routers as children. That parent-child relationship is what I'm trying to map, but there's no RLOC16, neighbor table, or parent identifier exposed through any available API. I've tested every path I can find. Here's what I've tried on a network with 44 Thread devices and 6 Border Routers: What works (partially) HAP Thread Management Service (0x0701) gives me the device role from characteristic 0x0703, the OpenThread version from 0x0706, and node capabilities from 0x0702. That's the complete set of characteristics on that service. None of them contain RLOC16, parent Router, or neighbor data. This service also only exists on HAP-native Thread devices. My 20 Matter-over-Thread devices (Aqara, Eve Door, SmartWings, Onvis S4) don't have it at all. MeshCoP Bonjour (_meshcop._udp) identifies Border Routers and the network name/Extended PAN ID. No topology data about other mesh nodes. What doesn't work ThreadNetwork framework (THClient) - retrieveAllCredentials() returns error Code 3 because the app can't access credentials stored by Apple Home. Even if it worked, THCredentials only contains network config (name, PAN ID, channel), not topology. Direct CoAP queries - Border Routers don't route traffic from WiFi to Thread management ports. Mesh-local addresses aren't reachable. No Thread NWInterface in Network.framework. Network.framework - No visibility into the Thread mesh from the WiFi side. The only remaining path I can see (but it's not practical) Matter cluster 0x0035 (Thread Network Diagnostics) appears to have exactly what I need: RLOC16, NeighborTable with isChild boolean, RouteTable. I haven't implemented this because it requires commissioning each device individually onto my app's own Matter fabric via Multi-Admin. That's 21 separate user-initiated pairing actions on my network. I can't ask end users to do that. The core issue Every Thread Router (whether it's a HomePod acting as a Border Router or a Nanoleaf bulb acting as a mesh Router) knows its own children and neighbors. The Border Routers also maintain route tables covering the mesh backbone. This data exists on the user's own devices but none of it is exposed to third-party apps. Even something minimal would help. HMAccessory already exposes matterNodeID as a cross-protocol identifier. Exposing RLOC16 the same way would be enough, since parent-child relationships are encoded in the address itself (ParentRLOC = ChildRLOC & 0xFC00). Has anyone found another approach I'm missing? Thanks in advance for any pointers.
2
0
784
3w
Connectivity loss caused by Content Filter dead lock.
We are using a Content Filter Network Extension to perform telemetry over the network activity of enterprise iOS devices. The filter itself is not blocking any connection. We encountered an issue where our Content Filter got stuck in a deadlock in the startFilter method of the NEFilterControlProvider. This resulted in a crash report where we see 64 threads stuck in the startFilter call. While the content filter was stuck in a deadlock, the device network connectivity was lost. We solved the deadlock issue coming from our logger, however, we would like to get a better understanding on the following points: What are the critical paths where a Content Filter can have a device wide impact on network connectivity? What is the behavior of the OS when the Content Filter is unresponsive (e.g. in startFilter, handle(Report), handleNewFlow)? Will it try to start the filter again? Force kill it ? We saw that startFilter was called multiple times in our crash reports whereas we expected it to be called only on vendor configuration changes. What is the lifecycle of the filter control provider and filter data provider ? When are the different methods like startFilter called ? We would like our Content Filter to never cause disruptions and implement a circuit breaker behavior in case any issue occurs. Do you have any recommendation on how to achieve this ?
5
1
648
3w
Different WebRTC ICE behavior between Xcode Release build and TestFlight on the same device
Hi everyone, I'm experiencing a very unusual difference in WebRTC ICE behavior between an application installed directly from Xcode and the exact same application distributed through TestFlight. Environment iOS application using Google's official WebRTC framework Same iPhone/iPad Same iOS version Same cellular network Same TURN server Xcode Run configuration: Release Archive configuration: Release Configuration The following configuration works perfectly when the application is installed directly from Xcode: config.iceTransportPolicy = .all config.iceServers = [ RTCIceServer( urlStrings: [ "turn:turn.example.com:3478?transport=udp" ], username: "username", credential: "<hidden>" ), RTCIceServer( urlStrings: [ "turn:turn.example.com:443?transport=tcp" ], username: "username", credential: "<hidden>" ), RTCIceServer( urlStrings: [ "turns:turn.example.com:5349?transport=tcp" ], username: "username", credential: "<hidden>" ), RTCIceServer( urlStrings: [ "stun:stun.l.google.com:19302" ] ) ] Calls connect quickly on both Wi-Fi and cellular networks. Problem After uploading exactly the same application to TestFlight, behavior changes significantly on cellular networks. ICE gathering appears to spend a long time generating host/server-reflexive candidates before a usable relay candidate becomes available. As a result, connection establishment becomes much slower than the same Release build installed directly from Xcode. Temporary workaround The only configuration that currently behaves reliably in TestFlight is forcing relay-only with a single TURN UDP server: config.iceTransportPolicy = .relay config.continualGatheringPolicy = .gatherContinually config.iceCandidatePoolSize = 2 config.iceServers = [ RTCIceServer( urlStrings: [ "turn:turn.example.com:3478?transport=udp" ], username: "username", credential: "" ) ] This connects quickly and reliably on both Wi-Fi and cellular networks. My question Has anyone experienced different ICE gathering or candidate selection behavior between: a Release build installed directly from Xcode the same Release build distributed through TestFlight on the same device and network? Are there any known differences in networking, ICE gathering, or runtime behavior that could explain this? I'd appreciate any suggestions or similar experiences. Thanks!
1
0
282
3w
Requesting URL Filter OHTTP Relay
Has anyone successfully requested an OHTTP Relay for URL filtering and got it approved? I first applied for a relay about a month ago, and it was rejected in the first 24h, apparently the DNS TXT record doesn’t have to be setup at the apex domain but at the PIR subdomain (or at least that’s my assumption because Apple doesn’t tell you). After correction the issue and resubmitting the request I haven’t heard back, it’s been in review for many weeks already. Has anyone experienced this kind of delay or has anyone gotten the relay approved?
3
0
455
3w
rvictl broken on iOS 27 Beta3
Using rvictl with iOS 27 beta3 doesn't work anymore. RVICTL reports a successful creation of the remote virtual interface, but the interface rvi0 fails to spawn. rvictl -s Starting device [SUCCEEDED] with interface rvi0 rvictl -l Could not get list of devices iPhone 16 pro iOS 27 Beta3 macOS 27 Xcode 27 beta Confirmed that the command still works on iOS 26.6 on an iPhone 15 Pro.
2
0
343
3w
NWConnectionGroup with Both Datagram and Non-datagram streams
I want to know the right way/API/usage to use NWConnectionGroup to send both datagram and non-datagram stream. I am currently working on an P2P video streaming app. I want to leverage NWConnectionGroup over QUIC to handle both message channel (traditionally handled by a TCP connection) and media channel (traditionally handled by sth. over UDP) to transmit SRT packets back and forth. I created a NWConnectionGroup and it worked fine on non-datagram parts. The problems are with datagram part. I tried extracting a connection with datagram = true either from the group or from message, doesn't and in some cases it breaks other non-datagram connections. I currently send datagram directly using the NWConnectionGroup.send(content:completion). It kinda works but I keep seeing it canceled a lot of messages, which breaks SRT shortly after start. The warnings belong flooded my console. (Seems like want me to create a connection to transmit datagram, how?) nw_connection_create_with_connection [C1600] Original connection not yet connected nw_connection_group_create_connection_for_endpoint_and_parameters [G1] failed to create connection with parameters quic, local: fe80::439:68b4:6ec2:694%en0.60517, definite, attribution: developer, server I must use it in wrong way. What should I do to fix it?
Replies
10
Boosts
0
Views
805
Activity
1w
Potential Network Extension memory leak
I've been investigating memory consumption issues with a network extension. It seems as though the "leak" exists within the network extension framework. Looking at a memory graph, there appears to be a _socketFlows dictionary or similar in the network extension framework that holds all of the flows and they continue to pile up and consume memory. The problem seems to be particularly bad when I leave my MacBook plugged in and running over the weekend and come back on Monday. For instance, in that time period, the memory consumption grew from <100MB to >1GB. To try to narrow this down to see if it was an "us" problem or truly in the framework, I installed Objective-See Foundation's Lulu tool, which also uses a network extension. It similarly saw memory grow from around 30MB or less to 600MB in the same time frame. Has anyone else seen this? We do have an open feedback ticket FB18731867 that might be related that has to do with seeing multiple instances of the same data filter provider started and maybe running in a network extension.
Replies
3
Boosts
0
Views
361
Activity
1w
iphone device initiates data path termination in 2.5 seconds while trying to connect our wifi device via wifiaware peer to peer app
model : iphone 17 ios version: 26.2 app used: https://developer.apple.com/documentation/wifiaware/building-peer-to-peer-apps Here is our observation when we tried to make wifi aware connection between iphone and our wifi device. note : we used iphone as subscriber ( view simulation) 1.pairing & bootstrapping was successfully done 2.Data path was successfully established between iphone and our device. after data path establishment ,within few seconds , DATA PATH TERMINATION was sent from iphone which leads to pairing verification with new NMI address. Same behaviour is noticed even when we try to establish connection between two iphone devices. Here we have few questions. Once we establish data path , Why iphone initiates data path termination instead using the same service for data path exchange. 2.Why do we go for PAIRING VERIFICATION everytime.
Replies
6
Boosts
0
Views
648
Activity
1w
TLS 1.2 session ID 不复用
We have an iOS app (Alamofire 5.9+, backed by URLSession) that talks to a LAN dashcam: HTTP/1.1 TLS 1.2 The device runs an embedded C HTTPS server Responses commonly include Connection: close (a new TCP connection is opened for each request) From Wireshark, looking at Client Hello, we observe: First connection: full handshake; a Session ID is negotiated Next new TCP connection: Client Hello carries that Session ID and completes an abbreviated handshake (resumption succeeds) After that: the same Session ID is not reused again Questions we want to confirm For TLS 1.2 Session ID resumption (RFC 5246), does iOS / URLSession intentionally allow a cached session to be resumed at most once? Or can the same Session ID be resumed multiple times until it expires / is evicted from the cache? Without changing the overall LAN dashcam product model, how should the server be configured—e.g. moving to TLS 1.3 and/or HTTP/2—so that iOS clients can resume via Session Ticket and/or Session ID multiple times? What we have already ruled out / observed The client already uses a shared long-lived URLSession / Alamofire Session (we do not create a new session per request) The server often returns Connection: close, so each request uses a new TCP connection; we are discussing TLS session resumption across connections, not HTTP keep-alive We occasionally see TLS time of only ~10–20 ms, which suggests at least one successful session resumption has occurred
Replies
2
Boosts
0
Views
336
Activity
1w
IOS Can't assign requested address, errno = 49
userlog.txt We've run into some HTTP request errors, details as follows: We're currently at a loss because restarting the app doesn't help, only rebooting the phone restores things to normal. Based on tracking data, the occurrence rate for users is about 0.033%, and it's only happening on iOS, Android is fine. iOS operating system versions: 14-27 are all affected. The same issue appears in Rust, Flutter, and C/C++. Rust: 2026-07-11-19:39:22.252+0800|F4E26069-2D7E-4D5F-8B53-664E012B2CA7|UPLogDefaultLogger|DEBUG|测试模式|1023629905|[userdomain_rust/rust_userdomain/src/operator/device_ops/refresh_device_list_op.rs:61]query_device_list error: HttpRequstFaild(Reqwest(reqwest::Error { kind: Request, url: "https://zj.haier.net/api-gw/wisdomdevice/device/v11/family/devices?familyId=ALL&filterFlag=false", source: hyper_util::client::legacy::Error(Connect, ConnectError("tcp connect error", 36.156.179.34:443, Os { code: 49, kind: AddrNotAvailable, message: "Can't assign requested address" })) })) Flutter: 2026-07-11-15:29:02.718371+0800|b2257ae8-f7d8-41d0-8811-2ff1824f95d9|UpPlugins|ERROR|正常模式|1023629905|level:error tag:smart_home msg:getWholeHousePreferenceSetting err: DioException [unknown]: null Error: SocketException: Connection failed (OS Error: Can't assign requested address, errno = 49), address = zj.haier.net, port = 443 C/C++: 2026-07-11-19:39:15.247588+0800|a991af96-bf02-4b94-a437-d4f7efc249ff|uSDK|ERROR|正常模式|1023629905|[CAE][[cae_sock_no_ssl_last_err:869][connect fd 122 ret -1 err 49: Can't assign requested address] ] Native iOS HTTP interface requests work fine, for example when using AFNetworking. Looking for your help~
Replies
3
Boosts
0
Views
419
Activity
2w
startProxy delegate for NETransparentProxyProvider class is being called twice for the same pid extension sometimes
We have an application which is written in Swift, which activates Transparent Proxy network extension. Our Transparent Proxy module is a system extension, which is exposing an app proxy provider interface (We are using NETransparentProxyProvider class and in extension’s Info.plist we use com.apple.networkextension.app-proxy key.) Sometimes we have observed that on starting the transparent proxy extension, the startProxy overridden delegate method(override func startProxy(options: [String : Any]?, completionHandler: @escaping (Error?) -> Void) {) in our AppProxyProvider class which is derived from NETransparentProxyProvider being called more than once for the same extension(pid). This leads to Over-resume of an object crash as we invoke setTunnelNetworkSettings inside the startProxy delegate. As this is controlled by the system, we are not sure why this delegate being called more than once sometimes even if we call the start TransparentProxy only once. Note that, this issue is seen only in Mac OS Tahoe. Apple Feedback ticket: FB21464147 (startProxy delegate for NETransparentProxyProvider class is being called twice for the same pid extension sometimes)
Replies
6
Boosts
0
Views
726
Activity
2w
Local Network Connection is still working even after denied the permission when asked
I've a iOT companion app, in which I'll connect to iOT's Wi-Fi and then communicate the device with APIs, for the above functionality we needed local network permission So we enabled neccessary keys in info.plist and at the time of App Launch we trigger local network permission using the following code info.plist <string>This app needs local network access permission to connect with your iOT device and customize its settings</string> <key>NSBonjourServices</key> <array> <string>_network-perm._tcp</string> <string>_network-perm._udp</string> </array> Network Permission Trigger Methods import Foundation import MultipeerConnectivity class NetworkPermissionManager: NSObject { static let shared = NetworkPermissionManager() private var session: MCSession? private var advertiser: MCNearbyServiceAdvertiser? private var browser: MCNearbyServiceBrowser? private var permissionCallback: ((String) -> Void)? func requestPermission(callback: @escaping (String) -> Void) { self.permissionCallback = callback do { let peerId = MCPeerID(displayName: UUID().uuidString) session = MCSession(peer: peerId, securityIdentity: nil, encryptionPreference: .required) session?.delegate = self advertiser = MCNearbyServiceAdvertiser( peer: peerId, discoveryInfo: nil, serviceType: "network-perm" ) advertiser?.delegate = self browser = MCNearbyServiceBrowser( peer: peerId, serviceType: "network-perm" ) browser?.delegate = self advertiser?.startAdvertisingPeer() browser?.startBrowsingForPeers() // Stop after delay DispatchQueue.main.asyncAfter(deadline: .now() + 1.0) { [weak self] in self?.stopAll() // If no error occurred until now, consider permission triggered self?.permissionCallback?("granted") self?.permissionCallback = nil } } catch { permissionCallback?("error: \(error.localizedDescription)") permissionCallback = nil } } func stopAll() { advertiser?.stopAdvertisingPeer() browser?.stopBrowsingForPeers() session?.disconnect() } } extension NetworkPermissionManager: MCSessionDelegate { func session(_: MCSession, peer _: MCPeerID, didChange _: MCSessionState) {} func session(_: MCSession, didReceive _: Data, fromPeer _: MCPeerID) {} func session(_: MCSession, didReceive _: InputStream, withName _: String, fromPeer _: MCPeerID) {} func session(_: MCSession, didStartReceivingResourceWithName _: String, fromPeer _: MCPeerID, with _: Progress) {} func session(_: MCSession, didFinishReceivingResourceWithName _: String, fromPeer _: MCPeerID, at _: URL?, withError _: Error?) {} } extension NetworkPermissionManager: MCNearbyServiceAdvertiserDelegate { func advertiser(_: MCNearbyServiceAdvertiser, didReceiveInvitationFromPeer _: MCPeerID, withContext _: Data?, invitationHandler: @escaping (Bool, MCSession?) -> Void) { invitationHandler(false, nil) } func advertiser(_: MCNearbyServiceAdvertiser, didNotStartAdvertisingPeer error: Error) { print("❌ Advertising failed: \(error)") if let nsError = error as NSError?, nsError.domain == NetService.errorDomain, nsError.code == -72008 { permissionCallback?("denied") } else { permissionCallback?("error: \(error.localizedDescription)") } permissionCallback = nil stopAll() } } extension NetworkPermissionManager: MCNearbyServiceBrowserDelegate { func browser(_: MCNearbyServiceBrowser, foundPeer _: MCPeerID, withDiscoveryInfo _: [String: String]?) {} func browser(_: MCNearbyServiceBrowser, lostPeer _: MCPeerID) {} func browser(_: MCNearbyServiceBrowser, didNotStartBrowsingForPeers error: Error) { print("❌ Browsing failed: \(error)") if let nsError = error as NSError?, nsError.domain == NetService.errorDomain, nsError.code == -72008 { permissionCallback?("denied") } else { permissionCallback?("error: \(error.localizedDescription)") } permissionCallback = nil stopAll() } }``` I want to satisfy this following cases but it's not working as expected # Case1 Working App launches --> trigger permission using above code --> user granted permission --> connect to iOT's Wi-Fi using app --> Communicate via Local API ---> should return success response # Case2 Not working App launches --> trigger permission using above code --> user denied permission --> connect to iOT's Wi-Fi using app --> Communicate via Local API ---> should throw an error I double checked the permission status in the app settings there also showing disabled state In my case case 2 is also return success, even though user denied the permission I got success response. I wonder why this happens the same above 2 cases working as expected in iOS 17.x versions
Replies
5
Boosts
0
Views
732
Activity
2w
NWConnection cancel: Do we need to wait for pending receive callbacks to be cancelled?
Hi, I’m using Network Framework to implement a UDP client via NWConnection, and I’m looking for clarification about the correct and fully safe shutdown procedure, especially regarding resource release. I have initiated some pending receive calls on the NWConnection (using receive). After calling connection.cancel(), do we need to wait for the cancellation of these pending receives? As mentioned in this thread, NWConnection retains references to the receive closures and releases them once they are called. If a receive closure holds a reference to the NWConnection itself, do we need to wait for these closures to be called to avoid memory leaks? Or, if there are no such retained references, we don't need to wait for the cancellation of the pending I/O and cancelled state for NWConnection?
Replies
7
Boosts
0
Views
705
Activity
2w
Supported architecture and organization requirement for an on-device iOS domain blocker
I am planning an iOS security and content-blocking app for unmanaged consumer iPhones. The app would not provide a traditional VPN service. It would not offer: Remote VPN servers Geographic location switching Access to a private corporate network IP-address masking as a service Anonymous browsing Instead, the app would allow the user to: View destination domains contacted by the device Classify destinations such as trackers, advertising, analytics, or potentially malicious domains Manually block selected domains Keep connection history and filtering decisions on the device I understand that NEFilterDataProvider and NEFilterControlProvider are the APIs intended for network content filtering. However, according to TN3134, these providers are not generally deployable for an unmanaged adult consumer iPhone. I also understand that TN3120 says NEPacketTunnelProvider should not be used as a general-purpose local content filter. This appears to leave a gap for an unmanaged consumer security app whose core feature is user-controlled, system-wide domain blocking. I am considering whether NETunnelProviderManager with an NEPacketTunnelProvider could support the feature, but I do not want to use the packet-tunnel API outside its supported purpose. My questions are: Is there currently a supported Network Extension architecture for system-wide, user-controlled domain blocking on an unmanaged adult consumer iPhone? Can an app with this purpose use NEPacketTunnelProvider, or would that necessarily be considered the unsupported general-purpose filtering use described in TN3120? If such an architecture is supported, could an app with this purpose be treated as an approved security or content-blocking provider under Guideline 5.4 rather than as an app offering a traditional VPN service? App Review Guideline 5.4 states that apps offering VPN services must be submitted by developers enrolled as organizations. It also states that parental-control, content-blocking, and security apps from approved providers may use NEVPNManager. For an app that does not provide a remote VPN service but uses Apple’s VPN configuration infrastructure only for local security and user-controlled blocking, must the developer still enroll as an organization, or may an individual Apple Developer Program member submit it?
Replies
1
Boosts
0
Views
417
Activity
2w
iOS Wi-Fi Aware: Throughput Comparison of Real-Time vs. Bulk Mode
Hello Apple Developer Technical Support / Engineering Team, We are currently developing an iOS application that utilizes Wi-Fi Aware (NAN) for peer-to-peer data transfer between iOS devices. We are in the process of optimizing our data transmission performance and are evaluating the different data path configurations available. Specifically, we would like to understand the performance characteristics and throughput differences between the Real-Time mode and the Bulk mode in the iOS Wi-Fi Aware implementation. Could you please provide clarification on the following points? Maximum Throughput: Between Real-Time mode and Bulk mode, which one is designed to provide a higher maximum throughput for continuous data transfer?
Replies
1
Boosts
0
Views
247
Activity
2w
Issue with Native Socket Connection (Error 65) over WiFi Aware on iOS
Dear Apple: 1、We want to create a socket application using the C language interface on the WiFi Aware channel, utilizing native socket APIs such as socket, connect, bind, etc., to transmit data through the established WiFi Aware channel. However, we wrote a demo and tested it. On the iOS side, when initiating a socket connect, we received error code 65. We also used the IPv6 protocol. We would like to ask for help: Is it impossible to use native socket APIs for programming on the WiFi Aware channel? 2、If native sockets are not available, which interfaces are recommended for WiFi Aware communication on iOS? Thanks.
Replies
4
Boosts
0
Views
468
Activity
2w
Is HTTPCookieStorage.shared.setCookies(_:for:mainDocumentURL:) synchronous or asynchronous?
Hi Team, I'm trying to understand the behavior of the following API: HTTPCookieStorage.shared.setCookies(_:for:mainDocumentURL:) Specifically, does this API persist cookies synchronously, or does it perform the storage asynchronously in the background? Our use case is storing FCAP (frequency capping) cookies so they persist across app sessions. We call setCookies(_:for:mainDocumentURL:) and want to know whether the cookies are guaranteed to be written before the method returns, or if the actual persistence happens asynchronously. I couldn't find documentation describing the persistence semantics of this API, so I'd appreciate any clarification or guidance from Apple or anyone familiar with its implementation. Thanks
Replies
1
Boosts
0
Views
360
Activity
2w
macOS 27 beta (26A5378n): kernel clamps TCP receive window to 5,440 bytes & doubles it once per second on USB Ethernet; Wi-Fi on the same Mac unaffected
Filed as FB23904785 with pcaps, a mid-episode sysdiagnose, & a userspace test harness. Posting here because the behavior localizes to the receive-window computation in xnu & I'd value a sanity check from anyone who knows what changed in this area for 27. On 26A5378n (MacBook Air M2, RTL8156B 2.5GbE via the in-kernel AppleUSBNCM driver), TCP downloads on the wired interface intermittently drop to 6-10 Mbps for stretches of minutes to 40 minutes, then recover on their own. Wi-Fi on the same machine pulls 50-70 Mbps from the same servers in the same seconds. Packet captures show why: during these stretches the kernel advertises a 5,440-byte receive window from the first post-handshake ACK & doubles it on 1.000 s ± 0.01 s wall-clock boundaries, seven doublings in a row, in two separate connections started 6.5 minutes apart, while bytes-per-interval varied 16x. Byte-count triggers can't produce byte-rate-invariant timing; that's a clock. What I ruled out inside a live occurrence: SO_RCVBUF of 4 MB (getsockopt-verified; identical staircase, so it isn't autotuning), ECN on/off (three toggles, no change), both link_heuristics sysctls, the WAN (during one occurrence ICMP loss was WORSE on Wi-Fi, 20% vs 10%, yet Wi-Fi ran 5x faster), & the wire itself (0.1% retransmissions, ACK timestamp-echo p50 43 ms, zero zero-window advertisements). TCP_CONNECTION_INFO confirms the on-wire numbers: tcpi_rcv_wnd 10,880 at t=2 s against a 4 MB buffer that stays 97% empty, tcpi_srtt 41 ms. The throttled flow itself hit 32.7 Mbps at t=7 s once the staircase reached 347 KB, so path capacity was there the whole time. The signature resembles a receiver-side LEDBAT governor (RFC 9840 describes exposing a reduced window through the receive window; tcp_rledbat.c in published xnu clamps recwin for sockets flagged receive-background). Two things don't add up though. First, I ported the published tcp_rledbat.c to userspace & drove it with the exact packet timeline from my capture: no parameterization reproduces constant 2x steps on one-second boundaries, because every growth law in that file counts bytes or RTTs, not seconds. Second, kern.ipc.throttle_best_effort reads 1 on a clean boot of this beta with no sysctl.conf, no profiles, & no third-party launch items, while published xnu initializes it to 0. That switch arms the demotion of best-effort sockets to receive-background on interfaces that recently carried realtime-marked traffic. Questions: did the receive-window governor change in 27, & did the throttle_best_effort default flip intentionally? And is there a supported way to see which sockets carry SOF1_TRAFFIC_MGT_TCP_RECVBG at runtime, to pin down what's marking these flows? Happy to attach anything from the evidence set to the FB or run diagnostics on request; the fault reproduces several times a day here.
Replies
2
Boosts
0
Views
346
Activity
3w
Transparent proxy breaks apps on macOS 15.7.8 RC 5
Hello! Users of my app observed behaviour that some apps stopped working after update to 15.7.8 via Beta channel with transparent proxy network extension on. The app receives Protocol not available error, and I see setsockopt SO_FLOW_DIVERT_TOKEN failed [42: Protocol not available] error in Console. To reproduce, create two rules in basic NETransparentProxyProvider: [[NENetworkRule alloc] initWithDestinationNetwork:nil prefix:0 protocol:NENetworkRuleProtocolTCP], [[NENetworkRule alloc] initWithDestinationNetwork:nil prefix:0 protocol:NENetworkRuleProtocolUDP], You may even return NO in handleNewFlow, it does not matter. After that, Safari won't open some sites, and Weather app will work unreliably. Do anyone knows any workaround for this problem? I've also create a relevant FB23788740.
Replies
7
Boosts
0
Views
642
Activity
3w
A very serious problem about NetworkExtension NETransparentProxyProvider
Version: MacOS 12.1 When I was using NETransparentProxyProvider, I overrive handleNewFlow, handleNewUDPFlow , and return true for some process, and then call - (void)openWithLocalEndpoint:(NWHostEndpoint *)localEndpoint completionHandler:(void (^)(NSError *error))completionHandler; at the beginning, work fine, buy sometime, when I visited qiye.163.com website, I often got an error when I do code below: - (void)writeData:(NSData *)data withCompletionHandler:(void (^)(NSError *error))completionHandler; Error Domain=NEAppProxyFlowErrorDomain Code=1 "The operation could not be completed because the flow is not connected" UserInfo={NSLocalizedDescription=The operation could not be completed because the flow is not connected , and the whole computer could not access the Internet , handleNewFlow and handleNewUDPFlow both are no longer called, unless I turn off the VPN. Turn off VPN and then Internet can be access
Replies
11
Boosts
0
Views
3.1k
Activity
3w
Thread topology data: no API path for parent-child relationships
I'm building a HomeKit app that discovers Thread devices and visualizes the mesh topology. I can detect device roles (Router vs End Device via characteristic 0x0703) and identify Border Routers (via _meshcop._udp), but I cannot determine which Router is the parent of a given End Device. Any Thread device can act as a Router (a Nanoleaf bulb, an Eve plug, not just HomePods), and End Devices attach to these Routers as children. That parent-child relationship is what I'm trying to map, but there's no RLOC16, neighbor table, or parent identifier exposed through any available API. I've tested every path I can find. Here's what I've tried on a network with 44 Thread devices and 6 Border Routers: What works (partially) HAP Thread Management Service (0x0701) gives me the device role from characteristic 0x0703, the OpenThread version from 0x0706, and node capabilities from 0x0702. That's the complete set of characteristics on that service. None of them contain RLOC16, parent Router, or neighbor data. This service also only exists on HAP-native Thread devices. My 20 Matter-over-Thread devices (Aqara, Eve Door, SmartWings, Onvis S4) don't have it at all. MeshCoP Bonjour (_meshcop._udp) identifies Border Routers and the network name/Extended PAN ID. No topology data about other mesh nodes. What doesn't work ThreadNetwork framework (THClient) - retrieveAllCredentials() returns error Code 3 because the app can't access credentials stored by Apple Home. Even if it worked, THCredentials only contains network config (name, PAN ID, channel), not topology. Direct CoAP queries - Border Routers don't route traffic from WiFi to Thread management ports. Mesh-local addresses aren't reachable. No Thread NWInterface in Network.framework. Network.framework - No visibility into the Thread mesh from the WiFi side. The only remaining path I can see (but it's not practical) Matter cluster 0x0035 (Thread Network Diagnostics) appears to have exactly what I need: RLOC16, NeighborTable with isChild boolean, RouteTable. I haven't implemented this because it requires commissioning each device individually onto my app's own Matter fabric via Multi-Admin. That's 21 separate user-initiated pairing actions on my network. I can't ask end users to do that. The core issue Every Thread Router (whether it's a HomePod acting as a Border Router or a Nanoleaf bulb acting as a mesh Router) knows its own children and neighbors. The Border Routers also maintain route tables covering the mesh backbone. This data exists on the user's own devices but none of it is exposed to third-party apps. Even something minimal would help. HMAccessory already exposes matterNodeID as a cross-protocol identifier. Exposing RLOC16 the same way would be enough, since parent-child relationships are encoded in the address itself (ParentRLOC = ChildRLOC & 0xFC00). Has anyone found another approach I'm missing? Thanks in advance for any pointers.
Replies
2
Boosts
0
Views
784
Activity
3w
Connectivity loss caused by Content Filter dead lock.
We are using a Content Filter Network Extension to perform telemetry over the network activity of enterprise iOS devices. The filter itself is not blocking any connection. We encountered an issue where our Content Filter got stuck in a deadlock in the startFilter method of the NEFilterControlProvider. This resulted in a crash report where we see 64 threads stuck in the startFilter call. While the content filter was stuck in a deadlock, the device network connectivity was lost. We solved the deadlock issue coming from our logger, however, we would like to get a better understanding on the following points: What are the critical paths where a Content Filter can have a device wide impact on network connectivity? What is the behavior of the OS when the Content Filter is unresponsive (e.g. in startFilter, handle(Report), handleNewFlow)? Will it try to start the filter again? Force kill it ? We saw that startFilter was called multiple times in our crash reports whereas we expected it to be called only on vendor configuration changes. What is the lifecycle of the filter control provider and filter data provider ? When are the different methods like startFilter called ? We would like our Content Filter to never cause disruptions and implement a circuit breaker behavior in case any issue occurs. Do you have any recommendation on how to achieve this ?
Replies
5
Boosts
1
Views
648
Activity
3w
Different WebRTC ICE behavior between Xcode Release build and TestFlight on the same device
Hi everyone, I'm experiencing a very unusual difference in WebRTC ICE behavior between an application installed directly from Xcode and the exact same application distributed through TestFlight. Environment iOS application using Google's official WebRTC framework Same iPhone/iPad Same iOS version Same cellular network Same TURN server Xcode Run configuration: Release Archive configuration: Release Configuration The following configuration works perfectly when the application is installed directly from Xcode: config.iceTransportPolicy = .all config.iceServers = [ RTCIceServer( urlStrings: [ "turn:turn.example.com:3478?transport=udp" ], username: "username", credential: "<hidden>" ), RTCIceServer( urlStrings: [ "turn:turn.example.com:443?transport=tcp" ], username: "username", credential: "<hidden>" ), RTCIceServer( urlStrings: [ "turns:turn.example.com:5349?transport=tcp" ], username: "username", credential: "<hidden>" ), RTCIceServer( urlStrings: [ "stun:stun.l.google.com:19302" ] ) ] Calls connect quickly on both Wi-Fi and cellular networks. Problem After uploading exactly the same application to TestFlight, behavior changes significantly on cellular networks. ICE gathering appears to spend a long time generating host/server-reflexive candidates before a usable relay candidate becomes available. As a result, connection establishment becomes much slower than the same Release build installed directly from Xcode. Temporary workaround The only configuration that currently behaves reliably in TestFlight is forcing relay-only with a single TURN UDP server: config.iceTransportPolicy = .relay config.continualGatheringPolicy = .gatherContinually config.iceCandidatePoolSize = 2 config.iceServers = [ RTCIceServer( urlStrings: [ "turn:turn.example.com:3478?transport=udp" ], username: "username", credential: "" ) ] This connects quickly and reliably on both Wi-Fi and cellular networks. My question Has anyone experienced different ICE gathering or candidate selection behavior between: a Release build installed directly from Xcode the same Release build distributed through TestFlight on the same device and network? Are there any known differences in networking, ICE gathering, or runtime behavior that could explain this? I'd appreciate any suggestions or similar experiences. Thanks!
Replies
1
Boosts
0
Views
282
Activity
3w
Requesting URL Filter OHTTP Relay
Has anyone successfully requested an OHTTP Relay for URL filtering and got it approved? I first applied for a relay about a month ago, and it was rejected in the first 24h, apparently the DNS TXT record doesn’t have to be setup at the apex domain but at the PIR subdomain (or at least that’s my assumption because Apple doesn’t tell you). After correction the issue and resubmitting the request I haven’t heard back, it’s been in review for many weeks already. Has anyone experienced this kind of delay or has anyone gotten the relay approved?
Replies
3
Boosts
0
Views
455
Activity
3w
rvictl broken on iOS 27 Beta3
Using rvictl with iOS 27 beta3 doesn't work anymore. RVICTL reports a successful creation of the remote virtual interface, but the interface rvi0 fails to spawn. rvictl -s Starting device [SUCCEEDED] with interface rvi0 rvictl -l Could not get list of devices iPhone 16 pro iOS 27 Beta3 macOS 27 Xcode 27 beta Confirmed that the command still works on iOS 26.6 on an iPhone 15 Pro.
Replies
2
Boosts
0
Views
343
Activity
3w