What's new in NetworkExtension

URL parsing configuration for controlling which URL components to exclude and parsing behavior during sub-URL enumeration. By default, all components (except Scheme and www subdomain) are included and parsing is case-insensitive. All possible sub-URL combinations are enumerated by walking up both the domain hierarchy and path hierarchy, including intermediate results.

For example:

• domain hierarchy (e.g., a.b.c.com -> a.b.c.com, b.c.com, c.com)
• path hierarchy (e.g., /a/b/c -> /a, /a/b, /a/b/c)
• intermediate pattern combinations (e.g., example.com/a/b/c?id=123 -> example.com,

example.com/a, example.com/a/b, example.com/a/b/c, example.com/a/b/c?id=123)

Use this configuration to change the default behavior.

Configure the report endpoint to enable periodic blocked URL reporting. Reports will be posted to the specified report endpoint on the PIR server URL, i.e. <URL server URL>/<report endpoint> at the specified interval. An HTTPS POST request will be sent to the specified PIR server URL report endpoint. The data of the request will be the list of blocked URLs accumulated during the last report interval. Report will not be sent if there is no blocked URLs in the last interval. The report requests will be authenticated and sent over the same OHTTP relay as the PIR traffic. Due to scheduling mechanism on the system, implementation should allow slight deviation between the scheduled time and the actual execution time of the task. Reporting will take effect on supervised devices only. Setting this property on a non-supervised device has no effect. The configuration will be saved successfully, but no reports will be sent. If nil, reporting will be disabled.

The format for blocked URL reports. Supported values: "json" or "protobuf". Default is "json".

JSON Format Details: The output uses standard JSON format with a simple array of strings. The structure is:

[
	"example.com",
	"example2.com",
	"example3.com"
]

Protobuf Format Details: The output uses Protocol Buffers wire format with manual encoding for a repeated string field. Each URL entry follows this binary structure:

• Field Tag: 1 byte (0x0A = field number 1, wire type 2 for length-delimited)
• String Length: Variable-length integer (varint) encoding the byte length of the URL string
• String Data: UTF-8 encoded URL bytes

For strings under 128 bytes, the length is a single byte. For longer strings, varint encoding is used where each byte has the MSB set (0x80) except the final byte.

Example encoding for URL "https://example.com": [0x0A] [0x13] [h][t][t][p][s][:][/][/][e][x][a][m][p][l][e][.][c][o][m] ^tag ^len=19 ^----------------------- 19 bytes of UTF-8 string data ----------------------^

Report format types for blocked URL reporting

The time interval at which the system will send reports of blocked URLs. Default interval is 86400 seconds (1 day). Minimum interval allowed is 3600 seconds (1 hour).

To set the urlParsingRegularExpression property. This allows for custom URL parsing patterns beyond the standard parsing options. The specified regular expression will be used to parse the URL before matching against the specified data set. URL parsing with regular expression is case insensitive.

The specified regular expression must use the standard name captured group syntax (e.g. "https?://(?<host>[^/]+)" captures the domain using group name 'host'). The group names in the regular expression are custom labels (limited to ASCII alphanumeric characters), selected by you. The delimiter is the space character. The result will be a single string in the following format: <group-1-name>=<group-1-value> <group-2-name>=<group-2-value> <group-3-name>=... where each name-value pair is separated by a space.

• throws
• Error : An error if the pattern is invalid.

Any regular expression without any name captured group is invalid and will result in error. For regular expressions that contains a mix of name captured groups and other type of captured groups, only the name captured groups will be included in the result. If urlParsingRegularExpression is specified, urlParsingConfiguration will have no effect.

URL parsing configuration that controls which URL components are excluded and parsing behavior in the filtering process. This determines how URLs are parsed and what sub-URLs are generated for matching against the filter data set. For any excluded component (domain, path, query, and fragment), the string "%*" will be substituted in place as a placeholder. Excluded scheme and www prefix are always stripped entirely without a placeholder, as URL matching typically does not require them. For example, for the requested URL "https://www.example.com/a/b/c?id=123#fragment", with the configuration set

var config = manager.urlParsingConfiguration
config.excludeScheme = true
config.domain.stripWWW = true
config.path.excluded = true
manager.urlParsingConfiguration = config

the parsing result will be "example.com/%*?id=123#fragment" where "%*" acts as the placeholder for the excluded path component. The presence of a placeholder indicates the original URL contained that component, but it was excluded by the parsing configuration. By default, Scheme and www subdomain are excluded. If urlParsingRegularExpression is set, this configuration has no effect.

A regular expression used for advanced URL parsing. This allows for custom URL parsing patterns beyond the standard parsing options. The specified regular expression will be used to parse the URL before matching against the specified data set. URL parsing with regular expression is case insensitive. This get-only property returns a String regex pattern if one has been set. Otherwise returns nil. To set this property, use setURLParsingRegularExpression(_:) which validates the pattern.

NEPacketTunnelNetworkSettings IP Family types