Captive networks do not work with NETunnelProviderManager even with probeURL set in OnDemand settings

Originator:adam
Number:rdar://28567679 Date Originated:9/30/2016
Status:Open Resolved:No
Product:iOS SDK Product Version:iOS 10.0.1 (14A403)
Classification:Serious Bug Reproducible:Always
 
Summary:
When installing a VPN profile via a .mobileconfig file, setting the URLStringProbe in OnDemand settings seemed to be enough to temporarily disable the VPN connection when in a captive network.
 
Now, we've been writing our own VPN client using NEPacketTunnelProvider, and setting probeURL in the NETunnelProviderManager doesn't seem to have the same effect. Captive networks do not work.
 
Is this a bug, or is there some other way to temporarily disable the VPN when in a captive network progamatically?

Steps to Reproduce:
1. Initialize a NETunnelProviderManager to save VPN preferences
2. Set various VPN preferences
3. Create an OnDemand "Connect" rule with a public probeURL
4. Save preferences
5. Enable VPN
6. Visit a captive network (like in an airport or café)

Expected Results:
VPN connection should be temporarily disabled, and captive portal sheet should pop up

Actual Results:
Connection hangs until VPN is manually disabled

Version:
iOS 10.0.1

Notes:


Configuration:
iPhone 7

Attachments:

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!