在 Mac 上，如何在每个 App VPN 配置文件的 App 中指定自定义隧道提供程序？

如何解决在 Mac 上，如何在每个 App VPN 配置文件的 App 中指定自定义隧道提供程序？

我正在为 macOS 平台开发 VPN 桌面客户端，我正在尝试实现 App Per-App VPN。据我了解，此功能的工作原理是让用户安装配置文件，其中包含有关该功能中包含哪些应用程序的信息。示例配置 profile 如下所示：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
   <dict>
   <key>PayloadContent</key>
   <array>
      <dict>
         <key>PayloadDescription</key>
         <string>Configures VPN app mapping settings</string>
         <key>PayloadDisplayName</key>
         <string>VPN (Per-App VPN TCP App Mapping)</string>
         <key>PayloadIdentifier</key>
         <string>com.f5.access.macos.perapp.vpn.appmapping</string>
         <key>PayloadOrganization</key>
         <string/>
         <key>PayloadType</key>
         <string>com.apple.vpn.managed.appmapping</string>
         <key>PayloadUUID</key>
         <string>6B015006-D559-4C5C-B197-737CF4DCFA96</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
         <key>AppLayerVPNMapping</key>
         <array>
            <dict>
               <key>Identifier</key>
               <string>com.google.Chrome</string>
               <key>VPNUUID</key>
               <string>6A015006-D559-4C5C-B197-737CF4DCFA96</string>
               <key>SigningIdentifier</key>
               <string>com.google.Chrome</string>
               <key>DesignatedRequirement</key>
               <string>(identifier "com.google.Chrome" or identifier "com.google.Chrome.beta" or identifier "com.google.Chrome.dev" or identifier "com.google.Chrome.canary") and (certificate leaf = H"85cee8254216185620ddc8851c7a9fc4dfe120ef" or certificate leaf = H"c9a99324ca3fcb23dbcc36bd5fd4f9753305130a")</string>
            </dict>
            <dict>
               <key>Identifier</key>
               <string>org.mozilla.firefox</string>
               <key>VPNUUID</key>
               <string>6A015006-D559-4C5C-B197-737CF4DCFA96</string>
               <key>SigningIdentifier</key>
               <string>org.mozilla.firefox</string>
               <key>DesignatedRequirement</key>
               <string>anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "43AQ936H96"</string>
               </dict>
         </array>
      </dict>
      <dict>
         <key>PayloadType</key>
         <string>com.apple.vpn.managed.applayer</string>
         <key>PayloadDescription</key>
         <string>Configures VPN settings,including authentication.</string>
         <key>PayloadDisplayName</key>
         <string>VPN (Per-App VPN App Mapping)</string>
         <key>PayloadIdentifier</key>
         <string>com.f5.access.macos.perapp.vpn.vpn</string>
         <key>PayloadOrganization</key>
         <string/>
         <key>PayloadUUID</key>
         <string>5A015006-D559-4C5C-B197-737CF4DCFA96</string>
         <key>PayloadVersion</key>
         <integer>1</integer>
         <key>Proxies</key>
         <dict/>
         <key>UserDefinedName</key>
         <string>App Mapping</string>
         <key>VPN</key>
            <dict>
               <key>AuthName</key>
               <string>test</string>
               <key>AuthPassword</key>
               <string>test</string>
               <key>AuthenticationMethod</key>
               <string>Password</string>
               <key>RemoteAddress</key>
               <string>https://portal.example.com</string>
               <key>OnDemandMatchAppEnabled</key>
               <true/>
               <key>ProviderType</key>
               <string>packet-tunnel</string>
               <key>ProviderBundleIdentifier</key>
               <string>com.f5.access.macos.PacketTunnel</string>
            </dict>
         <key>VPNSubType</key>
         <string>com.f5.access.macos</string>
         <key>VPNType</key>
         <string>VPN</string>
         <key>VendorConfig</key>
         <dict/>
         <key>VPNUUID</key>
         <string>6A015006-D559-4C5C-B197-737CF4DCFA96</string>
      </dict>
    </array>
    <key>PayloadDescription</key>
    <string>PerApp VPN Payload TCP Test</string>
    <key>PayloadDisplayName</key>
    <string>MDM - Per-App VPN TCP</string>
    <key>PayloadIdentifier</key>
    <string>com.f5.access.macos.perapp.vpn</string>
    <key>PayloadOrganization</key>
    <string/>
    <key>PayloadRemovalDisallowed</key>
    <false/>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>06A850CC-BC81-43FB-AA16-42BE472D2421</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
   </dict>
</plist>

当保存在 .mobileconfig（对不起，我不知道哪种文件扩展名适合 macOS 配置文件，所以我使用了 iOS 扩展名）配置文件时，双击它，macOS 正确地说配置文件是可在系统偏好设置 -> 配置文件中安装。当我去那里时，我可以安装配置文件，尽管它没有签名，而且我可以看到例如谷歌浏览器失去了互联网连接，因为配置文件包含许多占位符。但我相信这意味着配置文件正在发挥作用，系统根本找不到相关的 VPN 网络配置。我的下一步是使用实际的 Ike2 凭据等填充数据，但我的最终目标是使用此 Per App VPN 和我的应用程序在其网络扩展 appex 中支持的自定义 VPN 协议（Wireguard），使用自定义隧道提供程序。我真的不知道如何为这个场景配置配置文件，所以我希望有人能给我带来正确的方向。感谢您的帮助。