[client] Assign the Android TUN address as a host prefix (#7414)

Android 16+ local network protection derives the blocked prefixes from the interface address prefix. A /16 address turns the whole overlay into a local network, so apps without ACCESS_LOCAL_NETWORK cannot reach any peer. Pass the address as /32 and /128 and add the overlay networks to the route list that the Android side turns into VPN routes, on both the initial create and the renew path.
This commit is contained in:
Zoltan Papp
2026-09-04 15:10:36 +02:00
committed by GitHub
parent 825389818c
commit 5cb6b0d33b
6 changed files with 183 additions and 22 deletions
+6 -1
View File
@@ -63,7 +63,12 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
searchDomainsToString = ""
}
fd, err := t.tunAdapter.ConfigureInterface(t.address.String(), t.address.IPv6String(), int(t.mtu), dns, searchDomainsToString, routesString)
ipv6Host := ""
if t.address.HasIPv6() {
ipv6Host = t.address.IPv6HostPrefix().String()
}
fd, err := t.tunAdapter.ConfigureInterface(t.address.HostPrefix().String(), ipv6Host, int(t.mtu), dns, searchDomainsToString, routesString)
if err != nil {
log.Errorf("failed to create Android interface: %s", err)
return nil, err