From 77791b5858d1d9c9cfdb653fb710f0c6e0ddbb68 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Wed, 19 Aug 2026 09:47:57 +0000
Subject: [PATCH] [client] Report network addresses on Android for posture
 checks (#7235)

Android never reported its local network interfaces, so PeerNetworkRange posture checks could not be evaluated: NetworkAddresses always arrived empty.

net.Interfaces() is unusable on Android 11+ (SELinux blocks netlink), so the addresses are parsed from the interface description the host app already provides via stdnet.ExternalIFaceDiscover. The MAC filter is skipped, mirroring #5906
for iOS, since Android does not expose MACs either and nothing reads Mac server side.
---
 client/android/client.go              |  1 +
 client/system/info_android.go         |  6 ++
 client/system/network_addr.go         |  2 +-
 client/system/network_addr_android.go | 89 +++++++++++++++++++++++++++
 client/system/network_addr_test.go    |  2 +-
 5 files changed, 98 insertions(+), 2 deletions(-)
 create mode 100644 client/system/network_addr_android.go

diff --git a/client/android/client.go b/client/android/client.go
index 71bbe4380..7eea83dc0 100644
--- a/client/android/client.go
+++ b/client/android/client.go
@@ -152,6 +152,7 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 	execWorkaround(androidSDKVersion)
 
 	net.SetAndroidProtectSocketFn(tunAdapter.ProtectSocket)
+	system.SetIFaceDiscover(iFaceDiscover)
 	return &Client{
 		deviceName:            deviceName,
 		uiVersion:             uiVersion,
diff --git a/client/system/info_android.go b/client/system/info_android.go
index 3c71573bb..d4f479386 100644
--- a/client/system/info_android.go
+++ b/client/system/info_android.go
@@ -30,6 +30,11 @@ func GetInfo(ctx context.Context) *Info {
 		kernelVersion = osInfo[2]
 	}
 
+	addrs, err := networkAddresses()
+	if err != nil {
+		log.Warnf("discover network addresses: %s", err)
+	}
+
 	gio := &Info{
 		GoOS:               runtime.GOOS,
 		Kernel:             kernel,
@@ -41,6 +46,7 @@ func GetInfo(ctx context.Context) *Info {
 		NetbirdVersion:     version.NetbirdVersion(),
 		UIVersion:          extractUIVersion(ctx),
 		KernelVersion:      kernelVersion,
+		NetworkAddresses:   addrs,
 		SystemSerialNumber: serial(),
 		SystemProductName:  productModel(),
 		SystemManufacturer: productManufacturer(),
diff --git a/client/system/network_addr.go b/client/system/network_addr.go
index 44260a938..505a6f0ea 100644
--- a/client/system/network_addr.go
+++ b/client/system/network_addr.go
@@ -1,4 +1,4 @@
-//go:build !ios
+//go:build !ios && !android
 
 package system
 
diff --git a/client/system/network_addr_android.go b/client/system/network_addr_android.go
new file mode 100644
index 000000000..99a71e105
--- /dev/null
+++ b/client/system/network_addr_android.go
@@ -0,0 +1,89 @@
+package system
+
+import (
+	"net/netip"
+	"strings"
+)
+
+var iFaceDiscover IFaceDiscover
+
+type IFaceDiscover interface {
+	IFaces() (string, error)
+}
+
+// SetIFaceDiscover configures the Android interface discovery provider.
+func SetIFaceDiscover(discover IFaceDiscover) {
+	iFaceDiscover = discover
+}
+
+func networkAddresses() ([]NetworkAddress, error) {
+	if iFaceDiscover == nil {
+		return nil, nil
+	}
+	ifaces, err := iFaceDiscover.IFaces()
+	if err != nil {
+		return nil, err
+	}
+
+	var netAddresses []NetworkAddress
+	for _, line := range strings.Split(ifaces, "\n") {
+		addresses, ok := interfaceAddresses(line)
+		if !ok {
+			continue
+		}
+		for _, address := range addresses {
+			netAddr, ok := toNetworkAddress(address)
+			if !ok {
+				continue
+			}
+			if isDuplicated(netAddresses, netAddr) {
+				continue
+			}
+			netAddresses = append(netAddresses, netAddr)
+		}
+	}
+	return netAddresses, nil
+}
+
+func interfaceAddresses(line string) ([]string, bool) {
+	parts := strings.Split(line, "|")
+	if len(parts) != 2 {
+		return nil, false
+	}
+	flags := strings.Fields(parts[0])
+	if len(flags) != 8 {
+		return nil, false
+	}
+	up, loopback := flags[3], flags[5]
+	if up != "true" || loopback == "true" {
+		return nil, false
+	}
+	return strings.Fields(parts[1]), true
+}
+
+func toNetworkAddress(address string) (NetworkAddress, bool) {
+	prefix, err := netip.ParsePrefix(address)
+	if err != nil {
+		return NetworkAddress{}, false
+	}
+	if prefix.Addr().Is4In6() {
+		if prefix.Bits() < 96 {
+			return NetworkAddress{}, false
+		}
+		prefix = netip.PrefixFrom(prefix.Addr().Unmap(), prefix.Bits()-96)
+	}
+	ip := prefix.Addr()
+	if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsMulticast() {
+		return NetworkAddress{}, false
+	}
+	return NetworkAddress{NetIP: prefix}, true
+}
+
+func isDuplicated(addresses []NetworkAddress, addr NetworkAddress) bool {
+	for _, duplicated := range addresses {
+		if duplicated.NetIP == addr.NetIP {
+			return true
+		}
+	}
+	return false
+}
diff --git a/client/system/network_addr_test.go b/client/system/network_addr_test.go
index a5f9c4279..b0be40f0a 100644
--- a/client/system/network_addr_test.go
+++ b/client/system/network_addr_test.go
@@ -1,4 +1,4 @@
-//go:build !ios
+//go:build !ios && !android
 
 package system