VPN-6523: Fix Android LAN exclusions #9757
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
oskirby
force-pushed
the
vpn-6523-fix-android-lan-exclusions
branch
from
7913e85 to
b6c3b51
Compare
oskirby
commented
Aug 1, 2024
| const auto localRoutes = Controller::getExcludedIPAddressRanges().flatten(); | ||
| const auto fullAllowedIPs = | ||
| IPAddress::excludeAddresses(config.m_allowedIPAddressRanges, localRoutes); | ||
| // This could be done better with VpnService.Builder.excludeRoute() |
There was a problem hiding this comment.
I actually went down the rabbit hole of implementing this with VpnService.Builder.excludeRoute() and it worked great, and only afterwards did I realize that it requires a higher API level than we ship with. So this implementation here is just crudely working around the issue, but in a way that doesn't require a change to our minimum Android version.
strseb
approved these changes
Aug 1, 2024
mcleinman
approved these changes
Aug 1, 2024
oskirby
added a commit
that referenced
this pull request
Aug 1, 2024
5 tasks
oskirby
added a commit
that referenced
this pull request
Aug 6, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
In PR #9674 we tried to improve the LAN exclusion implementation for Windows and Linux. However, this introduced a bug in Android where the LAN exclusion calculation would cause routes to the internal Mulvad network to get lost. This causes the VPN's connectivity checks to fail, and results in the client entering the
No Signalstate shortly after connecting.The cause of the bug is that
IPAddress::excludeAddresses()doesn't handle routes nested inside an excluded route. For example,excludeAddresses({"0.0.0.0/0", "10.64.0.1/32"},{"10.0.0.0/8"})will ignore the route to10.64.0.1because it is excluded by10.0.0.0/8despite having a longer prefix length.Reference
JIRA issue: VPN-6523
Previous PR: #9674
Checklist