security: require mixed inbound auth whenever exposed to LAN (#4)

The mixed inbound binds to 0.0.0.0 when allowAccess is enabled (in both VPN
and Proxy modes), but authentication was only applied in VPN mode and was
dropped entirely when appendHttpProxy was active on Android Q+. That left an
unauthenticated open proxy reachable from the LAN.

- mixedInboundNeedsAuth now requires auth whenever allowAccess is set,
  regardless of service mode or appendHttpProxy.
- Loopback-only behavior is unchanged (appendHttpProxy still works).
- When allowAccess and appendHttpProxy are both on (Q+), skip
  VpnService.setHttpProxy, since Android's system HTTP proxy cannot supply
  credentials; log a note explaining why.

Author: hawkff

app/src/main/java/io/nekohasekai/sagernet/bg/VpnService.kt

@@ -189,7 +189,18 @@ class VpnService : BaseVpnService(),
         }
 
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q && DataStore.appendHttpProxy) {
-            builder.setHttpProxy(ProxyInfo.buildDirectProxy(LOCALHOST, DataStore.mixedPort))
+            if (DataStore.allowAccess) {
+                // When LAN access is enabled the mixed inbound requires authentication
+                // (see DataStore.mixedInboundNeedsAuth). Android's system HTTP proxy
+                // cannot supply credentials, so registering it here would just fail.
+                // Skip it instead of weakening inbound auth and exposing an open LAN proxy.
+                Logs.w(
+                    "Append HTTP proxy was skipped because LAN access requires proxy " +
+                        "authentication. Disable Allow LAN access to use system HTTP proxy."
+                )
+            } else {
+                builder.setHttpProxy(ProxyInfo.buildDirectProxy(LOCALHOST, DataStore.mixedPort))
+            }
         }
 
         metered = DataStore.meteredNetwork

app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt

@@ -153,8 +153,16 @@ object DataStore : OnPreferenceDataStoreChangeListener {
         set(value) = saveLocalPort(Key.MIXED_PORT, value)
 
     val mixedInboundNeedsAuth: Boolean
-        get() = serviceMode == Key.MODE_VPN &&
-            !(appendHttpProxy && Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+        get() =
+            // When the inbound is exposed to the LAN (bind 0.0.0.0 via allowAccess),
+            // authentication is mandatory so the proxy is never an open relay. This
+            // holds in both VPN and Proxy service modes and overrides appendHttpProxy.
+            allowAccess ||
+                // Loopback-only inbound: keep the prior behavior. In VPN mode the
+                // inbound is authenticated, except when appendHttpProxy is active on
+                // Android Q+ (the system HTTP proxy cannot supply credentials).
+                (serviceMode == Key.MODE_VPN &&
+                    !(appendHttpProxy && Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q))
 
     val mixedInboundUser: String get() = if (mixedInboundAuthed) Key.MIXED_USERNAME else ""
     val mixedInboundPass: String get() = if (mixedInboundAuthed) mixedSecret else ""