|
2 | 2 | // SPDX-License-Identifier: BSD-3-Clause |
3 | 3 | package com.tailscale.ipn |
4 | 4 |
|
| 5 | +import android.content.Context |
5 | 6 | import android.net.ConnectivityManager |
6 | 7 | import android.net.LinkProperties |
7 | 8 | import android.net.Network |
8 | 9 | import android.net.NetworkCapabilities |
9 | 10 | import android.net.NetworkRequest |
| 11 | +import android.net.wifi.WifiInfo |
| 12 | +import android.net.wifi.WifiManager |
| 13 | +import android.os.Build |
10 | 14 | import android.util.Log |
| 15 | +import androidx.work.ExistingWorkPolicy |
| 16 | +import androidx.work.OneTimeWorkRequest |
| 17 | +import androidx.work.WorkManager |
11 | 18 | import com.tailscale.ipn.util.TSLog |
12 | 19 | import java.util.concurrent.locks.ReentrantLock |
13 | 20 | import kotlin.concurrent.withLock |
@@ -37,6 +44,22 @@ object NetworkChangeCallback { |
37 | 44 | var cachedDefaultInterfaceName: String? = null |
38 | 45 | private set |
39 | 46 |
|
| 47 | + // Networks where we auto-started VPN (blacklist or defaultOn). Tracked to auto-stop on leave. |
| 48 | + private val startedForNetworks = mutableMapOf<Network, String>() |
| 49 | + |
| 50 | + // Networks where we auto-stopped VPN (whitelist). Tracked to restart VPN on leave if defaultOn. |
| 51 | + private val stoppedForNetworks = mutableMapOf<Network, String>() |
| 52 | + |
| 53 | + // User manually stopped VPN on a blacklist/defaultOn network → suppress re-auto-start. |
| 54 | + private val userStoppedOnNetworks = mutableSetOf<Network>() |
| 55 | + |
| 56 | + // User manually started VPN on a whitelist network → suppress auto-stop. |
| 57 | + private val userStartedOnWhitelist = mutableSetOf<Network>() |
| 58 | + |
| 59 | + // Stored for checkExistingNetworks(). |
| 60 | + private var wifiAutoConnectivity: ConnectivityManager? = null |
| 61 | + private var wifiAutoConnectApp: UninitializedApp? = null |
| 62 | + |
40 | 63 | // monitorDnsChanges sets up a network callback to monitor changes to the |
41 | 64 | // system's network state and update the DNS configuration when interfaces |
42 | 65 | // become available or properties of those interfaces change. |
@@ -208,4 +231,146 @@ object NetworkChangeCallback { |
208 | 231 | Libtailscale.onDNSConfigChanged(info.linkProps.interfaceName) |
209 | 232 | } |
210 | 233 | } |
| 234 | + |
| 235 | + // userStoppedVpn: user manually stopped VPN → suppress re-auto-start on current networks. |
| 236 | + fun userStoppedVpn() { |
| 237 | + lock.withLock { userStoppedOnNetworks.addAll(startedForNetworks.keys) } |
| 238 | + } |
| 239 | + |
| 240 | + // userStartedVpn: user manually started VPN → suppress auto-stop on whitelist networks. |
| 241 | + fun userStartedVpn() { |
| 242 | + lock.withLock { userStartedOnWhitelist.addAll(stoppedForNetworks.keys) } |
| 243 | + } |
| 244 | + |
| 245 | + // monitorWifiAutoConnect registers a callback to auto-start the VPN on trusted SSIDs and |
| 246 | + // auto-stop it when leaving those networks. |
| 247 | + fun monitorWifiAutoConnect(connectivityManager: ConnectivityManager, app: UninitializedApp) { |
| 248 | + wifiAutoConnectivity = connectivityManager |
| 249 | + wifiAutoConnectApp = app |
| 250 | + val request = |
| 251 | + NetworkRequest.Builder() |
| 252 | + .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET) |
| 253 | + .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN) |
| 254 | + .build() |
| 255 | + |
| 256 | + connectivityManager.registerNetworkCallback( |
| 257 | + request, |
| 258 | + object : ConnectivityManager.NetworkCallback() { |
| 259 | + override fun onCapabilitiesChanged( |
| 260 | + network: Network, |
| 261 | + capabilities: NetworkCapabilities |
| 262 | + ) { |
| 263 | + super.onCapabilitiesChanged(network, capabilities) |
| 264 | + if (!capabilities.hasTransport(NetworkCapabilities.TRANSPORT_WIFI)) return |
| 265 | + val ssid = getSsid(capabilities, app) ?: return |
| 266 | + lock.withLock { |
| 267 | + val whitelist = app.getWhitelistSsids() |
| 268 | + val blacklist = app.getBlacklistSsids() |
| 269 | + val defaultOn = app.getWifiAutoConnectDefaultOn() |
| 270 | + val isWhitelisted = whitelist.contains(ssid) |
| 271 | + val isBlacklisted = blacklist.contains(ssid) |
| 272 | + TSLog.d(TAG, "wifi: ssid=$ssid whitelist=$whitelist blacklist=$blacklist defaultOn=$defaultOn") |
| 273 | + when { |
| 274 | + isWhitelisted -> { |
| 275 | + if (network in userStartedOnWhitelist) return@withLock |
| 276 | + if (network in stoppedForNetworks) return@withLock |
| 277 | + TSLog.d(TAG, "wifi: whitelist → stopping VPN") |
| 278 | + stoppedForNetworks[network] = ssid |
| 279 | + app.stopVPN() |
| 280 | + } |
| 281 | + isBlacklisted || defaultOn -> { |
| 282 | + if (network in userStoppedOnNetworks) return@withLock |
| 283 | + if (network in startedForNetworks) return@withLock |
| 284 | + if (!app.isAbleToStartVPN()) return@withLock |
| 285 | + TSLog.d(TAG, "wifi: ${if (isBlacklisted) "blacklist" else "defaultOn"} → starting VPN") |
| 286 | + startedForNetworks[network] = ssid |
| 287 | + val req = OneTimeWorkRequest.Builder(StartVPNWorker::class.java).build() |
| 288 | + WorkManager.getInstance(app).enqueueUniqueWork( |
| 289 | + "wifi_auto_connect", ExistingWorkPolicy.KEEP, req) |
| 290 | + } |
| 291 | + else -> TSLog.d(TAG, "wifi: unknown network, defaultOn=false → no action") |
| 292 | + } |
| 293 | + } |
| 294 | + } |
| 295 | + |
| 296 | + override fun onLost(network: Network) { |
| 297 | + super.onLost(network) |
| 298 | + lock.withLock { |
| 299 | + val startedSsid = startedForNetworks.remove(network) |
| 300 | + val stoppedSsid = stoppedForNetworks.remove(network) |
| 301 | + userStoppedOnNetworks.remove(network) |
| 302 | + userStartedOnWhitelist.remove(network) |
| 303 | + if (startedSsid != null) { |
| 304 | + TSLog.d(TAG, "wifi: left blacklist/defaultOn network $startedSsid → stopping VPN") |
| 305 | + app.stopVPN() |
| 306 | + } |
| 307 | + if (stoppedSsid != null && app.getWifiAutoConnectDefaultOn()) { |
| 308 | + TSLog.d(TAG, "wifi: left whitelist network $stoppedSsid, defaultOn=true → starting VPN") |
| 309 | + val req = OneTimeWorkRequest.Builder(StartVPNWorker::class.java).build() |
| 310 | + WorkManager.getInstance(app).enqueueUniqueWork( |
| 311 | + "wifi_auto_connect", ExistingWorkPolicy.KEEP, req) |
| 312 | + } |
| 313 | + } |
| 314 | + } |
| 315 | + }) |
| 316 | + } |
| 317 | + |
| 318 | + // checkExistingNetworks re-evaluates all active WiFi networks against current lists. |
| 319 | + // Call when whitelist, blacklist, or defaultOn setting changes. |
| 320 | + fun checkExistingNetworks() { |
| 321 | + wifiAutoConnectivity ?: return |
| 322 | + val app = wifiAutoConnectApp ?: return |
| 323 | + lock.withLock { |
| 324 | + val whitelist = app.getWhitelistSsids() |
| 325 | + val blacklist = app.getBlacklistSsids() |
| 326 | + val defaultOn = app.getWifiAutoConnectDefaultOn() |
| 327 | + for ((network, info) in activeNetworks) { |
| 328 | + if (!info.caps.hasTransport(NetworkCapabilities.TRANSPORT_WIFI)) continue |
| 329 | + val ssid = getSsidFromCaps(info.caps, app) ?: continue |
| 330 | + val isWhitelisted = whitelist.contains(ssid) |
| 331 | + val isBlacklisted = blacklist.contains(ssid) |
| 332 | + when { |
| 333 | + isWhitelisted -> { |
| 334 | + if (network in userStartedOnWhitelist) continue |
| 335 | + if (network in stoppedForNetworks) continue |
| 336 | + stoppedForNetworks[network] = ssid |
| 337 | + app.stopVPN() |
| 338 | + } |
| 339 | + isBlacklisted || defaultOn -> { |
| 340 | + if (network in userStoppedOnNetworks) continue |
| 341 | + if (network in startedForNetworks) continue |
| 342 | + if (!app.isAbleToStartVPN()) continue |
| 343 | + startedForNetworks[network] = ssid |
| 344 | + val req = OneTimeWorkRequest.Builder(StartVPNWorker::class.java).build() |
| 345 | + WorkManager.getInstance(app).enqueueUniqueWork( |
| 346 | + "wifi_auto_connect", ExistingWorkPolicy.KEEP, req) |
| 347 | + } |
| 348 | + } |
| 349 | + } |
| 350 | + } |
| 351 | + } |
| 352 | + |
| 353 | + private fun getSsid(capabilities: NetworkCapabilities, app: UninitializedApp): String? = |
| 354 | + getSsidFromCaps(capabilities, app) |
| 355 | + |
| 356 | + private fun getSsidFromCaps(capabilities: NetworkCapabilities, app: UninitializedApp): String? { |
| 357 | + // Try transportInfo first (preferred on API 29+, no location perm needed on API 31+). |
| 358 | + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) { |
| 359 | + val fromTransport = |
| 360 | + (capabilities.transportInfo as? WifiInfo) |
| 361 | + ?.ssid |
| 362 | + ?.removePrefix("\"") |
| 363 | + ?.removeSuffix("\"") |
| 364 | + ?.takeIf { it.isNotEmpty() && it != "<unknown ssid>" } |
| 365 | + if (fromTransport != null) return fromTransport |
| 366 | + } |
| 367 | + // Fallback: WifiManager (works if ACCESS_FINE_LOCATION or NEARBY_WIFI_DEVICES is granted). |
| 368 | + @Suppress("DEPRECATION") |
| 369 | + return (app.getSystemService(Context.WIFI_SERVICE) as? WifiManager) |
| 370 | + ?.connectionInfo |
| 371 | + ?.ssid |
| 372 | + ?.removePrefix("\"") |
| 373 | + ?.removeSuffix("\"") |
| 374 | + ?.takeIf { it.isNotEmpty() && it != "<unknown ssid>" } |
| 375 | + } |
211 | 376 | } |
0 commit comments