android: Apply split tunneling options when creating TUN device

Android blocks traffic for address families for which no IPs, DNS servers
or routes are installed via VpnService.Builder.  Since Android 5+ (API
level 21) it is possible to explicitly allow such traffic to bypass the VPN.

So for proper split tunneling we note whether we saw a VIP and/or DNS
server of a specific family, and if not, allow traffic of that family
to bypass the VPN using the new API (on older systems there is no change
and such traffic will still be blocked).  Otherwise, we do what we did so
far, that is, simply install the received routes (traffic selectors), all
other traffic will not be directed to the TUN device and use the underlying
network instead.

If traffic for a family should be blocked we install a default route via
TUN device even if we received more specific traffic selectors from the
server.  libipsec will use the actual traffic selectors as IPsec policies
and drop any packets it received that don't match them.  We only do this
if we saw any VIPs or DNS servers of a family.  Otherwise the traffic for
that family is blocked anyway.

0 files changed, 0 insertions, 0 deletions