From 90a77386dc290973558ffa62a68574f94943c2a3 Mon Sep 17 00:00:00 2001
From: iris <2+iris@noreply.localhost>
Date: Fri, 28 Aug 2026 18:19:32 -0400
Subject: [PATCH] Record that the local-network permission survives the tunnel

Android's Local Network Definition says a local network "excludes
cellular (WWAN) or VPN connections", which reads as: an app reaching its
server through WireGuard needs no ACCESS_LOCAL_NETWORK. Both projects
reach their server through WireGuard, so both had a reason to delete it.

Measured on a real device on 2026-08-28: the permission is still
required, and without it the traffic is dropped. The documented exclusion
does not hold for a tun carrying an RFC1918 destination.

The note goes here because this is the one function a person would read
before removing the permission, and because neither project can find this
out for itself -- the API 36 emulator images both are tested against do
not enforce the permission at all, so removing it passes every test
available locally and fails only on the phone.
---
 .../kotlin/com/example/wgapplink/ServerConfig.kt     | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt b/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt
index 582b077..dfbc525 100644
--- a/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt
+++ b/app/src/main/kotlin/com/example/wgapplink/ServerConfig.kt
@@ -147,6 +147,18 @@ class ServerStore(private val scheme: String, private val keyAlias: String) {
  * the OS drops the traffic, so a blocked app and an unreachable server produce the same connect
  * timeout. Without asking explicitly there is no way to tell those apart, and the failure shown
  * would blame the server or the tunnel for something neither is doing.
+ *
+ * **The permission is still required when the server is reached through WireGuard, and the
+ * platform's own documentation says otherwise.** Android's Local Network Definition describes a
+ * local network as one that "utilizes a broadcast-capable network interface, such as Wi-Fi or
+ * Ethernet, but excludes cellular (WWAN) or VPN connections" — read straight, a tunnelled 10.66.0.1
+ * is excluded and needs nothing. Measured on a real device on 2026-08-28: it is not excluded, and
+ * without the permission the traffic is dropped. Do not remove the permission on the strength of
+ * that paragraph.
+ *
+ * **Neither project can catch this in an emulator.** The API 36 images both are tested against do
+ * not enforce the permission at all, so removing it passes every local test and fails only on a
+ * phone. That asymmetry is the reason this note is here rather than in a commit message.
  */
 fun localNetworkAllowed(context: Context): Boolean =
     android.os.Build.VERSION.SDK_INT < 37 ||