Network security config for range of ip addresses?

Question

In Android P, cleartext communication is disabled by default. Instead, there are two options:

One needs to explicitly declare that cleartext communication is allowed in the manifest file with
Or needs to declare the allowed domains that allow cleartext communication via a network security config.

My question has to do with the second approach. I can whitelist a specific ip address like this in network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">192.168.1.1</domain>
    </domain-config>
</network-security-config>

However, I would like to whitelist all private ip addresses. I had a few trial-and-error cases but I wasn't able to make it work.

In essence, is there an option given to define a range of ip addresses in the network security config?

score 3 · Answer 1 · answered Nov 11 '20 at 10:06

Thought you are looking for a way to allow specific range of IP addresses but that seems to be impossible to this time, you can allow all IP addresses and get rid of the error message by making this config:

config.xml

<platform name="android">
...
        <edit-config file="app/src/main/AndroidManifest.xml" mode="merge" target="/manifest/application" xmlns:android="http://schemas.android.com/apk/res/android">
            <application android:networkSecurityConfig="@xml/network_security_config" />
        </edit-config>
        <resource-file src="resources/android/xml/network_security_config.xml" target="app/src/main/res/xml/network_security_config.xml" />
...
</platform>

resources/android/xml/network_security_config.xml

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true" />
</network-security-config>

Note: this answer is specifically for Cordova – Troy Jan 11 '23 at 17:45 — Troy, Jan 11 '23 at 17:45
The config.xml must be in which location? – Alex8752 Mar 16 '23 at 12:07 — Alex8752, Mar 16 '23 at 12:07

score 2 · Answer 2 · answered Nov 15 '18 at 12:01

2

No, sorry.

In fact, I suspect that supporting <domain includeSubdomains="true">192.168.1.1</domain> is accidental and may not prove reliable over time, if they start to think that <domain> refers to actual domain names and not arbitrary host values, such as IP addresses.

answered Nov 15 '18 at 12:01

CommonsWare

986,068
189
2,389
2,491

Thank you for your answer! If I may ask, how did you arrive at that conclusion? Did you see something at the source code,by trial and error or just by the semantical meaning and android docs? – user10293922 Nov 16 '18 at 08:50
@user10293922: I ported the network security configuration code to a standalone library that works back to Android 4.2. That being said, my statement is based more on the semantical meaning and Android docs. – CommonsWare Nov 16 '18 at 12:06

score 2 · Answer 3 · answered Sep 06 '20 at 06:09

For getting the IP of your machine, there is a solution

This is my network config file at res/xml:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">
            <!-- YOUR LOCAL IP -->
        </domain>
    </domain-config>
</network-security-config>

This is the code at my gradle:

static def getLocalIP() {
    def ip4s = []
    NetworkInterface.getNetworkInterfaces()
        .findAll { it.isUp() && !it.isLoopback() && !it.isVirtual() }
        .each {
            if (it.name.startsWith("wlan")) {
                it.getInetAddresses()
                    .findAll { !it.isLoopbackAddress() && it instanceof Inet4Address }
                    .each { ip4s << it }
            }
        }
    return ip4s.first().toString().substring(1)
}

task ipNetwork(type: Copy) {
    from ('src/main/res/xml/network_security_config.xml')
    into ('src/debug/res/xml')
    filter {
        String line -> line.replaceAll("<!-- YOUR LOCAL IP -->", getLocalIP())
    }
}

This changes just the debug file, so it's useful to point your debug app to local machine. The script could be adapted to generate a bunch of domain tags to each variation of IP. This was my first thought, add a domain for every 192.168.., but it would result in a file with 65536 domains, it seems a little bit awful

Network security config for range of ip addresses?

3 Answers3