From d1f4e9eb6789163e9049c8653cee45fb82383327 Mon Sep 17 00:00:00 2001
From: M57 <41645758+Hy4ri@users.noreply.github.com>
Date: Sat, 20 Jun 2026 23:17:00 +0300
Subject: [PATCH] fix(#67): restrict cleartext traffic to local subnets and
 Tailscale range (#178)

---
 app/src/main/AndroidManifest.xml              |  2 +-
 .../main/res/xml/network_security_config.xml  | 85 +++++++++++++++++++
 2 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 app/src/main/res/xml/network_security_config.xml

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 60a92754..66c2bb7f 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -14,7 +14,7 @@
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
-        android:usesCleartextTraffic="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:theme="@style/Theme.HermesControl">
         <activity
             android:name=".MainActivity"
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 00000000..f0c9065f
--- /dev/null
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<network-security-config>
+    <!-- Restrict cleartext traffic only to local network hosts and private IP blocks (including Tailscale CGNAT) -->
+    <domain-config cleartextTrafficPermitted="true">
+        <!-- Localhost / Loopback -->
+        <domain includeSubdomains="true">localhost</domain>
+        <domain includeSubdomains="true">127.0.0.1</domain>
+
+        <!-- Private IP Subnets (IPv4 RFC 1918) -->
+        <!-- Class A Private Network: 10.0.0.0 - 10.255.255.255 -->
+        <domain includeSubdomains="true">10.in-addr.arpa</domain>
+        <!-- Class B Private Network: 172.16.0.0 - 172.31.255.255 -->
+        <!-- Class C Private Network: 192.168.0.0 - 192.168.255.255 -->
+        <domain includeSubdomains="true">168.192.in-addr.arpa</domain>
+
+        <!-- Tailscale CGNAT IP Subnet: 100.64.0.0 - 100.127.255.255 -->
+        <domain includeSubdomains="true">64.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">65.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">66.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">67.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">68.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">69.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">70.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">71.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">72.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">73.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">74.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">75.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">76.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">77.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">78.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">79.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">80.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">81.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">82.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">83.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">84.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">85.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">86.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">87.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">88.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">89.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">90.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">91.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">92.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">93.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">94.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">95.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">96.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">97.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">98.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">99.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">100.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">101.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">102.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">103.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">104.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">105.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">106.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">107.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">108.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">109.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">110.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">111.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">112.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">113.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">114.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">115.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">116.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">117.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">118.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">119.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">120.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">121.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">122.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">123.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">124.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">125.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">126.100.in-addr.arpa</domain>
+        <domain includeSubdomains="true">127.100.in-addr.arpa</domain>
+    </domain-config>
+
+    <!-- Fallback default configuration: restrict global cleartext -->
+    <base-config cleartextTrafficPermitted="false" />
+</network-security-config>