diff options
| author | Sreeram Ramachandran <sreeram@google.com> | 2014-07-10 12:35:23 -0700 |
|---|---|---|
| committer | Sreeram Ramachandran <sreeram@google.com> | 2014-07-10 20:59:51 +0000 |
| commit | 1384605a89775dcaae48e8d5f0081143f896a8cb (patch) | |
| tree | 7127a5a24f594c67de792cbc032134ee7279790c /docs/html/sdk/api_diff/16/changes | |
| parent | 5f90bccd96397f23b988c5e668b13f5344fd104b (diff) | |
Update VpnService API documentation.
The goal of blocking an address family by default is to prevent unintended
security holes. For example, a VPN that only deals with IPv4 doesn't know or
care about IPv6 at all, so it doesn't do anything for IPv6. An app shouldn't be
able to get around (bypass) the VPN by using IPv6.
Therefore, it is not necessary to block an address family in removeAddress().
The VPN was clearly aware of the address family (since it had configured such an
address before), so if it wants to block that family, it should add a default
route for that family and explicitly drop/block/reject those packets.
Bug: 15972465
Bug: 15409819
Change-Id: I845426fa90dc2358d3e11bc601db0b4bd5d3b7ac
Diffstat (limited to 'docs/html/sdk/api_diff/16/changes')
0 files changed, 0 insertions, 0 deletions