Clarify SNI research-mode IP-leak warning accounts for remote routing - #687
Merged
Conversation
The SNI research-mode warning previously implied it always exposes the user's real IP to tracker servers. In fact SNI is parsed locally, from traffic already passing through the same block/allow decision used for every other packet, before that packet is dispatched to any egress path. When remote routing (WireGuard) is enabled, the resulting connection to the tracker goes out through the tunnel, so only the VPN provider's IP is exposed. Clarify this in the README, the in-app settings summary, and AGENTS.md's privacy rationale, per the discussion in #685.
kasnder
marked this pull request as ready for review
July 28, 2026 07:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #685. Verified in the native packet path (
app/src/main/jni/netguard/ip.c,handle_ip()) that SNI research-mode extraction runs as part of the same local block/allow decision applied to every packet, before that packet is dispatched to any egress path (direct, SOCKS5, or the WireGuard bridge). This means the existing "leaks your IP address to tracker servers" warnings were correct for direct routing but overstated for the case where remote routing (WireGuard) is also enabled — in that case only the VPN provider's IP is exposed to the tracker, not the device's real IP.This PR is documentation/strings only, no behavior change:
README.md: clarify the SNI paragraph in "Example Use" to note the local-parsing + remote-routing interaction.app/src/main/res/values/strings.xml: add a short parenthetical tosummary_sni_enabled(the in-app settings toggle description).AGENTS.md: expand the privacy-preserving-by-construction rationale (§4.2) with thehandle_ip()ordering detail, so future triage doesn't repeat the "SNI isn't supported with WireGuard" assumption from Research Mode Remote Routing IP #685.Test plan
ip.cbehavior.Generated by Claude Code