Document limitations of the VpnService setHttpProxy API
There is no way to make proxies work on split tunnels in the
current architecture, because only the system knows about
the split tunnels but it's the app that sends requests to
the proxy.
Test: comment-only change
Bug: 185574854
Change-Id: Ica7096c31e5e81373b80ac5eef92d82783a38ed5
diff --git a/core/java/android/net/VpnService.java b/core/java/android/net/VpnService.java
index 1ae1b050d..37bd67a 100644
--- a/core/java/android/net/VpnService.java
+++ b/core/java/android/net/VpnService.java
@@ -537,8 +537,15 @@
}
/**
- * Sets an HTTP proxy for the VPN network. This proxy is only a recommendation
- * and it is possible that some apps will ignore it. PAC proxies are not supported.
+ * Sets an HTTP proxy for the VPN network.
+ * <p class="note">This proxy is only a recommendation and it is possible that some apps
+ * will ignore it.
+ * <p class="note">PAC proxies are not supported over VPNs.
+ * <p class="note">Apps that do use the proxy cannot distinguish between routes handled
+ * and not handled by the VPN and will try to access HTTP resources over the proxy
+ * regardless of the destination. In practice this means using a proxy with a split
+ * tunnel generally won't work as expected, because HTTP accesses on routes not handled by
+ * the VPN will not reach as the proxy won't be available outside of the VPN network.
*/
@NonNull
public Builder setHttpProxy(@NonNull ProxyInfo proxyInfo) {
