Android 11 local discovery not working

[webeule]

Description of the issue

Local discovery does not work. When I turn on global discorvery it is just working. I also used Wireshark to check multicast messages and cannot see them for the device running synthing-android. For the other device I can see them. I also added another device connected to the same Wifi, that is also working.

Reproducer

Setup

• Rock64 SBC on LAN (working)
• Android phone in Wifi (not working)
• Windows 10 laptop in Wifi (working)
• Fritzbos 7590 as router

Version Information

App Version: 1.12.0.
Syncthing Version: v1.12.0
Android Version: Android 11
Device manufacturer: Google
Device model: Pixel 4a

Device platform info

adb shell "getprop | grep ro.product"

Android Log

adb logcat v
or MatLog (search on GitHub) output

Here some logs directly from Syncthing, do not know if it helps:

2020-12-29 11:44:31 Enabled debug data for "beacon"
2020-12-29 11:44:33 route ip+net: netlinkrib: permission denied
2020-12-29 11:44:33 Stopped broadcastBeacon writer: route ip+net: netlinkrib: permission denied
2020-12-29 11:44:33 broadcastBeacon: Failed service 'Service@0x40000d66c0 created by broadcastBeacon@0x4000138230/writer' (1.999843 failures of 2.000000), restarting: true, error: "{Service@0x40000d66c0 created by broadcastBeacon@0x4000138230/writer Service@0x40000d66c0 created by broadcastBeacon@0x4000138230/writer} returned unexpectedly", stacktrace: [unknown stack trace]
2020-12-29 11:44:33 Starting broadcastBeacon writer
2020-12-29 11:45:03 route ip+net: netlinkrib: permission denied
2020-12-29 11:45:03 Stopped broadcastBeacon writer: route ip+net: netlinkrib: permission denied
2020-12-29 11:45:03 broadcastBeacon: Failed service 'Service@0x40000d66c0 created by broadcastBeacon@0x4000138230/writer' (1.999810 failures of 2.000000), restarting: true, error: "{Service@0x40000d66c0 created by broadcastBeacon@0x4000138230/writer Service@0x40000d66c0 created by broadcastBeacon@0x4000138230/writer} returned unexpectedly", stacktrace: [unknown stack trace]
2020-12-29 11:45:03 Starting broadcastBeacon writer
2020-12-29 11:45:31 Exiting backoff state.
2020-12-29 11:45:31 Starting multicastBeacon writer
2020-12-29 11:45:31 Starting multicastBeacon reader
2020-12-29 11:45:31 route ip+net: netlinkrib: permission denied
2020-12-29 11:45:31 Stopped multicastBeacon writer: route ip+net: netlinkrib: permission denied
2020-12-29 11:45:31 multicastBeacon: Failed service 'Service@0x40000d6d80 created by multicastBeacon@0x40001382d0/writer' (1.000000 failures of 2.000000), restarting: true, error: "{Service@0x40000d6d80 created by

[Catfriend1]

Hi,

it seems the beacon cannot be sent out, but I don't know if it's an Android 11 restriction yet that wasn't there before?! If this doesn't apply, please file a topic at forum.syncthing.net with the beacon log and let's hope devs see a bug there or can point us in the right direction. Btw do you have a firewall on the device?

[webeule]

Ok, I created a topic in the syncthing forum: Link
I have not installed any firewall by myself and as far as I know, there is also no default firewall on Android.

[Catfriend1]

Continued in forum.

[gsauthof]

I get the similar errors on Android 11 (on a Pixel 3a) - and other devices can't be connected/aren't discovered. In contrast to the initial report, my log also shows some SELinux AVC denied messages for bind.

Is there a way to restrict syncthing to IPv6? Perhaps Android just denies broadcasts but would allow multicast?

[gsauthof]

Some AVCs via adb logcat:

02-06 21:03:03.275 15405 17969 W SyncthingNativeCode: 2021/02/06 20:03:03 broadcastBeacon: Failed service 'Service@0x40001447c0 created by broadcastBeacon@0x4000126730/writer' (1.999465 failures of 2.000000), restarting: true, error: route ip+net: netlinkrib: permission denied
02-06 21:03:03.267 17967 17967 W libsyncthingnat: type=1400 audit(0.0:6462): avc: denied { bind } for scontext=u:r:untrusted_app:s0:c51,c257,c512,c768 tcontext=u:r:untrusted_app:s0:c51,c257,c512,c768 tclass=netlink_route_socket permissive=0 b/155595000 app=com.github.catfriend1.syncthingandroid
02-06 21:03:03.271 17967 17967 W libsyncthingnat: type=1400 audit(0.0:6463): avc: denied { bind } for scontext=u:r:untrusted_app:s0:c51,c257,c512,c768 tcontext=u:r:untrusted_app:s0:c51,c257,c512,c768 tclass=netlink_route_socket permissive=0 b/155595000 app=com.github.catfriend1.syncthingandroid

I've also tried the other Syncthing Android client (on the same device) and there this error doesn't show up. I can even connect the device to another Linux host on the local network then.

[Catfriend1]

Continued in forum.

[gsauthof]

Continued in forum.

Yeah, although the linked thread was closed 10 days ago without much of a conclusion.

[Catfriend1]

Please ask a moderator to reopen.

[DrSchnagels]

I updated my OnePlus 7t Pro yesterday to Android 11. Suddenly I have this problem too :(.
Later when Im home I'll try to reopen the other forums topic.

[bt90]

Related? golang/go#40569

[Catfriend1]

Yeah, 11 blocks a lot things

[bt90]

https://android.googlesource.com/platform/bionic/+/95ca52a7d69f3bdb0df1b2f4d488f83a24e56e10

Looks like they switched to a whitelist?

https://developer.android.com/training/articles/user-data-ids#mac-11-plus

[Iey4iej3]

Mine does not work either under LineageOS 18.1. I don't see beacon thing in the log but I find the following in the logcat:

04-18 01:17:44.937  3251  3251 W libsyncthingnat: type=1400 audit(0.0:892): avc: denied { bind } for scontext=u:r:untrusted_app:s0:c97,c256,c512,c768 tcontext=u:r:untrusted_app:s0:c97,c256,c512,c768 tclass=netlink_route_socket permissive=0 b/155595000 app=com.github.catfriend1.syncthingandroid
04-18 01:17:44.937  3251  3251 I chatty  : uid=10097(com.github.catfriend1.syncthingandroid) libsyncthingnat identical 1 line
04-18 01:17:44.937  3251  3251 W libsyncthingnat: type=1400 audit(0.0:894): avc: denied { bind } for scontext=u:r:untrusted_app:s0:c97,c256,c512,c768 tcontext=u:r:untrusted_app:s0:c97,c256,c512,c768 tclass=netlink_route_socket permissive=0 b/155595000 app=com.github.catfriend1.syncthingandroid

I wonder whether it is the same issue?

[Catfriend1]

Maybe explicitly setting http://androidpermissions.com/permission/android.permission.CHANGE_WIFI_MULTICAST_STATE and acquiring the multicast lock might help discovery? If anyone who has an Android 11 device could test that?!

[bt90]

That's the SELinux policy for SDK 30 which blocks binding to a netlink_route_socket as described in golang/go#40569 (comment)

The only possible workaround would be to let the wrapper handle IP address discovery using the Android framework and e.g set it via the REST API.

Edit: i think the issue can be tagged with android restriction because upstream won't be able to fix this :/