ui,tunnel: add HTTP proxy setting to Go backend

Only make the HTTP proxy settings visible on supported Android versions,
i.e. Android 10 (AKA Android Q) and later.

Signed-off-by: Mikael Magnusson <mikma@users.sourceforge.net>

11 files changed, 372 insertions, 10 deletions

diff --git a/tunnel/src/main/java/com/wireguard/android/backend/GoBackend.java b/tunnel/src/main/java/com/wireguard/android/backend/GoBackend.java
index 429cb1f1..242f81d8 100644
--- a/tunnel/src/main/java/com/wireguard/android/backend/GoBackend.java
+++ b/tunnel/src/main/java/com/wireguard/android/backend/GoBackend.java
@@ -7,6 +7,7 @@ package com.wireguard.android.backend;
 
 import android.content.Context;
 import android.content.Intent;
+import android.net.ProxyInfo;
 import android.os.Build;
 import android.os.ParcelFileDescriptor;
 import android.system.OsConstants;
@@ -24,6 +25,7 @@ import com.wireguard.crypto.KeyFormatException;
 import com.wireguard.util.NonNullForAll;
 
 import java.net.InetAddress;
+import java.net.URL;
 import java.time.Instant;
 import java.util.Collections;
 import java.util.Set;
@@ -318,6 +320,10 @@ public final class GoBackend implements Backend {
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M)
                 service.setUnderlyingNetworks(null);
 
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                config.getInterface().getHttpProxy().ifPresent(pi -> builder.setHttpProxy(pi.getProxyInfo()));
+            }
+
             builder.setBlocking(true);
             try (final ParcelFileDescriptor tun = builder.establish()) {
                 if (tun == null)
diff --git a/tunnel/src/main/java/com/wireguard/config/BadConfigException.java b/tunnel/src/main/java/com/wireguard/config/BadConfigException.java
index db022e14..0d41cc05 100644
--- a/tunnel/src/main/java/com/wireguard/config/BadConfigException.java
+++ b/tunnel/src/main/java/com/wireguard/config/BadConfigException.java
@@ -8,6 +8,8 @@ package com.wireguard.config;
 import com.wireguard.crypto.KeyFormatException;
 import com.wireguard.util.NonNullForAll;
 
+import java.net.MalformedURLException;
+
 import androidx.annotation.Nullable;
 
 @NonNullForAll
@@ -44,6 +46,12 @@ public class BadConfigException extends Exception {
     }
 
     public BadConfigException(final Section section, final Location location,
+                              @Nullable final CharSequence text,
+                              final MalformedURLException cause) {
+        this(section, location, Reason.INVALID_VALUE, text, cause);
+    }
+
+    public BadConfigException(final Section section, final Location location,
                               final ParseException cause) {
         this(section, location, Reason.INVALID_VALUE, cause.getText(), cause);
     }
@@ -73,6 +81,7 @@ public class BadConfigException extends Exception {
         ENDPOINT("Endpoint"),
         EXCLUDED_APPLICATIONS("ExcludedApplications"),
         INCLUDED_APPLICATIONS("IncludedApplications"),
+        HTTP_PROXY("HttpProxy"),
         LISTEN_PORT("ListenPort"),
         MTU("MTU"),
         PERSISTENT_KEEPALIVE("PersistentKeepalive"),
diff --git a/tunnel/src/main/java/com/wireguard/config/HttpProxy.java b/tunnel/src/main/java/com/wireguard/config/HttpProxy.java
new file mode 100644
index 00000000..0a9d19f6
--- /dev/null
+++ b/tunnel/src/main/java/com/wireguard/config/HttpProxy.java
@@ -0,0 +1,78 @@
+/*
+ * Copyright © 2023 WireGuard LLC. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package com.wireguard.config;
+
+import com.wireguard.config.BadConfigException.Location;
+import com.wireguard.config.BadConfigException.Section;
+import com.wireguard.util.NonNullForAll;
+
+import java.net.MalformedURLException;
+import java.net.URL;
+
+import android.net.ProxyInfo;
+import android.net.Uri;
+
+@NonNullForAll
+public final class HttpProxy {
+    public static final int DEFAULT_PROXY_PORT = 8080;
+
+    private ProxyInfo pi;
+
+    protected HttpProxy(ProxyInfo pi) {
+        this.pi = pi;
+    }
+
+    public ProxyInfo getProxyInfo() {
+        return pi;
+    }
+
+    public String getHost() {
+        return pi.getHost();
+    }
+
+    public Uri getPacFileUrl() {
+        return pi.getPacFileUrl();
+    }
+
+    public int getPort() {
+        return pi.getPort();
+    }
+
+    public static HttpProxy parse(final String httpProxy) throws BadConfigException {
+        try {
+            if (httpProxy.startsWith("pac:")) {
+                return new HttpProxy(ProxyInfo.buildPacProxy(Uri.parse(httpProxy.substring(4))));
+            } else {
+                final String urlStr;
+                if (!httpProxy.contains("://")) {
+                    urlStr = "http://" + httpProxy;
+                } else {
+                    urlStr = httpProxy;
+                }
+                URL url = new URL(urlStr);
+                return new HttpProxy(ProxyInfo.buildDirectProxy(url.getHost(), url.getPort() <= 0 ? DEFAULT_PROXY_PORT : url.getPort()));
+            }
+        } catch (final MalformedURLException e) {
+            throw new BadConfigException(Section.INTERFACE, Location.HTTP_PROXY, httpProxy, e);
+        }
+    }
+
+    @Override
+    public String toString() {
+        final StringBuilder sb = new StringBuilder();
+        if (pi.getPacFileUrl() != null && pi.getPacFileUrl() != Uri.EMPTY)
+            sb.append("pac:").append(pi.getPacFileUrl());
+        else {
+            sb.append("http://").append(pi.getHost()).append(':');
+            if (pi.getPort() <= 0)
+                sb.append(DEFAULT_PROXY_PORT);
+            else
+                sb.append(pi.getPort());
+        }
+
+        return sb.toString();
+    }
+}
diff --git a/tunnel/src/main/java/com/wireguard/config/Interface.java b/tunnel/src/main/java/com/wireguard/config/Interface.java
index bebca2e5..e47e0be3 100644
--- a/tunnel/src/main/java/com/wireguard/config/Interface.java
+++ b/tunnel/src/main/java/com/wireguard/config/Interface.java
@@ -46,6 +46,7 @@ public final class Interface {
     private final KeyPair keyPair;
     private final Optional<Integer> listenPort;
     private final Optional<Integer> mtu;
+    private final Optional<HttpProxy> httpProxy;
 
     private Interface(final Builder builder) {
         // Defensively copy to ensure immutability even if the Builder is reused.
@@ -57,6 +58,7 @@ public final class Interface {
         keyPair = Objects.requireNonNull(builder.keyPair, "Interfaces must have a private key");
         listenPort = builder.listenPort;
         mtu = builder.mtu;
+        httpProxy = builder.httpProxy;
     }
 
     /**
@@ -92,6 +94,9 @@ public final class Interface {
                 case "mtu":
                     builder.parseMtu(attribute.getValue());
                     break;
+                case "httpproxy":
+                    builder.parseHttpProxy(attribute.getValue());
+                    break;
                 case "privatekey":
                     builder.parsePrivateKey(attribute.getValue());
                     break;
@@ -115,7 +120,8 @@ public final class Interface {
                 && includedApplications.equals(other.includedApplications)
                 && keyPair.equals(other.keyPair)
                 && listenPort.equals(other.listenPort)
-                && mtu.equals(other.mtu);
+                && mtu.equals(other.mtu)
+                && httpProxy.equals(other.httpProxy);
     }
 
     /**
@@ -195,6 +201,15 @@ public final class Interface {
         return mtu;
     }
 
+    /**
+     * Returns the HTTP proxy used for the WireGuard interface.
+     *
+     * @return the HTTP proxy, or {@code Optional.empty()} if none is configured
+     */
+    public Optional<HttpProxy> getHttpProxy() {
+        return httpProxy;
+    }
+
     @Override
     public int hashCode() {
         int hash = 1;
@@ -205,6 +220,7 @@ public final class Interface {
         hash = 31 * hash + keyPair.hashCode();
         hash = 31 * hash + listenPort.hashCode();
         hash = 31 * hash + mtu.hashCode();
+        hash = 31 * hash + httpProxy.hashCode();
         return hash;
     }
 
@@ -244,6 +260,7 @@ public final class Interface {
             sb.append("IncludedApplications = ").append(Attribute.join(includedApplications)).append('\n');
         listenPort.ifPresent(lp -> sb.append("ListenPort = ").append(lp).append('\n'));
         mtu.ifPresent(m -> sb.append("MTU = ").append(m).append('\n'));
+        httpProxy.ifPresent(p -> sb.append("HttpProxy = ").append(p).append('\n'));
         sb.append("PrivateKey = ").append(keyPair.getPrivateKey().toBase64()).append('\n');
         return sb.toString();
     }
@@ -279,6 +296,8 @@ public final class Interface {
         private Optional<Integer> listenPort = Optional.empty();
         // Defaults to not present.
         private Optional<Integer> mtu = Optional.empty();
+        // Defaults to not present.
+        private Optional<HttpProxy> httpProxy = Optional.empty();
 
         public Builder addAddress(final InetNetwork address) {
             addresses.add(address);
@@ -391,6 +410,10 @@ public final class Interface {
             }
         }
 
+        public Builder parseHttpProxy(final String httpProxy) throws BadConfigException {
+            return setHttpProxy(HttpProxy.parse(httpProxy));
+        }
+
         public Builder parsePrivateKey(final String privateKey) throws BadConfigException {
             try {
                 return setKeyPair(new KeyPair(Key.fromBase64(privateKey)));
@@ -419,5 +442,13 @@ public final class Interface {
             this.mtu = mtu == 0 ? Optional.empty() : Optional.of(mtu);
             return this;
         }
+
+        public Builder setHttpProxy(final HttpProxy httpProxy) throws BadConfigException {
+            if (httpProxy == null)
+                throw new BadConfigException(Section.INTERFACE, Location.HTTP_PROXY,
+                        Reason.INVALID_VALUE, String.valueOf(httpProxy));
+            this.httpProxy = httpProxy == null ? Optional.empty() : Optional.of(httpProxy);
+            return this;
+        }
     }
 }
diff --git a/ui/src/main/java/com/wireguard/android/fragment/TunnelEditorFragment.kt b/ui/src/main/java/com/wireguard/android/fragment/TunnelEditorFragment.kt
index edf4b226..a677ef58 100644
--- a/ui/src/main/java/com/wireguard/android/fragment/TunnelEditorFragment.kt
+++ b/ui/src/main/java/com/wireguard/android/fragment/TunnelEditorFragment.kt
@@ -16,13 +16,17 @@ import android.view.View
 import android.view.ViewGroup
 import android.view.WindowManager
 import android.view.inputmethod.InputMethodManager
+import android.widget.ArrayAdapter
+import android.widget.AutoCompleteTextView
 import android.widget.EditText
+import android.widget.Filter
 import android.widget.Toast
 import androidx.core.os.BundleCompat
 import androidx.core.view.MenuProvider
 import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.lifecycleScope
 import com.google.android.material.snackbar.Snackbar
+import com.google.android.material.textfield.TextInputLayout
 import com.wireguard.android.Application
 import com.wireguard.android.R
 import com.wireguard.android.backend.Tunnel
@@ -32,6 +36,7 @@ import com.wireguard.android.util.AdminKnobs
 import com.wireguard.android.util.BiometricAuthenticator
 import com.wireguard.android.util.ErrorMessages
 import com.wireguard.android.viewmodel.ConfigProxy
+import com.wireguard.android.viewmodel.Constants
 import com.wireguard.config.Config
 import kotlinx.coroutines.launch
 
@@ -43,6 +48,21 @@ class TunnelEditorFragment : BaseFragment(), MenuProvider {
     private var binding: TunnelEditorFragmentBinding? = null
     private var tunnel: ObservableTunnel? = null
 
+    private class MaterialSpinnerAdapter<T>(context: Context, resource: Int, private val objects: List<T>) : ArrayAdapter<T>(context, resource, objects) {
+        private val _filter: Filter by lazy {
+            object : Filter() {
+                override fun performFiltering(constraint: CharSequence?): FilterResults {
+                    return FilterResults()
+                }
+
+                override fun publishResults(constraint: CharSequence?, results: FilterResults?) {
+                }
+            }
+        }
+
+        override fun getFilter(): Filter = _filter
+    }
+
     private fun onConfigLoaded(config: Config) {
         binding?.config = ConfigProxy(config)
     }
@@ -80,6 +100,13 @@ class TunnelEditorFragment : BaseFragment(), MenuProvider {
             executePendingBindings()
             privateKeyTextLayout.setEndIconOnClickListener { config?.`interface`?.generateKeyPair() }
         }
+
+        var httpProxyMenu = binding?.root?.findViewById<TextInputLayout>(R.id.http_proxy_menu)
+        var httpProxyItems = listOf(Constants.HTTP_PROXY_NONE, Constants.HTTP_PROXY_MANUAL) // Constants.HTTP_PROXY_PAC is currently unsupported
+        var httpProxyAdapter = MaterialSpinnerAdapter(requireContext(), R.layout.http_proxy_menu_item, httpProxyItems)
+        var httpProxyMenuText = httpProxyMenu?.editText as? AutoCompleteTextView
+        httpProxyMenuText?.setAdapter(httpProxyAdapter)
+
         return binding?.root
     }
 
diff --git a/ui/src/main/java/com/wireguard/android/util/ErrorMessages.kt b/ui/src/main/java/com/wireguard/android/util/ErrorMessages.kt
index d617adec..97be8c99 100644
--- a/ui/src/main/java/com/wireguard/android/util/ErrorMessages.kt
+++ b/ui/src/main/java/com/wireguard/android/util/ErrorMessages.kt
@@ -122,6 +122,8 @@ object ErrorMessages {
             return resources.getString(R.string.bad_config_explanation_udp_port)
         } else if (bce.location == BadConfigException.Location.MTU) {
             return resources.getString(R.string.bad_config_explanation_positive_number)
+        } else if (bce.location == BadConfigException.Location.HTTP_PROXY) {
+            return resources.getString(R.string.bad_config_explanation_http_proxy)
         } else if (bce.location == BadConfigException.Location.PERSISTENT_KEEPALIVE) {
             return resources.getString(R.string.bad_config_explanation_pka)
         }
diff --git a/ui/src/main/java/com/wireguard/android/viewmodel/InterfaceProxy.kt b/ui/src/main/java/com/wireguard/android/viewmodel/InterfaceProxy.kt
index 004ebed1..16c3e6a3 100644
--- a/ui/src/main/java/com/wireguard/android/viewmodel/InterfaceProxy.kt
+++ b/ui/src/main/java/com/wireguard/android/viewmodel/InterfaceProxy.kt
@@ -4,6 +4,8 @@
  */
 package com.wireguard.android.viewmodel
 
+import android.net.Uri
+import android.os.Build
 import android.os.Parcel
 import android.os.Parcelable
 import androidx.databinding.BaseObservable
@@ -18,6 +20,12 @@ import com.wireguard.crypto.Key
 import com.wireguard.crypto.KeyFormatException
 import com.wireguard.crypto.KeyPair
 
+object Constants {
+    const val HTTP_PROXY_NONE = "None"
+    const val HTTP_PROXY_MANUAL = "Manual"
+    const val HTTP_PROXY_PAC = "Proxy Auto-Config"
+}
+
 class InterfaceProxy : BaseObservable, Parcelable {
     @get:Bindable
     val excludedApplications: ObservableList<String> = ObservableArrayList()
@@ -54,6 +62,44 @@ class InterfaceProxy : BaseObservable, Parcelable {
         }
 
     @get:Bindable
+    var httpProxyMenu: String = ""
+        set(value) {
+            field = value
+            notifyPropertyChanged(BR.httpProxyMenu)
+            notifyPropertyChanged(BR.httpProxyManualVisibility)
+            notifyPropertyChanged(BR.httpProxyPacVisibility)
+        }
+
+    @get:Bindable
+    var httpProxyManualVisibility: Int = 0
+        get() = if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) android.view.View.GONE else (if (httpProxyMenu == Constants.HTTP_PROXY_MANUAL) android.view.View.VISIBLE else android.view.View.GONE)
+
+    @get:Bindable
+    var httpProxyHostname: String = ""
+        set(value) {
+            field = value
+            notifyPropertyChanged(BR.httpProxyHostname)
+        }
+
+    @get:Bindable
+    var httpProxyPort: String = ""
+        set(value) {
+            field = value
+            notifyPropertyChanged(BR.httpProxyPort)
+        }
+
+    @get:Bindable
+    var httpProxyPac: String = ""
+        set(value) {
+            field = value
+            notifyPropertyChanged(BR.httpProxyPac)
+        }
+
+    @get:Bindable
+    var httpProxyPacVisibility: Int = 0
+        get() = if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) android.view.View.GONE else (if (httpProxyMenu == Constants.HTTP_PROXY_PAC) android.view.View.VISIBLE else android.view.View.GONE)
+
+    @get:Bindable
     var privateKey: String = ""
         set(value) {
             field = value
@@ -76,6 +122,10 @@ class InterfaceProxy : BaseObservable, Parcelable {
         parcel.readStringList(includedApplications)
         listenPort = parcel.readString() ?: ""
         mtu = parcel.readString() ?: ""
+        httpProxyMenu = parcel.readString() ?: ""
+        httpProxyHostname = parcel.readString() ?: ""
+        httpProxyPort = parcel.readString() ?: ""
+        httpProxyPac = parcel.readString() ?: ""
         privateKey = parcel.readString() ?: ""
     }
 
@@ -87,6 +137,10 @@ class InterfaceProxy : BaseObservable, Parcelable {
         includedApplications.addAll(other.includedApplications)
         listenPort = other.listenPort.map { it.toString() }.orElse("")
         mtu = other.mtu.map { it.toString() }.orElse("")
+        httpProxyHostname = other.httpProxy.map { if (it.getHost().startsWith('[') && it.getHost().endsWith(']')) it.getHost().substring(1, it.getHost().length-1) else it.getHost() }.orElse("")
+        httpProxyPort = other.httpProxy.map { if (it.getPort() <= 0) "8080" else it.getPort().toString() }.orElse("")
+        httpProxyPac = other.httpProxy.map { it.getPacFileUrl().toString() }.orElse("")
+        httpProxyMenu = other.httpProxy.map { if (it.getPacFileUrl() != null && it.getPacFileUrl() != Uri.EMPTY) Constants.HTTP_PROXY_PAC else if (it.getHost() != "") Constants.HTTP_PROXY_MANUAL else Constants.HTTP_PROXY_NONE }.orElse(Constants.HTTP_PROXY_NONE)
         val keyPair = other.keyPair
         privateKey = keyPair.privateKey.toBase64()
     }
@@ -111,6 +165,20 @@ class InterfaceProxy : BaseObservable, Parcelable {
         if (includedApplications.isNotEmpty()) builder.includeApplications(includedApplications)
         if (listenPort.isNotEmpty()) builder.parseListenPort(listenPort)
         if (mtu.isNotEmpty()) builder.parseMtu(mtu)
+        if (Constants.HTTP_PROXY_MANUAL.equals(httpProxyMenu) && httpProxyHostname.isNotEmpty()) {
+            var httpProxy: String
+            if (httpProxyHostname.contains(":")) {
+                httpProxy = "[" + httpProxyHostname + "]"
+            } else {
+                httpProxy = httpProxyHostname
+            }
+            if (httpProxyPort.isNotEmpty()) {
+                httpProxy += ":" + httpProxyPort;
+            }
+            builder.parseHttpProxy(httpProxy)
+        } else if (Constants.HTTP_PROXY_PAC.equals(httpProxyMenu) && httpProxyPac.isNotEmpty()) {
+            builder.parseHttpProxy("pac:" + httpProxyPac)
+        }
         if (privateKey.isNotEmpty()) builder.parsePrivateKey(privateKey)
         return builder.build()
     }
@@ -122,6 +190,10 @@ class InterfaceProxy : BaseObservable, Parcelable {
         dest.writeStringList(includedApplications)
         dest.writeString(listenPort)
         dest.writeString(mtu)
+        dest.writeString(httpProxyMenu)
+        dest.writeString(httpProxyHostname)
+        dest.writeString(httpProxyPort)
+        dest.writeString(httpProxyPac)
         dest.writeString(privateKey)
     }
 
diff --git a/ui/src/main/res/layout/http_proxy_menu_item.xml b/ui/src/main/res/layout/http_proxy_menu_item.xml
new file mode 100644
index 00000000..8ad5c026
--- /dev/null
+++ b/ui/src/main/res/layout/http_proxy_menu_item.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<TextView xmlns:android="http://schemas.android.com/apk/res/android"
+    android:layout_width="match_parent"
+    android:layout_height="wrap_content"
+    android:padding="16dp"
+    android:ellipsize="end"
+    android:maxLines="1"
+/>
diff --git a/ui/src/main/res/layout/tunnel_detail_fragment.xml b/ui/src/main/res/layout/tunnel_detail_fragment.xml
index 332df04a..296dd572 100644
--- a/ui/src/main/res/layout/tunnel_detail_fragment.xml
+++ b/ui/src/main/res/layout/tunnel_detail_fragment.xml
@@ -5,6 +5,8 @@
 
     <data>
 
+        <import type="android.os.Build" />
+
         <import type="com.wireguard.android.backend.Tunnel.State" />
 
         <import type="com.wireguard.android.util.ClipboardUtils" />
@@ -223,7 +225,7 @@
                         android:contentDescription="@string/listen_port"
                         android:nextFocusRight="@id/mtu_text"
                         android:nextFocusUp="@id/dns_search_domains_text"
-                        android:nextFocusDown="@id/applications_text"
+                        android:nextFocusDown="@id/http_proxy_text"
                         android:nextFocusForward="@id/mtu_text"
                         android:onClick="@{ClipboardUtils::copyTextView}"
                         android:text="@{config.interface.listenPort}"
@@ -256,7 +258,7 @@
                         android:contentDescription="@string/mtu"
                         android:nextFocusLeft="@id/listen_port_text"
                         android:nextFocusUp="@id/dns_servers_text"
-                        android:nextFocusForward="@id/applications_text"
+                        android:nextFocusForward="@id/http_proxy_text"
                         android:onClick="@{ClipboardUtils::copyTextView}"
                         android:text="@{config.interface.mtu}"
                         android:textAppearance="?attr/textAppearanceBodyLarge"
@@ -276,6 +278,33 @@
                         app:constraint_referenced_ids="listen_port_text,mtu_text" />
 
                     <TextView
+                        android:id="@+id/http_proxy_label"
+                        android:layout_width="0dp"
+                        android:layout_height="wrap_content"
+                        android:layout_marginTop="8dp"
+                        android:labelFor="@+id/http_proxy_text"
+                        android:text="@string/http_proxy"
+                        android:visibility="@{(Build.VERSION.SDK_INT &lt; Build.VERSION_CODES.Q || !config.interface.httpProxy.isPresent()) ? android.view.View.GONE : android.view.View.VISIBLE}"
+                        app:layout_constraintStart_toStartOf="parent"
+                        app:layout_constraintTop_toBottomOf="@+id/listen_port_mtu_barrier" />
+
+                    <TextView
+                        android:id="@+id/http_proxy_text"
+                        android:layout_width="0dp"
+                        android:layout_height="wrap_content"
+                        android:contentDescription="@string/http_proxy"
+                        android:nextFocusUp="@id/listen_port_text"
+                        android:nextFocusDown="@id/applications_text"
+                        android:nextFocusForward="@id/applications_text"
+                        android:onClick="@{ClipboardUtils::copyTextView}"
+                        android:text="@{config.interface.httpProxy}"
+                        android:textAppearance="?attr/textAppearanceBodyLarge"
+                        android:visibility="@{(Build.VERSION.SDK_INT &lt; Build.VERSION_CODES.Q || !config.interface.httpProxy.isPresent()) ? android.view.View.GONE : android.view.View.VISIBLE}"
+                        app:layout_constraintTop_toBottomOf="@id/http_proxy_label"
+                        app:layout_constraintStart_toStartOf="parent"
+                        tools:text="http://example.com:8888" />
+
+                    <TextView
                         android:id="@+id/applications_label"
                         android:layout_width="wrap_content"
                         android:layout_height="wrap_content"
@@ -284,7 +313,7 @@
                         android:text="@string/applications"
                         android:visibility="@{config.interface.includedApplications.isEmpty() &amp;&amp; config.interface.excludedApplications.isEmpty() ? android.view.View.GONE : android.view.View.VISIBLE}"
                         app:layout_constraintStart_toStartOf="parent"
-                        app:layout_constraintTop_toBottomOf="@+id/listen_port_mtu_barrier" />
+                        app:layout_constraintTop_toBottomOf="@+id/http_proxy_text" />
 
                     <TextView
                         android:id="@+id/applications_text"
@@ -318,4 +347,4 @@
                 tools:ignore="UselessLeaf" />
         </androidx.constraintlayout.widget.ConstraintLayout>
     </ScrollView>
-</layout>
\ No newline at end of file
+</layout>
diff --git a/ui/src/main/res/layout/tunnel_editor_fragment.xml b/ui/src/main/res/layout/tunnel_editor_fragment.xml
index 0350486b..42222399 100644
--- a/ui/src/main/res/layout/tunnel_editor_fragment.xml
+++ b/ui/src/main/res/layout/tunnel_editor_fragment.xml
@@ -5,6 +5,8 @@
 
     <data>
 
+        <import type="android.os.Build" />
+
         <import type="com.wireguard.android.util.ClipboardUtils" />
 
         <import type="com.wireguard.android.widget.KeyInputFilter" />
@@ -210,7 +212,7 @@
                                 android:imeOptions="actionNext"
                                 android:inputType="textNoSuggestions|textVisiblePassword"
                                 android:nextFocusUp="@id/addresses_label_text"
-                                android:nextFocusDown="@id/set_excluded_applications"
+                                android:nextFocusDown="@id/http_proxy_hostname_text"
                                 android:nextFocusForward="@id/mtu_text"
                                 android:text="@={config.interface.dnsServers}" />
                         </com.google.android.material.textfield.TextInputLayout>
@@ -235,19 +237,112 @@
                                 android:imeOptions="actionDone"
                                 android:inputType="number"
                                 android:nextFocusUp="@id/listen_port_text"
-                                android:nextFocusDown="@id/set_excluded_applications"
-                                android:nextFocusForward="@id/set_excluded_applications"
+                                android:nextFocusDown="@id/http_proxy_hostname_text"
+                                android:nextFocusForward="@id/http_proxy_hostname_text"
                                 android:text="@={config.interface.mtu}"
                                 android:textAlignment="center" />
                         </com.google.android.material.textfield.TextInputLayout>
 
+                        <com.google.android.material.textfield.TextInputLayout
+                            android:id="@+id/http_proxy_menu"
+                            style="@style/Widget.Material3.TextInputLayout.OutlinedBox.ExposedDropdownMenu"
+                            android:layout_width="0dp"
+                            android:layout_height="wrap_content"
+                            android:layout_margin="4dp"
+                            android:hint="@string/http_proxy"
+                            app:expandedHintEnabled="false"
+                            app:layout_constraintEnd_toEndOf="parent"
+                            app:layout_constraintStart_toStartOf="parent"
+                            app:layout_constraintTop_toBottomOf="@id/dns_servers_label_layout">
+
+                                <AutoCompleteTextView
+                                    android:layout_width="match_parent"
+                                    android:layout_height="wrap_content"
+                                    android:inputType="none"
+                                    android:text="@={config.interface.httpProxyMenu}"
+                                />
+                        </com.google.android.material.textfield.TextInputLayout>
+
+                        <com.google.android.material.textfield.TextInputLayout
+                            android:id="@+id/http_proxy_hostname_label_layout"
+                            android:layout_width="0dp"
+                            android:layout_height="wrap_content"
+                            android:layout_margin="4dp"
+                            android:hint="@string/http_proxy_hostname"
+                            android:visibility="@{config.interface.httpProxyManualVisibility}"
+                            app:layout_constraintEnd_toStartOf="@id/http_proxy_port_label_layout"
+                            app:layout_constraintHorizontal_chainStyle="spread"
+                            app:layout_constraintHorizontal_weight="0.7"
+                            app:layout_constraintStart_toStartOf="parent"
+                            app:layout_constraintTop_toBottomOf="@id/http_proxy_menu">
+
+                            <com.google.android.material.textfield.TextInputEditText
+                                android:id="@+id/http_proxy_hostname_text"
+                                android:layout_width="match_parent"
+                                android:layout_height="wrap_content"
+                                android:imeOptions="actionNext"
+                                android:inputType="textNoSuggestions|textVisiblePassword"
+                                android:nextFocusUp="@id/mtu_text"
+                                android:nextFocusDown="@id/set_excluded_applications"
+                                android:nextFocusForward="@id/http_proxy_port_text"
+                                android:text="@={config.interface.httpProxyHostname}" />
+                        </com.google.android.material.textfield.TextInputLayout>
+
+                        <com.google.android.material.textfield.TextInputLayout
+                            android:id="@+id/http_proxy_port_label_layout"
+                            android:layout_width="0dp"
+                            android:layout_height="wrap_content"
+                            android:layout_margin="4dp"
+                            android:hint="@string/http_proxy_port"
+                            android:visibility="@{config.interface.httpProxyManualVisibility}"
+                            app:expandedHintEnabled="false"
+                            app:layout_constraintEnd_toEndOf="parent"
+                            app:layout_constraintHorizontal_weight="0.3"
+                            app:layout_constraintStart_toEndOf="@id/http_proxy_hostname_label_layout"
+                            app:layout_constraintTop_toBottomOf="@id/http_proxy_menu">
+
+                            <com.google.android.material.textfield.TextInputEditText
+                                android:id="@+id/http_proxy_port_text"
+                                android:layout_width="match_parent"
+                                android:layout_height="wrap_content"
+                                android:imeOptions="actionDone"
+                                android:nextFocusUp="@id/mtu_text"
+                                android:nextFocusDown="@id/http_proxy_pac_label_layout"
+                                android:nextFocusForward="@id/http_proxy_pac_label_layout"
+                                android:text="@={config.interface.httpProxyPort}"
+                                android:textAlignment="center" />
+                        </com.google.android.material.textfield.TextInputLayout>
+
+                        <com.google.android.material.textfield.TextInputLayout
+                            android:id="@+id/http_proxy_pac_label_layout"
+                            android:layout_width="0dp"
+                            android:layout_height="wrap_content"
+                            android:layout_margin="4dp"
+                            android:hint="@string/http_proxy_pac"
+                            android:visibility="@{config.interface.httpProxyPacVisibility}"
+                            app:layout_constraintEnd_toEndOf="parent"
+                            app:layout_constraintStart_toStartOf="parent"
+                            app:layout_constraintTop_toBottomOf="@id/http_proxy_hostname_label_layout">
+
+                            <com.google.android.material.textfield.TextInputEditText
+                                android:id="@+id/http_proxy_pac_text"
+                                android:layout_width="match_parent"
+                                android:layout_height="wrap_content"
+                                android:imeOptions="actionNext"
+                                android:inputType="textNoSuggestions|textVisiblePassword"
+                                android:nextFocusUp="@id/http_proxy_hostname_text"
+                                android:nextFocusDown="@id/set_excluded_applications"
+                                android:nextFocusForward="@id/set_excluded_applications"
+                                android:text="@={config.interface.httpProxyPac}" />
+                        </com.google.android.material.textfield.TextInputLayout>
+
                         <com.google.android.material.button.MaterialButton
                             android:id="@+id/set_excluded_applications"
                             style="@style/Widget.Material3.Button.TextButton"
                             android:layout_width="0dp"
                             android:layout_height="wrap_content"
                             android:layout_margin="4dp"
-                            android:nextFocusUp="@id/dns_servers_text"
+                            android:nextFocusUp="@id/http_proxy_hostname_text"
                             android:nextFocusDown="@id/peers_layout"
                             android:nextFocusForward="@id/peers_layout"
                             android:onClick="@{fragment::onRequestSetExcludedIncludedApplications}"
@@ -256,7 +351,7 @@
                             app:layout_constraintBottom_toBottomOf="parent"
                             app:layout_constraintEnd_toEndOf="parent"
                             app:layout_constraintStart_toStartOf="parent"
-                            app:layout_constraintTop_toBottomOf="@id/mtu_label_layout"
+                            app:layout_constraintTop_toBottomOf="@id/http_proxy_pac_label_layout"
                             app:rippleColor="?attr/colorSecondary"
                             tools:text="4 excluded applications" />
                     </androidx.constraintlayout.widget.ConstraintLayout>
diff --git a/ui/src/main/res/values/strings.xml b/ui/src/main/res/values/strings.xml
index df3d3340..87e75768 100644
--- a/ui/src/main/res/values/strings.xml
+++ b/ui/src/main/res/values/strings.xml
@@ -67,6 +67,7 @@
     <string name="bad_config_context">%1$s\'s %2$s</string>
     <string name="bad_config_context_top_level">%s</string>
     <string name="bad_config_error">%1$s in %2$s</string>
+    <string name="bad_config_explanation_http_proxy">: Must be valid proxy hostname and port</string>
     <string name="bad_config_explanation_pka">: Must be positive and no more than 65535</string>
     <string name="bad_config_explanation_positive_number">: Must be positive</string>
     <string name="bad_config_explanation_udp_port">: Must be a valid UDP port number</string>
@@ -130,6 +131,10 @@
     <string name="hint_optional">(optional)</string>
     <string name="hint_optional_discouraged">(optional, not recommended)</string>
     <string name="hint_random">(random)</string>
+    <string name="http_proxy">Proxy</string>
+    <string name="http_proxy_hostname">Proxy hostname</string>
+    <string name="http_proxy_pac">Proxy Auto-Config URL</string>
+    <string name="http_proxy_port">Proxy port</string>
     <string name="illegal_filename_error">Illegal file name “%s”</string>
     <string name="import_error">Unable to import tunnel: %s</string>
     <string name="import_from_qr_code">Import Tunnel from QR Code</string>