fix: address review on MasterDnsVPN sidecar

- buildMasterDnsVpnConfig: wrap advancedJson parse in try-catch (malformed
  override must not crash config build / VPN start; logged + ignored).
- Default encryption method 1 (XOR) -> 0 (None) in Bean/DataStore/XML: avoid
  false security (XOR with an empty key); user picks a cipher + key explicitly.
- Fix KDoc to match the actual launch flags (-json <file>, not -json-base64).
- masterdnsvpn.sh: validate Go >= 1.25 before building.
- Simplify serverAddress placeholder in the settings init.

Author: hawkff

app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt

@@ -258,7 +258,7 @@ object DataStore : OnPreferenceDataStoreChangeListener {
 
     // MasterDnsVPN
     var mdvDomains by profileCacheStore.string(Key.MDV_DOMAINS)
-    var mdvEncryptionMethod by profileCacheStore.stringToInt(Key.MDV_ENCRYPTION_METHOD) { 1 }
+    var mdvEncryptionMethod by profileCacheStore.stringToInt(Key.MDV_ENCRYPTION_METHOD) { 0 }
     var mdvEncryptionKey by profileCacheStore.string(Key.MDV_ENCRYPTION_KEY)
     var mdvResolvers by profileCacheStore.string(Key.MDV_RESOLVERS)
     var mdvBalancingStrategy by profileCacheStore.stringToInt(Key.MDV_BALANCING_STRATEGY) { 3 }

app/src/main/java/io/nekohasekai/sagernet/fmt/masterdnsvpn/MasterDnsVpnBean.java

@@ -75,7 +75,9 @@ public class MasterDnsVpnBean extends AbstractBean {
     public void initializeDefaultValues() {
         super.initializeDefaultValues();
         if (domains == null) domains = "";
-        if (dataEncryptionMethod == null) dataEncryptionMethod = 1;
+        // Default to None: encryption must match the server and needs a key, so don't
+        // imply security with XOR + an empty key. The user picks a cipher + key explicitly.
+        if (dataEncryptionMethod == null) dataEncryptionMethod = 0;
         if (encryptionKey == null) encryptionKey = "";
         if (resolvers == null) resolvers = "8.8.8.8\n1.1.1.1";
         if (resolverBalancingStrategy == null) resolverBalancingStrategy = 3;

app/src/main/java/io/nekohasekai/sagernet/fmt/masterdnsvpn/MasterDnsVpnFmt.kt

@@ -10,14 +10,15 @@
 package io.nekohasekai.sagernet.fmt.masterdnsvpn
 
 import io.nekohasekai.sagernet.fmt.LOCALHOST
+import io.nekohasekai.sagernet.ktx.Logs
 import io.nekohasekai.sagernet.ktx.toStringPretty
 import org.json.JSONArray
 import org.json.JSONObject
 
 /**
  * Builds the JSON config for the bundled MasterDnsVPN client (sidecar).
  *
- * The client is launched as `libmasterdnsvpn.so -json-base64 <b64> -resolvers <file>`.
+ * The client is launched as `libmasterdnsvpn.so -json <cfg.json> -resolvers <file>`.
  * Resolvers are written to a separate file (the client always loads resolvers from a
  * file); see [resolverLines]. The config uses the client's uppercase config keys.
  *
@@ -72,9 +73,14 @@ fun MasterDnsVpnBean.buildMasterDnsVpnConfig(port: Int, protectPath: String): St
 
     // Merge the advanced JSON override last so it can set/replace any key.
     if (advancedJson.isNotBlank()) {
-        val extra = JSONObject(advancedJson)
-        for (key in extra.keys()) {
-            cfg.put(key, extra.get(key))
+        // Malformed override JSON must not crash config generation / VPN start.
+        try {
+            val extra = JSONObject(advancedJson)
+            for (key in extra.keys()) {
+                cfg.put(key, extra.get(key))
+            }
+        } catch (e: Exception) {
+            Logs.w("MasterDnsVPN: ignoring invalid advanced JSON override: ${e.message}")
         }
     }
 

app/src/main/java/io/nekohasekai/sagernet/ui/profile/MasterDnsVpnSettingsActivity.kt

@@ -25,8 +25,8 @@ class MasterDnsVpnSettingsActivity : ProfileSettingsActivity<MasterDnsVpnBean>()
 
     override fun MasterDnsVpnBean.init() {
         DataStore.profileName = name
-        // serverAddress/Port are unused by this protocol but kept for the base editor.
-        DataStore.serverAddress = if (serverAddress.isNullOrBlank()) "masterdnsvpn" else serverAddress
+        // serverAddress/Port are unused by this protocol; the editor uses the MDV_* fields.
+        DataStore.serverAddress = "masterdnsvpn"
         DataStore.mdvDomains = domains
         DataStore.mdvEncryptionMethod = dataEncryptionMethod
         DataStore.mdvEncryptionKey = encryptionKey

app/src/main/res/xml/masterdnsvpn_preferences.xml

@@ -14,7 +14,7 @@
             app:title="@string/mdv_domains"
             app:useSimpleSummaryProvider="true" />
         <moe.matsuri.nb4a.ui.SimpleMenuPreference
-            app:defaultValue="1"
+            app:defaultValue="0"
             app:entries="@array/mdv_encryption_method"
             app:entryValues="@array/mdv_encryption_method_value"
             app:icon="@drawable/ic_settings_password"

buildScript/lib/masterdnsvpn.sh

@@ -55,6 +55,19 @@ fi
 
 pushd "$WORK" >/dev/null
 
+# MasterDnsVPN requires Go 1.25+. Fail fast with a clear message otherwise.
+if ! command -v go >/dev/null 2>&1; then
+  echo "Error: go not found on PATH (MasterDnsVPN needs Go 1.25+)." >&2
+  exit 1
+fi
+GO_VER="$(go env GOVERSION 2>/dev/null | sed 's/^go//')"
+GO_MAJOR="${GO_VER%%.*}"
+GO_REST="${GO_VER#*.}"; GO_MINOR="${GO_REST%%.*}"
+if [ "${GO_MAJOR:-0}" -lt 1 ] || { [ "${GO_MAJOR:-0}" -eq 1 ] && [ "${GO_MINOR:-0}" -lt 25 ]; }; then
+  echo "Error: Go $GO_VER is too old; MasterDnsVPN needs Go 1.25+." >&2
+  exit 1
+fi
+
 build_abi() {
   local abi="$1" goarch="$2" cc="$3" goarm="$4"
   echo ">> building libmasterdnsvpn.so for $abi"