docs: record MasterDnsVPN integration deferral and design#13
Conversation
MasterDnsVPN has no Android VpnService.protect mechanism, so its DNS carrier sockets would loop inside NekoBox's VPN. A sing-box direct-route bypass does not protect a separate sidecar process's sockets; per-socket VpnService.protect is the only reliable approach. Deferred pending an upstream socket-protect hook. Documents the analysis and the recommended sequence: ship proxy-mode-only sidecar first, upstream a MASTERDNSVPN_PROTECT_PATH hook (Dialer.Control + SCM_RIGHTS fd passing), reuse NekoBox's Mieru-style protect bridge, then enable VPN mode.
|
Warning Review limit reached
More reviews will be available in 7 hours, 22 minutes, and 4 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Comment |
Resolve the open Go-version question: use a separate setup-go scoped to the MasterDnsVPN build job rather than raising the repo-wide pin, keeping libcore's deliberate 1.24.9 toolchain alignment untouched.
1 participant
Docs-only. Records why Phase 12 (MasterDnsVPN) is deferred and captures the full integration design for when work resumes.
Key finding: MasterDnsVPN has no Android VpnService.protect mechanism, so its DNS-carrier sockets would loop inside NekoBox's VPN. Analysis (confirmed via external model review):
Recommended sequence documented: (1) ship proxy-mode-only sidecar, (2) upstream a MASTERDNSVPN_PROTECT_PATH hook (Dialer.Control/ListenConfig.Control + SCM_RIGHTS fd passing), (3) reuse NekoBox's Mieru-style protect bridge, (4) enable VPN mode.
No functional app changes.