feat: MasterDnsVPN sidecar (DNS-tunnel client, VPN-mode capable)

.github/workflows/build.yml

@@ -9,6 +9,7 @@ on:
 env:
   MIERU_VERSION: v3.34.0
   HYSTERIA_VERSION: v2.9.2
+  MDVPN_REF: android-vpnservice-protect-hook
 permissions:
   contents: read
 jobs:
@@ -44,14 +45,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars
       - name: Install Golang
         if: steps.cache.outputs.cache-hit != 'true'
         uses: actions/setup-go@v6
@@ -63,6 +64,9 @@ jobs:
       - name: Hysteria2 Download
         if: steps.cache.outputs.cache-hit != 'true'
         run: ./run lib hysteria2
+      - name: MasterDnsVPN Build
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: ./run lib masterdnsvpn
   build:
     name: Build OSS APK
     runs-on: ubuntu-latest
@@ -83,18 +87,18 @@ jobs:
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: sidecars-cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars
       - name: Verify Sidecar Artifacts
         run: |
           for abi in arm64-v8a armeabi-v7a x86 x86_64; do
-            for so in libmieru.so libhysteria2.so; do
+            for so in libmieru.so libhysteria2.so libmasterdnsvpn.so; do
               if [ ! -f "app/executableSo/$abi/$so" ]; then
                 echo "Error: missing app/executableSo/$abi/$so (sidecar cache miss)" >&2
                 exit 1

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
 env:
   MIERU_VERSION: v3.34.0
   HYSTERIA_VERSION: v2.9.2
+  MDVPN_REF: android-vpnservice-protect-hook
 permissions:
   contents: read
 jobs:
@@ -49,14 +50,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars-ci
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars-ci
       - name: Install Golang
         if: steps.cache.outputs.cache-hit != 'true'
         uses: actions/setup-go@v6
@@ -68,6 +69,9 @@ jobs:
       - name: Hysteria2 Download
         if: steps.cache.outputs.cache-hit != 'true'
         run: ./run lib hysteria2
+      - name: MasterDnsVPN Build
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: ./run lib masterdnsvpn
   build:
     name: Build OSS APK
     runs-on: ubuntu-latest
@@ -93,18 +97,18 @@ jobs:
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}-ci
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: sidecars-cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars-ci
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars-ci
       - name: Verify Sidecar Artifacts
         run: |
           for abi in arm64-v8a armeabi-v7a x86 x86_64; do
-            for so in libmieru.so libhysteria2.so; do
+            for so in libmieru.so libhysteria2.so libmasterdnsvpn.so; do
               if [ ! -f "app/executableSo/$abi/$so" ]; then
                 echo "Error: missing app/executableSo/$abi/$so (sidecar cache miss)" >&2
                 exit 1
@@ -128,8 +132,8 @@ jobs:
           APK=$(find app/build/outputs/apk -name '*arm64-v8a*.apk')
           APK=$(dirname $APK)
           echo "APK=$APK" >> $GITHUB_ENV
-      # - name: Upload Artifacts
-      #   uses: actions/upload-artifact@v5
-      #   with:
-      #     name: APKs
-      #     path: ${{ env.APK }}
+      - name: Upload Artifacts
+        uses: actions/upload-artifact@v5
+        with:
+          name: NekoBox-debug-apks
+          path: ${{ env.APK }}

.github/workflows/preview.yml

@@ -5,6 +5,7 @@ on:
 env:
   MIERU_VERSION: v3.34.0
   HYSTERIA_VERSION: v2.9.2
+  MDVPN_REF: android-vpnservice-protect-hook
 permissions:
   contents: read
 jobs:
@@ -40,14 +41,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars
       - name: Install Golang
         if: steps.cache.outputs.cache-hit != 'true'
         uses: actions/setup-go@v6
@@ -59,6 +60,9 @@ jobs:
       - name: Hysteria2 Download
         if: steps.cache.outputs.cache-hit != 'true'
         run: ./run lib hysteria2
+      - name: MasterDnsVPN Build
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: ./run lib masterdnsvpn
   build:
     name: Build OSS APK
     runs-on: ubuntu-latest
@@ -79,18 +83,18 @@ jobs:
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: sidecars-cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars
       - name: Verify Sidecar Artifacts
         run: |
           for abi in arm64-v8a armeabi-v7a x86 x86_64; do
-            for so in libmieru.so libhysteria2.so; do
+            for so in libmieru.so libhysteria2.so libmasterdnsvpn.so; do
               if [ ! -f "app/executableSo/$abi/$so" ]; then
                 echo "Error: missing app/executableSo/$abi/$so (sidecar cache miss)" >&2
                 exit 1

.github/workflows/release.yml

@@ -11,6 +11,7 @@ on:
 env:
   MIERU_VERSION: v3.34.0
   HYSTERIA_VERSION: v2.9.2
+  MDVPN_REF: android-vpnservice-protect-hook
 permissions:
   contents: write
 jobs:
@@ -46,14 +47,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars
       - name: Install Golang
         if: steps.cache.outputs.cache-hit != 'true'
         uses: actions/setup-go@v6
@@ -65,6 +66,9 @@ jobs:
       - name: Hysteria2 Download
         if: steps.cache.outputs.cache-hit != 'true'
         run: ./run lib hysteria2
+      - name: MasterDnsVPN Build
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: ./run lib masterdnsvpn
   build:
     name: Build OSS APK
     runs-on: ubuntu-latest
@@ -85,18 +89,18 @@ jobs:
             app/libs/libcore.aar
           key: ${{ hashFiles('.github/workflows/*', 'golang_status', 'libcore_status') }}
       - name: Sidecars Status
-        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
+        run: cat buildScript/lib/mieru.sh buildScript/lib/hysteria2.sh buildScript/lib/masterdnsvpn.sh buildScript/init/env.sh buildScript/init/env_ndk.sh | sha1sum > sidecars_status
       - name: Sidecars Cache
         id: sidecars-cache
         uses: actions/cache@v5
         with:
           path: |
             app/executableSo
-          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-sidecars
+          key: ${{ hashFiles('.github/workflows/*', 'sidecars_status') }}-${{ env.MIERU_VERSION }}-${{ env.HYSTERIA_VERSION }}-${{ env.MDVPN_REF }}-sidecars
       - name: Verify Sidecar Artifacts
         run: |
           for abi in arm64-v8a armeabi-v7a x86 x86_64; do
-            for so in libmieru.so libhysteria2.so; do
+            for so in libmieru.so libhysteria2.so libmasterdnsvpn.so; do
               if [ ! -f "app/executableSo/$abi/$so" ]; then
                 echo "Error: missing app/executableSo/$abi/$so (sidecar cache miss)" >&2
                 exit 1

app/src/main/AndroidManifest.xml

@@ -193,6 +193,9 @@
         <activity
             android:name="io.nekohasekai.sagernet.ui.profile.SnellSettingsActivity"
             android:configChanges="uiMode" />
+        <activity
+            android:name="io.nekohasekai.sagernet.ui.profile.MasterDnsVpnSettingsActivity"
+            android:configChanges="uiMode" />
         <activity
             android:name="io.nekohasekai.sagernet.ui.profile.ChainSettingsActivity"
             android:configChanges="uiMode" />

app/src/main/java/io/nekohasekai/sagernet/Constants.kt

@@ -133,6 +133,29 @@ object Key {
     const val SERVER_HY2_GECKO_MIN_PACKET = "serverHy2GeckoMinPacket"
     const val SERVER_HY2_GECKO_MAX_PACKET = "serverHy2GeckoMaxPacket"
 
+    // MasterDnsVPN
+    const val MDV_DOMAINS = "mdvDomains"
+    const val MDV_ENCRYPTION_METHOD = "mdvEncryptionMethod"
+    const val MDV_ENCRYPTION_KEY = "mdvEncryptionKey"
+    const val MDV_RESOLVERS = "mdvResolvers"
+    const val MDV_BALANCING_STRATEGY = "mdvBalancingStrategy"
+    const val MDV_PACKET_DUP = "mdvPacketDup"
+    const val MDV_SETUP_PACKET_DUP = "mdvSetupPacketDup"
+    const val MDV_AUTO_DISABLE_TIMEOUT = "mdvAutoDisableTimeout"
+    const val MDV_AUTO_REMOVE_LOW_MTU = "mdvAutoRemoveLowMtu"
+    const val MDV_BASE_ENCODE = "mdvBaseEncode"
+    const val MDV_UPLOAD_COMPRESSION = "mdvUploadCompression"
+    const val MDV_DOWNLOAD_COMPRESSION = "mdvDownloadCompression"
+    const val MDV_COMPRESSION_MIN_SIZE = "mdvCompressionMinSize"
+    const val MDV_MIN_UPLOAD_MTU = "mdvMinUploadMtu"
+    const val MDV_MIN_DOWNLOAD_MTU = "mdvMinDownloadMtu"
+    const val MDV_MAX_UPLOAD_MTU = "mdvMaxUploadMtu"
+    const val MDV_MAX_DOWNLOAD_MTU = "mdvMaxDownloadMtu"
+    const val MDV_LOCAL_DNS_ENABLED = "mdvLocalDnsEnabled"
+    const val MDV_LOCAL_DNS_PORT = "mdvLocalDnsPort"
+    const val MDV_LOG_LEVEL = "mdvLogLevel"
+    const val MDV_ADVANCED_JSON = "mdvAdvancedJson"
+
     const val SERVER_PRIVATE_KEY = "serverPrivateKey"
     const val SERVER_INSECURE_CONCURRENCY = "serverInsecureConcurrency"
 

app/src/main/java/io/nekohasekai/sagernet/bg/Executable.kt

@@ -10,7 +10,7 @@ import androidx.core.text.isDigitsOnly
 
 object Executable {
     private val EXECUTABLES = setOf(
-        "libtrojan.so", "libtrojan-go.so", "libnaive.so", "libtuic.so", "libhysteria.so", "libmieru.so", "libhysteria2.so"
+        "libtrojan.so", "libtrojan-go.so", "libnaive.so", "libtuic.so", "libhysteria.so", "libmieru.so", "libhysteria2.so", "libmasterdnsvpn.so"
     )
 
     fun killAll(alsoKillBg: Boolean = false) {

app/src/main/java/io/nekohasekai/sagernet/bg/proto/BoxInstance.kt

@@ -11,6 +11,9 @@ import io.nekohasekai.sagernet.fmt.buildConfig
 import io.nekohasekai.sagernet.fmt.hysteria.HysteriaBean
 import io.nekohasekai.sagernet.fmt.hysteria.buildHysteria1Config
 import io.nekohasekai.sagernet.fmt.hysteria.buildHysteria2SidecarConfig
+import io.nekohasekai.sagernet.fmt.masterdnsvpn.MasterDnsVpnBean
+import io.nekohasekai.sagernet.fmt.masterdnsvpn.buildMasterDnsVpnConfig
+import io.nekohasekai.sagernet.fmt.masterdnsvpn.resolverLines
 import io.nekohasekai.sagernet.fmt.mieru.MieruBean
 import io.nekohasekai.sagernet.fmt.mieru.buildMieruConfig
 import io.nekohasekai.sagernet.fmt.naive.NaiveBean
@@ -98,6 +101,13 @@ abstract class BoxInstance(
                             }
                         }
                     }
+
+                    is MasterDnsVpnBean -> {
+                        initPlugin("masterdnsvpn-plugin")
+                        pluginConfigs[port] = profile.type to bean.buildMasterDnsVpnConfig(
+                            port, File(app.noBackupFilesDir, "protect_path").absolutePath
+                        )
+                    }
                 }
             }
         }
@@ -234,6 +244,28 @@ abstract class BoxInstance(
 
                         processes.start(commands)
                     }
+
+                    bean is MasterDnsVpnBean -> {
+                        // Port is unique per chain entry, so two sidecars can't collide
+                        // (unlike a bare elapsedRealtime() shared by the config+resolvers pair).
+                        val ts = "${port}_${SystemClock.elapsedRealtime()}"
+                        val configFile = File(cacheDir, "masterdnsvpn_$ts.json")
+                        configFile.parentFile?.mkdirs()
+                        configFile.writeText(config)
+                        cacheFiles.add(configFile)
+
+                        val resolversFile = File(cacheDir, "masterdnsvpn_${ts}_resolvers.txt")
+                        resolversFile.writeText(bean.resolverLines())
+                        cacheFiles.add(resolversFile)
+
+                        val commands = mutableListOf(
+                            initPlugin("masterdnsvpn-plugin").path,
+                            "-json", configFile.absolutePath,
+                            "-resolvers", resolversFile.absolutePath,
+                        )
+
+                        processes.start(commands)
+                    }
                 }
             }
         }

app/src/main/java/io/nekohasekai/sagernet/database/DataStore.kt

@@ -256,6 +256,29 @@ object DataStore : OnPreferenceDataStoreChangeListener {
     var serverHy2GeckoMinPacket by profileCacheStore.stringToInt(Key.SERVER_HY2_GECKO_MIN_PACKET) { 512 }
     var serverHy2GeckoMaxPacket by profileCacheStore.stringToInt(Key.SERVER_HY2_GECKO_MAX_PACKET) { 1200 }
 
+    // MasterDnsVPN
+    var mdvDomains by profileCacheStore.string(Key.MDV_DOMAINS)
+    var mdvEncryptionMethod by profileCacheStore.stringToInt(Key.MDV_ENCRYPTION_METHOD) { 0 }
+    var mdvEncryptionKey by profileCacheStore.string(Key.MDV_ENCRYPTION_KEY)
+    var mdvResolvers by profileCacheStore.string(Key.MDV_RESOLVERS)
+    var mdvBalancingStrategy by profileCacheStore.stringToInt(Key.MDV_BALANCING_STRATEGY) { 3 }
+    var mdvPacketDup by profileCacheStore.stringToInt(Key.MDV_PACKET_DUP) { 3 }
+    var mdvSetupPacketDup by profileCacheStore.stringToInt(Key.MDV_SETUP_PACKET_DUP) { 4 }
+    var mdvAutoDisableTimeout by profileCacheStore.boolean(Key.MDV_AUTO_DISABLE_TIMEOUT)
+    var mdvAutoRemoveLowMtu by profileCacheStore.boolean(Key.MDV_AUTO_REMOVE_LOW_MTU)
+    var mdvBaseEncode by profileCacheStore.boolean(Key.MDV_BASE_ENCODE)
+    var mdvUploadCompression by profileCacheStore.stringToInt(Key.MDV_UPLOAD_COMPRESSION) { 0 }
+    var mdvDownloadCompression by profileCacheStore.stringToInt(Key.MDV_DOWNLOAD_COMPRESSION) { 0 }
+    var mdvCompressionMinSize by profileCacheStore.stringToInt(Key.MDV_COMPRESSION_MIN_SIZE) { 120 }
+    var mdvMinUploadMtu by profileCacheStore.stringToInt(Key.MDV_MIN_UPLOAD_MTU) { 38 }
+    var mdvMinDownloadMtu by profileCacheStore.stringToInt(Key.MDV_MIN_DOWNLOAD_MTU) { 200 }
+    var mdvMaxUploadMtu by profileCacheStore.stringToInt(Key.MDV_MAX_UPLOAD_MTU) { 150 }
+    var mdvMaxDownloadMtu by profileCacheStore.stringToInt(Key.MDV_MAX_DOWNLOAD_MTU) { 4000 }
+    var mdvLocalDnsEnabled by profileCacheStore.boolean(Key.MDV_LOCAL_DNS_ENABLED)
+    var mdvLocalDnsPort by profileCacheStore.stringToInt(Key.MDV_LOCAL_DNS_PORT) { 53 }
+    var mdvLogLevel by profileCacheStore.string(Key.MDV_LOG_LEVEL) { "INFO" }
+    var mdvAdvancedJson by profileCacheStore.string(Key.MDV_ADVANCED_JSON)
+
     var protocolVersion by profileCacheStore.stringToInt(Key.PROTOCOL_VERSION) { 2 } // default is SOCKS5
 
     var serverProtocolInt by profileCacheStore.stringToInt(Key.SERVER_PROTOCOL)