From fa68ea20fa0f3d316f42a2e12bce60568e2ffd88 Mon Sep 17 00:00:00 2001 From: Denozordec Date: Wed, 11 Nov 2026 14:16:43 +0700 Subject: [PATCH] =?UTF-8?q?android:=20DNS=20proxy=20sockets=20are=20no=20l?= =?UTF-8?q?onger=20re-protected=20on=20every=20network=20change:=20they=20?= =?UTF-8?q?were=20added=20to=20the=20list=20of=20sockets=20protected=20aga?= =?UTF-8?q?in=20on=20a=20roam,=20from=20which=20nothing=20is=20ever=20remo?= =?UTF-8?q?ved,=20although=20they=20are=20closed=20after=2030=20s=20-=20on?= =?UTF-8?q?e=20hour=20of=20use=20left=2043=20closed=20descriptors,=20each?= =?UTF-8?q?=20a=20failed=20VpnService.protect()=20when=20Wi-Fi=20appeared,?= =?UTF-8?q?=20and=20a=20reused=20descriptor=20number=20could=20have=20been?= =?UTF-8?q?=20pulled=20out=20of=20the=20tunnel;=20the=20diag=20log=20says?= =?UTF-8?q?=20=C2=ABdisconnect=20requested=C2=BB=20instead=20of=20=C2=ABus?= =?UTF-8?q?er=C2=BB=20for=20any=20deliberate=20disconnect=20(the=20trusted?= =?UTF-8?q?-network=20park=20was=20logged=20as=20the=20user's)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5.2 --- .../java/org/strongswan/android/logic/SaCloseReason.kt | 4 +++- .../main/jni/libandroidbridge/backend/android_dns_proxy.c | 8 +++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt index eeae75fc5..93749ed10 100644 --- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt +++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt @@ -17,7 +17,9 @@ package org.strongswan.android.logic /** Why an established IKE SA went down; for the diagnostic log only (plan 8.1). */ enum class SaClose(val label: String, val drop: Boolean) { - USER("user", false), + /* any deliberate disconnect: the user, a scenario, a pause or the trusted-network + * park (the line logged just before says which) */ + USER("disconnect requested", false), REAUTH("reauth", false), RETRANSMIT_AFTER_NETWORK_CHANGE("retransmit-timeout after network change", true), RETRANSMIT_TIMEOUT("retransmit-timeout", true), diff --git a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c index e5ddeb14f..df2a033d8 100644 --- a/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c +++ b/src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c @@ -22,6 +22,7 @@ #include #include "android_dns_proxy.h" +#include "../charonservice.h" #include #include @@ -137,7 +138,12 @@ static int open_socket(int family) DBG1(DBG_NET, "could not open proxy socket: %s", strerror(errno)); return -1; } - if (!charon->kernel->bypass_socket(charon->kernel, skt, family)) + /* not through the kernel interface: that also adds the socket to the list + * that is protected again on every network change, from which nothing is + * ever removed. These sockets live for SOCKET_TIMEOUT seconds, so the + * list only collected closed descriptors (43 failed protect() calls on + * one roam after an hour, more with every query) */ + if (!charonservice->bypass_socket(charonservice, skt, FALSE)) { DBG1(DBG_NET, "installing bypass policy for proxy socket failed"); close(skt);