android: DNS proxy sockets are no longer re-protected on every network change: they were added to the list of sockets protected again on a roam, from which nothing is ever removed, although they are closed after 30 s - one hour of use left 43 closed descriptors, each a failed VpnService.protect() when Wi-Fi appeared, and a reused descriptor number could have been pulled out of the tunnel; the diag log says «disconnect requested» instead of «user» for any deliberate disconnect (the trusted-network park was logged as the user's)

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

src/frontends/android/app/src/main/java/org/strongswan/android/logic/SaCloseReason.kt

@@ -17,7 +17,9 @@ package org.strongswan.android.logic
 /** Why an established IKE SA went down; for the diagnostic log only (plan 8.1). */
 enum class SaClose(val label: String, val drop: Boolean)
 {
-	USER("user", false),
+	/* any deliberate disconnect: the user, a scenario, a pause or the trusted-network
+	 * park (the line logged just before says which) */
+	USER("disconnect requested", false),
 	REAUTH("reauth", false),
 	RETRANSMIT_AFTER_NETWORK_CHANGE("retransmit-timeout after network change", true),
 	RETRANSMIT_TIMEOUT("retransmit-timeout", true),

src/frontends/android/app/src/main/jni/libandroidbridge/backend/android_dns_proxy.c

@@ -22,6 +22,7 @@
 #include <string.h>
 
 #include "android_dns_proxy.h"
+#include "../charonservice.h"
 
 #include <daemon.h>
 #include <threading/rwlock.h>
@@ -137,7 +138,12 @@ static int open_socket(int family)
 		DBG1(DBG_NET, "could not open proxy socket: %s", strerror(errno));
 		return -1;
 	}
-	if (!charon->kernel->bypass_socket(charon->kernel, skt, family))
+	/* not through the kernel interface: that also adds the socket to the list
+	 * that is protected again on every network change, from which nothing is
+	 * ever removed.  These sockets live for SOCKET_TIMEOUT seconds, so the
+	 * list only collected closed descriptors (43 failed protect() calls on
+	 * one roam after an hour, more with every query) */
+	if (!charonservice->bypass_socket(charonservice, skt, FALSE))
 	{
 		DBG1(DBG_NET, "installing bypass policy for proxy socket failed");
 		close(skt);