Android 13+ excludeRoute bypass, arm64-only, pin ezvpn v0.0.43 - #7
Merged
Merged
Conversation
The 2013 Nexus 7 (32-bit armeabi-v7a) is no longer a target, so the docs, instructions and scripts lose the "physical device" serial and the fixed-adb-port notes. scripts/install-release-apk.sh now requires RELEASE_DEVICE_SERIAL instead of defaulting to that tablet, and scripts/run-device.sh no longer needs to refuse it. The app packages only arm64-v8a (ndk.abiFilters), per Google Play's 64-bit requirement; the core release zip's other ABIs are not shipped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC
The core's bypass set (server/relay underlay hosts a routed prefix would capture) was always subtracted from the tunnel routes, because VpnService.Builder had no excludeRoute before API 33. Subtraction splits the containing prefix into every sibling down to the host: a /128 inside a routed /56 became 72 IPv6 routes on the interface and in the detail screen. On API 33+ the plan now keeps the routes whole and the service installs the bypass hosts with Builder.excludeRoute — a throw route inside the routed prefix that wins by longest match. TunnelPlan.from takes the platform's capability as a flag so tunnelcore stays pure; subtraction remains for Android 10–12. DNS-coverage warnings are judged on the effective set under both shapes, so a resolver on a bypassed address still warns. Verified on the arm64 emulator (API 36) with a profile whose server sits inside its routed IPv6 /56: one /56 route plus a kernel throw route for the /128, the direct IPv6 path stays selected, both families reach the gateway. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC
The custom-relay /healthz probe no longer builds rustls-platform-verifier, which aborted the app on "Connection path" for profiles with custom relays. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
excludeRouteon API 33+: the core's bypass hosts were always subtracted from the tunnel routes (noexcludeRoutebefore Android 13), which turned a server/128inside a routed IPv6/56into 72 routes.TunnelPlan.from(…, excludeRoutes)now keeps routes whole on API 33+ and the service installs the bypass withVpnService.Builder.excludeRoute(a throw route, longest match wins); subtraction remains for Android 10–12. DNS-coverage warnings use the effective set under both shapes.ndk.abiFilters = arm64-v8a(Play's 64-bit requirement); the physical-device serial, fixed-adb-port notes and refusal logic are gone from docs/scripts.scripts/install-release-apk.shrequiresRELEASE_DEVICE_SERIAL./healthzprobe no longer buildsrustls-platform-verifier, which aborted the app on "Connection path" for profiles with custom relays (Verify custom-relay /healthz with webpki roots; 0.0.43 ezvpn#57).Test plan
./gradlew :tunnelcore:test :app:testDebugUnitTest :app:assembleDebug(newplanExcludesBypassInsteadOfSubtractingWhenThePlatformCan)lib/arm64-v8a/2600:…:a000::/56containing the server's underlay/128: readout shows the single/56+ bypass/128; kernel hasthrow 2600:…:b6f8 dev lo; direct IPv6 path selected; IPv4/IPv6 gateway pings OK; "Connection path" opens without the abort and shows both relays working; clean disconnect🤖 Generated with Claude Code
https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC