Add root DNS hijacker support

.gitignore

@@ -48,6 +48,8 @@ proguard/
 # native binaries
 libs/
 obj/
+dnsdaemon/libs/
+dnsdaemon/obj/
 
 # IDE related 
 .idea/

app/src/main/AndroidManifest.xml

@@ -162,6 +162,9 @@
         <activity
             android:name=".activity.LogHubActivity"
             android:configChanges="orientation|keyboardHidden|screenSize|keyboard|locale|screenLayout"></activity>
+        <activity
+            android:name=".activity.DnsQueriesActivity"
+            android:configChanges="orientation|keyboardHidden|screenSize|keyboard|locale|screenLayout"></activity>
         <activity
             android:name=".activity.ApplicationErrorsActivity"
             android:configChanges="orientation|keyboardHidden|screenSize|keyboard|locale|screenLayout"></activity>
@@ -224,6 +227,9 @@
                 <category android:name="android.intent.category.DEFAULT" />
             </intent-filter>
         </receiver>
+        <receiver
+            android:name=".broadcast.DnsBlocklistUpdateReceiver"
+            android:exported="false" />
         <receiver
             android:name=".broadcast.PackageBroadcast"
             android:exported="true">

app/src/main/java/dev/ukanth/ufirewall/Api.java

@@ -129,6 +129,7 @@
 import dev.ukanth.ufirewall.MainActivity.GetAppList;
 import dev.ukanth.ufirewall.customrules.CustomRule;
 import dev.ukanth.ufirewall.customrules.CustomRule_Table;
+import dev.ukanth.ufirewall.dns.DnsHijackManager;
 import dev.ukanth.ufirewall.log.Log;
 import dev.ukanth.ufirewall.log.LogData;
 import dev.ukanth.ufirewall.log.LogData_Table;
@@ -1173,6 +1174,10 @@ private static boolean applyIptablesRulesImpl(final Context ctx, RuleDataSet rul
                 cmds.add("-t nat -I OUTPUT 1 -j " + chainName);
             }
 
+            // DNS redirect must be built in the same root batch as firewall apply so stale root
+            // grants fail through normal apply logging instead of leaving half-installed redirects.
+            DnsHijackManager.appendApplyCommands(ctx, cmds, ipv6);
+
             // custom rules in afwall-{3g,wifi,reject} supersede everything else
             addCustomRules(Api.PREF_CUSTOMSCRIPT, cmds, ipv6);
 
@@ -1348,7 +1353,6 @@ private static void iptablesCommands(List<String> in, List<String> out, boolean
         }
         boolean firstLit = true;
         for (String s : in) {
-            s = s + waitTime;
             if (s.matches("#LITERAL# .*")) {
                 if (firstLit) {
                     // export vars for the benefit of custom scripts
@@ -1359,11 +1363,12 @@ private static void iptablesCommands(List<String> in, List<String> out, boolean
                             + "export IPV6=" + (ipv6 ? "1" : "0") + "; "
                             + "true");
                 }
+                // Literal commands may be supervisor/control scripts and must not inherit iptables flags.
                 out.add(s.replaceFirst("^#LITERAL# ", ""));
             } else if (s.matches("#NOCHK# .*")) {
-                out.add(s.replaceFirst("^#NOCHK# ", "#NOCHK# " + ipPath + " "));
+                out.add(s.replaceFirst("^#NOCHK# ", "#NOCHK# " + ipPath + " ") + waitTime);
             } else {
-                out.add(ipPath + " " + s);
+                out.add(ipPath + " " + s + waitTime);
             }
         }
     }
@@ -1800,6 +1805,9 @@ public static void purgeIptables(Context ctx, boolean showErrors, RootCommand ca
         } else {
             cmdsv4.add("#NOCHK# -D OUTPUT -j " + chainName);
         }
+        // Purging firewall rules must also remove DNS capture, otherwise the root daemon can keep
+        // receiving traffic after the user thinks protection has been disabled.
+        DnsHijackManager.appendPurgeCommands(ctx, cmds, false);
 
         //make sure reset the OUTPUT chain to accept state.
         cmds.add("-P OUTPUT ACCEPT");
@@ -1828,6 +1836,7 @@ public static void purgeIptables(Context ctx, boolean showErrors, RootCommand ca
                 cmdsv6.add("-F " + chainName + s);
             }
             cmdsv6.add("#NOCHK# -D OUTPUT -j " + chainName);
+            DnsHijackManager.appendPurgeCommands(ctx, cmdsv6, true);
             cmdsv6.add("-P OUTPUT ACCEPT");
             if (G.enableInbound()) {
                 cmdsv6.add("-D INPUT -j " + chainName + "-input");

app/src/main/java/dev/ukanth/ufirewall/MainActivity.java

@@ -102,6 +102,7 @@
 import dev.ukanth.ufirewall.activity.CustomScriptActivity;
 import dev.ukanth.ufirewall.activity.HelpActivity;
 import dev.ukanth.ufirewall.activity.LogHubActivity;
+import dev.ukanth.ufirewall.dns.DnsHijackManager;
 import dev.ukanth.ufirewall.log.Log;
 import dev.ukanth.ufirewall.preferences.PreferencesActivity;
 import dev.ukanth.ufirewall.profiles.ProfileData;
@@ -1080,10 +1081,36 @@ public void onItemSelected(AdapterView<?> parent, View view, int position, long
             showOrLoadApplications();
             if (G.applyOnSwitchProfiles()) {
                 applyOrSaveRules();
+            } else {
+                refreshDnsProfilePolicyAfterSwitch();
             }
         }
     }
 
+    private void refreshDnsProfilePolicyAfterSwitch() {
+        if (!G.enableDnsHijack() || !G.dnsHijackUseProfilePolicy()) {
+            return;
+        }
+        Api.setRulesUpToDate(false);
+        ApplicationErrorLog.add(this, "DNS profile policy changed; refreshing DNS service for active profile: "
+                + G.activeDnsHijackPolicyProfile());
+        DnsHijackManager.repairDnsProtection(this, new RootCommand.Callback() {
+            @Override
+            public void cbFunc(RootCommand state) {
+                if (state.exitCode == 0) {
+                    ApplicationErrorLog.add(MainActivity.this,
+                            "DNS profile policy refresh completed for active profile: "
+                                    + G.activeDnsHijackPolicyProfile());
+                } else {
+                    ApplicationErrorLog.add(MainActivity.this,
+                            "DNS profile policy refresh failed after profile switch");
+                    runOnUiThread(() -> Api.toast(MainActivity.this,
+                            getString(R.string.dns_hijack_redirect_settings_failed)));
+                }
+            }
+        });
+    }
+
     @Override
     public void onNothingSelected(AdapterView<?> parent) {
 

app/src/main/java/dev/ukanth/ufirewall/activity/ApplicationErrorsActivity.java

@@ -13,6 +13,7 @@
 
 import dev.ukanth.ufirewall.Api;
 import dev.ukanth.ufirewall.R;
+import dev.ukanth.ufirewall.dns.DnsHijackManager;
 import dev.ukanth.ufirewall.util.ApplicationErrorLog;
 import dev.ukanth.ufirewall.util.G;
 import dev.ukanth.ufirewall.util.ThemeHelper;
@@ -76,6 +77,7 @@ public boolean onOptionsItemSelected(MenuItem item) {
     }
 
     private void refreshData() {
+        DnsHijackManager.syncServiceLogsToAppLog(this);
         String errors = ApplicationErrorLog.get(this);
         content.setText(errors.trim().isEmpty() ? getString(R.string.application_errors_empty) : errors);
     }

app/src/main/java/dev/ukanth/ufirewall/activity/ApplicationLogActivity.java

@@ -4,6 +4,7 @@
 import android.os.Bundle;
 
 import dev.ukanth.ufirewall.R;
+import dev.ukanth.ufirewall.dns.DnsHijackManager;
 import dev.ukanth.ufirewall.log.Log;
 
 public class ApplicationLogActivity extends RulesActivity {
@@ -19,6 +20,7 @@ protected void onCreate(Bundle savedInstanceState) {
     protected void populateData(final Context ctx) {
         result = new StringBuilder();
         updateLoadingState(getString(R.string.loading));
+        DnsHijackManager.syncServiceLogsToAppLog(ctx);
         writeHeading(result, false, "Logcat");
         result.append(Log.getApplicationLog());
         updateLoadingState(getString(R.string.ready));

app/src/main/java/dev/ukanth/ufirewall/activity/DataDumpActivity.java

@@ -222,6 +222,8 @@ private String detectSectionType(String line) {
             return "ifconfig";
         } else if (trimmed.contains("System info")) {
             return "system";
+        } else if (trimmed.equals(getString(R.string.dns_diagnostics_title))) {
+            return "dns";
         } else if (trimmed.contains("Preferences")) {
             return "preferences";
         } else if (trimmed.equals(getString(R.string.application_errors_title))) {
@@ -266,6 +268,17 @@ private void processSectionContent(String sectionType, String content) {
                 systemCard.setVisibility(View.VISIBLE);
                 systemContent.setText(trimmedContent);
                 break;
+
+            case "dns":
+                systemCard.setVisibility(View.VISIBLE);
+                String existingSystem = systemContent.getText().toString();
+                String dnsContent = getString(R.string.dns_diagnostics_title) + "\n" + trimmedContent;
+                if (!existingSystem.isEmpty()) {
+                    systemContent.setText(existingSystem + "\n\n" + dnsContent);
+                } else {
+                    systemContent.setText(dnsContent);
+                }
+                break;
 
             case "preferences":
                 preferencesCard.setVisibility(View.VISIBLE);