vpnhide/docs
Danila Gornushko db77076d0d
Some checks failed
CI / setup (push) Waiting to run
CI / lint (push) Blocked by required conditions
CI / kmod-activator (push) Blocked by required conditions
CI / kmod (android12-5.10) (push) Blocked by required conditions
CI / kmod (android13-5.10) (push) Blocked by required conditions
CI / kmod (android13-5.15) (push) Blocked by required conditions
CI / kmod (android14-5.15) (push) Blocked by required conditions
CI / kmod (android14-6.1) (push) Blocked by required conditions
CI / kmod (android15-6.6) (push) Blocked by required conditions
CI / kmod (android16-6.12) (push) Blocked by required conditions
CI / kmod-qemu (android12-5.10) (push) Blocked by required conditions
CI / kmod-qemu (android13-5.10) (push) Blocked by required conditions
CI / kmod-qemu (android13-5.15) (push) Blocked by required conditions
CI / kmod-qemu (android14-5.15) (push) Blocked by required conditions
CI / kmod-qemu (android14-6.1) (push) Blocked by required conditions
CI / kmod-qemu (android15-6.6) (push) Blocked by required conditions
CI / kmod-qemu (android16-6.12) (push) Blocked by required conditions
CI / kpm-qemu (android12-5.10) (push) Blocked by required conditions
CI / kpm-qemu (android13-5.10) (push) Blocked by required conditions
CI / kpm-qemu (android13-5.15) (push) Blocked by required conditions
CI / kpm-qemu (android14-5.15) (push) Blocked by required conditions
CI / kpm-qemu (android14-6.1) (push) Blocked by required conditions
CI / kpm-qemu (android15-6.6) (push) Blocked by required conditions
CI / kpm-qemu (android16-6.12) (push) Blocked by required conditions
CI / kpm-qemu-legacy (4.14) (push) Blocked by required conditions
CI / kpm-qemu-legacy (4.19) (push) Blocked by required conditions
CI / kpm-qemu-legacy (5.4) (push) Blocked by required conditions
CI / kpm (push) Blocked by required conditions
CI / zygisk (push) Blocked by required conditions
CI / lsposed (push) Blocked by required conditions
CI / portshide (push) Blocked by required conditions
CI / release (push) Blocked by required conditions
QEMU Test Images / build-push (android12-5.10) (push) Has been cancelled
QEMU Test Images / build-push (android13-5.10) (push) Has been cancelled
QEMU Test Images / build-push (android13-5.15) (push) Has been cancelled
QEMU Test Images / build-push (android14-5.15) (push) Has been cancelled
QEMU Test Images / build-push (android14-6.1) (push) Has been cancelled
QEMU Test Images / build-push (android15-6.6) (push) Has been cancelled
QEMU Test Images / build-push (android16-6.12) (push) Has been cancelled
QEMU Test Images / build-legacy (push) Has been cancelled
fix(kmod): hide VPN ifaces from the SIOCGIFCONF size query, not just the fill (#213)
The classic two-step SIOCGIFCONF enumeration first calls with ifc_req == NULL
to learn the buffer size (the kernel returns ifc_len = N * sizeof(struct ifreq)
without copying anything), then calls again with a sized buffer. sock_ioctl_ret
filtered the fill but bailed on the NULL probe, so the size query returned the
unfiltered count — a target comparing the two back-to-back saw a one-interface
discrepancy that revealed a hidden VPN.

sock_ioctl_ret now also handles ifc_req == NULL: it rcu-enumerates the socket's
netns netdevs (net captured at entry from the socket, matching dev_ifconf's
sock_net) and subtracts sizeof(struct ifreq) per IPv4-addressed VPN iface,
matched by ifa_label — the exact set and naming inet_gifconf would have emitted
— so the size query agrees with the filtered fill.

Validated by a new harness vector (ifconf_size_probe, via kmod/test/ifconf-probe.c)
asserting a target's size query equals its filtered fill and drops below the
non-target size query: 19/19 PASS, no panic, on GKI 6.1 and 6.6 in QEMU; CI
covers the remaining KMIs once the ddk-qemu image rebuilds with the new probe.

The 32-bit compat SIOCGIFCONF path (compat_sock_ioctl) remains unhooked and is
tracked in docs as low priority. The KPM backend's filter_ifconf still bails on
the NULL probe (raw netdev walking by per-kver offset is not worth it for the
legacy probe) and is noted as WIP parity.
2026-06-30 15:52:13 +03:00
..
adb-root-debugging.md docs: clarify adb su command quoting 2026-06-29 15:56:51 +03:00
changelog.md fix(scripts): CHANGELOG.md at release time + Markdown fragments 2026-04-19 21:57:34 +03:00
detection-vectors.md fix(kmod): hide VPN ifaces from the SIOCGIFCONF size query, not just the fill (#213) 2026-06-30 15:52:13 +03:00
development.md Pin C formatting to clang-format 18 2026-06-29 02:55:57 +03:00
protocol.md Drop dead proc diagnostics, fix misaligned reads, align parser parity (#206) 2026-06-30 11:30:11 +03:00
releasing.md build: align native cdylib on 16 KiB; unify kmod/zygisk build scripts 2026-04-26 23:26:30 +03:00
ROADMAP.md kmod host-route: cover the legacy kernels (4.14/4.19/5.4), document the 32-bit SIOCGIFCONF gap (#211) 2026-06-30 11:32:26 +03:00
state.md feat(lsposed): improve protection help 2026-06-29 14:02:47 +03:00
storage.md Add backend-specific native hook selection 2026-06-29 19:24:03 +03:00