Mullvad report : VPN leaks DNS traffic outside the tunnel

[shuvashish76]

Findings
Identified scenarios where the Android OS can leak DNS traffic:

• If a VPN is active without any DNS server configured.
• For a short period of time while a VPN app is re-configuring the tunnel or is being force stopped/crashes.

Source: https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android
Android issue tracker: https://issuetracker.google.com/issues/337961996
Invisible Pro issue: Gedsh/InviZible#262

What's the stand of RDNS on this issue?

Previously mullvad reported similar issue for "connectivity check trafic". (Muntashir's CPC app work for this purpose)

[ignoramous]

• see: Show popular System Components by default #1167

re: claims in the article:

"If a VPN is active without any DNS server configured."

Rethink never leaves DNS servers unconfigured. They're always set to 10.111.222.3 (v4) or fd66:f83a:c650::3 (v6).

rethink-app/app/src/main/java/com/celzero/bravedns/service/BraveVPNService.kt

Lines 2823 to 2831 in 6fc4c28

	private fun addDnsServer4(b: Builder): Builder {
	b.addDnsServer(LanIp.DNS.make(IPV4_TEMPLATE))
	return b
	}
	private fun addDnsServer6(b: Builder): Builder {
	b.addDnsServer(LanIp.DNS.make(IPV6_TEMPLATE))
	return b
	}

"For a short period of time while a VPN app is re-configuring the tunnel or is being force stopped/crashes."

Rethink attempts "seamless handover" (that's been available in Android since Pie, I believe) when possible. "Seamless handover" is Android terminology for avoiding packet leaks for the brief time the tunnel is being re-created.

Rethink may crash, but we're hoping to eliminate those as much as possible: #1455