feat: migrate to sing-box 1.14.2

android/app/src/main/kotlin/org/getlantern/lantern/notification/NotificationManager.kt

@@ -250,6 +250,12 @@ class NotificationHelper {
         notificationManager.notify(notification.typeID, builder.build())
     }
 
+    // Cancels a notification posted by sendNotification, which uses the type ID
+    // as the notification ID.
+    fun cancelNotification(typeID: Int) {
+        notificationManager.cancel(typeID)
+    }
+
     private fun resolveNotificationSmallIcon(): Int {
         val configured = BuildConfig.NOTIFICATION_SMALL_ICON.removePrefix("@")
         val parts = configured.split("/", limit = 2)

android/app/src/main/kotlin/org/getlantern/lantern/service/LanternVpnService.kt

@@ -23,8 +23,8 @@ import kotlinx.coroutines.runBlocking
 import kotlinx.coroutines.sync.Mutex
 import kotlinx.coroutines.sync.withLock
 import kotlinx.coroutines.withContext
+import lantern.io.libbox.Libbox
 import lantern.io.libbox.Notification
-import lantern.io.libbox.StringIterator
 import lantern.io.libbox.TunOptions
 import lantern.io.mobile.Mobile
 import lantern.io.utils.Opts
@@ -291,17 +291,8 @@ open class LanternVpnService :
         notificationHelper.sendNotification(notification)
     }
 
-    override fun systemCertificates(): StringIterator {
-        //return empty iterator as we are not using system certificates
-        return object : StringIterator {
-            override fun hasNext(): Boolean = false
-            override fun len(): Int {
-                return 0
-            }
-
-            override fun next(): String = ""
-        }
-
+    override fun cancelNotification(identifier: String?, typeID: Int) {
+        notificationHelper.cancelNotification(typeID)
     }
 
     private suspend fun startRadiance() {
@@ -623,7 +614,12 @@ open class LanternVpnService :
         builder.addDisallowedApplication(BuildConfig.APPLICATION_ID)
 
         if (options.autoRoute) {
-            builder.addDnsServer(options.dnsServerAddress.value)
+            if (options.dnsMode.value != Libbox.DNSModeDisabled) {
+                val dnsServerAddress = options.dnsServerAddress
+                while (dnsServerAddress.hasNext()) {
+                    builder.addDnsServer(dnsServerAddress.next())
+                }
+            }
 
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
                 val inet4RouteAddress = options.inet4RouteAddress

android/app/src/main/kotlin/org/getlantern/lantern/service/PlatformInterfaceWrapper.kt

@@ -8,11 +8,16 @@ import android.os.Process
 import android.system.Os
 import android.system.OsConstants
 import androidx.annotation.RequiresApi
+import lantern.io.libbox.BridgeOptions
+import lantern.io.libbox.BridgeSession
 import lantern.io.libbox.ConnectionOwner
 import lantern.io.libbox.InterfaceUpdateListener
 import lantern.io.libbox.Libbox
 import lantern.io.libbox.LocalDNSTransport
+import lantern.io.libbox.NeighborUpdateListener
 import lantern.io.libbox.NetworkInterfaceIterator
+import lantern.io.libbox.PlatformUser
+import lantern.io.libbox.ShellSession
 import lantern.io.libbox.StringIterator
 import lantern.io.libbox.WIFIState
 import lantern.io.utils.PlatformInterface
@@ -197,6 +202,64 @@ interface PlatformInterfaceWrapper : PlatformInterface {
         }
     }
 
+    // Called on every openTun, so it must not throw.
+    override fun registerMyInterface(name: String?) {
+    }
+
+    // sing-box calls the methods below only for features Lantern doesn't
+    // configure: the neighbor resolver, the platform shell and SSH used by
+    // Tailscale, and the bridge outbound.
+
+    override fun startNeighborMonitor(listener: NeighborUpdateListener?) {
+        throw UnsupportedOperationException("neighbor monitor is not supported")
+    }
+
+    override fun closeNeighborMonitor(listener: NeighborUpdateListener?) {
+    }
+
+    override fun usePlatformShell(): Boolean {
+        return false
+    }
+
+    override fun checkPlatformShell() {
+        throw UnsupportedOperationException("platform shell is not supported")
+    }
+
+    override fun openShellSession(
+        user: PlatformUser?,
+        command: String?,
+        environ: StringIterator?,
+        term: String?,
+        rows: Int,
+        cols: Int
+    ): ShellSession {
+        throw UnsupportedOperationException("platform shell is not supported")
+    }
+
+    override fun lookupUser(username: String?): PlatformUser {
+        throw UnsupportedOperationException("user lookup is not supported")
+    }
+
+    override fun lookupSFTPServer(): String {
+        throw UnsupportedOperationException("SFTP server is not supported")
+    }
+
+    override fun readSystemSSHHostKey(): String {
+        throw UnsupportedOperationException("system SSH host key is not supported")
+    }
+
+    override fun tailscaleHostname(): String {
+        return ""
+    }
+
+    override fun usePlatformBridge(): Boolean {
+        return false
+    }
+
+    override fun createBridge(options: BridgeOptions?): BridgeSession {
+        throw UnsupportedOperationException("platform bridge is not supported")
+    }
+
     private class InterfaceArray(private val iterator: Iterator<lantern.io.libbox.NetworkInterface>) :
         NetworkInterfaceIterator {
 

docs/android-arm32-validation.md

@@ -23,7 +23,9 @@ Its verified APK SHA-256 is
 Physical testing also exposed gVisor TUN teardown retaining Android's VPN
 network after disconnect. The shared [sing-tun backport](https://github.com/getlantern/sing-tun/commit/5448fbd8b70bb2057bd1f6f2148830fde4f18f85)
 preserves `Attach(nil)` through its filter so the packet reader stops before
-closing the descriptor. Reconnect passes with that fix.
+closing the descriptor. Reconnect passes with that fix. The sing-tun that
+sing-box 1.14 uses includes the same fix upstream (be4ce8d320a5), so the
+backport is no longer pinned.
 
 ## Verified evidence