WIP EXPERIMENT

net/dns/resolver/forwarder_android.go

@@ -0,0 +1,18 @@
+// Copyright (c) Tailscale Inc & contributors
+// SPDX-License-Identifier: BSD-3-Clause
+
+//go:build android
+
+package resolver
+
+import (
+	"net"
+
+	"tailscale.com/net/netns"
+	"tailscale.com/types/nettype"
+)
+
+func init() {
+	lc := &net.ListenConfig{Control: netns.ControlFuncForDNS()}
+	stdNetPacketListener = nettype.MakePacketListenerWithNetIP(lc)
+}

net/netns/netns_android.go

@@ -106,3 +106,10 @@ func controlC(network, address string, c syscall.RawConn) error {
 	}
 	return sockErr
 }
+
+// ControlFuncForDNS returns the Android-specific socket control function that
+// calls VpnService.protect() and bindSocketToNetwork(). This must be used for
+// DNS forwarder sockets to prevent them from being routed through the VPN.
+func ControlFuncForDNS() func(network, address string, c syscall.RawConn) error {
+	 return controlC
+}