fix: drop blocking /proc and root-shell reads from the DNS hot path

Measured on a rooted Android 13 device (SM-N986N) with Root Proxy mode
running, logcat showed findUidFromProcNet being walked end to end per DNS
query — 892, 408 and 168 "Cannot read /proc/net/udp: EACCES" lines in three
consecutive minutes, i.e. ~7 queries/sec sustained, each one:

  - parsing /proc/net/udp and /proc/net/udp6 in full, twice, only to fail.
    The old comment assumed SELinux merely narrowed these reads to our own
    sockets; on this device they are flat EACCES, so the result is a
    guaranteed miss.
  - then running Shell.cmd("cat /proc/net/udp /proc/net/udp6").exec(), a
    blocking libsu call. libsu serialises every command on one shared
    shell, so DNS resolution queued behind these — and behind every
    iptables call. That is issue #130's failure mode, which the
    snapshotter was meant to have fixed. It didn't: a 100ms snapshot
    interval cannot catch DNS sockets that live a few milliseconds, so
    queries kept falling through to the shell.

On API 29+ the hot path now consults only the background snapshot, which is
what the existing comment already promised ("read this map without
blocking — no inline shell"). API < 29 keeps the direct /proc reads, where
they work without root and without SELinux denial. findUidFromProcNetRoot
is deleted rather than left unreachable.

What this costs is attribution, not filtering: a query whose socket the
snapshot missed is logged without an app name instead of with one. Blocking
decisions never consulted this UID.

Not yet measured after the change — reinstalling stopped the service, so
the post-fix logcat is empty for lack of traffic rather than for lack of
these calls. The pre-fix numbers above are real; the after is pending a
run with protection enabled.

SNAPSHOT_INTERVAL_MS stays at 100ms, so root mode still issues ~10 shell
commands/sec from the snapshotter itself. That is a separate cost, left
deliberately untouched here.

Refs #130, #226

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: nqmgaming

app/src/main/java/app/pwhs/blockads/utils/AppNameResolver.kt

@@ -40,9 +40,6 @@ class AppNameResolver(private val context: Context) {
     // DNS query lookups read this map without blocking — no inline shell.
     @Volatile private var procNetSnapshot: Map<Int, Int> = emptyMap()
 
-    // Read from the DNS hot path (many Go threads) to decide whether the
-    // /proc and root-shell lookups are worth attempting, so it needs to be
-    // visible across threads — see [rootModeActive].
     @Volatile private var snapshotJob: Job? = null
 
     /**
@@ -145,52 +142,41 @@ class AppNameResolver(private val context: Context) {
     }
 
     /**
-     * Look up /proc/net/udp and /proc/net/udp6 to find the UID owning the given port.
-     * Used on API < 29 and on Android 10+ in Root Proxy mode.
+     * Look up the UID owning the given port. Runs inline on every DNS query,
+     * so nothing blocking is allowed here.
      *
-     * Every step here runs inline on a DNS query, so each one must justify
-     * itself per query. Outside Root Proxy mode none of them can: on Android
-     * 10+ SELinux limits the unprivileged read to our own sockets (so it can
-     * never see the querying app's), and the root-shell read needs a root
-     * shell we don't have. Both are therefore gated — see [rootModeActive].
-     * Without that gate a VPN-mode query walks the whole chain and ends on a
-     * blocking libsu command; libsu serialises everything on one shared
-     * shell, so every DNS query queues behind the previous one. That is
-     * issue #130's failure mode, which the snapshotter fixed for Root
-     * Proxy mode only.
+     * On API 29+ the only source consulted is [procNetSnapshot], which
+     * [startSnapshotter] refreshes in the background. The two paths that used
+     * to follow it are gone from the hot path, because measurement on a rooted
+     * Android 13 device showed what they actually cost per query:
+     *
+     *  - `/proc/net/udp{,6}` direct reads: not merely SELinux-narrowed as the
+     *    old comment assumed, but flat `EACCES`. Two full-file parses per
+     *    query to guarantee a miss (~7 queries/sec sustained in logcat).
+     *  - the libsu root read: a blocking shell command per query. libsu runs
+     *    everything on one shared shell, so DNS resolution serialised behind
+     *    it — and behind every iptables call too. That is issue #130's
+     *    failure mode, which the snapshotter was supposed to have fixed; it
+     *    didn't, because a 100ms snapshot interval misses DNS sockets that
+     *    live for a few milliseconds, so queries kept falling through.
+     *
+     * The cost of dropping them is attribution, not filtering: a query whose
+     * socket the snapshot didn't catch is logged as unresolved instead of
+     * named. Blocking decisions never depended on this. API < 29 keeps the
+     * direct reads, where they work without root and without SELinux denial.
      */
     private fun findUidFromProcNet(port: Int): Int {
-        // Hot path (Root Proxy mode): read from the background snapshot.
         procNetSnapshot[port]?.let { return it }
 
-        val legacyAndroid = Build.VERSION.SDK_INT < Build.VERSION_CODES.Q
-        if (!legacyAndroid && !rootModeActive) return -1
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) return -1
 
         val hexPort = String.format("%04X", port)
-
-        // Unprivileged read fallback (works for own app's sockets and on older Android)
         findUidInProcFile("/proc/net/udp", hexPort)?.let { return it }
         findUidInProcFile("/proc/net/udp6", hexPort)?.let { return it }
 
-        if (!rootModeActive) return -1
-
-        // Root-privileged read: on Android 10+, SELinux restricts /proc/net/udp
-        // to only show the app's own sockets. In Root Proxy mode the snapshotter
-        // already covers this path; this branch is the slow-path safety net.
-        findUidFromProcNetRoot(hexPort)?.let { return it }
-
         return -1
     }
 
-    /**
-     * True while Root Proxy mode is running — [startSnapshotter] is called
-     * only by RootProxyService, so the snapshot job's presence is exactly the
-     * signal we need. Deliberately not `Shell.isAppGrantedRoot()`: that call
-     * can itself construct the shell this gate exists to avoid.
-     */
-    private val rootModeActive: Boolean
-        get() = snapshotJob != null
-
     /**
      * Build a port → UID map from the full /proc/net/udp{,6} table via
      * the libsu persistent root shell. Sockets owned by our own app
@@ -222,41 +208,6 @@ class AppNameResolver(private val context: Context) {
         return map
     }
 
-    /**
-     * Read /proc/net/udp and /proc/net/udp6 via root shell (libsu).
-     * This bypasses SELinux restrictions on Android 10+ that prevent
-     * normal apps from seeing other apps' socket entries.
-     */
-    private fun findUidFromProcNetRoot(hexPort: String): Int? {
-        try {
-            val result = com.topjohnwu.superuser.Shell.cmd(
-                "cat /proc/net/udp /proc/net/udp6 2>/dev/null"
-            ).exec()
-            if (!result.isSuccess) return null
-
-            for (line in result.out) {
-                try {
-                    val parts = line.trim().split("\\s+".toRegex())
-                    if (parts.size >= 8) {
-                        val localAddress = parts[1]
-                        val colonIndex = localAddress.lastIndexOf(':')
-                        if (colonIndex >= 0) {
-                            val localPort = localAddress.substring(colonIndex + 1)
-                            if (localPort.equals(hexPort, ignoreCase = true)) {
-                                return parts[7].toIntOrNull()
-                            }
-                        }
-                    }
-                } catch (_: Exception) {
-                    // Skip malformed lines
-                }
-            }
-        } catch (e: Exception) {
-            Timber.d("Root /proc/net lookup failed: ${e.message}")
-        }
-        return null
-    }
-
     private fun findUidInProcFile(path: String, hexPort: String): Int? {
         try {
             File(path).bufferedReader(Charsets.UTF_8).use { reader ->