ignoramous Strangely, on Android 14, when I try ping localhost from Termux, I see Rethink reciving those ICMP echos but as coming from the underlying network's interface (and not lo).
Try "ping 127.0.0.1" instead. "localhost" is a domain name, so might get resolved by the regular DNS resolver. It should always resolve to 127.0.0.1, but just to be certain, better write the IP address.
ignoramous The technique employed by Meta (not Yandex) not rely on binding to ALL interfaces and not just lo? At least, that's what I understood from GrapheneOS' communication on Mastodon (link).
I don't think they bind to any interface. I haven't read it in details what Meta did, but as I understood it, they use the peer-to-peer protocol WebRTC built into most web browsers, and then claim to be 127.0.0.1 at some port number, and then ask to make a peer connection to them. If the web browser goes ahead to that without realizing that isn't a globally routable IP address, the web browser would connect to the Meta app running locally on the device at that port number.
ignoramous On Android 15, in our preliminary testing, under no circumstance is loopback traffic between apps sent to the TUN device
Yeah, it shouldn't be. It is intended to always stay local to the device. But thanks for testing and confirming.