I was following the situation with the multicast, DNS leaks outside the VPN tunnel for a while but didn't grasp the full picture. What issues are resolved and perist currently?
I'd love to get some explanations on 0edb781:
// Unfortunately we have to allow system apps to use this service even when under a lockdown
// VPN, otherwise would break things.
// Prevent unicast leaks. Can only do this for regular apps as core system and system apps rely
// on this being allowed.
// TODO: Review IP_UNICAST_IF and IP_PKTINFO.
// TODO: Review PermissionMonitor#hasRestrictedNetworkPermission to see if this covers all of
// the system uids that need to SO_BINDTODEVICE. These uids do not have LOCKDOWN_VPN_MATCH.
I remember reading the code and coming to the conclusion it isn't safe to use IPv6 for now, but i literally don't remember how i came up to this conclusion.