celzero / rethink-app

## Rethink DNS + Firewall + VPN for Android
A multi-hop WireGuard client, an OpenSnitch-inspired firewall and network monitor + a pi-hole-inspired DNS over HTTPS (DoH), Oblivious DoH, DNS over TLS (DoT), DNSCrypt client with blocklists.
 Release certificate SHA-256 digests: 
 *Prod flavour on the Play Store & Website*: `1f32d432e81a1dc5c00aafeb0c6636cd7819965d174420e59db9675dff7a88e9`. 
 *Izzy flavour*: `80e15f1ed5a1ec512c51E14aa29b18c7befe13c1acb6cfec4b87bd31d171fe7f`. 
 *Alpha flavour on GitHub*: `014da2d3c66439105d1238f3bcf5705d63a7ce2da2f54005f72066cf8717bbbf`. 
In other words, Rethink DNS + Firewall + VPN has three primary modes, VPN, DNS, and Firewall. The VPN (proxifier) mode supports multiple WireGuard upstreams in a split-tunnel configuration. The DNS mode routes all DNS traffic generated by apps to _any_ user-chosen DNS-over-HTTPS / Oblivious DNS-over-HTTPS / DNS-over-TLS / DNSCrypt resolver, or to WireGuard-configured DNS in a split-tunnel configuration. The Firewall mode lets the user deny internet-access to entire applications based on events like screen-on / screen-off, app-foreground / app-background, unmetered-connection / metered-connection; or based on play-store defined categories like Social, Games, Utility, Productivity; or additionally, based on user-defined domain & IP denylists.
 *screenshots from `v055e`.* 
### VPN / Proxifier
Rethink supports forwarding TCP & UDP over SOCKS5, HTTP CONNECT, and WireGuard tunnels. Split-tunneling further helps run multiple such tunnels at the same time and lets users route different apps over different tunnels. For example, one could route Firefox over SOCKS5 connecting to Tor, Netflix over WireGuard connecting through any popular VPN provider, and Telegram or WhatsApp over censorship-resistant HTTP CONNECT endpoints at the same time.
### Firewall
The firewall doesn't really care about the connections per se rather what's making those connections. This is different from the traditional firewalls but in-line with Little Snitch, LuLu, Glasswire and others.
Currently, per-app connection mapping is implemented by capturing `udp` and `tcp` flows managed by `firestack` (written in Go) and asking ConnectivityService for the owner, an API available only on Android 10+. `procfs` (`/proc/net/tcp` and `/proc/net/udp`) is read on-demand to track per-app connections like NetGuard or OpenSnitch do, on Android 9 & below.
### Network Monitor
A network monitor is a per-app report-card of sorts on when connections were made, how many were made, and to where. Tracking UDP / TCP (and DNS on Android 12+) is straight-forward. DNS requests are trickier to track on Android 11 & below, and so a rough heuristic is used for now, which may not hold good in all cases.
### DNS over HTTPS client
Almost all of the network related code (`firestack`), including DNS over HTTPS split-tunnel, is a hard fork of Jigsaw-Code/outline-go-tun2socks written in golang. The UI is vastly different but borrows minimally from Jigsaw-Code