Android previously treated setTunFd as a single-instance update, and the
VpnService plugin could only expose one IPv4 address. That made shared
TUN members disable each other or leave only one address configured.
Group enabled Android TUN instances by shared dev_name, send the fd to
every compatible member, and only disable incompatible TUN users. Build
the Android VPN request from the whole running shared group and pass
every IPv4 address to VpnService.
The shared mobile dispatcher now owns current fd device state on a
process-level runtime. New setTunFd calls replace that state even when
the raw fd number is reused, and mobile TUN read/write/create failures
rebuild with backoff while preserving member registrations.
Protect shared member cleanup with per-registration ownership tokens, so
old async cleanup cannot unregister a recreated member or remove its
source claims. Mobile source addresses are registered in the dispatcher
without applying OS ifcfg changes, so Android-originated packets return
through the owning instance.
When one shared member stops while another remains, notify the frontend
to recalculate the VpnService config instead of leaving stale addresses
and routes. Serialize Android VpnService config recalculation so stale
async events cannot overwrite newer shared-group state.
If one shared member is not ready, rebuild from the healthy members and
retry the missing member later. If no healthy member remains, stop the
Android VPN service instead of keeping stale routes active.
Cover shared tun duplicate proxy CIDR failover and runtime proxy
CIDR add/remove through netns integration tests.
Start IP proxy from config patch events so a node that did not have
proxy CIDRs at startup can serve a later proxy network patch.
Ignore NotFound for shared NIC remove-side ifcfg cleanup so member
teardown does not poison shared owner state when the OS item is
already gone.
Add dispatcher coverage for TUN read failure invalidation and member
close notification.
Track each shared tun member's claimed IPv4 and IPv6 addresses in
the dispatcher.
When a packet arrives from the shared device, keep the existing flow
affinity lookup first, then route by source address owner before
falling back to an arbitrary member. This keeps public IPv6 auto
traffic on the member that owns the leased address while preserving
the simple local-origin fallback.
Migrate high-value shared tun coverage from the backup branch: real
member communication, no_tun isolation, proxy CIDR forwarding, and
public IPv6 auto through a shared device.
Replace full flow table clears with a small FIFO order queue so overflow evicts only older flow ownership hints.
Keep lookup read-only on the packet hot path and prune stale queue entries when a shared member unregisters.
Parse shared virtual nic flow keys directly from IP payload bytes instead of building pnet packet wrappers on the dispatcher hot path.
Use a local HashMap for flow owner lookup and clear the bounded table on overflow instead of removing a BTreeMap entry by key order.
Move shared member and flow ownership state into the dispatcher task.
Use control messages for member register and unregister events.
Keep the member table lock off the packet forwarding path.
Add the shared NIC dispatcher that owns the underlying VirtualNic tunnel.
Connect member ring tunnels through a private member table.
Track reverse flow ownership from packets written by a member.
Replies read from the shared device go back to the same member.
Packets without an owner fall back to any active member.
Mark the shared NIC invalid when the underlying tunnel closes or fails.
Notify members so their NicCtx can rebuild.
sijie.sun