# DragonTCP Lite VPN

This version deliberately returns to the lightweight DragonTCP architecture.
DragonTCP itself is an HTTP/HTTPS CONNECT proxy tunnel; Android's `VpnService`
is only the local adapter that feeds normal app TCP traffic into that proxy.

## Architecture

```text
Android apps
     |
     | IPv4 TCP / DNS packets
     v
Android VpnService TUN
     |
     | lightweight userspace TCP adapter
     v
127.0.0.1:8080 HTTP CONNECT
     |
     v
DragonTCP Go client
     |
     | adaptive records + mandatory XOR 0xAD
     | TCP/53
     v
DragonTCP Lite server
     |
     v
Internet destination
```

There is **no Linux TUN**, no server NAT, no raw-IP DragonTCP protocol, and no
packet batching on the DragonTCP server. The remote side is the same style of
lightweight stream proxy that worked in the earlier Termux tests.

## Defaults

Android:

```text
Server port:       53/TCP
Token:             optional / empty allowed
Local proxy:       127.0.0.1:8080
Pollers:           1 (fixed)
Reconnect Every:   1
Chunk Start:       Max Chunk
Chunk Min:         32
Chunk Max:         1,048,576 bytes
Chunk Grow After:  16 successes
Chunk timeout:     2 seconds
XOR:               0xAD, mandatory
DNS:               1.1.1.1 through DNS-over-TCP through DragonTCP
```

The Android log is intentionally quiet. It shows service state, actual errors,
and DragonTCP adaptive changes such as:

```text
adaptive upload chunk: 65536 -> 32768 after transport failure
adaptive download chunk: 32 -> 64 after stable success
```

It does not redraw the screen or print periodic traffic statistics.

## Android traffic behavior

- IPv4 TCP: forwarded through DragonTCP.
- DNS UDP/53: converted to DNS-over-TCP and sent to `1.1.1.1` through the local
  DragonTCP HTTP CONNECT proxy.
- IPv6: captured by the VPN and dropped so it cannot bypass DragonTCP.
- Other UDP: not forwarded in this HTTP CONNECT build.
- ICMP/ping: not forwarded.

This trade-off keeps DragonTCP itself lightweight and stream-oriented.

## Start the server

Port 53 is privileged on Linux, so run as root:

```bash
sudo ./dragontcp-lite-server-linux-amd64 --chunk-max 1048576
```

No token is required by default. To require one:

```bash
sudo ./dragontcp-lite-server-linux-amd64 --token 'SECRET' --chunk-max 1048576
```

The Android Token field must contain the same value.

If you do not want to run the binary as root:

```bash
sudo setcap cap_net_bind_service=+ep ./dragontcp-lite-server-linux-amd64
./dragontcp-lite-server-linux-amd64
```

If TCP/53 is already occupied by a DNS resolver, free that port first.

## Android usage

1. Install `DragonTCP-LiteVPN-arm64.apk`.
2. Enter the server address.
3. Leave Port at `53`.
4. Leave Token empty if the server was started without `--token`.
5. Keep `Reconnect every = 1` for restrictive networks.
6. Press **CONNECT** and approve Android's VPN dialog.
7. Press **STOP** to terminate both the TUN adapter and DragonTCP core.

The app excludes its own UID from the VPN, so the DragonTCP TCP/53 transport
uses the physical/mobile network and does not loop into its own TUN interface.

## Build everything from source

Requirements:

- Go 1.22+
- JDK 17+
- Android SDK platform + build-tools (35 works)
- Android 10 / API 29 or newer on the phone
- Kotlin compiler 1.9.x distribution containing
  `kotlinx-coroutines-core-jvm.jar`
- `zip`

Example environment:

```bash
export ANDROID_SDK_ROOT="$HOME/Android/Sdk"
export KOTLIN_HOME="$HOME/.sdkman/candidates/kotlin/current"
```

Then:

```bash
./build_all.sh
```

Outputs:

```text
bin/dragontcp-lite-server-linux-amd64
bin/dragontcp-lite-server-linux-arm64
android/lib/arm64-v8a/libdragontcp_client.so
android/build/DragonTCP-LiteVPN-arm64.apk
```

`libdragontcp_client.so` is intentionally the Android ARM64 Go executable stored
in the APK native-library directory. `DragonService` launches it with
`ProcessBuilder`; it is not JNI.

## Build only the Go core/server

```bash
./build_core.sh
```

## Build only the APK

After the core has been built:

```bash
cd android
./build_apk.sh
```

The script creates a local debug signing key if one does not already exist.
For production distribution, supply your own keystore/signing process.

## Source layout

```text
core/                               DragonTCP Go client/server
android/src/com/dragontcp/client/   Android UI + VpnService
android/src/tech/xvanturing/...     Lightweight TUN-to-proxy stack
android/lib/arm64-v8a/              Embedded DragonTCP Android core
licenses/                           Third-party licenses
```

## Third-party stack

The userspace Android TUN/TCP adapter is adapted from the Apache-2.0-licensed
FreeProxy project. See `THIRD_PARTY_NOTICES.md` and
`licenses/FreeProxy-APACHE-2.0.txt`.

## Validation performed for this package

- Go unit/build checks: PASS.
- Empty-token client/server protocol: PASS.
- Fixed 1 poller + reconnect every 1: PASS.
- 8 MiB HTTP transfer through local DragonTCP proxy: SHA-256 exact.
- Kotlin TUN adapter compilation: PASS.
- Android Java service/UI compilation: PASS.
- ARM64 Android DragonTCP core build: PASS.
- APK resource/DEX/native packaging: PASS.
- APK signature verification (v3): PASS.
- Supplied APK uses the same signing certificate as the previous Lite/v7 APK and has versionCode 10, so it can be installed as an in-place update.

A physical Android device is still required to validate the final VpnService
path against a real mobile network.

## v10 split UI update

This release changes only the Android UI. The embedded DragonTCP transport
core and the Lite server are unchanged from the working Lite release.

UI changes:

- Live Log is a true sibling pane below the settings pane; it is never drawn
  over the settings.
- The settings pane is explicitly clipped to its own region.
- The settings scrollbar is hidden, so no scrollbar can appear behind the log.
- Live Log keeps its own internal scroll area and receives appended lines
  without rebuilding the Activity.
- A visible divider separates settings from Live Log.
- CONNECT remains disabled while connecting/connected and STOP remains state-aware.
- The visible XOR wording was removed from the Android UI. Transport behavior
  itself is unchanged.
- The Activity explicitly uses `adjustResize` when the keyboard opens.

The APK is versionCode 10 / versionName `10.0-lite-split-ui` and is signed with
the same certificate as the previous Lite UI build.