OnionVPN

Privacy-focused Android VPN that routes all device traffic through Tor, with DNSCrypt for app DNS over Tor SOCKS (TunDnsMux divert). Inspired by InviZible and Mullvad-style leak protection.

What it does

- Tor tunnel: full-device VPN via hev-socks5-tunnel to Tor SOCKS; kill switch blocks traffic when the tunnel is down. - DNSCrypt: app DNS resolved through DNSCrypt (upstream via Tor); TunDnsMux on 10.8.0.1. - Interactive firewall: OpenSnitch-style Accept / Deny for new outbound connections (notification and prompt, FIFO queue, permanent / session / temporary rules). - Domain threat lists: HaGeZi lists colour destinations on prompts: green safe (unlisted), orange ads/tracking/telemetry, red malware/C2. Updates prefer Tor when the tunnel is up. - App lock: lock the UI without stopping the tunnel or kill switch. - Tor tuning: circuit rotation presets, stream isolation modes, editable torrc / dnscrypt-proxy.toml. - Tor engine: dual backend, C Tor (libtor.so, default) or Arti (arti-mobile and/or onionmasq TUN). - TUN data plane: hev-socks5 (C Tor / Arti fallback) or onionmasq (Arti preferred when libonionmasq_mobile.so is present). - Circuit UI: Onionmasq path with per-app hops, NEWNYM-per-app, exit directory from NewDirectoryEvent.

Security

OnionVPN opts into hardware memory tagging (MTE) with android:memtagMode="async" on <application>, the same pattern as GrapheneOS Auditor and Camera. On MTE-capable devices the OS enables tagging for the app process; on other devices the attribute is ignored.

Components loaded in the app process (JVM, Compose, Hilt, JNI .so such as hev, arti, onionmasq) are covered by MTE. libtor.so (C Tor) runs in a child process; arm64 builds from the Tor-Android-build-script use -fsanitize=memtag when ENABLE_MTE=1. DNSCrypt, Lyrebird and Conjure run in a child process under OS defaults (Go PTs are not MTE-instrumented).

hardened_malloc and extended virtual address space (48-bit VA) are GrapheneOS system features, not something an APK can embed. For this 64-bit-only app they are on by default on GrapheneOS. Do not disable Native code memory tagging, Hardened malloc, or Extended virtual address space for OnionVPN unless debugging a confirmed native memory bug.

After enabling the tunnel on a GrapheneOS Pixel 8+, check logcat:

adb logcat -d | grep -E 'SEGV_MTEAERR|hardened_malloc|memtag'

License

Proprietary / OnionPhone family