v6.2.0: Major release — encrypted DNS, content filtering, parental controls, threat intel, 7 new screens

v5.2: Expanded tracker DB (405 signatures), threat intel feeds (URLhaus, Spamhaus, ET), captive portal handling
v6.0: NetworkTrackerDb (200+ domains), DNS-over-TLS, local DNS server, safe search, encrypted backups, DNS stamps, schedule presets, DNS benchmark
v6.1: Per-app DNS rules, content filtering (12+ categories), proxy mode (no-VPN blocking), QR config sharing, parental controls (PIN lock), crash reporter, WebDAV sync, connection tracker, Vico charts, Glance widgets, Lottie animations
v6.2: DNS-over-QUIC (RFC 9250), WireGuard DNS proxy, 7 new settings screens, TLS fingerprinting (JA3/JA4), release hardening audit (operator precedence fixes, OkHttp leak fixes, security patches), 52/52 roadmap items complete

Author: SysAdminDoc

CLAUDE.md

@@ -1,6 +1,6 @@
 # HostShield
 
-![Version](https://img.shields.io/badge/version-5.0.0-blue)
+![Version](https://img.shields.io/badge/version-6.2.0-blue)
 ![License](https://img.shields.io/badge/license-GPL--3.0-green)
 ![Platform](https://img.shields.io/badge/platform-Android%208+-3DDC84?logo=android&logoColor=white)
 ![Kotlin](https://img.shields.io/badge/Kotlin-2.0-7F52FF?logo=kotlin&logoColor=white)
@@ -74,6 +74,9 @@
 | Feature | Description |
 |---------|-------------|
 | **DNS-over-HTTPS (DoH)** | RFC 8484 POST+GET. Cloudflare, Google, Quad9, NextDNS, AdGuard, Mullvad, CleanBrowsing |
+| **DNS-over-TLS (DoT)** | RFC 7858, TLSv1.3, SNI + hostname verification. Cloudflare, Google, Quad9, AdGuard |
+| **DNS-over-QUIC (DoQ)** | RFC 9250, QUIC Initial framing. AdGuard, NextDNS, Mullvad. Falls back to DoT |
+| **DNS-over-WireGuard** | Noise_IKpsk2 handshake, AES-256-GCM transport encryption. DNS-only WireGuard tunnel |
 | **Certificate Pinning** | SHA-256 pin validation per provider, unpinned fallback as last resort |
 | **Smart Latency Failover** | EMA-based latency tracking per provider, auto-selects fastest, falls back through all on failure |
 | **DNS Trap** | Routes hardcoded DNS IPs (8.8.8.8, 1.1.1.1, etc.) through VPN tunnel to prevent bypass |
@@ -154,14 +157,25 @@
 |---------|-------------|
 | **AMOLED Dark Theme** | Material 3 dark UI optimized for OLED displays |
 | **6 Accent Colors** | Teal, Blue, Purple, Green, Pink, Peach |
-| **24+ Screens** | Home, Sources, Rules, Stats, Settings, Logs, Apps, AppPrivacy, AppLogs, Firewall, ConnectionLog, DnsTools, NetworkStats, OverlapAnalysis, DnsLeakTest, RuleTest, HostsEditor, HostsDiff, AppExclusions, Onboarding, BlocklistGallery, AutomationAudit |
+| **31+ Screens** | Home, Sources, Rules, Stats, Settings, Logs, Apps, AppPrivacy, AppLogs, Firewall, ConnectionLog, DnsTools, NetworkStats, OverlapAnalysis, DnsLeakTest, RuleTest, HostsEditor, HostsDiff, AppExclusions, Onboarding, BlocklistGallery, AutomationAudit, ContentFilter, ParentalControls, DnsBenchmark, WebDavSync, CrashReports, QrConfig, TlsFingerprints |
 | **Home Dashboard** | Shield status, live query rate, cache hit rate, latency sparkline, top queried apps, category toggles, search history chips |
 | **Widgets** | Toggle widget + stats widget (blocked count, queries, block rate) |
 | **Quick Settings Tile** | VPN toggle from Quick Settings panel |
 | **App Shortcuts** | Long-press launcher: Toggle, Refresh Lists, Open Logs |
 | **Deep Links** | `hostshield://logs`, `hostshield://stats`, etc. |
 | **Onboarding Wizard** | Private DNS conflict detection, VPN permission, battery optimization |
 
+### Content Filtering & Parental Controls
+
+| Feature | Description |
+|---------|-------------|
+| **15 Content Categories** | Gaming, Streaming, Social Media, News, Shopping, Dating, Gambling, Adult, VPN/Proxy, Malware, and more — toggleable per category |
+| **Parental Controls** | 3 age profiles (Child, Teen, Adult) with automatic category blocking per profile |
+| **PIN Lock** | SHA-256 hashed PIN protects parental control settings from bypass |
+| **Local DNS Server** | "Portable Pi-hole" mode on port 5353 — other LAN devices can use phone as DNS filter |
+| **DNS Proxy Mode** | No-VPN, no-root DNS blocking via local proxy (tri-mode: VPN / Root / Proxy) |
+| **Safe Search Enforcement** | DNS-level rewriting for Google, Bing, DuckDuckGo, YouTube |
+
 ### Import, Export & Backup
 
 | Feature | Description |
@@ -247,7 +261,7 @@ All actions are rate-limited (5s cooldown per action per caller) and logged to t
 | Language | Kotlin 2.0 |
 | UI | Jetpack Compose + Material 3 |
 | DI | Hilt (Dagger) |
-| Database | Room (10 tables, 9 migrations) |
+| Database | Room (11 tables, 12 migrations) |
 | Preferences | DataStore |
 | Async | Coroutines + Flow, ViewModels + StateFlow |
 | Networking | OkHttp 4 (source downloads, DoH resolver) |
@@ -262,8 +276,8 @@ All actions are rate-limited (5s cooldown per action per caller) and logged to t
 ```
 app/src/main/java/com/hostshield/
 ├── data/
-│   ├── database/      # Room DB, DAOs, converters, migrations (v1-v9)
-│   ├── model/         # Entities (10 tables), enums
+│   ├── database/      # Room DB, DAOs, converters, migrations (v1-v12)
+│   ├── model/         # Entities (11 tables), enums
 │   ├── preferences/   # DataStore preferences (AppPreferences)
 │   ├── repository/    # HostShieldRepository
 │   └── source/        # SourceDownloader
@@ -273,32 +287,51 @@ app/src/main/java/com/hostshield/
 │   └── parser/
 │       └── HostsParser.kt    # Hosts file parser with wildcard support
 ├── service/
-│   ├── DnsVpnService.kt      # VPN packet loop (~2000 lines)
+│   ├── DnsVpnService.kt      # VPN packet loop (~2700 lines)
 │   ├── DnsCache.kt           # LRU + serve-stale + prefetch + negative/failure cache
 │   ├── DnsPacketBuilder.kt   # DNS wire format builder/parser
 │   ├── DohResolver.kt        # DoH with smart latency failover
+│   ├── DotResolver.kt        # DoT (RFC 7858, TLSv1.3, 4 providers)
+│   ├── DoqResolver.kt        # DoQ (RFC 9250, QUIC Initial, 3 providers)
+│   ├── WireGuardProxy.kt     # DNS-over-WireGuard (Noise_IKpsk2, AES-256-GCM)
 │   ├── CnameCloakDetector.kt # CNAME + SVCB/HTTPS cloak detection
 │   ├── CnameCloakUpdater.kt  # Remote CNAME cloak DB fetcher (AdGuard + NextDNS)
 │   ├── DohBypassUpdater.kt   # Remote DoH bypass list fetcher
 │   ├── RootDnsService.kt     # Root-mode DNS proxy
 │   ├── RootDnsLogger.kt      # Root-mode DNS logging with UID attribution
 │   ├── IptablesManager.kt    # Per-app firewall rule management
-│   ├── DnsCache.kt           # DNS response cache with RFC 8767/2308/9520
+│   ├── LocalDnsServer.kt     # LAN DNS server on port 5353
+│   ├── DnsProxyService.kt    # No-VPN proxy mode DNS blocking
+│   ├── ContentFilterManager.kt # 15 content filter categories
+│   ├── ParentalControlManager.kt # Age-profile parental controls + PIN
+│   ├── AppDnsRuleEngine.kt   # Per-app domain DNS rules
+│   ├── ConnectionTracker.kt  # Real-time per-app connection tracking
+│   ├── ThreatIntelManager.kt # Threat intel feeds + radix trie IP lookup
+│   ├── SafeSearchEnforcer.kt # DNS-level safe search rewriting
 │   ├── NetworkStatsTracker.kt
 │   ├── AutomationReceiver.kt # Broadcast intent API
 │   ├── ScreenStateReceiver.kt # Context-aware firewall state
 │   └── *Worker.kt            # HostsUpdate, AutoBackup, LogCleanup, etc.
 ├── ui/
 │   ├── navigation/    # Compose navigation graph
-│   ├── screens/       # 24+ screens (Home, Logs, Stats, Settings, Firewall, ...)
+│   ├── screens/       # 31+ screens (Home, Logs, Stats, Settings, Firewall, ...)
+│   ├── components/    # Vico charts, Lottie animations, animated log feed
+│   ├── widget/        # Glance widgets (toggle + stats)
 │   └── theme/         # Material 3 theme + accent colors
 └── util/
     ├── OfflineGeoIp.kt        # MaxMind GeoLite2 offline lookups
     ├── GeoIpLookup.kt         # ip-api.com online lookups (legacy)
     ├── TrackerSignatureDb.kt   # Exodus-style APK tracker scanner
+    ├── TlsFingerprinter.kt    # JA3/JA4 TLS ClientHello fingerprinting
     ├── AppPrivacyScorer.kt     # Per-app A-F privacy grades
     ├── ImportExportUtil.kt     # Multi-format import/export
+    ├── EncryptedBackup.kt      # AES-256-GCM encrypted backups
     ├── BackupRestoreUtil.kt    # Backup/restore to app storage
+    ├── WebDavSync.kt           # WebDAV cloud sync
+    ├── QrConfigSharing.kt      # QR code config sharing (GZIP+Base64)
+    ├── CrashReporter.kt        # Custom crash reporting
+    ├── DnsBenchmark.kt         # DNS resolver latency benchmark
+    ├── DnsStampParser.kt       # sdns:// DNS stamp parser
     ├── DiagnosticExporter.kt   # One-tap diagnostic report
     ├── PcapExporter.kt         # PCAP packet capture export
     └── RootUtil.kt             # Root detection + binary management
@@ -335,6 +368,9 @@ VPN mode: ~1-3% battery/day (all traffic routed through local TUN interface). Ro
 
 | Version | Highlights |
 |---------|-----------|
+| **6.2.0** | DoQ resolver (RFC 9250), WireGuard DNS proxy, 7 new UI screens, ConnectionTracker + TlsFingerprinter wired in. **Release hardening audit**: fixed ~60 operator precedence bugs in DNS wire format parsing across 6 files, WireGuard encryption failure no longer leaks plaintext, OkHttp response leaks fixed in 8 files, shell command injection prevention in root mode, CoroutineScope lifecycle fix in LocalDnsServer, private IP range validation fix, Compose crash safety, ProGuard rules for all new classes. **52/52 roadmap items complete** |
+| **6.1.0** | Per-app DNS rules, content filtering (15 categories), proxy mode, QR config sharing, parental controls, crash reporter, WebDAV sync, connection tracker, Vico charts, Lottie animations, Glance widgets |
+| **6.0.0** | Threat intel integration, NetworkTrackerDb, Safe Search enforcement, DNS benchmark, local DNS server, DoT resolver, encrypted backups, DNS stamps, schedule presets |
 | **5.0.0** | Serve-stale DNS (RFC 8767), SERVFAIL caching (RFC 9520), cache prefetching, hash set fast path (~2x), filter decision LRU cache, CNAME cloak databases (AdGuard+NextDNS), SVCB/HTTPS record parsing, offline GeoIP (MaxMind GeoLite2), configurable TTL caps |
 | 4.6.0 | DNS latency sparkline, source summary stats, search history persistence |
 | 4.5.0 | Query type distribution chart, per-app DNS log drill-down, permanent block/allow in log detail |

README.md

@@ -1,4 +1,4 @@
-// HostShield v5.0.0
+// HostShield v6.2.0
 plugins {
     id("com.android.application")
     id("org.jetbrains.kotlin.android")
@@ -15,8 +15,8 @@ android {
         applicationId = "com.hostshield"
         minSdk = 26
         targetSdk = 35
-        versionCode = 49
-        versionName = "5.0.0"
+        versionCode = 55
+        versionName = "6.2.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
 
@@ -145,9 +145,25 @@ dependencies {
     // DataStore for preferences
     implementation("androidx.datastore:datastore-preferences:1.1.1")
 
+    // Custom Tabs (captive portal login)
+    implementation("androidx.browser:browser:1.8.0")
+
     // Splash screen
     implementation("androidx.core:core-splashscreen:1.0.1")
 
+    // v6.1: Vico chart library (Roadmap #26)
+    implementation("com.patrykandpatrick.vico:compose-m3:2.0.1")
+
+    // v6.1: Lottie animations (Roadmap #27)
+    implementation("com.airbnb.android:lottie-compose:6.6.2")
+
+    // v6.1: Jetpack Glance widgets (Roadmap #29)
+    implementation("androidx.glance:glance-appwidget:1.1.1")
+    implementation("androidx.glance:glance-material3:1.1.1")
+
+    // v6.2: QR code generation for config sharing (Roadmap #38)
+    implementation("com.google.zxing:core:3.5.3")
+
     // v5.0: MaxMind GeoIP2 for offline GeoIP lookups (replaces ip-api.com rate-limited API)
     // Bundled GeoLite2-Country.mmdb (~6MB) + GeoLite2-ASN.mmdb (~8MB)
     implementation("com.maxmind.geoip2:geoip2:4.2.1")

app/app/build.gradle.kts

@@ -57,6 +57,7 @@
 # ── Services ──────────────────────────────────────────────────
 -keep class com.hostshield.service.DnsVpnService { *; }
 -keep class com.hostshield.service.RootDnsService { *; }
+-keep class com.hostshield.service.DnsProxyService { *; }
 -keep class com.hostshield.service.HostShieldTileService { *; }
 -keep class com.hostshield.service.DnsPacketBuilder { *; }
 -keep class com.hostshield.service.DnsCache { *; }
@@ -66,20 +67,36 @@
 -keep class com.hostshield.service.CnameCloakDetector$CnameResult { *; }
 -keep class com.hostshield.service.DohBypassUpdater { *; }
 -keep class com.hostshield.service.DohResolver { *; }
+-keep class com.hostshield.service.LocalDnsServer { *; }
+-keep class com.hostshield.service.DotResolver { *; }
+-keep class com.hostshield.service.DotResolver$** { *; }
 -keep class com.hostshield.service.IptablesManager { *; }
 -keep class com.hostshield.service.IptablesBinaryManager { *; }
 -keep class com.hostshield.util.DiagnosticExporter { *; }
 -keep class com.hostshield.util.TrackerSignatureDb { *; }
 -keep class com.hostshield.util.GeoIpLookup { *; }
 -keep class com.hostshield.util.GeoIpLookup$** { *; }
 -keep class com.hostshield.util.TrackerSignatureDb$** { *; }
+-keep class com.hostshield.util.NetworkTrackerDb { *; }
+-keep class com.hostshield.util.NetworkTrackerDb$** { *; }
 -keep class com.hostshield.service.ContextState { *; }
 
 # ── v5.0: New classes ──────────────────────────────────────
 -keep class com.hostshield.service.CnameCloakUpdater { *; }
 -keep class com.hostshield.service.DnsCache$CacheResult { *; }
+-keep class com.hostshield.service.DnsDiskCache { *; }
+-keep class com.hostshield.service.DnsDiskCache$** { *; }
 -keep class com.hostshield.util.OfflineGeoIp { *; }
 -keep class com.hostshield.util.OfflineGeoIp$** { *; }
+-keep class com.hostshield.util.DnsBenchmark { *; }
+-keep class com.hostshield.util.DnsBenchmark$** { *; }
+
+# ── v5.2: Captive portal + Threat Intel ──────────────────
+-keep class com.hostshield.service.CaptivePortalHandler { *; }
+-keep class com.hostshield.service.ThreatIntelManager { *; }
+-keep class com.hostshield.service.ThreatIntelManager$** { *; }
+-keep class com.hostshield.service.ThreatIntelWorker { *; }
+-keep class com.hostshield.service.SafeSearchEnforcer { *; }
 
 # ── v5.0: MaxMind GeoIP2 ──────────────────────────────────
 -dontwarn com.maxmind.**
@@ -112,3 +129,64 @@
 -keepattributes EnclosingMethod
 -keepattributes SourceFile,LineNumberTable
 -renamesourcefileattribute SourceFile
+
+# ── v5.x: Encrypted Backup (Roadmap #36) ────────────────────
+-keep class com.hostshield.util.EncryptedBackup { *; }
+
+# ── v1.7.0: Named Schedule Presets (Roadmap #35) ────────────
+-keep class com.hostshield.util.SchedulePresets { *; }
+-keep class com.hostshield.util.SchedulePresets$** { *; }
+-keep class com.hostshield.util.SchedulePreset { *; }
+
+# ── v5.x: DNS Stamp Parser (Roadmap #42) ─────────────────────
+-keep class com.hostshield.util.DnsStampParser { *; }
+-keep class com.hostshield.util.DnsStampParser$** { *; }
+
+# ── v5.x: QR Config Sharing (Roadmap #38) ────────────────────
+-keep class com.hostshield.util.QrConfigSharing { *; }
+-keep class com.hostshield.util.ShareableConfig { *; }
+-keep class com.hostshield.util.RuleEntry { *; }
+
+# ── v6.1: Domain-per-app DNS rules (Roadmap #12) ─────────────
+-keep class com.hostshield.service.AppDnsRuleEngine { *; }
+-keep class com.hostshield.service.AppDnsRuleEngine$** { *; }
+-keep class com.hostshield.data.model.AppDnsRule { *; }
+
+# ── v6.1: Content Filter Categories (Roadmap #40) ────────────
+-keep class com.hostshield.service.ContentFilterManager { *; }
+-keep class com.hostshield.service.ContentFilterManager$** { *; }
+-keep enum com.hostshield.service.ContentCategory { *; }
+
+# ── v6.1: Parental Controls (Roadmap #48) ──────────────────
+-keep class com.hostshield.service.ParentalControlManager { *; }
+-keep class com.hostshield.service.ParentalControlManager$** { *; }
+
+# ── v6.1: TLS Fingerprinting (Roadmap #47) ─────────────────
+-keep class com.hostshield.util.TlsFingerprinter { *; }
+-keep class com.hostshield.util.TlsFingerprinter$** { *; }
+
+# ── v6.1: Crash Reporter (Roadmap #39) ─────────────────────
+-keep class com.hostshield.util.CrashReporter { *; }
+-keep class com.hostshield.util.CrashReporter$** { *; }
+
+# ── v6.1: Connection Tracker (Roadmap #46) ─────────────────
+-keep class com.hostshield.service.ConnectionTracker { *; }
+-keep class com.hostshield.service.ConnectionTracker$** { *; }
+
+# ── v6.1: WebDAV Cloud Sync (Roadmap #37) ──────────────────
+-keep class com.hostshield.util.WebDavSync { *; }
+-keep class com.hostshield.util.WebDavSync$** { *; }
+
+# ── v6.2: DoQ + WireGuard (Roadmap #45, #51) ────────────────
+-keep class com.hostshield.service.DoqResolver { *; }
+-keep class com.hostshield.service.DoqResolver$** { *; }
+-keep class com.hostshield.service.WireGuardProxy { *; }
+-keep class com.hostshield.service.WireGuardProxy$** { *; }
+
+# ── v6.2: NflogReader + RootDnsLogger ───────────────────────
+-keep class com.hostshield.service.NflogReader { *; }
+-keep class com.hostshield.service.NflogReader$** { *; }
+-keep class com.hostshield.service.RootDnsLogger { *; }
+-keep class com.hostshield.service.RootDnsLogger$** { *; }
+-keep class com.hostshield.service.BlockNotificationService { *; }
+-keep class com.hostshield.service.BlockingScheduleWorker { *; }

app/app/proguard-rules.pro

@@ -73,6 +73,15 @@
                 android:value="Root-mode DNS interception proxy for ad and tracker blocking" />
         </service>
 
+        <service
+            android:name=".service.DnsProxyService"
+            android:exported="false"
+            android:foregroundServiceType="specialUse">
+            <property
+                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
+                android:value="Local DNS proxy for ad and tracker blocking without VPN or root" />
+        </service>
+
         <receiver
             android:name=".service.BootReceiver"
             android:exported="true"

app/app/src/main/AndroidManifest.xml

@@ -4,6 +4,7 @@ import android.app.Application
 import androidx.hilt.work.HiltWorkerFactory
 import androidx.work.Configuration
 import com.hostshield.service.CnameCloakUpdater
+import com.hostshield.service.ThreatIntelWorker
 import com.hostshield.util.OfflineGeoIp
 import com.topjohnwu.superuser.Shell
 import dagger.hilt.android.HiltAndroidApp
@@ -27,6 +28,10 @@ class HostShieldApp : Application(), Configuration.Provider {
         // v5.0: Non-blocking startup initialization
         appScope.launch { cnameCloakUpdater.loadCached() }
         appScope.launch { offlineGeoIp.initialize() }
+
+        // v6.0: Schedule daily threat intelligence feed updates
+        try { ThreatIntelWorker.schedule(this) }
+        catch (e: Exception) { android.util.Log.w("HostShieldApp", "WorkManager scheduling failed: ${e.message}") }
     }
 
     override val workManagerConfiguration: Configuration