Handle denied system DNS lookup in manager

[Shallow-dusty]

Fixes #636

When DoH is disabled, the manager uses OkHttp's system DNS implementation through CloudflareDNS.lookup(). The crash log in #636 shows Android 11 can throw an unchecked SecurityException from that DNS lookup path:

• FATAL EXCEPTION: OkHttp Dispatcher
• java.lang.SecurityException: Permission denied (missing INTERNET permission?)
• at org.lsposed.manager.util.CloudflareDNS.lookup(...)

The manifest already declares android.permission.INTERNET, so this is not a manifest-permission fix. Instead, handle the denied lookup defensively at the Dns.lookup() boundary by converting SecurityException into UnknownHostException, which is the checked failure type OkHttp expects from DNS implementations.

Validation

• git diff --check
• ./gradlew.bat --no-daemon :app:compileDebugJavaWithJavac
• ./gradlew.bat --no-daemon :app:assembleDebug
• Android 11 / API 30 emulator (Vector_API30), doh=false: manager UI launches and remains alive; no fatal crash in logcat.

Reproduction boundary

I could not reproduce the exact EPERM / SecurityException on a clean API 30 emulator. Attempts included Private DNS off, opportunistic, invalid hostname mode, Data Saver / app UID restrict-background blacklist, and a local-only no-INTERNET manifest build. These did not reproduce the reporter's environment-specific android_getaddrinfo failed: EPERM path.

To verify the fix still covers the reported failure mode, I used a local-only fault-injection comparison that was not included in this PR:

• On origin/master, injecting the same SecurityException("Permission denied (missing INTERNET permission?)") from CloudflareDNS.lookup() with doh=false reproduced FATAL EXCEPTION: OkHttp Dispatcher and Process: org.lsposed.manager.
• On this branch, injecting the same exception inside the new try block kept the app alive and converted the request failures to java.net.UnknownHostException: Permission denied (missing INTERNET permission?), with no AndroidRuntime fatal crash.

So the clean emulator cannot recreate the original device policy state, but the branch directly covers the exception class/message at the same method boundary shown in the issue stack.

[Copilot]

Pull request overview

Defensively prevents Vector manager crashes on Android 11 when using OkHttp’s system DNS (DoH disabled) by converting unexpected SecurityException failures at the Dns.lookup() boundary into the checked UnknownHostException OkHttp expects.

Changes:

• Wrap CloudflareDNS.lookup() resolution path in a try/catch.
• Convert SecurityException from DNS lookup into UnknownHostException with the original exception set as the cause.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.