mirror of
https://github.com/therealaleph/MasterHttpRelayVPN-RUST.git
synced 2026-05-18 05:36:56 +03:00
96d1352728
The app is a Kotlin/Compose front-end that reuses the mhrv-rs crate
via JNI. It speaks VpnService to get a TUN fd, hands that to tun2proxy,
and funnels every app's traffic through the in-process SOCKS5 listener —
no per-app proxy setup on the device.
Two fixes in `src/proxy_server.rs` apply to desktop builds too:
* SNI peek via `LazyConfigAcceptor`. When a browser uses DoH (Chrome's
default), tun2proxy hands us a raw IP in the SOCKS5 CONNECT. Minting
a MITM cert for the IP produced `ERR_CERT_COMMON_NAME_INVALID` on
Cloudflare-fronted sites. We now read the ClientHello's SNI first
and use that both as the cert subject and as the upstream host for
the Apps Script relay (fetching `https://<IP>/...` with an IP in the
Host header gets rejected by CF anyway).
* Short-circuit CORS preflight at the MITM boundary. `UrlFetchApp.fetch()`
rejects `OPTIONS` with a Swedish "Ett attribut med ogiltigt värde
har angetts: method" error, which silently broke every fetch()/XHR
preflight and was the root cause of "JS doesn't load" on Discord,
Yahoo, and similar. Since we already terminate the TLS the browser
talks to, answering the preflight with a permissive 204 is safe —
the real request still goes through the relay.
Android-side capabilities (feature-parity with `mhrv-rs-ui` where it
fits on a phone):
* multi-deployment ID editor
* SNI rotation pool + per-SNI "Test" + "Test all" (JNI into scan_sni)
* live logs panel (JNI ring buffer drained on a 500 ms poll)
* Advanced section: verify_ssl, parallel_relay, log_level, upstream_socks5
* CA install flow that matches modern Android's reality: saves
`Downloads/mhrv-ca.crt` via MediaStore, deep-links Security settings,
then verifies post-hoc by fingerprint lookup in AndroidCAStore (the
KeyChain intent dead-ends with a Close-only dialog on Android 11+)
* Start/Stop debounced to dodge an emulator EGL renderer crash on
rapid taps
Theme matches the desktop palette exactly — always-dark, accent
`#4678B4`, card fill `#1C1E22`, 4dp button / 6dp card radii.
No dynamic color, no light scheme: the desktop is always dark and
we follow.
Build wiring:
* `Cargo.toml`: `cdylib` crate-type added; `jni` + `tun2proxy`
scoped to `cfg(target_os = "android")` so desktop builds pay
nothing.
* `src/data_dir.rs`: `set_data_dir()` override so the Android app's
private filesDir replaces the `directories` crate's desktop default.
* `src/android_jni.rs`: JNI entry points for start/stop/exportCa plus
a ring buffer draining to `Native.drainLogs()` and `testSni()` that
wraps `scan_sni::probe_one`.
* Gradle task chain runs `cargo ndk` before each assemble; post-step
normalizes tun2proxy's hash-suffixed cdylib to a stable filename
so `System.loadLibrary("tun2proxy")` works.
Verified end-to-end on an API 34 emulator: ipleak, yahoo, discord,
cloudflare.com all render; TLS is MITM-ed under our user-installed
CA; service survives rapid Stop/Start cycles.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
249 lines
8.5 KiB
Bash
Executable File
249 lines
8.5 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
#
|
|
# Copyright © 2015 the original authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# https://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
|
|
##############################################################################
|
|
#
|
|
# Gradle start up script for POSIX generated by Gradle.
|
|
#
|
|
# Important for running:
|
|
#
|
|
# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
|
|
# noncompliant, but you have some other compliant shell such as ksh or
|
|
# bash, then to run this script, type that shell name before the whole
|
|
# command line, like:
|
|
#
|
|
# ksh Gradle
|
|
#
|
|
# Busybox and similar reduced shells will NOT work, because this script
|
|
# requires all of these POSIX shell features:
|
|
# * functions;
|
|
# * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
|
|
# «${var#prefix}», «${var%suffix}», and «$( cmd )»;
|
|
# * compound commands having a testable exit status, especially «case»;
|
|
# * various built-in commands including «command», «set», and «ulimit».
|
|
#
|
|
# Important for patching:
|
|
#
|
|
# (2) This script targets any POSIX shell, so it avoids extensions provided
|
|
# by Bash, Ksh, etc; in particular arrays are avoided.
|
|
#
|
|
# The "traditional" practice of packing multiple parameters into a
|
|
# space-separated string is a well documented source of bugs and security
|
|
# problems, so this is (mostly) avoided, by progressively accumulating
|
|
# options in "$@", and eventually passing that to Java.
|
|
#
|
|
# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
|
|
# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
|
|
# see the in-line comments for details.
|
|
#
|
|
# There are tweaks for specific operating systems such as AIX, CygWin,
|
|
# Darwin, MinGW, and NonStop.
|
|
#
|
|
# (3) This script is generated from the Groovy template
|
|
# https://github.com/gradle/gradle/blob/2d6327017519d23b96af35865dc997fcb544fb40/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
|
|
# within the Gradle project.
|
|
#
|
|
# You can find Gradle at https://github.com/gradle/gradle/.
|
|
#
|
|
##############################################################################
|
|
|
|
# Attempt to set APP_HOME
|
|
|
|
# Resolve links: $0 may be a link
|
|
app_path=$0
|
|
|
|
# Need this for daisy-chained symlinks.
|
|
while
|
|
APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path
|
|
[ -h "$app_path" ]
|
|
do
|
|
ls=$( ls -ld "$app_path" )
|
|
link=${ls#*' -> '}
|
|
case $link in #(
|
|
/*) app_path=$link ;; #(
|
|
*) app_path=$APP_HOME$link ;;
|
|
esac
|
|
done
|
|
|
|
# This is normally unused
|
|
# shellcheck disable=SC2034
|
|
APP_BASE_NAME=${0##*/}
|
|
# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
|
|
APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
|
|
|
|
# Use the maximum available, or set MAX_FD != -1 to use that value.
|
|
MAX_FD=maximum
|
|
|
|
warn () {
|
|
echo "$*"
|
|
} >&2
|
|
|
|
die () {
|
|
echo
|
|
echo "$*"
|
|
echo
|
|
exit 1
|
|
} >&2
|
|
|
|
# OS specific support (must be 'true' or 'false').
|
|
cygwin=false
|
|
msys=false
|
|
darwin=false
|
|
nonstop=false
|
|
case "$( uname )" in #(
|
|
CYGWIN* ) cygwin=true ;; #(
|
|
Darwin* ) darwin=true ;; #(
|
|
MSYS* | MINGW* ) msys=true ;; #(
|
|
NONSTOP* ) nonstop=true ;;
|
|
esac
|
|
|
|
|
|
|
|
# Determine the Java command to use to start the JVM.
|
|
if [ -n "$JAVA_HOME" ] ; then
|
|
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
|
|
# IBM's JDK on AIX uses strange locations for the executables
|
|
JAVACMD=$JAVA_HOME/jre/sh/java
|
|
else
|
|
JAVACMD=$JAVA_HOME/bin/java
|
|
fi
|
|
if [ ! -x "$JAVACMD" ] ; then
|
|
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
|
|
|
|
Please set the JAVA_HOME variable in your environment to match the
|
|
location of your Java installation."
|
|
fi
|
|
else
|
|
JAVACMD=java
|
|
if ! command -v java >/dev/null 2>&1
|
|
then
|
|
die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
|
|
|
|
Please set the JAVA_HOME variable in your environment to match the
|
|
location of your Java installation."
|
|
fi
|
|
fi
|
|
|
|
# Increase the maximum file descriptors if we can.
|
|
if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
|
|
case $MAX_FD in #(
|
|
max*)
|
|
# In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
|
|
# shellcheck disable=SC2039,SC3045
|
|
MAX_FD=$( ulimit -H -n ) ||
|
|
warn "Could not query maximum file descriptor limit"
|
|
esac
|
|
case $MAX_FD in #(
|
|
'' | soft) :;; #(
|
|
*)
|
|
# In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
|
|
# shellcheck disable=SC2039,SC3045
|
|
ulimit -n "$MAX_FD" ||
|
|
warn "Could not set maximum file descriptor limit to $MAX_FD"
|
|
esac
|
|
fi
|
|
|
|
# Collect all arguments for the java command, stacking in reverse order:
|
|
# * args from the command line
|
|
# * the main class name
|
|
# * -classpath
|
|
# * -D...appname settings
|
|
# * --module-path (only if needed)
|
|
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
|
|
|
|
# For Cygwin or MSYS, switch paths to Windows format before running java
|
|
if "$cygwin" || "$msys" ; then
|
|
APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
|
|
|
|
JAVACMD=$( cygpath --unix "$JAVACMD" )
|
|
|
|
# Now convert the arguments - kludge to limit ourselves to /bin/sh
|
|
for arg do
|
|
if
|
|
case $arg in #(
|
|
-*) false ;; # don't mess with options #(
|
|
/?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath
|
|
[ -e "$t" ] ;; #(
|
|
*) false ;;
|
|
esac
|
|
then
|
|
arg=$( cygpath --path --ignore --mixed "$arg" )
|
|
fi
|
|
# Roll the args list around exactly as many times as the number of
|
|
# args, so each arg winds up back in the position where it started, but
|
|
# possibly modified.
|
|
#
|
|
# NB: a `for` loop captures its iteration list before it begins, so
|
|
# changing the positional parameters here affects neither the number of
|
|
# iterations, nor the values presented in `arg`.
|
|
shift # remove old arg
|
|
set -- "$@" "$arg" # push replacement arg
|
|
done
|
|
fi
|
|
|
|
|
|
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
|
DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
|
|
|
|
# Collect all arguments for the java command:
|
|
# * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
|
|
# and any embedded shellness will be escaped.
|
|
# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
|
|
# treated as '${Hostname}' itself on the command line.
|
|
|
|
set -- \
|
|
"-Dorg.gradle.appname=$APP_BASE_NAME" \
|
|
-jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
|
|
"$@"
|
|
|
|
# Stop when "xargs" is not available.
|
|
if ! command -v xargs >/dev/null 2>&1
|
|
then
|
|
die "xargs is not available"
|
|
fi
|
|
|
|
# Use "xargs" to parse quoted args.
|
|
#
|
|
# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
|
|
#
|
|
# In Bash we could simply go:
|
|
#
|
|
# readarray ARGS < <( xargs -n1 <<<"$var" ) &&
|
|
# set -- "${ARGS[@]}" "$@"
|
|
#
|
|
# but POSIX shell has neither arrays nor command substitution, so instead we
|
|
# post-process each arg (as a line of input to sed) to backslash-escape any
|
|
# character that might be a shell metacharacter, then use eval to reverse
|
|
# that process (while maintaining the separation between arguments), and wrap
|
|
# the whole thing up as a single "set" statement.
|
|
#
|
|
# This will of course break if any of these variables contains a newline or
|
|
# an unmatched quote.
|
|
#
|
|
|
|
eval "set -- $(
|
|
printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
|
|
xargs -n1 |
|
|
sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
|
|
tr '\n' ' '
|
|
)" '"$@"'
|
|
|
|
exec "$JAVACMD" "$@"
|