diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml new file mode 100644 index 0000000..313f3c7 --- /dev/null +++ b/.github/workflows/android-ci.yml @@ -0,0 +1,134 @@ +name: Android CI + +on: + push: + branches: + - main + pull_request: + branches: + - main + +permissions: + contents: read + +jobs: + android: + runs-on: ubuntu-24.04 + timeout-minutes: 45 + + steps: + - name: Checkout + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + + - name: Set up Java 17 + uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 + with: + distribution: temurin + java-version: '17' + + - name: Verify Gradle supply chain + shell: bash + run: | + set -euo pipefail + test -x android/gradlew + test -f android/gradlew.bat + test -f android/gradle/wrapper/gradle-wrapper.jar + test -s android/gradle/verification-metadata.xml + test "$(sha256sum android/gradle/wrapper/gradle-wrapper.jar | awk '{print $1}')" = '7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172' + grep -qx 'distributionSha256Sum=efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1' android/gradle/wrapper/gradle-wrapper.properties + grep -q 'true' android/gradle/verification-metadata.xml + ./android/gradlew --version + + - name: Set up Flutter + uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2 + with: + flutter-version: '3.47.2' + channel: stable + cache: false + + - name: Create CI app config + run: cp lib/logic/app_config.example.dart lib/logic/app_config.dart + + - name: Resolve dependencies + run: flutter pub get + + - name: Verify dependency lock is committed + run: git diff --exit-code -- pubspec.lock + + - name: Verify vendored runtime provenance + shell: bash + run: | + set -euo pipefail + PKG='local_packages/flutter_vless_android-1.1.5' + test -f "$PKG/UPSTREAM" + grep -q 'Tag: v1.1.5' "$PKG/UPSTREAM" + grep -q 'path: local_packages/flutter_vless_android-1.1.5' pubspec.yaml + ! grep -q 'patchFlutterVless' android/app/build.gradle.kts + + - name: Analyze + run: flutter analyze + + - name: Test + run: flutter test + + - name: Android lint + working-directory: android + run: ./gradlew :app:lintDebug --no-daemon + + - name: Verify production release config fails closed + shell: bash + working-directory: android + run: | + set -euo pipefail + set +e + output="$(./gradlew :app:verifyReleaseAppConfig --no-daemon 2>&1)" + status=$? + set -e + printf '%s\n' "$output" + test "$status" -ne 0 + grep -Fq 'REVOLT_APP_CONFIG_SHA256 is required for production release builds' <<<"$output" + + - name: Cold APK build + run: flutter build apk --debug + + - name: Verify vendored native source stayed immutable + run: git diff --exit-code -- local_packages/flutter_vless_android-1.1.5 + + - name: Warm APK build + run: flutter build apk --debug + + - name: Release R8 smoke build + env: + REVOLT_CI_RELEASE_SMOKE: 'true' + run: | + flutter build apk --release + test -f build/app/outputs/flutter-apk/app-release.apk + test -f build/app/outputs/mapping/release/mapping.txt + + - name: Verify tracked build inputs stayed immutable + run: | + git diff --exit-code -- \ + pubspec.yaml \ + pubspec.lock \ + local_packages/flutter_vless_android-1.1.5 \ + android/app/build.gradle.kts \ + android/app/proguard-rules.pro \ + android/gradle/verification-metadata.xml \ + android/gradle/wrapper/gradle-wrapper.properties \ + android/gradle/wrapper/gradle-wrapper.jar \ + android/gradlew \ + android/gradlew.bat + + - name: Upload APK + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + with: + name: revoltvpn-debug-apk + if-no-files-found: error + path: build/app/outputs/flutter-apk/app-debug.apk + + - name: Upload resolved lockfile + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + with: + name: revoltvpn-resolved-lockfile + if-no-files-found: error + path: pubspec.lock diff --git a/.gitignore b/.gitignore index e59e800..1638154 100644 --- a/.gitignore +++ b/.gitignore @@ -1,48 +1,18 @@ # ============================================================================= -# ReVoltVPN — .gitignore -# -# Type-based by design. This repo ships Dart, Kotlin, XML and image assets; -# everything else is excluded by extension or directory rather than by being -# listed individually. A new file is therefore ignored by default instead of -# needing to be named here, and this file does not enumerate what it protects. - +# ReVoltVPN # ============================================================================= -# ── Secrets ──────────────────────────────────────────────────────────────── +# Secrets / machine-local release material *.keystore *.jks android/key.properties android/admob.properties -# Real IPs and IDs. app_config.example.dart is the committed template. +# This file may contain the private AdMob unit id. Network trust is verified +# independently at release time; do not replace this with a broad extension rule. lib/logic/app_config.dart -# ── File types the shipped app does not contain ──────────────────────────── -*.py -*.pyc -*.json -*.conf -*.sh -*.txt -*.html -*.zip -*.log -*.class - -# ── Documentation ────────────────────────────────────────────────────────── -# The published set is allow-listed; anything else, at any depth, is not. -# Leading slashes anchor these to the repo root so a same-named file in a -# subdirectory is NOT re-included by the negation. -*.md -!/README.md -!/CHANGELOG.md -!/CONTRIBUTING.md -!/PRIVACY_POLICY.md - -# ── Working directories ──────────────────────────────────────────────────── -# Material that is not part of the app. These need directory rules rather -# than type rules, because they can hold source-file types the rules above -# deliberately do not cover. +# Working directories that are intentionally outside the shipped client .local/ internal/ hivemind/ @@ -51,8 +21,9 @@ backup/ backups/ lib/logic/backup/ server_files/ +whatsthis -# ── Flutter / Dart build output ──────────────────────────────────────────── +# Flutter / Dart generated output .dart_tool/ *.dart_tool/ .flutter-plugins @@ -66,20 +37,17 @@ local_packages/*/.dart_tool/ **/doc/api/ **/ios/Flutter/.last_build_id -# ── Android build output ─────────────────────────────────────────────────── +# Android generated output / local SDK state **/android/.gradle **/android/.cxx/ **/android/app/build/ **/android/captures/ -**/android/gradlew -**/android/gradlew.bat **/android/local.properties -**/android/**/gradle-wrapper.jar **/android/**/GeneratedPluginRegistrant.java **/android/app/src/main/java/io/flutter/plugins/GeneratedPluginRegistrant.java **/android/app/crashlytics-build.properties -# ── Editors, tooling & OS ────────────────────────────────────────────────── +# Editors / tooling / OS noise .claude/ .codewhale/ .idea/ @@ -90,8 +58,6 @@ local_packages/*/.dart_tool/ .java-version .DS_Store *.swp +*.iml __pycache__/ devtools_options.yaml - -#why are you even looking at this file? it's a secret. go away. -whatsthis \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 58a17b5..8b04f1e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,47 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH --- +## [3.3.5] — 2026-09-03 + +### Added +- **OS-level session-expiry enforcement.** The native VPN service now enforces the + server deadline with both a monotonic in-process handler and `AlarmManager`, so + expiry does not depend on the Flutter UI process staying alive. +- Only the non-secret runtime generation token and absolute expiry timestamp are + persisted app-private for the OS alarm. Per-session VLESS UUID/SOCKS credentials + remain memory-only; if Android cannot redeliver the original start intent, the + runtime fails closed instead of reconstructing a tunnel from secrets on disk. +- A successful support reward now requests an immediate control-plane refresh so the + extended deadline is pushed to the native service without waiting for the next poll. + +### Fixed +- **Session clock reattach race.** `SessionTimer` is eager and evaluates the current + VPN state once after construction, so a UI process attaching to an already-live + tunnel no longer leaves the countdown at `00:00:00`. +- Forced support sync no longer disappears behind an already-running periodic sync; + it waits for the active request and then performs a fresh control-plane refresh. +- VPN permission requests now fail with `NO_ACTIVITY` during Android activity detach + instead of dereferencing a null Activity. +- Receiver cleanup logs lifecycle races instead of silently swallowing them. +- An early/stale session-expiry alarm no longer leaves an otherwise unused service + process running. + +### Changed +- Unknown/obsolete persisted connection-mode labels, including the old `ass`/`auto` + values, now fail closed to TUN. Only the explicit current `proxy` value restores + SOCKS5 mode. +- App version is `3.3.5+31`. + +### Security +- Existing AdMob bypass/callback behavior is intentionally unchanged. +- Build-time mutation of the global Flutter pub cache remains removed; the hardened + `flutter_vless_android` 1.1.5 source remains vendored and immutable during builds. +- Full IPv4/IPv6 TUN routing, fail-closed DNS/TUN setup, authenticated ephemeral + loopback SOCKS5, generation-scoped STOP/state handling, production config pinning, + dependency verification, R8 gates and updater host allowlists remain in force. + +--- + ## [3.3.4] — 2026-09-02 ### Added @@ -41,17 +82,9 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH ## [3.3.3] — 2026-09-01 ### Fixed -- **The session clock stayed at 00:00:00 on a live tunnel, and the notification - countdown froze with it.** `SessionTimer` is built lazily, so when the app reattaches - to a tunnel that outlived its UI process, `VpnConnection` had already reported - "connected" before the timer existed — and a change listener does not replay events - it was not present for. The timer now evaluates the current connection state once at - construction instead of waiting for a transition, and is created eagerly alongside - `VpnConnection`. Because the timer is what pushes text to the foreground - notification, a stopped clock also meant a frozen countdown; both come from this. -- Resuming the clock no longer requires `adoptedRunningRuntime` or a previous - successful sync, both of which are false in a freshly started process. A connected - tunnel with a stopped clock is now always treated as something to resume. +- The session timer now resumes when the Flutter process attaches to a tunnel that was + already connected before the timer listener existed. This also prevents the + foreground countdown from freezing after UI-process recreation. ## [3.3.2] — 2026-09-01 diff --git a/PRIVACY_POLICY.md b/PRIVACY_POLICY.md index cb21628..d3e1f8e 100644 --- a/PRIVACY_POLICY.md +++ b/PRIVACY_POLICY.md @@ -1,6 +1,6 @@ # Privacy Policy -**Last updated:** September 2026 +**Last updated:** August 2026 ReVoltVPN is a free VPN service built and operated by ReVolt Team. @@ -27,7 +27,7 @@ Support ads (the "Support us" button) extend an active session by 30 minutes and ## Operational logs -Server logs are written to the systemd journal (`journalctl -u hivemind`). These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs stay on the server and are accessible only to the server operator via local console; retention follows the server's systemd journal settings. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device. +We keep a short in-memory log buffer (last 200 lines) for debugging and server health monitoring. These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs never leave the server, are not retained after a server restart, and are only accessible to the server operator via local console. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device. ## What we do not collect diff --git a/README.md b/README.md index 8f3ac7c..67b9e99 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ No email. No password. No payment. The ad pays for the server. ## Protocol - **Transport** — VLESS over XHTTP (HTTP/2 multiplexed, path-hidden behind `/revolt`) -- **Obfuscation** — Xray Reality spoofs a real website's TLS. To any DPI box, your tunnel looks like a browser visiting that website +- **Obfuscation** — Xray Reality spoofs `some website's` TLS. To any DPI box, your tunnel looks like a browser visiting that website - **Encryption** — TLS 1.3 with borrowed certificate (Reality). No certbot, no domain ownership required - **API** — Standard HTTPS to a separate domain. Tunnel destination is IP-pinned — domain compromise is DoS only diff --git a/analysis_options.yaml b/analysis_options.yaml index b9bce79..d7a1ec0 100644 --- a/analysis_options.yaml +++ b/analysis_options.yaml @@ -2,6 +2,8 @@ include: package:flutter_lints/flutter.yaml analyzer: exclude: + - build/** + - android/** - local_packages/** - whatsthis/** diff --git a/android/.gitignore b/android/.gitignore index 0a741cb..26bd9ae 100644 --- a/android/.gitignore +++ b/android/.gitignore @@ -1,8 +1,5 @@ -gradle-wrapper.jar /.gradle /captures/ -/gradlew -/gradlew.bat /local.properties GeneratedPluginRegistrant.java diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts index b302bb4..cb24e65 100644 --- a/android/app/build.gradle.kts +++ b/android/app/build.gradle.kts @@ -1,132 +1,16 @@ import java.util.Properties import java.io.File import java.io.FileInputStream +import java.security.MessageDigest plugins { id("com.android.application") id("dev.flutter.flutter-gradle-plugin") } -val projectRootDir = rootProject.projectDir.parentFile -val localPropertiesFile = rootProject.file("local.properties") -val localProperties = Properties().apply { - if (localPropertiesFile.exists()) { - localPropertiesFile.inputStream().use { load(it) } - } -} -val flutterSdkPath = localProperties.getProperty("flutter.sdk") - ?: throw GradleException("flutter.sdk not set in android/local.properties") -val dartExecutable = File( - flutterSdkPath, - if (System.getProperty("os.name").lowercase().contains("windows")) { - "bin/cache/dart-sdk/bin/dart.exe" - } else { - "bin/cache/dart-sdk/bin/dart" - }, -) -val flutterVlessRecoveryPatchScript = File( - projectRootDir, - "tool/patch_flutter_vless_runtime_recovery.dart", -) -val flutterVlessSecureSocksPatchScript = File( - projectRootDir, - "tool/patch_flutter_vless_secure_socks_v2.dart", -) -val flutterVlessSecureSocksScopeFixScript = File( - projectRootDir, - "tool/patch_flutter_vless_secure_socks_scope_fix.dart", -) - -val patchFlutterVlessRuntimeRecovery = tasks.register("patchFlutterVlessRuntimeRecovery") { - group = "build setup" - description = "Recover stale Xray core and tun2socks socket before restart" - workingDir(projectRootDir) - - doFirst { - if (!dartExecutable.isFile) { - throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}") - } - if (!flutterVlessRecoveryPatchScript.isFile) { - throw GradleException("flutter_vless recovery patch script missing: ${flutterVlessRecoveryPatchScript.absolutePath}") - } - if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) { - throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.") - } - } - - commandLine( - dartExecutable.absolutePath, - "run", - flutterVlessRecoveryPatchScript.absolutePath, - ) -} - -val patchFlutterVlessSecureSocks = tasks.register("patchFlutterVlessSecureSocks") { - group = "build setup" - description = "Add authenticated ephemeral SOCKS5 and fail-closed process recovery to pinned flutter_vless_android 1.1.5" - workingDir(projectRootDir) - dependsOn(patchFlutterVlessRuntimeRecovery) - - doFirst { - if (!dartExecutable.isFile) { - throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}") - } - if (!flutterVlessSecureSocksPatchScript.isFile) { - throw GradleException("secure SOCKS patch script missing: ${flutterVlessSecureSocksPatchScript.absolutePath}") - } - if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) { - throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.") - } - } - - commandLine( - dartExecutable.absolutePath, - "run", - flutterVlessSecureSocksPatchScript.absolutePath, - ) -} - -val patchFlutterVlessSecureSocksScopeFix = tasks.register("patchFlutterVlessSecureSocksScopeFix") { - group = "build setup" - description = "Repair the secure Xray process monitor capture without changing stock 1.1.5 runtime sequencing" - workingDir(projectRootDir) - dependsOn(patchFlutterVlessSecureSocks) - - doFirst { - if (!dartExecutable.isFile) { - throw GradleException("Flutter Dart executable not found: ${dartExecutable.absolutePath}") - } - if (!flutterVlessSecureSocksScopeFixScript.isFile) { - throw GradleException("secure SOCKS scope fix script missing: ${flutterVlessSecureSocksScopeFixScript.absolutePath}") - } - if (!File(projectRootDir, ".dart_tool/package_config.json").isFile) { - throw GradleException("Flutter package metadata missing. Run `flutter pub get` before Android compilation.") - } - } - - commandLine( - dartExecutable.absolutePath, - "run", - flutterVlessSecureSocksScopeFixScript.absolutePath, - ) -} - -// App compilation and the transitive Android plugin compilation must both wait -// for the pinned runtime patches. Plain `flutter build apk` must behave like CI -// instead of relying on a hidden manual pre-build step. -tasks.configureEach { - if (name == "preBuild") { - dependsOn(patchFlutterVlessSecureSocksScopeFix) - } -} - -gradle.projectsEvaluated { - rootProject.findProject(":flutter_vless_android") - ?.tasks - ?.matching { it.name == "preBuild" } - ?.configureEach { - dependsOn(patchFlutterVlessSecureSocksScopeFix) - } +fun sha256Hex(file: File): String { + val digest = MessageDigest.getInstance("SHA-256").digest(file.readBytes()) + return digest.joinToString("") { "%02x".format(it.toInt() and 0xff) } } android { @@ -140,10 +24,6 @@ android { targetCompatibility = JavaVersion.VERSION_17 } - packaging { - resources.excludes.add("META-INF/**") - } - val keystorePropertiesFile = rootProject.file("key.properties") val keystoreProperties = Properties() if (keystorePropertiesFile.exists()) { @@ -156,6 +36,68 @@ android { admobProperties.load(FileInputStream(admobPropertiesFile)) } + // Explicit opt-in used only by GitHub Actions to exercise the real + // release/R8 graph. Production release signing and config pinning remain + // fail-closed outside that CI smoke path. + val ciReleaseSmoke = + System.getenv("GITHUB_ACTIONS") == "true" && + System.getenv("REVOLT_CI_RELEASE_SMOKE") == "true" + + val appConfigFile = rootProject.file("../lib/logic/app_config.dart") + val verifyReleaseAppConfig = tasks.register("verifyReleaseAppConfig") { + group = "verification" + description = "Verify the production Dart app config against REVOLT_APP_CONFIG_SHA256." + doLast { + if (ciReleaseSmoke) { + logger.lifecycle("Skipping production app-config pin for CI release smoke build") + return@doLast + } + + val expected = System.getenv("REVOLT_APP_CONFIG_SHA256")?.trim()?.lowercase() + if (expected.isNullOrEmpty()) { + throw org.gradle.api.GradleException( + "REVOLT_APP_CONFIG_SHA256 is required for production release builds" + ) + } + if (!Regex("[0-9a-f]{64}").matches(expected)) { + throw org.gradle.api.GradleException( + "REVOLT_APP_CONFIG_SHA256 must be exactly 64 lowercase hexadecimal characters" + ) + } + if (!appConfigFile.isFile) { + throw org.gradle.api.GradleException( + "Production app config is missing: ${appConfigFile.absolutePath}" + ) + } + + val configText = appConfigFile.readText() + val templateMarkers = listOf( + "'0.0.0.0'", + "YOUR_DOMAIN", + "YOUR_GITHUB_USERNAME", + "YOUR_REPO_NAME", + "ca-app-pub-0000000000000000/0000000000", + ) + val remainingMarker = templateMarkers.firstOrNull(configText::contains) + if (remainingMarker != null) { + throw org.gradle.api.GradleException( + "Production app config still contains template marker: $remainingMarker" + ) + } + + val actual = sha256Hex(appConfigFile) + if (actual != expected) { + throw org.gradle.api.GradleException( + "Production app config SHA-256 mismatch: expected $expected, got $actual" + ) + } + } + } + + tasks.matching { it.name == "preReleaseBuild" }.configureEach { + dependsOn(verifyReleaseAppConfig) + } + defaultConfig { applicationId = "com.paladinvpn.app" minSdk = flutter.minSdkVersion @@ -176,7 +118,11 @@ android { buildTypes { release { - signingConfig = signingConfigs.getByName("release") + signingConfig = if (ciReleaseSmoke) { + signingConfigs.getByName("debug") + } else { + signingConfigs.getByName("release") + } isMinifyEnabled = true isShrinkResources = true proguardFiles( diff --git a/android/app/proguard-rules.pro b/android/app/proguard-rules.pro index 0d60756..6ab7ded 100644 --- a/android/app/proguard-rules.pro +++ b/android/app/proguard-rules.pro @@ -1,4 +1,4 @@ -# PaladinVPN ProGuard / R8 Rules +# ReVoltVPN ProGuard / R8 Rules # ============================================================================== # These rules prevent R8 from stripping classes and methods that are accessed # via JNI (Java Native Interface) or reflection, which would cause @@ -11,9 +11,8 @@ -keep class xray.** { *; } # ── Flutter / Platform Channels ─────────────────────────────────────────────── +# io.flutter.** already includes embedding and plugin subpackages. -keep class io.flutter.** { *; } --keep class io.flutter.embedding.** { *; } --keep class io.flutter.plugin.** { *; } # ── Google Mobile Ads (AdMob) ───────────────────────────────────────────────── -keep class com.google.android.gms.ads.** { *; } diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml index 1476797..0b45736 100644 --- a/android/app/src/main/AndroidManifest.xml +++ b/android/app/src/main/AndroidManifest.xml @@ -10,9 +10,6 @@ - - when (call.method) { - // Doze and App Standby stop background services of apps that - // are not exempt. A VPN has to be exempt to survive the screen - // going off, so surface the real state rather than guessing. "isIgnoringBatteryOptimizations" -> result.success(isIgnoringBatteryOptimizations()) "requestIgnoreBatteryOptimizations" -> result.success(requestIgnoreBatteryOptimizations()) - "setSessionExpiry" -> { - val expiresAtMs = call.argument("expiresAtMs")?.toLong() ?: 0L - if (expiresAtMs > 0) { - sendSessionExpiryToDaemon(expiresAtMs) - } - result.success(null) - } - // Is our VPN runtime actually alive? The service lives in - // :RunSoLibXrayDaemon, a separate process, so its statics are - // NOT visible here -- this is the only honest check. - "isVpnRuntimeAlive" -> result.success(isVpnRuntimeAlive()) else -> result.notImplemented() } } @@ -118,7 +101,6 @@ class MainActivity : FlutterActivity() { super.onDestroy() } - /** True when the OS has exempted us from Doze / App Standby. */ private fun isIgnoringBatteryOptimizations(): Boolean { if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true return try { @@ -129,11 +111,6 @@ class MainActivity : FlutterActivity() { } } - /** - * Opens the system exemption prompt. Android shows this as a single dialog; - * it cannot be granted silently, so the caller must treat a false return as - * "ask again later" rather than a denial. - */ private fun requestIgnoreBatteryOptimizations(): Boolean { if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true if (isIgnoringBatteryOptimizations()) return true @@ -146,7 +123,6 @@ class MainActivity : FlutterActivity() { ) true } catch (_: Exception) { - // Some OEM builds hide the direct intent; fall back to the list. try { startActivity(Intent(Settings.ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS)) true @@ -156,58 +132,6 @@ class MainActivity : FlutterActivity() { } } - /** Pushes the session-expiry deadline to the VPN service process. */ - private fun sendSessionExpiryToDaemon(expiresAtMs: Long) { - try { - val intent = Intent(this, XrayVPNService::class.java) - intent.putExtra("SESSION_EXPIRES_AT_MS", expiresAtMs) - startService(intent) - } catch (_: Exception) { - // Daemon not reachable; its persisted expiry still applies. - } - } - - /** - * Whether the VPN runtime is genuinely alive. - * - * The Xray service runs in :RunSoLibXrayDaemon, a separate process, so its - * statics (AppConfigs.V2RAY_CONFIG, V2RAY_STATE) are NOT visible from here -- - * reading them yields a fresh, empty copy. getRunningAppProcesses still - * returns our *own* processes, which makes it the one reliable signal. - */ - private fun isVpnRuntimeAlive(): Map { - var processAlive = false - try { - val am = getSystemService(Context.ACTIVITY_SERVICE) as ActivityManager - processAlive = am.runningAppProcesses - ?.any { it.processName.endsWith(VPN_PROCESS_SUFFIX) } == true - } catch (_: Exception) { - } - - var vpnTransport = false - try { - val cm = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager - vpnTransport = cm.allNetworks.any { network -> - cm.getNetworkCapabilities(network) - ?.hasTransport(NetworkCapabilities.TRANSPORT_VPN) == true - } - } catch (_: Exception) { - } - - return mapOf( - "processAlive" to processAlive, - "vpnTransport" to vpnTransport, - ) - } - - /** Removes a notification left behind by a runtime that is no longer alive. */ - private fun cancelVpnNotification() { - try { - NotificationManagerCompat.from(this).cancel(NOTIFICATION_ID) - } catch (_: Exception) { - } - } - private fun updateVpnNotification(title: String, text: String, actionLabel: String) { if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU && checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) != @@ -216,15 +140,6 @@ class MainActivity : FlutterActivity() { return } - // The foreground notification (id 1) is owned by XrayVPNService via - // startForeground. Posting to it from this process while the service is - // gone leaves a frozen countdown nothing will ever update again. - val alive = isVpnRuntimeAlive()["processAlive"] == true - if (!alive) { - cancelVpnNotification() - return - } - ensureNotificationChannel() val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) { @@ -234,17 +149,28 @@ class MainActivity : FlutterActivity() { } val launchIntent = packageManager.getLaunchIntentForPackage(packageName) - launchIntent?.action = "FROM_DISCONNECT_BTN" launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_NEW_TASK - val stopIntent = Intent(this, XrayVPNService::class.java) - stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) - val stopPendingIntent = PendingIntent.getService(this, 0, stopIntent, flags) + // The VPN service owns the authoritative Disconnect PendingIntent and + // embeds the current runtime-generation token in it. Never recreate an + // unscoped STOP intent from the UI process: a stale notification could + // otherwise stop a newer tunnel. Reuse the live service action when the + // platform exposes it; on older Android versions omit the action rather + // than weaken generation scoping. + val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager + val serviceStopAction = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) { + manager.activeNotifications + .firstOrNull { it.id == NOTIFICATION_ID } + ?.notification + ?.actions + ?.firstOrNull() + ?.actionIntent + } else { + null + } - // Public lock-screen preview: keep the VPN status visible but hide the - // session countdown/speed so usage metadata never reaches the lock screen. val publicVersion = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID) .setSmallIcon(R.drawable.notification_status_icon) .setContentTitle("Revolt VPN") @@ -255,7 +181,6 @@ class MainActivity : FlutterActivity() { .setSmallIcon(R.drawable.notification_status_icon) .setContentTitle(title) .setContentText(text) - .addAction(0, actionLabel, stopPendingIntent) .setColorized(true) .setColor(0xFF0D1117.toInt()) .setOngoing(true) @@ -267,6 +192,10 @@ class MainActivity : FlutterActivity() { .setVisibility(NotificationCompat.VISIBILITY_PRIVATE) .setPublicVersion(publicVersion) + if (serviceStopAction != null) { + builder.addAction(0, actionLabel, serviceStopAction) + } + if (launchIntent != null) { builder.setContentIntent(PendingIntent.getActivity(this, 0, launchIntent, flags)) } @@ -473,7 +402,6 @@ class MainActivity : FlutterActivity() { companion object { private const val NOTIFICATION_ID = 1 - private const val VPN_PROCESS_SUFFIX = ":RunSoLibXrayDaemon" - private const val NOTIFICATION_CHANNEL_ID = "XRAY_SERVICE_CHANNEL" + private const val NOTIFICATION_CHANNEL_ID = "REVOLT_VPN_SERVICE" } } diff --git a/android/app/src/main/res/drawable/notification_status_icon.xml b/android/app/src/main/res/drawable/notification_status_icon.xml index 183ed91..f768282 100644 --- a/android/app/src/main/res/drawable/notification_status_icon.xml +++ b/android/app/src/main/res/drawable/notification_status_icon.xml @@ -1,9 +1,4 @@ - - - + diff --git a/android/gradle/verification-metadata.xml b/android/gradle/verification-metadata.xml new file mode 100644 index 0000000..590f03d --- /dev/null +++ b/android/gradle/verification-metadata.xml @@ -0,0 +1,8845 @@ + + + + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/android/gradle/wrapper/gradle-wrapper.jar b/android/gradle/wrapper/gradle-wrapper.jar new file mode 100644 index 0000000..1b33c55 Binary files /dev/null and b/android/gradle/wrapper/gradle-wrapper.jar differ diff --git a/android/gradlew b/android/gradlew new file mode 100755 index 0000000..0f14772 --- /dev/null +++ b/android/gradlew @@ -0,0 +1,251 @@ +#!/bin/sh + +# +# Copyright © 2015-2021 the original authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# SPDX-License-Identifier: Apache-2.0 +# + +############################################################################## +# +# Gradle start up script for POSIX generated by Gradle. +# +# Important for running: +# +# (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is +# noncompliant, but you have some other compliant shell such as ksh or +# bash, then to run this script, type that shell name before the whole +# command line, like: +# +# ksh Gradle +# +# Busybox and similar reduced shells will NOT work, because this script +# requires all of these POSIX shell features: +# * functions; +# * expansions «$var», «${var}», «${var:-default}», «${var+SET}», +# «${var#prefix}», «${var%suffix}», and «$( cmd )»; +# * compound commands having a testable exit status, especially «case»; +# * various built-in commands including «command», «set», and «ulimit». +# +# Important for patching: +# +# (2) This script targets any POSIX shell, so it avoids extensions provided +# by Bash, Ksh, etc; in particular arrays are avoided. +# +# The "traditional" practice of packing multiple parameters into a +# space-separated string is a well documented source of bugs and security +# problems, so this is (mostly) avoided, by progressively accumulating +# options in "$@", and eventually passing that to Java. +# +# Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS, +# and GRADLE_OPTS) rely on word-splitting, this is performed explicitly; +# see the in-line comments for details. +# +# There are tweaks for specific operating systems such as AIX, CygWin, +# Darwin, MinGW, and NonStop. +# +# (3) This script is generated from the Groovy template +# https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt +# within the Gradle project. +# +# You can find Gradle at https://github.com/gradle/gradle/. +# +############################################################################## + +# Attempt to set APP_HOME + +# Resolve links: $0 may be a link +app_path=$0 + +# Need this for daisy-chained symlinks. +while + APP_HOME=${app_path%"${app_path##*/}"} # leaves a trailing /; empty if no leading path + [ -h "$app_path" ] +do + ls=$( ls -ld "$app_path" ) + link=${ls#*' -> '} + case $link in #( + /*) app_path=$link ;; #( + *) app_path=$APP_HOME$link ;; + esac +done + +# This is normally unused +# shellcheck disable=SC2034 +APP_BASE_NAME=${0##*/} +# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036) +APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit + +# Use the maximum available, or set MAX_FD != -1 to use that value. +MAX_FD=maximum + +warn () { + echo "$*" +} >&2 + +die () { + echo + echo "$*" + echo + exit 1 +} >&2 + +# OS specific support (must be 'true' or 'false'). +cygwin=false +msys=false +darwin=false +nonstop=false +case "$( uname )" in #( + CYGWIN* ) cygwin=true ;; #( + Darwin* ) darwin=true ;; #( + MSYS* | MINGW* ) msys=true ;; #( + NONSTOP* ) nonstop=true ;; +esac + +CLASSPATH="\\\"\\\"" + + +# Determine the Java command to use to start the JVM. +if [ -n "$JAVA_HOME" ] ; then + if [ -x "$JAVA_HOME/jre/sh/java" ] ; then + # IBM's JDK on AIX uses strange locations for the executables + JAVACMD=$JAVA_HOME/jre/sh/java + else + JAVACMD=$JAVA_HOME/bin/java + fi + if [ ! -x "$JAVACMD" ] ; then + die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +else + JAVACMD=java + if ! command -v java >/dev/null 2>&1 + then + die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. + +Please set the JAVA_HOME variable in your environment to match the +location of your Java installation." + fi +fi + +# Increase the maximum file descriptors if we can. +if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then + case $MAX_FD in #( + max*) + # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked. + # shellcheck disable=SC2039,SC3045 + MAX_FD=$( ulimit -H -n ) || + warn "Could not query maximum file descriptor limit" + esac + case $MAX_FD in #( + '' | soft) :;; #( + *) + # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked. + # shellcheck disable=SC2039,SC3045 + ulimit -n "$MAX_FD" || + warn "Could not set maximum file descriptor limit to $MAX_FD" + esac +fi + +# Collect all arguments for the java command, stacking in reverse order: +# * args from the command line +# * the main class name +# * -classpath +# * -D...appname settings +# * --module-path (only if needed) +# * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables. + +# For Cygwin or MSYS, switch paths to Windows format before running java +if "$cygwin" || "$msys" ; then + APP_HOME=$( cygpath --path --mixed "$APP_HOME" ) + CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" ) + + JAVACMD=$( cygpath --unix "$JAVACMD" ) + + # Now convert the arguments - kludge to limit ourselves to /bin/sh + for arg do + if + case $arg in #( + -*) false ;; # don't mess with options #( + /?*) t=${arg#/} t=/${t%%/*} # looks like a POSIX filepath + [ -e "$t" ] ;; #( + *) false ;; + esac + then + arg=$( cygpath --path --ignore --mixed "$arg" ) + fi + # Roll the args list around exactly as many times as the number of + # args, so each arg winds up back in the position where it started, but + # possibly modified. + # + # NB: a `for` loop captures its iteration list before it begins, so + # changing the positional parameters here affects neither the number of + # iterations, nor the values presented in `arg`. + shift # remove old arg + set -- "$@" "$arg" # push replacement arg + done +fi + + +# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +DEFAULT_JVM_OPTS='-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"' + +# Collect all arguments for the java command: +# * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments, +# and any embedded shellness will be escaped. +# * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be +# treated as '${Hostname}' itself on the command line. + +set -- \ + "-Dorg.gradle.appname=$APP_BASE_NAME" \ + -classpath "$CLASSPATH" \ + -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \ + "$@" + +# Stop when "xargs" is not available. +if ! command -v xargs >/dev/null 2>&1 +then + die "xargs is not available" +fi + +# Use "xargs" to parse quoted args. +# +# With -n1 it outputs one arg per line, with the quotes and backslashes removed. +# +# In Bash we could simply go: +# +# readarray ARGS < <( xargs -n1 <<<"$var" ) && +# set -- "${ARGS[@]}" "$@" +# +# but POSIX shell has neither arrays nor command substitution, so instead we +# post-process each arg (as a line of input to sed) to backslash-escape any +# character that might be a shell metacharacter, then use eval to reverse +# that process (while maintaining the separation between arguments), and wrap +# the whole thing up as a single "set" statement. +# +# This will of course break if any of these variables contains a newline or +# an unmatched quote. +# + +eval "set -- $( + printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" | + xargs -n1 | + sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' | + tr '\n' ' ' + )" '"$@"' + +exec "$JAVACMD" "$@" diff --git a/android/gradlew.bat b/android/gradlew.bat new file mode 100644 index 0000000..8de1053 --- /dev/null +++ b/android/gradlew.bat @@ -0,0 +1,94 @@ +@rem +@rem Copyright 2015 the original author or authors. +@rem +@rem Licensed under the Apache License, Version 2.0 (the "License"); +@rem you may not use this file except in compliance with the License. +@rem You may obtain a copy of the License at +@rem +@rem https://www.apache.org/licenses/LICENSE-2.0 +@rem +@rem Unless required by applicable law or agreed to in writing, software +@rem distributed under the License is distributed on an "AS IS" BASIS, +@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +@rem See the License for the specific language governing permissions and +@rem limitations under the License. +@rem +@rem SPDX-License-Identifier: Apache-2.0 +@rem + +@if "%DEBUG%"=="" @echo off +@rem ########################################################################## +@rem +@rem Gradle startup script for Windows +@rem +@rem ########################################################################## + +@rem Set local scope for the variables with windows NT shell +if "%OS%"=="Windows_NT" setlocal + +set DIRNAME=%~dp0 +if "%DIRNAME%"=="" set DIRNAME=. +@rem This is normally unused +set APP_BASE_NAME=%~n0 +set APP_HOME=%DIRNAME% + +@rem Resolve any "." and ".." in APP_HOME to make it shorter. +for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi + +@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. +set DEFAULT_JVM_OPTS=-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m" + +@rem Find java.exe +if defined JAVA_HOME goto findJavaFromJavaHome + +set JAVA_EXE=java.exe +%JAVA_EXE% -version >NUL 2>&1 +if %ERRORLEVEL% equ 0 goto execute + +echo. 1>&2 +echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2 +echo. 1>&2 +echo Please set the JAVA_HOME variable in your environment to match the 1>&2 +echo location of your Java installation. 1>&2 + +goto fail + +:findJavaFromJavaHome +set JAVA_HOME=%JAVA_HOME:"=% +set JAVA_EXE=%JAVA_HOME%/bin/java.exe + +if exist "%JAVA_EXE%" goto execute + +echo. 1>&2 +echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2 +echo. 1>&2 +echo Please set the JAVA_HOME variable in your environment to match the 1>&2 +echo location of your Java installation. 1>&2 + +goto fail + +:execute +@rem Setup the command line + +set CLASSPATH= + + +@rem Execute Gradle +"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* + +:end +@rem End local scope for the variables with windows NT shell +if %ERRORLEVEL% equ 0 goto mainEnd + +:fail +rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of +rem the _cmd.exe /c_ return code! +set EXIT_CODE=%ERRORLEVEL% +if %EXIT_CODE% equ 0 set EXIT_CODE=1 +if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE% +exit /b %EXIT_CODE% + +:mainEnd +if "%OS%"=="Windows_NT" endlocal + +:omega diff --git a/lib/components/connect_button.dart b/lib/components/connect_button.dart index 2e739ee..60227d2 100644 --- a/lib/components/connect_button.dart +++ b/lib/components/connect_button.dart @@ -19,6 +19,7 @@ class _ConnectButtonState extends State DateTime _lastTap = DateTime.fromMillisecondsSinceEpoch(0); AnimationController? _pulse; Animation? _pulseAnim; + VpnConnection? _vpn; double get _pulseValue => _pulseAnim?.value ?? 0.0; @@ -35,20 +36,25 @@ class _ConnectButtonState extends State ); WidgetsBinding.instance.addObserver(this); WidgetsBinding.instance.addPostFrameCallback((_) { - if (mounted) context.read().addListener(_onVpnChanged); + if (!mounted || _vpn != null) return; + final vpn = context.read(); + _vpn = vpn; + vpn.addListener(_onVpnChanged); + _onVpnChanged(); }); } @override void dispose() { WidgetsBinding.instance.removeObserver(this); - context.read().removeListener(_onVpnChanged); + _vpn?.removeListener(_onVpnChanged); _pulse?.dispose(); super.dispose(); } void _onVpnChanged() { - final vpn = context.read(); + final vpn = _vpn; + if (vpn == null) return; if (vpn.status == VpnStatus.connected) { _pulse?.repeat(reverse: true); } else { @@ -60,14 +66,12 @@ class _ConnectButtonState extends State @override void didChangeAppLifecycleState(AppLifecycleState state) { if (!mounted) return; - if (state == AppLifecycleState.paused || - state == AppLifecycleState.detached) { + if (state != AppLifecycleState.resumed) { _pulse?.stop(); - } else if (state == AppLifecycleState.resumed) { - final vpn = context.read(); - if (vpn.status == VpnStatus.connected) { - _pulse?.repeat(reverse: true); - } + return; + } + if (_vpn?.status == VpnStatus.connected) { + _pulse?.repeat(reverse: true); } } diff --git a/lib/components/data_disclosure_dialog.dart b/lib/components/data_disclosure_dialog.dart index 85d8132..95a59b5 100644 --- a/lib/components/data_disclosure_dialog.dart +++ b/lib/components/data_disclosure_dialog.dart @@ -19,23 +19,28 @@ class DataDisclosureDialog { if (!context.mounted) return; - await showDialog( + final accepted = await showDialog( context: context, barrierDismissible: false, // Must tap Continue — no tap-outside dismiss. - builder: (_) => _DisclosureDialog( - onContinue: () { - prefs.setBool(_key, true); - Navigator.of(context).pop(); // Dismiss the dialog. - }, - ), + builder: (_) => const _DisclosureDialog(), ); + if (accepted != true) return; + + // Persist only after the user action is complete. If storage fails, do not + // invent an accepted state; the disclosure will simply reappear later. + try { + final saved = await prefs.setBool(_key, true); + if (!saved) { + debugPrint('[Disclosure] Preference write was rejected'); + } + } catch (e) { + debugPrint('[Disclosure] Failed to persist acknowledgement: $e'); + } } } class _DisclosureDialog extends StatelessWidget { - final VoidCallback onContinue; - - const _DisclosureDialog({required this.onContinue}); + const _DisclosureDialog(); @override Widget build(BuildContext context) { @@ -49,7 +54,6 @@ class _DisclosureDialog extends StatelessWidget { mainAxisSize: MainAxisSize.min, crossAxisAlignment: CrossAxisAlignment.start, children: [ - // Title const Text( 'Before you connect', style: TextStyle( @@ -59,8 +63,6 @@ class _DisclosureDialog extends StatelessWidget { ), ), const SizedBox(height: 16), - - // Body const Text( 'Revolt VPN creates a secure VPN tunnel to protect your ' 'traffic. To enforce your data/time quota, we log your ' @@ -76,12 +78,10 @@ class _DisclosureDialog extends StatelessWidget { ), ), const SizedBox(height: 24), - - // Continue button — full-width, accent SizedBox( width: double.infinity, child: ElevatedButton( - onPressed: onContinue, + onPressed: () => Navigator.of(context).pop(true), style: ElevatedButton.styleFrom( backgroundColor: AppColors.accent, foregroundColor: AppColors.bgDeep, diff --git a/lib/components/lightning.dart b/lib/components/lightning.dart index 03a032d..0ad6e3f 100644 --- a/lib/components/lightning.dart +++ b/lib/components/lightning.dart @@ -5,13 +5,9 @@ import 'package:revoltvpn/logic/app_colors.dart'; import 'package:revoltvpn/screens/settings/in_settings/lightning.dart'; /// 2D lightning bolt — a jagged yellow line from top to bottom with glow. - class LightningEffect extends StatefulWidget { - final int minIntervalSec; - final int maxIntervalSec; - final double doubleChance; const LightningEffect({ @@ -26,26 +22,49 @@ class LightningEffect extends StatefulWidget { } class _LightningEffectState extends State - with SingleTickerProviderStateMixin { + with SingleTickerProviderStateMixin, WidgetsBindingObserver { late final AnimationController _ctrl; Timer? _timer; final _random = Random(); + bool _appActive = true; LightningBolt? _bolt; @override void initState() { super.initState(); - _ctrl = AnimationController(vsync: this, duration: const Duration(milliseconds: 400)); + _ctrl = AnimationController( + vsync: this, + duration: const Duration(milliseconds: 400), + ); + WidgetsBinding.instance.addObserver(this); + final lifecycle = WidgetsBinding.instance.lifecycleState; + _appActive = lifecycle == null || lifecycle == AppLifecycleState.resumed; lightningEnabled.addListener(_onEnabledChanged); + if (_appActive && lightningEnabled.value) _scheduleNext(); + } + + @override + void didChangeAppLifecycleState(AppLifecycleState state) { + _appActive = state == AppLifecycleState.resumed; + if (!_appActive) { + _timer?.cancel(); + _timer = null; + _ctrl.stop(); + _bolt = null; + if (mounted) setState(() {}); + return; + } + if (lightningEnabled.value) _scheduleNext(); } void _onEnabledChanged() { - if (lightningEnabled.value) { + if (lightningEnabled.value && _appActive) { _scheduleNext(); } else { _timer?.cancel(); + _timer = null; _ctrl.stop(); _bolt = null; } @@ -54,6 +73,7 @@ class _LightningEffectState extends State @override void dispose() { + WidgetsBinding.instance.removeObserver(this); lightningEnabled.removeListener(_onEnabledChanged); _timer?.cancel(); _ctrl.dispose(); @@ -61,19 +81,23 @@ class _LightningEffectState extends State } void _scheduleNext() { + _timer?.cancel(); + if (!mounted || !_appActive || !lightningEnabled.value) return; + final secs = widget.minIntervalSec + _random.nextInt(widget.maxIntervalSec - widget.minIntervalSec + 1); _timer = Timer(Duration(seconds: secs), _strike); } void _strike() { - if (!mounted || !lightningEnabled.value) return; + _timer = null; + if (!mounted || !_appActive || !lightningEnabled.value) return; _bolt = LightningBolt.random(_random); _ctrl.forward(from: 0.0); if (_random.nextDouble() < widget.doubleChance) { Future.delayed(const Duration(milliseconds: 120), () { - if (mounted && lightningEnabled.value) { + if (mounted && _appActive && lightningEnabled.value) { _bolt = LightningBolt.random(_random); _ctrl.forward(from: 0.0); } @@ -83,10 +107,10 @@ class _LightningEffectState extends State _scheduleNext(); } - /// Sharp flash curve: quick on, quick off. No slow fade. + /// Sharp flash curve: quick on, quick off. No slow fade. double _opacity(double t) { - if (t < 0.08) return t / 0.08; // fast ramp - return 1.0 - ((t - 0.08) / 0.92); // linear decay + if (t < 0.08) return t / 0.08; + return 1.0 - ((t - 0.08) / 0.92); } @override @@ -117,37 +141,31 @@ class _LightningEffectState extends State } } - /// A single bolt defined by a list of 2D points (0.0–1.0 in width×height space). class LightningBolt { final List mainPath; - final List> branches; // 0–2 forks off the main path + final List> branches; const LightningBolt({required this.mainPath, this.branches = const []}); - /// Generate a random bolt. The path always starts near the top-center + /// Generate a random bolt. The path always starts near the top-center /// and ends near the bottom, zigzagging left/right along the way. factory LightningBolt.random(Random rng) { final points = []; - // Start: top, slight horizontal offset double x = 0.5 + (rng.nextDouble() - 0.5) * 0.15; points.add(Offset(x, 0.0)); - // Zigzag down — 6–10 segments final segments = 6 + rng.nextInt(5); for (int i = 1; i < segments; i++) { final y = i / segments; - // Random horizontal offset — each segment adds jitter x += (rng.nextDouble() - 0.5) * 0.25; - x = x.clamp(0.05, 0.95); // stay on screen + x = x.clamp(0.05, 0.95); points.add(Offset(x, y)); } - // End: bottom points.add(Offset(x.clamp(0.1, 0.9), 1.0)); - // Branches — 0–2 forks from random points along the main path final branches = >[]; final branchCount = rng.nextInt(3); for (int b = 0; b < branchCount; b++) { @@ -160,7 +178,7 @@ class LightningBolt { double by = start.dy; final branchLen = 2 + rng.nextInt(3); for (int j = 0; j < branchLen; j++) { - by += (0.05 + rng.nextDouble() * 0.12); + by += 0.05 + rng.nextDouble() * 0.12; bx += (rng.nextDouble() - 0.5) * 0.3; bx = bx.clamp(0.02, 0.98); by = by.clamp(0.0, 1.0); @@ -173,7 +191,6 @@ class LightningBolt { } } - class _LightningPainter extends CustomPainter { final LightningBolt bolt; final double opacity; @@ -182,7 +199,8 @@ class _LightningPainter extends CustomPainter { @override void paint(Canvas canvas, Size size) { - final toScreen = (Offset p) => Offset(p.dx * size.width, p.dy * size.height); + Offset toScreen(Offset p) => Offset(p.dx * size.width, p.dy * size.height); + final scaledMain = bolt.mainPath.map(toScreen).toList(); final scaledBranches = bolt.branches .map((b) => b.map(toScreen).toList()) @@ -191,7 +209,6 @@ class _LightningPainter extends CustomPainter { final baseColor = AppColors.accent.withAlpha((opacity * 255).round()); final glowColor = AppColors.accent.withAlpha((opacity * 0.35 * 255).round()); - // Glow final glowPaint = Paint() ..color = glowColor ..strokeWidth = 18 @@ -202,7 +219,6 @@ class _LightningPainter extends CustomPainter { _drawPath(canvas, scaledMain, scaledBranches, glowPaint); - // Core final corePaint = Paint() ..color = baseColor ..strokeWidth = 5 @@ -212,7 +228,6 @@ class _LightningPainter extends CustomPainter { _drawPath(canvas, scaledMain, scaledBranches, corePaint); - // Hot center if (opacity > 0.6) { final hotPaint = Paint() ..color = Colors.white.withAlpha((opacity * 180).round()) @@ -225,8 +240,12 @@ class _LightningPainter extends CustomPainter { } } - void _drawPath(Canvas canvas, List main, - List> branches, Paint paint) { + void _drawPath( + Canvas canvas, + List main, + List> branches, + Paint paint, + ) { final mainPath = Path()..moveTo(main.first.dx, main.first.dy); for (int i = 1; i < main.length; i++) { mainPath.lineTo(main[i].dx, main[i].dy); diff --git a/lib/components/sidebar_contents/discord_link_button.dart b/lib/components/sidebar_contents/discord_link_button.dart index 012322d..9f1d183 100644 --- a/lib/components/sidebar_contents/discord_link_button.dart +++ b/lib/components/sidebar_contents/discord_link_button.dart @@ -14,8 +14,8 @@ class DiscordLinkButton extends StatelessWidget { @override Widget build(BuildContext context) { - return IconButton( - icon: const Icon(Icons.discord, color: AppColors.textWhite, size: 28), + return const IconButton( + icon: Icon(Icons.discord, color: AppColors.textWhite, size: 28), onPressed: launchDiscord, tooltip: 'Join Discord', splashRadius: 24, diff --git a/lib/components/sidebar_contents/gdpr_button.dart b/lib/components/sidebar_contents/gdpr_button.dart index 696ac13..00f95d0 100644 --- a/lib/components/sidebar_contents/gdpr_button.dart +++ b/lib/components/sidebar_contents/gdpr_button.dart @@ -76,8 +76,8 @@ class GdprButton extends StatelessWidget { @override Widget build(BuildContext context) { - return IconButton( - icon: const Icon(Icons.admin_panel_settings_outlined, + return const IconButton( + icon: Icon(Icons.admin_panel_settings_outlined, color: AppColors.textWhite, size: 28), onPressed: showConsentForm, tooltip: 'Ad consent & privacy choices', diff --git a/lib/components/sidebar_contents/info_button.dart b/lib/components/sidebar_contents/info_button.dart index 9a2f575..98559ad 100644 --- a/lib/components/sidebar_contents/info_button.dart +++ b/lib/components/sidebar_contents/info_button.dart @@ -14,8 +14,8 @@ class InfoButton extends StatelessWidget { @override Widget build(BuildContext context) { - return IconButton( - icon: const Icon(Icons.help_outline, color: AppColors.textWhite, size: 28), + return const IconButton( + icon: Icon(Icons.help_outline, color: AppColors.textWhite, size: 28), onPressed: launchGitHub, tooltip: 'About ReVoltVPN', splashRadius: 24, diff --git a/lib/components/sidebar_contents/privacy_policy_button.dart b/lib/components/sidebar_contents/privacy_policy_button.dart index 09b6bd1..38ad136 100644 --- a/lib/components/sidebar_contents/privacy_policy_button.dart +++ b/lib/components/sidebar_contents/privacy_policy_button.dart @@ -6,7 +6,9 @@ class PrivacyPolicyButton extends StatelessWidget { const PrivacyPolicyButton({super.key}); static Future launchPrivacyPolicy() async { - final Uri url = Uri.parse('https://github.com/esefxdz/ReVoltVPN/blob/main/PRIVACY_POLICY.md'); + final Uri url = Uri.parse( + 'https://github.com/esefxdz/ReVoltVPN/blob/main/PRIVACY_POLICY.md', + ); if (!await launchUrl(url, mode: LaunchMode.externalApplication)) { debugPrint('Could not launch $url'); } @@ -14,8 +16,12 @@ class PrivacyPolicyButton extends StatelessWidget { @override Widget build(BuildContext context) { - return IconButton( - icon: const Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28), + return const IconButton( + icon: Icon( + Icons.privacy_tip_outlined, + color: AppColors.textWhite, + size: 28, + ), onPressed: launchPrivacyPolicy, tooltip: 'Privacy Policy', splashRadius: 24, diff --git a/lib/components/sidebar_contents/website_button.dart b/lib/components/sidebar_contents/website_button.dart index ef6496a..c5d7b0a 100644 --- a/lib/components/sidebar_contents/website_button.dart +++ b/lib/components/sidebar_contents/website_button.dart @@ -14,8 +14,8 @@ class WebsiteButton extends StatelessWidget { @override Widget build(BuildContext context) { - return IconButton( - icon: const Icon(Icons.language, color: AppColors.textWhite, size: 28), + return const IconButton( + icon: Icon(Icons.language, color: AppColors.textWhite, size: 28), onPressed: launchWebsite, tooltip: 'Website', splashRadius: 24, diff --git a/lib/components/status_bar.dart b/lib/components/status_bar.dart index 9e640b4..3eb1434 100644 --- a/lib/components/status_bar.dart +++ b/lib/components/status_bar.dart @@ -1,91 +1,58 @@ import 'package:flutter/material.dart'; import 'package:provider/provider.dart'; +import 'package:revoltvpn/components/online_dot.dart'; import 'package:revoltvpn/logic/app_colors.dart'; import 'package:revoltvpn/logic/vpn_connection.dart'; -import 'package:revoltvpn/logic/session_timer.dart'; -import 'package:revoltvpn/logic/server_list.dart'; -import 'package:revoltvpn/components/online_dot.dart'; -import 'package:revoltvpn/screens/server_selector/selection_screen.dart'; class StatusBar extends StatelessWidget { const StatusBar({super.key}); @override Widget build(BuildContext context) { - return Consumer2( - builder: (context, vpn, timer, _) { + return Consumer( + builder: (context, vpn, _) { final isConnected = vpn.status == VpnStatus.connected; - final isConnecting = vpn.status == VpnStatus.connecting; - final serverHealthy = - vpn.serverReachable || (isConnected && timer.hasSyncedOnce); - final sessionOrTunnelHealthy = timer.hasSyncedOnce || vpn.serverReachable; - - final statusLabel = isConnected - ? (sessionOrTunnelHealthy ? 'Online' : 'Syncing…') - : (isConnecting - ? 'Connecting…' - : (vpn.serverReachable ? 'Ready' : 'Offline')); - - final server = context.watch().selected; + final statusLabel = switch (vpn.status) { + VpnStatus.connected => 'Connected', + VpnStatus.connecting => 'Connecting…', + VpnStatus.disconnecting => 'Disconnecting…', + VpnStatus.error => 'Error', + VpnStatus.disconnected => vpn.serverReachable ? 'Ready' : 'Offline', + }; return Padding( padding: const EdgeInsets.symmetric(horizontal: 24), child: Column( mainAxisSize: MainAxisSize.min, children: [ - GestureDetector( - onTap: () { - Navigator.of(context).push( - PageRouteBuilder( - transitionDuration: const Duration(milliseconds: 300), - pageBuilder: (_, __, ___) => const SelectionScreen(), - transitionsBuilder: (_, animation, __, child) { - return SlideTransition( - position: Tween( - begin: const Offset(1.0, 0.0), - end: Offset.zero, - ).animate( - CurvedAnimation( - parent: animation, - curve: Curves.easeOut, - ), - ), - child: child, - ); - }, + Container( + padding: + const EdgeInsets.symmetric(horizontal: 20, vertical: 12), + decoration: BoxDecoration( + color: AppColors.bgCard, + borderRadius: BorderRadius.circular(16), + border: Border.all(color: AppColors.slate15), + ), + child: Row( + children: [ + Image.asset( + 'assets/finland_flag_256.png', + width: 20, + height: 20, ), - ); - }, - child: Container( - padding: - const EdgeInsets.symmetric(horizontal: 20, vertical: 12), - decoration: BoxDecoration( - color: AppColors.bgCard, - borderRadius: BorderRadius.circular(16), - border: Border.all(color: AppColors.slate15), - ), - child: Row( - children: [ - Image.asset(server.flagAsset, width: 20, height: 20), - const SizedBox(width: 8), - Expanded( - child: Text( - server.name, - style: const TextStyle( - color: AppColors.accent, - fontWeight: FontWeight.w600, - fontSize: 13, - letterSpacing: 0.5, - ), + const SizedBox(width: 8), + const Expanded( + child: Text( + 'Helsinki, Finland', + style: TextStyle( + color: AppColors.accent, + fontWeight: FontWeight.w600, + fontSize: 13, + letterSpacing: 0.5, ), ), - const Icon( - Icons.chevron_right, - color: AppColors.textDim, - size: 20, - ), - ], - ), + ), + ], ), ), const SizedBox(height: 8), @@ -100,7 +67,7 @@ class StatusBar extends StatelessWidget { child: Row( children: [ OnlineDot( - isOnline: serverHealthy, + isOnline: isConnected, label: statusLabel, ), const Spacer(), diff --git a/lib/logic/connection_settings.dart b/lib/logic/connection_settings.dart index 6189360..e7a6e36 100644 --- a/lib/logic/connection_settings.dart +++ b/lib/logic/connection_settings.dart @@ -18,23 +18,32 @@ abstract final class ConnectionSettings { final prefs = await SharedPreferences.getInstance(); final storedMode = prefs.getString(_modeKey); - // Any unrecognized value (including the pre-V3 'auto') is TUN. 'proxy' is - // the only persisted value that selects the SOCKS5 mode. + // Only the explicit current proxy value restores SOCKS5. Unknown and + // obsolete values, including the former 'auto'/'ass' labels, fail closed + // to full-tunnel TUN instead of silently selecting a weaker route. _mode = storedMode == ConnectionMode.proxy.name ? ConnectionMode.proxy : ConnectionMode.tun; if (storedMode != _mode.name) { - await prefs.setString(_modeKey, _mode.name); + final migrated = await prefs.setString(_modeKey, _mode.name); + if (!migrated) { + throw StateError('Could not persist migrated connection mode.'); + } } _initialized = true; } - static Future setMode(ConnectionMode mode) async { + static Future setMode(ConnectionMode mode) async { + if (_initialized && _mode == mode) return true; + + final prefs = await SharedPreferences.getInstance(); + final saved = await prefs.setString(_modeKey, mode.name); + if (!saved) return false; + _mode = mode; _initialized = true; - final prefs = await SharedPreferences.getInstance(); - await prefs.setString(_modeKey, mode.name); + return true; } } diff --git a/lib/logic/hivemind_service.dart b/lib/logic/hivemind_service.dart index e1f3d8a..a09a1fb 100644 --- a/lib/logic/hivemind_service.dart +++ b/lib/logic/hivemind_service.dart @@ -13,6 +13,7 @@ class HivemindService { static const _ua = 'Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 ' '(KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36'; + static const int _maxControlResponseBytes = 256 * 1024; static const _pollBackoff = [ Duration(seconds: 1), Duration(seconds: 2), @@ -27,7 +28,58 @@ class HivemindService { return http.get(uri, headers: {'User-Agent': _ua}).timeout(timeout); } - static void cancel() => _currentCallId++; + static Future controlGet( + Uri uri, { + Duration timeout = const Duration(seconds: 5), + }) async { + final client = http.Client(); + final request = http.Request('GET', uri) + ..headers['User-Agent'] = _ua + ..followRedirects = false; + + Future read() async { + final streamed = await client.send(request); + final declaredLength = streamed.contentLength; + if (declaredLength != null && declaredLength > _maxControlResponseBytes) { + throw const FormatException('Control response is too large.'); + } + + final bytes = []; + await for (final chunk in streamed.stream) { + if (bytes.length + chunk.length > _maxControlResponseBytes) { + throw const FormatException('Control response is too large.'); + } + bytes.addAll(chunk); + } + + return http.Response.bytes( + bytes, + streamed.statusCode, + headers: streamed.headers, + isRedirect: streamed.isRedirect, + persistentConnection: streamed.persistentConnection, + reasonPhrase: streamed.reasonPhrase, + request: request, + ); + } + + try { + return await read().timeout( + timeout, + onTimeout: () { + client.close(); + throw TimeoutException('Control request timed out.', timeout); + }, + ); + } finally { + client.close(); + } + } + + static void cancel() { + _currentCallId++; + _expectedNonce = null; + } static void setExpectedNonce(String nonce) { _expectedNonce = nonce; @@ -37,13 +89,19 @@ class HivemindService { void Function(int attempt, int total)? onAttempt, bool skipAdBypass = false, }) async { - final deviceId = await CryptoService.getDeviceId(); + // Capture the generation before the first await. Otherwise a disconnect + // that lands while secure storage is resolving the device ID can be lost + // and the cancelled call can resume network work with a fresh generation. final callId = ++_currentCallId; + final deviceId = await CryptoService.getDeviceId(); + _throwIfCancelled(callId); + final nonce = _newNonce(); _expectedNonce = nonce; if (!skipAdBypass) { await _runConfiguredBypass(deviceId, nonce); + _throwIfCancelled(callId); } const maxAttempts = 5; @@ -53,6 +111,7 @@ class HivemindService { try { final session = await _fetchActiveSession(deviceId, nonce); + _throwIfCancelled(callId); if (session != null) { _expectedNonce = null; return session.toVlessUrl(); @@ -73,7 +132,7 @@ class HivemindService { static Future checkHealth() async { try { - final response = await directGet( + final response = await controlGet( _publicUrl('/health'), timeout: const Duration(seconds: 3), ); @@ -109,15 +168,15 @@ class HivemindService { final statusUri = _publicUrl('/session/status').replace( queryParameters: {'device_id': deviceId}, ); - final response = await directGet(statusUri); + final response = await controlGet(statusUri); if (response.statusCode != 200) return null; final decoded = jsonDecode(response.body); if (decoded is! Map) return null; final serverNonce = decoded['nonce']; - if (_expectedNonce != null && - serverNonce is String && + if (_expectedNonce != nonce || + serverNonce is! String || serverNonce != nonce) { return null; } @@ -141,6 +200,13 @@ class HivemindService { } class _HivemindSessionConfig { + static final RegExp _uuidPattern = RegExp( + r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$', + caseSensitive: false, + ); + static final RegExp _shortIdPattern = + RegExp(r'^[0-9a-f]{0,16}$', caseSensitive: false); + final String uuid; final String host; final int port; @@ -162,50 +228,174 @@ class _HivemindSessionConfig { }); factory _HivemindSessionConfig.fromJson(Map json) { - final uuid = _requiredString(json, 'vless_uuid'); - final host = _stringOr(json['vless_ip'], AppConfig.serverIp); - final port = _portOr(json['vless_port'], 443); - final sni = _requiredString(json, 'reality_sni'); + final uuid = _requiredString(json, 'vless_uuid', maxLength: 64); + if (!_uuidPattern.hasMatch(uuid)) { + throw const FormatException('Invalid VLESS UUID'); + } + + // The API may rotate credentials and Reality parameters, but it must never + // choose the tunnel destination. Keep that trust anchor compiled into the + // app so an API/domain compromise can cause denial of service, not redirect + // VPN traffic to an attacker-controlled server. + final pinnedHost = _validatedPublicIp(AppConfig.serverIp, 'serverIp'); + final advertisedHost = json['vless_ip']; + if (advertisedHost != null) { + if (advertisedHost is! String || advertisedHost.trim() != pinnedHost) { + throw const FormatException( + 'Session VLESS host does not match compiled server pin', + ); + } + } + final host = pinnedHost; + + final advertisedPort = json['vless_port']; + if (advertisedPort != null && + (advertisedPort is! num || advertisedPort.toInt() != 443)) { + throw const FormatException('Session VLESS port does not match compiled pin'); + } + const port = 443; + final sni = _validatedHost( + _requiredString(json, 'reality_sni', maxLength: 253), + 'reality_sni', + ); + final publicKey = _requiredString(json, 'reality_pbk', maxLength: 128); + final shortId = _stringOr(json['reality_sid'], '').trim(); + if (!_shortIdPattern.hasMatch(shortId)) { + throw const FormatException('Invalid Reality short ID'); + } + + final fingerprint = + _boundedString(json['reality_fp'], AppConfig.realityFp, 32, 'reality_fp'); + final path = + _boundedString(json['xhttp_path'], AppConfig.vlessPath, 2048, 'xhttp_path'); + if (!path.startsWith('/')) { + throw const FormatException('Invalid XHTTP path'); + } return _HivemindSessionConfig( uuid: uuid, host: host, port: port, - publicKey: _stringOr(json['reality_pbk'], ''), - shortId: _stringOr(json['reality_sid'], ''), + publicKey: publicKey, + shortId: shortId, sni: sni, - fingerprint: _stringOr(json['reality_fp'], AppConfig.realityFp), - path: _stringOr(json['xhttp_path'], AppConfig.vlessPath), + fingerprint: fingerprint, + path: path, ); } String toVlessUrl() { - return 'vless://$uuid@$host:$port' - '?security=${AppConfig.vlessSecurity}' - '&type=${AppConfig.vlessType}' - '&path=$path' - '&pbk=${Uri.encodeComponent(publicKey)}' - '&sni=${Uri.encodeComponent(sni)}' - '&sid=${Uri.encodeComponent(shortId)}' - '&fp=${Uri.encodeComponent(fingerprint)}' - '#Revolt VPN'; + return Uri( + scheme: 'vless', + userInfo: uuid, + host: host, + port: port, + queryParameters: { + 'security': AppConfig.vlessSecurity, + 'type': AppConfig.vlessType, + 'path': path, + 'pbk': publicKey, + 'sni': sni, + 'sid': shortId, + 'fp': fingerprint, + }, + fragment: 'Revolt VPN', + ).toString(); } - static String _requiredString(Map json, String key) { + static String _requiredString( + Map json, + String key, { + int maxLength = 4096, + }) { final value = json[key]; - if (value is String && value.trim().isNotEmpty) return value.trim(); - throw FormatException('Missing required session field: $key'); + if (value is! String) { + throw FormatException('Missing required session field: $key'); + } + final trimmed = value.trim(); + if (trimmed.isEmpty || trimmed.length > maxLength) { + throw FormatException('Invalid session field: $key'); + } + return trimmed; } static String _stringOr(Object? value, String fallback) { - return value is String && value.isNotEmpty ? value : fallback; + return value is String && value.trim().isNotEmpty ? value.trim() : fallback; } - static int _portOr(Object? value, int fallback) { - final parsed = value is num ? value.toInt() : fallback; - if (parsed <= 0 || parsed > 65535) { - throw const FormatException('Invalid VLESS port'); + static String _boundedString( + Object? value, + String fallback, + int maxLength, + String field, + ) { + final result = _stringOr(value, fallback); + if (result.isEmpty || result.length > maxLength) { + throw FormatException('Invalid session field: $field'); } - return parsed; + return result; + } + + static String _validatedHost(String input, String field) { + final value = input.trim(); + if (value.isEmpty || + value.length > 253 || + value.contains(RegExp(r'[\s/@?#]'))) { + throw FormatException('Invalid session host: $field'); + } + try { + final probe = Uri(scheme: 'https', host: value); + if (probe.host.isEmpty) { + throw FormatException('Invalid session host: $field'); + } + } on FormatException { + throw FormatException('Invalid session host: $field'); + } + return value; + } + + static String _validatedPublicIp(String input, String field) { + final value = input.trim().toLowerCase(); + if (_isPublicIpv4(value) || _isPublicIpv6(value)) return value; + throw FormatException('Invalid public IP pin: $field'); + } + + static bool _isPublicIpv4(String value) { + final parts = value.split('.'); + if (parts.length != 4) return false; + final octets = []; + for (final part in parts) { + if (part.isEmpty || (part.length > 1 && part.startsWith('0'))) return false; + final parsed = int.tryParse(part); + if (parsed == null || parsed < 0 || parsed > 255) return false; + octets.add(parsed); + } + final a = octets[0]; + final b = octets[1]; + if (a == 0 || a == 10 || a == 127 || a >= 224) return false; + if (a == 100 && b >= 64 && b <= 127) return false; + if (a == 169 && b == 254) return false; + if (a == 172 && b >= 16 && b <= 31) return false; + if (a == 192 && b == 168) return false; + if (a == 192 && b == 0 && octets[2] == 2) return false; + if (a == 198 && b == 51 && octets[2] == 100) return false; + if (a == 203 && b == 0 && octets[2] == 113) return false; + return true; + } + + static bool _isPublicIpv6(String value) { + if (!value.contains(':') || value.contains('.')) return false; + try { + final parsed = Uri.parse('https://[$value]/'); + if (parsed.host.isEmpty || !parsed.host.contains(':')) return false; + } on FormatException { + return false; + } + if (value == '::' || value == '::1') return false; + if (value.startsWith('fc') || value.startsWith('fd')) return false; + if (value.startsWith('fe8') || value.startsWith('fe9') || value.startsWith('fea') || value.startsWith('feb')) return false; + if (value.startsWith('ff')) return false; + if (value.startsWith('2001:db8:') || value == '2001:db8::') return false; + return true; } } diff --git a/lib/logic/local_socks_tester.dart b/lib/logic/local_socks_tester.dart index 6e405bc..b672e88 100644 --- a/lib/logic/local_socks_tester.dart +++ b/lib/logic/local_socks_tester.dart @@ -20,13 +20,13 @@ abstract final class LocalSocksTester { /// Fast local readiness probe used while starting the VPN. /// - /// This stops after SOCKS5 authentication. Startup must not depend on an - /// unrelated external host being reachable. + /// This stops after authenticated SOCKS5 negotiation. Startup must not depend + /// on an unrelated external host being reachable. static Future testListener({ String host = '127.0.0.1', - int port = 10807, - String? username, - String? password, + required int port, + required String username, + required String password, }) async { final stopwatch = Stopwatch()..start(); Socket? socket; @@ -86,26 +86,40 @@ abstract final class LocalSocksTester { } } - /// Full user-facing test: authenticated local SOCKS handshake plus outbound - /// CONNECT. Credentials are optional so the helper remains usable for legacy - /// no-auth diagnostic builds. + /// Full user-facing test: authenticated local SOCKS handshake plus an + /// outbound TCP CONNECT through the active ReVolt route. static Future test({ String host = '127.0.0.1', - int port = 10807, - String? username, - String? password, - String targetHost = 'paladinvpn.duckdns.org', + required int port, + required String username, + required String password, + String targetHost = 'example.com', int targetPort = 443, }) async { + const totalTimeout = Duration(seconds: 8); final stopwatch = Stopwatch()..start(); Socket? socket; _SocketReader? reader; + Duration remaining() { + final micros = totalTimeout.inMicroseconds - stopwatch.elapsedMicroseconds; + if (micros <= 0) throw TimeoutException('SOCKS5 test timed out.', totalTimeout); + return Duration(microseconds: micros); + } + try { + if (targetPort <= 0 || targetPort > 65535) { + return const LocalSocksTestResult( + ok: false, + latencyMs: null, + message: 'SOCKS5 test target is invalid.', + ); + } + socket = await Socket.connect( host, port, - timeout: const Duration(seconds: 3), + timeout: remaining(), ); socket.setOption(SocketOption.tcpNoDelay, true); reader = _SocketReader(socket); @@ -115,6 +129,7 @@ abstract final class LocalSocksTester { socket, username: username, password: password, + timeout: remaining(), ); if (!authenticated) { return const LocalSocksTestResult( @@ -145,7 +160,7 @@ abstract final class LocalSocksTester { ]); await socket.flush(); - final replyHead = await reader.readExactly(4); + final replyHead = await reader.readExactly(4, timeout: remaining()); if (replyHead[0] != 0x05 || replyHead[1] != 0x00) { return const LocalSocksTestResult( ok: false, @@ -155,7 +170,7 @@ abstract final class LocalSocksTester { ); } - await _consumeAddress(reader, replyHead[3]); + await _consumeAddress(reader, replyHead[3], timeout: remaining()); stopwatch.stop(); return LocalSocksTestResult( ok: true, @@ -189,23 +204,10 @@ abstract final class LocalSocksTester { static Future _authenticate( _SocketReader reader, Socket socket, { - required String? username, - required String? password, + required String username, + required String password, Duration timeout = const Duration(seconds: 4), }) async { - final passwordAuth = username != null && password != null; - if ((username == null) != (password == null)) return false; - - socket.add(passwordAuth - ? const [0x05, 0x01, 0x02] - : const [0x05, 0x01, 0x00]); - await socket.flush(); - - final greeting = await reader.readExactly(2, timeout: timeout); - if (greeting[0] != 0x05) return false; - if (!passwordAuth) return greeting[1] == 0x00; - if (greeting[1] != 0x02) return false; - final userBytes = utf8.encode(username); final passBytes = utf8.encode(password); if (userBytes.isEmpty || @@ -215,6 +217,15 @@ abstract final class LocalSocksTester { return false; } + // ReVolt never accepts unauthenticated local SOCKS. Advertising only RFC + // 1929 username/password auth makes a future credential-plumbing regression + // fail closed instead of silently falling back to method 0x00. + socket.add(const [0x05, 0x01, 0x02]); + await socket.flush(); + + final greeting = await reader.readExactly(2, timeout: timeout); + if (greeting[0] != 0x05 || greeting[1] != 0x02) return false; + socket.add([ 0x01, userBytes.length, @@ -229,18 +240,24 @@ abstract final class LocalSocksTester { } static Future _consumeAddress( - _SocketReader reader, int addressType) async { + _SocketReader reader, + int addressType, { + required Duration timeout, + }) async { if (addressType == 0x01) { - await reader.readExactly(4 + 2); + await reader.readExactly(4 + 2, timeout: timeout); return; } if (addressType == 0x04) { - await reader.readExactly(16 + 2); + await reader.readExactly(16 + 2, timeout: timeout); return; } if (addressType == 0x03) { - final length = (await reader.readExactly(1)).first; - await reader.readExactly(length + 2); + final length = (await reader.readExactly(1, timeout: timeout)).first; + if (length == 0) { + throw const FormatException('Invalid SOCKS5 domain length'); + } + await reader.readExactly(length + 2, timeout: timeout); return; } throw const FormatException('Unsupported SOCKS5 address type'); @@ -257,8 +274,15 @@ class _SocketReader { int count, { Duration timeout = const Duration(seconds: 4), }) async { + final elapsed = Stopwatch()..start(); while (_buffer.length < count) { - final hasNext = await _iterator.moveNext().timeout(timeout); + final remainingMicros = timeout.inMicroseconds - elapsed.elapsedMicroseconds; + if (remainingMicros <= 0) { + throw TimeoutException('Socket read timed out', timeout); + } + final hasNext = await _iterator.moveNext().timeout( + Duration(microseconds: remainingMicros), + ); if (!hasNext) { throw const SocketException('Socket closed early'); } diff --git a/lib/logic/notification_service.dart b/lib/logic/notification_service.dart index d9e9f8c..88f46f1 100644 --- a/lib/logic/notification_service.dart +++ b/lib/logic/notification_service.dart @@ -16,16 +16,17 @@ class NotificationService { /// Sets the notification's content text to [text]. /// /// The native side rebuilds the whole notification, so skip the round-trip - /// when the text has not changed. + /// when the text has not changed. A failed native update is intentionally + /// not cached so the next tick can retry it. static Future updateTimer(String text) async { if (text == _lastText) return; - _lastText = text; try { await _channel.invokeMethod('updateNotificationText', { 'title': 'Revolt VPN', 'text': text, 'disconnectLabel': 'Disconnect', }); + _lastText = text; } catch (_) { // Cosmetic. } diff --git a/lib/logic/power_settings.dart b/lib/logic/power_settings.dart index cee5934..4bffc4a 100644 --- a/lib/logic/power_settings.dart +++ b/lib/logic/power_settings.dart @@ -1,13 +1,7 @@ import 'package:flutter/foundation.dart'; import 'package:flutter/services.dart'; -/// Background-survival controls. -/// -/// Android stops background services of apps that are not exempt from Doze and -/// App Standby, and it tears down the whole process group when a task is swiped -/// away. Those are OS behaviours, not app bugs; the battery-optimisation -/// exemption is the one sanctioned way an app can ask for around them, and it -/// still needs one user tap. +/// Android background-survival controls that ReVolt can actually verify. abstract final class PowerSettings { PowerSettings._(); @@ -15,7 +9,6 @@ abstract final class PowerSettings { 'com.revoltvpn.app/power', ); - /// Whether the OS has exempted this app from Doze / App Standby. static Future isBatteryOptimisationDisabled() async { if (kIsWeb) return true; try { @@ -28,8 +21,6 @@ abstract final class PowerSettings { } } - /// Shows the system exemption dialog. Returns false only when no system UI - /// could be opened at all — a user declining still returns true. static Future requestDisableBatteryOptimisation() async { if (kIsWeb) return true; try { @@ -41,53 +32,4 @@ abstract final class PowerSettings { return false; } } - - /// Whether the VPN runtime is genuinely alive. - /// - /// The Xray service runs in a separate process, so nothing it stores in - /// statics is visible to us. This asks the OS instead: is our service process - /// running, and (for TUN) is there an active VPN transport? - static Future runtimeState() async { - if (kIsWeb) return const VpnRuntimeState(processAlive: false, vpnTransport: false); - try { - final result = await _channel.invokeMapMethod( - 'isVpnRuntimeAlive', - ); - return VpnRuntimeState( - processAlive: result?['processAlive'] == true, - vpnTransport: result?['vpnTransport'] == true, - ); - } catch (_) { - return const VpnRuntimeState(processAlive: false, vpnTransport: false); - } - } - - /// Pushes the absolute session-expiry timestamp (epoch ms) to the VPN - /// service so it can tear the tunnel down even when the UI process is gone. - static Future setSessionExpiry(int expiresAtMs) async { - if (kIsWeb) return; - try { - await _channel.invokeMethod('setSessionExpiry', { - 'expiresAtMs': expiresAtMs, - }); - } catch (_) { - // Best-effort. The daemon also keeps its last persisted expiry. - } - } -} - -@immutable -class VpnRuntimeState { - final bool processAlive; - final bool vpnTransport; - - const VpnRuntimeState({ - required this.processAlive, - required this.vpnTransport, - }); - - /// TUN needs both a live service and a real VPN interface. Proxy mode has no - /// VPN interface at all, so the service process is the whole signal. - bool aliveFor({required bool tunMode}) => - processAlive && (!tunMode || vpnTransport); } diff --git a/lib/logic/secure_socks_session.dart b/lib/logic/secure_socks_session.dart index 2a88247..8c31a31 100644 --- a/lib/logic/secure_socks_session.dart +++ b/lib/logic/secure_socks_session.dart @@ -39,40 +39,29 @@ class SecureSocksSession { final username = _token(16); final password = _token(32); - final sourceInbounds = decoded['inbounds']; - final inbounds = []; - if (sourceInbounds is List) { - for (final value in sourceInbounds) { - if (value is Map) { - final protocol = value['protocol']?.toString().toLowerCase(); - // ReVolt owns local proxy ingress on Android. Drop imported SOCKS/HTTP - // listeners so a stale no-auth proxy cannot remain reachable beside - // the authenticated session listener. - if (protocol == 'socks' || protocol == 'http') continue; - } - inbounds.add(value); - } - } - - inbounds.add({ - 'tag': inboundTag, - 'port': port, - 'listen': '127.0.0.1', - 'protocol': 'socks', - 'settings': { - 'auth': 'password', - 'udp': true, - 'ip': '127.0.0.1', - 'users': >[ - {'user': username, 'pass': password}, - ], + // ReVolt owns local ingress. Never accept listeners supplied by a remote + // or imported Xray config; the client exposes exactly one authenticated + // loopback SOCKS5 listener for the current ephemeral session. + decoded['inbounds'] = >[ + { + 'tag': inboundTag, + 'port': port, + 'listen': '127.0.0.1', + 'protocol': 'socks', + 'settings': { + 'auth': 'password', + 'udp': true, + 'ip': '127.0.0.1', + 'users': >[ + {'user': username, 'pass': password}, + ], + }, + 'sniffing': { + 'enabled': true, + 'destOverride': ['http', 'tls'], + }, }, - 'sniffing': { - 'enabled': true, - 'destOverride': ['http', 'tls'], - }, - }); - decoded['inbounds'] = inbounds; + ]; return SecureSocksSession._( port: port, diff --git a/lib/logic/server_list.dart b/lib/logic/server_list.dart deleted file mode 100644 index f5665c7..0000000 --- a/lib/logic/server_list.dart +++ /dev/null @@ -1,69 +0,0 @@ -import 'package:flutter/foundation.dart'; -import 'package:shared_preferences/shared_preferences.dart'; - -// ── lib/logic/server_list.dart ────────────────────────────────────────────── -// Server data model and ChangeNotifier — shared by StatusBar (shows current -// server name/flag) and SelectionScreen (lets user pick a server). -// -// Each server is defined by its tunnel IP/port. Reality credentials (public -// key, shortId) come from /session/status per session; only the transport -// parameters live in AppConfig. -// -// When multi-server ships: -// - _all becomes a fetched list (from /api/servers or bundled config) -// - SelectionScreen shows multiple rows -// - select() triggers a disconnect/reconnect cycle if the tunnel is active - -class ServerInfo { - final String id; - final String name; - final String flagAsset; - final String ip; - final int port; - - const ServerInfo({ - required this.id, - required this.name, - required this.flagAsset, - required this.ip, - required this.port, - }); -} - -class ServerList extends ChangeNotifier { - static const _all = [ - ServerInfo( - id: 'finland', - name: 'Helsinki, Finland', - flagAsset: 'assets/finland_flag_256.png', - ip: '204.168.246.88', - port: 443, - ), - ]; - - int _selectedIndex = 0; - - List get all => _all; - int get selectedIndex => _selectedIndex; - ServerInfo get selected => _all[_selectedIndex]; - - // Loads persisted selection from SharedPreferences. - // Fire-and-forget — UI starts with default, updates when prefs load. - Future init() async { - final prefs = await SharedPreferences.getInstance(); - final saved = prefs.getInt('selected_server_index') ?? 0; - if (saved >= 0 && saved < _all.length && saved != _selectedIndex) { - _selectedIndex = saved; - notifyListeners(); - } - } - - // Switches to a different server. Persists the choice. - Future select(int index) async { - if (index == _selectedIndex || index < 0 || index >= _all.length) return; - _selectedIndex = index; - notifyListeners(); - final prefs = await SharedPreferences.getInstance(); - await prefs.setInt('selected_server_index', index); - } -} diff --git a/lib/logic/session_timer.dart b/lib/logic/session_timer.dart index 4625647..4164fb3 100644 --- a/lib/logic/session_timer.dart +++ b/lib/logic/session_timer.dart @@ -7,13 +7,11 @@ import 'package:revoltvpn/logic/app_config.dart'; import 'package:revoltvpn/logic/crypto_service.dart'; import 'package:revoltvpn/logic/hivemind_service.dart'; import 'package:revoltvpn/logic/notification_service.dart'; -import 'package:revoltvpn/logic/power_settings.dart'; import 'package:revoltvpn/logic/vpn_connection.dart'; class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { Timer? _timer; int _tickCount = 0; - int _lastPushedExpiryAtMs = 0; bool _appBackgrounded = false; final VpnConnection vpnConnection; @@ -25,7 +23,10 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { bool _hasSyncedOnce = false; int _consecutiveFailures = 0; bool _isDisconnecting = false; - bool _syncInProgress = false; + int? _syncEpochInProgress; + Completer? _syncCompletion; + int _sessionEpoch = 0; + bool _supportRewardClaimed = false; bool _supportRewardStateLoaded = false; int _supportStateEpoch = 0; @@ -38,25 +39,21 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { static const int _maxOfflineSeconds = 120; int _offlineSeconds = 0; - // The countdown ticks locally every second; these only drive the slow - // server heartbeat that catches server-side changes (support-ad extension, - // 10 GB cap, session-ended). Keeping it slow avoids a chatty /session/status - // beacon (see internal/LAUNCH_READINESS.md "cut the beacon rate"). - static const int _pollIntervalSeconds = 60; - static const int _backgroundPollIntervalSeconds = 60; + static const int _pollIntervalSeconds = 5; + static const int _backgroundPollIntervalSeconds = 30; int _lastUsedBytes = 0; - DateTime? _lastSuccessfulSyncAt; + Stopwatch? _sinceLastSuccessfulSync; double _currentSpeedKBps = 0.0; SessionTimer({required this.vpnConnection}) { WidgetsBinding.instance.addObserver(this); vpnConnection.addListener(_onVpnConnectionChanged); unawaited(_loadSupportRewardState()); - // This provider is built lazily, so the tunnel may already be up and - // VpnConnection may already have fired its change before we attached. - // A listener does not replay history -- evaluate the current state once. - // Deferred so we never notify during the build that created us. + + // VpnConnection is eager and can report an already-running native tunnel + // before this provider is created. ChangeNotifier listeners do not replay + // old events, so always evaluate the current state once after construction. unawaited(Future.microtask(_onVpnConnectionChanged)); } @@ -113,11 +110,8 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { } void _onVpnConnectionChanged() { - // A live tunnel with a stopped clock is always wrong, however we got here: - // adopting a tunnel that outlived the UI process, recovering from a blip, or - // attaching late to one that was already up. Previously this required either - // adoptedRunningRuntime or _hasSyncedOnce, both false on a fresh process, so - // the clock stayed at 00:00:00 and the notification countdown froze with it. + // A live tunnel with a stopped clock is always wrong, whether this process + // adopted an existing runtime, attached late, or recovered from a blip. if (vpnConnection.status == VpnStatus.connected && !isRunning && !_isDisconnecting) { @@ -130,7 +124,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { if (!hadActiveSession || _isDisconnecting) return; if (vpnConnection.status == VpnStatus.error) { - _stopForVpnFailure('VPN entered error state'); + unawaited(_doDisconnect('VPN entered error state')); return; } @@ -139,33 +133,16 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { } } - void _stopForVpnFailure(String reason) { - if (_isDisconnecting) return; - _isDisconnecting = true; - debugPrint('[Timer] Stopping after VPN failure: $reason'); - - _timer?.cancel(); - _timer = null; - _currentSpeedKBps = 0.0; - _remainingSeconds = 0; - _remainingAtLastSync = 0; - _hasSyncedOnce = false; - _lastSuccessfulSyncAt = null; - _consecutiveFailures = 0; - _offlineSeconds = 0; - NotificationService.reset(); - notifyListeners(); - } - Future start() async { + _sessionEpoch++; _remainingSeconds = 0; _remainingAtLastSync = 0; _usedBytes = 0; _lastUsedBytes = 0; - _lastSuccessfulSyncAt = null; + _sinceLastSuccessfulSync?.stop(); + _sinceLastSuccessfulSync = null; _currentSpeedKBps = 0.0; _tickCount = 0; - _lastPushedExpiryAtMs = 0; _hasSyncedOnce = false; _consecutiveFailures = 0; _offlineSeconds = 0; @@ -188,7 +165,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { void _tick(Timer t) { if (_isDisconnecting) return; - if (_hasSyncedOnce && _consecutiveFailures < _maxConsecutiveFailures) { + if (_hasSyncedOnce) { _reconcileElapsedTime(); } @@ -220,9 +197,23 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { } } - /// Force an immediate server sync (e.g. after a support-ad extension so the - /// countdown reflects the new expiry without waiting for the next heartbeat). - Future syncNow() => _syncWithHivemind(); + /// Force a control-plane refresh after an event that changes the session + /// server-side. If a periodic sync is already in flight, wait for it and + /// issue a fresh request so the event cannot be hidden behind the busy guard. + Future syncNow() async { + final requestedEpoch = _sessionEpoch; + while (requestedEpoch == _sessionEpoch && !_isDisconnecting) { + final active = _syncEpochInProgress == requestedEpoch + ? _syncCompletion + : null; + if (active != null) { + await active.future; + continue; + } + await _syncWithHivemind(); + return; + } + } Future disconnect({String reason = 'User requested'}) async { await _doDisconnect(reason); @@ -231,6 +222,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { Future _doDisconnect(String reason) async { if (_isDisconnecting) return; _isDisconnecting = true; + _sessionEpoch++; debugPrint('[Timer] Disconnecting: $reason'); _timer?.cancel(); @@ -239,13 +231,13 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { _remainingSeconds = 0; _remainingAtLastSync = 0; _hasSyncedOnce = false; - _lastSuccessfulSyncAt = null; + _sinceLastSuccessfulSync?.stop(); + _sinceLastSuccessfulSync = null; NotificationService.reset(); notifyListeners(); await vpnConnection.disconnect(); - if (!_isDisconnecting) return; _isDisconnecting = false; notifyListeners(); } @@ -257,20 +249,28 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { } Future _syncWithHivemind() async { - if (_isDisconnecting || _syncInProgress) return; - _syncInProgress = true; + if (_isDisconnecting) return; + final epoch = _sessionEpoch; + if (_syncEpochInProgress == epoch) return; + + final completion = Completer(); + _syncCompletion = completion; + _syncEpochInProgress = epoch; + try { final deviceId = await CryptoService.getDeviceId(); + if (epoch != _sessionEpoch || _isDisconnecting) return; + final base = Uri.parse('${AppConfig.hivemindApiPublic}/session/status'); final url = base.replace(queryParameters: {'device_id': deviceId}); - final response = await HivemindService.directGet(url); - if (_isDisconnecting) return; + final response = await HivemindService.controlGet(url); + if (epoch != _sessionEpoch || _isDisconnecting) return; if (response.statusCode == 200) { final decoded = jsonDecode(response.body); if (decoded is! Map) { debugPrint('[Timer] Invalid session payload type.'); - _markSyncFailure(); + _markSyncFailure(epoch); return; } final data = decoded; @@ -278,7 +278,7 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { final activeValue = data['active']; if (activeValue is! bool) { debugPrint('[Timer] Session payload missing boolean active state.'); - _markSyncFailure(); + _markSyncFailure(epoch); return; } if (!activeValue) { @@ -291,61 +291,66 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { !expiresValue.isFinite || expiresValue < 0) { debugPrint('[Timer] Session payload has invalid expiry.'); - _markSyncFailure(); + _markSyncFailure(epoch); return; } + final elapsedMs = _sinceLastSuccessfulSync?.elapsedMilliseconds; _remainingAtLastSync = expiresValue.toInt(); _remainingSeconds = _remainingAtLastSync; - // Push the absolute deadline to the VPN service so it can tear the - // tunnel down on its own clock, even if this UI process is gone. - final expiresAtMs = - DateTime.now().millisecondsSinceEpoch + _remainingSeconds * 1000; - if ((expiresAtMs - _lastPushedExpiryAtMs).abs() > 5000) { - _lastPushedExpiryAtMs = expiresAtMs; - unawaited(PowerSettings.setSessionExpiry(expiresAtMs)); - } _usedBytes = _readNonNegativeInt(data['used_bytes'], _usedBytes); - final now = DateTime.now(); - final previousSyncAt = _lastSuccessfulSyncAt; final deltaBytes = _usedBytes - _lastUsedBytes; - if (_hasSyncedOnce && previousSyncAt != null) { - final elapsedMs = now.difference(previousSyncAt).inMilliseconds; - if (deltaBytes > 0 && elapsedMs > 0) { - _currentSpeedKBps = (deltaBytes / (elapsedMs / 1000.0)) / 1000.0; - } else { - _currentSpeedKBps = 0.0; - } + if (_hasSyncedOnce && elapsedMs != null && elapsedMs > 0) { + _currentSpeedKBps = deltaBytes > 0 + ? (deltaBytes / (elapsedMs / 1000.0)) / 1000.0 + : 0.0; } else { _currentSpeedKBps = 0.0; } _lastUsedBytes = _usedBytes; - _lastSuccessfulSyncAt = now; + _sinceLastSuccessfulSync?.stop(); + _sinceLastSuccessfulSync = Stopwatch()..start(); if (data['cap_exhausted'] == true) { await _doDisconnect('Data cap reached'); return; } + if (epoch != _sessionEpoch || _isDisconnecting) return; + try { + await vpnConnection.setNativeSessionDeadline(_remainingAtLastSync); + } catch (e) { + debugPrint('[Timer] Failed to arm native session deadline: $e'); + await _doDisconnect('Native session deadline unavailable'); + return; + } + if (epoch != _sessionEpoch || _isDisconnecting) return; _consecutiveFailures = 0; _offlineSeconds = 0; _hasSyncedOnce = true; notifyListeners(); } else { - _markSyncFailure(); + _markSyncFailure(epoch); } } catch (e) { - if (!_isDisconnecting) { + if (epoch == _sessionEpoch && !_isDisconnecting) { debugPrint('Hivemind sync error: $e'); - _markSyncFailure(); + _markSyncFailure(epoch); } } finally { - _syncInProgress = false; + if (_syncEpochInProgress == epoch) { + _syncEpochInProgress = null; + } + if (identical(_syncCompletion, completion)) { + _syncCompletion = null; + } + if (!completion.isCompleted) completion.complete(); } } - void _markSyncFailure() { + void _markSyncFailure(int epoch) { + if (epoch != _sessionEpoch || _isDisconnecting) return; _consecutiveFailures++; if (_consecutiveFailures >= _maxConsecutiveFailures) { notifyListeners(); @@ -353,10 +358,10 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { } void _reconcileElapsedTime() { - final syncedAt = _lastSuccessfulSyncAt; - if (!_hasSyncedOnce || syncedAt == null) return; + final clock = _sinceLastSuccessfulSync; + if (!_hasSyncedOnce || clock == null) return; - final elapsed = DateTime.now().difference(syncedAt).inSeconds; + final elapsed = clock.elapsed.inSeconds; _remainingSeconds = (_remainingAtLastSync - elapsed).clamp(0, 1 << 31).toInt(); } @@ -396,9 +401,15 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver { @override void dispose() { + // Invalidate every asynchronous generation before removing listeners so + // late storage/network completions cannot notify a disposed notifier. + _sessionEpoch++; + _supportStateEpoch++; + _isDisconnecting = true; WidgetsBinding.instance.removeObserver(this); vpnConnection.removeListener(_onVpnConnectionChanged); _timer?.cancel(); + _sinceLastSuccessfulSync?.stop(); super.dispose(); } } diff --git a/lib/logic/updater.dart b/lib/logic/updater.dart index f3e55bb..6094896 100644 --- a/lib/logic/updater.dart +++ b/lib/logic/updater.dart @@ -1,15 +1,14 @@ import 'dart:convert'; import 'dart:io'; + import 'package:flutter/foundation.dart'; import 'package:flutter/material.dart'; import 'package:flutter/services.dart'; import 'package:http/http.dart' as http; import 'package:package_info_plus/package_info_plus.dart'; -import 'package:url_launcher/url_launcher.dart'; -import 'package:revoltvpn/logic/app_config.dart'; import 'package:revoltvpn/logic/app_colors.dart'; - -enum UpdateStatus { upToDate, updateAvailable, checkFailed } +import 'package:revoltvpn/logic/app_config.dart'; +import 'package:url_launcher/url_launcher.dart'; enum InstallSource { playStore, sideload } @@ -40,10 +39,12 @@ class _ParsedVersion { if (rawCore.isEmpty || rawCore.any((p) => int.tryParse(p) == null)) { return null; } - final core = rawCore.map(int.parse).toList(growable: false); + + final core = rawCore.map(int.parse).toList(); while (core.length < 3) { core.add(0); } + final pre = prePart.isEmpty ? const [] : prePart.split('.').where((e) => e.isNotEmpty).toList(growable: false); @@ -93,10 +94,7 @@ class PlayStoreUpdater { static Future open() async { final uri = _trustedHttpsUri(_url, const {'play.google.com'}); - if (uri == null) { - debugPrint('[Updater] Refusing invalid Play Store URL.'); - return false; - } + if (uri == null) return false; try { return await launchUrl(uri, mode: LaunchMode.externalApplication); } catch (e) { @@ -121,38 +119,24 @@ class GitHubUpdater { final response = await http .get(apiUri, headers: {'Accept': 'application/vnd.github+json'}) .timeout(const Duration(seconds: 8)); - - if (response.statusCode != 200) { - debugPrint('[Updater] GitHub API returned ${response.statusCode}'); - return null; - } + if (response.statusCode != 200) return null; final decoded = jsonDecode(response.body); - if (decoded is! Map) { - debugPrint('[Updater] Invalid GitHub release payload.'); - return null; - } + if (decoded is! Map) return null; final htmlUrl = decoded['html_url']; - if (htmlUrl is String && - _trustedHttpsUri(htmlUrl, const {'github.com'}) != null) { - _cachedDownloadUrl = htmlUrl; - } else { - _cachedDownloadUrl = null; - } + _cachedDownloadUrl = htmlUrl is String && + _trustedHttpsUri(htmlUrl, const {'github.com'}) != null + ? htmlUrl + : null; final rawTag = decoded['tag_name']; if (rawTag is! String || rawTag.isEmpty || rawTag.length > 64) { - debugPrint('[Updater] Invalid release tag.'); return null; } final normalized = rawTag.startsWith('v') ? rawTag.substring(1) : rawTag; - if (_ParsedVersion.tryParse(normalized) == null) { - debugPrint('[Updater] Release tag is not a supported version: $rawTag'); - return null; - } - return normalized; + return _ParsedVersion.tryParse(normalized) == null ? null : normalized; } catch (e) { debugPrint('[Updater] GitHub API error: $e'); return null; @@ -162,11 +146,7 @@ class GitHubUpdater { static Future open() async { final raw = _cachedDownloadUrl ?? AppConfig.githubReleasesUrl; final uri = _trustedHttpsUri(raw, const {'github.com'}); - if (uri == null) { - debugPrint('[Updater] Refusing untrusted GitHub update URL.'); - return false; - } - + if (uri == null) return false; try { return await launchUrl(uri, mode: LaunchMode.externalApplication); } catch (e) { @@ -179,36 +159,32 @@ class GitHubUpdater { class Updater { Updater._(); + static const MethodChannel _installerChannel = + MethodChannel('com.revoltvpn.app/installer'); static InstallSource? _cachedSource; static Future get installSource async { if (_cachedSource != null) return _cachedSource!; if (kIsWeb || !Platform.isAndroid) { - _cachedSource = InstallSource.sideload; - return _cachedSource!; + return _cachedSource = InstallSource.sideload; } try { - final result = await MethodChannel('com.revoltvpn.app/installer') - .invokeMethod('getInstallerPackage'); - _cachedSource = (result == 'com.android.vending') + final result = + await _installerChannel.invokeMethod('getInstallerPackage'); + return _cachedSource = result == 'com.android.vending' ? InstallSource.playStore : InstallSource.sideload; } catch (e) { debugPrint('[Updater] Installer check failed: $e'); - _cachedSource = InstallSource.sideload; + return _cachedSource = InstallSource.sideload; } - - return _cachedSource!; } static int _compareVersions(String a, String b) { final left = _ParsedVersion.tryParse(a); final right = _ParsedVersion.tryParse(b); - if (left == null || right == null) { - // Invalid local metadata should not invent an ordering. - return 0; - } + if (left == null || right == null) return 0; return left.compareTo(right); } @@ -218,11 +194,9 @@ class Updater { } static Future check(BuildContext context) { - final navigator = Navigator.of(context, rootNavigator: true); - final messenger = ScaffoldMessenger.of(context); return checkWithHandles( - navigator: navigator, - messenger: messenger, + navigator: Navigator.of(context, rootNavigator: true), + messenger: ScaffoldMessenger.of(context), ); } @@ -230,14 +204,46 @@ class Updater { required NavigatorState navigator, required ScaffoldMessengerState messenger, }) async { + final source = await installSource; + if (source == InstallSource.playStore) { + if (!navigator.mounted) return; + await showDialog( + context: navigator.context, + builder: (ctx) => AlertDialog( + backgroundColor: AppColors.bgCard, + title: const Text( + 'Updates are managed by Play Store', + style: TextStyle(color: AppColors.textWhite), + ), + content: const Text( + 'Open Play Store to check whether an update is available for this install.', + style: TextStyle(color: AppColors.slate70), + ), + actions: [ + TextButton( + onPressed: () => Navigator.pop(ctx), + child: const Text('Cancel'), + ), + TextButton( + onPressed: () { + Navigator.pop(ctx); + PlayStoreUpdater.open(); + }, + child: const Text( + 'Open Play Store', + style: TextStyle(color: AppColors.accent), + ), + ), + ], + ), + ); + return; + } + final info = await PackageInfo.fromPlatform(); final localVersion = info.version; if (localVersion.isEmpty || _ParsedVersion.tryParse(localVersion) == null) { - _showSnackBar( - messenger, - 'Could not determine app version', - isError: true, - ); + _showSnackBar(messenger, 'Could not determine app version', isError: true); return; } @@ -252,12 +258,8 @@ class Updater { return; } - final source = await installSource; - final storeName = - source == InstallSource.playStore ? 'Play Store' : 'GitHub'; if (!navigator.mounted) return; - - showDialog( + await showDialog( context: navigator.context, builder: (ctx) => AlertDialog( backgroundColor: AppColors.bgCard, @@ -266,7 +268,7 @@ class Updater { style: TextStyle(color: AppColors.textWhite), ), content: Text( - '${_versionLabel(latestVersion, false)} is available on $storeName.\n' + '${_versionLabel(latestVersion, false)} is available on GitHub.\n' 'You have ${_versionLabel(localVersion, true)}.', style: const TextStyle(color: AppColors.slate70), ), @@ -281,13 +283,11 @@ class Updater { TextButton( onPressed: () { Navigator.pop(ctx); - source == InstallSource.playStore - ? PlayStoreUpdater.open() - : GitHubUpdater.open(); + GitHubUpdater.open(); }, - child: Text( - 'Open $storeName', - style: const TextStyle(color: AppColors.accent), + child: const Text( + 'Open GitHub', + style: TextStyle(color: AppColors.accent), ), ), ], diff --git a/lib/logic/vpn_connection.dart b/lib/logic/vpn_connection.dart index 80d7c83..4147fe6 100644 --- a/lib/logic/vpn_connection.dart +++ b/lib/logic/vpn_connection.dart @@ -1,12 +1,12 @@ import 'dart:async'; import 'package:flutter/foundation.dart'; +import 'package:flutter/services.dart'; import 'package:flutter_vless/flutter_vless.dart'; import 'package:revoltvpn/logic/connection_settings.dart'; import 'package:revoltvpn/logic/hivemind_service.dart'; import 'package:revoltvpn/logic/local_socks_tester.dart'; import 'package:revoltvpn/logic/network_monitor.dart'; -import 'package:revoltvpn/logic/power_settings.dart'; import 'package:revoltvpn/logic/secure_socks_session.dart'; enum VpnStatus { @@ -18,7 +18,12 @@ enum VpnStatus { } class VpnConnection extends ChangeNotifier { - bool _cancelled = false; + static const MethodChannel _nativeControl = MethodChannel('flutter_vless'); + + int _connectEpoch = 0; + bool _suppressNativeConnect = false; + bool _disposed = false; + VpnStatus _status = VpnStatus.disconnected; VpnStatus get status => _status; @@ -45,6 +50,7 @@ class VpnConnection extends ChangeNotifier { SecureSocksSession? get activeSocksSession => _lastSecureSocks; bool get canTestActiveLocalSocks => + !_disposed && _status == VpnStatus.connected && _activeMode == ConnectionMode.proxy && _lastSecureSocks != null; @@ -94,9 +100,10 @@ class VpnConnection extends ChangeNotifier { } Future _startEngine() async { - if (kIsWeb) return; + if (kIsWeb || _disposed) return; await ConnectionSettings.initialize(); + if (_disposed) return; _activeMode = ConnectionSettings.mode; _vless = FlutterVless( @@ -115,13 +122,16 @@ class VpnConnection extends ChangeNotifier { notificationIconResourceType: 'drawable', notificationIconResourceName: 'notification_status_icon', ); + if (_disposed) return; _initialized = true; } catch (e) { debugPrint('[VPN] VLESS init error (expected on emulator): $e'); } + if (_disposed) return; _networkSubscription = NetworkMonitor.changes.listen( (snapshot) { + if (_disposed) return; // ConnectivityManager is informational only. Restarting from every // callback caused the old VPN-created-network reconnect loop. _networkTransport = snapshot.transport; @@ -139,32 +149,10 @@ class VpnConnection extends ChangeNotifier { try { final coreVersion = await _vless.getCoreVersion(); - debugPrint('[VPN] Xray core version: $coreVersion'); - } catch (_) {} - - await _adoptRunningRuntime(); - } - - /// Reflect a tunnel that is already up when the UI starts. - /// - /// This asks the OS whether our VPN service process is alive, rather than - /// probing a local SOCKS port. The old probe called getConnectedServerDelay(), - /// which reads AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807 — but - /// AppConfigs lives in the VPN's own process, so from here it is always null - /// and the port always fell back to 10807. That was correct only while the - /// SOCKS port was fixed; per-session ephemeral ports made it permanently - /// wrong, so the app reported "connected" against a dead tunnel. - Future _adoptRunningRuntime() async { - if (kIsWeb) return; - try { - final state = await PowerSettings.runtimeState(); - if (state.aliveFor(tunMode: _activeMode == ConnectionMode.tun)) { - _adoptedRunningRuntime = true; - _setStatus(VpnStatus.connected, _connectedLabel); + if (!_disposed) { + debugPrint('[VPN] Xray core version: $coreVersion'); } - } catch (e) { - debugPrint('[VPN] Runtime liveness check failed: $e'); - } + } catch (_) {} } String get _connectedLabel { @@ -176,9 +164,15 @@ class VpnConnection extends ChangeNotifier { } } + bool _isCurrentConnect(int epoch) => + !_disposed && epoch == _connectEpoch && !_userDisconnecting; + void _mapStatus(VlessStatus status) { + if (_disposed) return; switch (status.connectionState) { case VlessConnectionState.connected: + if (_suppressNativeConnect || _userDisconnecting) return; + if (_connectEpoch == 0) _adoptedRunningRuntime = true; _setStatus(VpnStatus.connected, _connectedLabel); break; @@ -188,6 +182,7 @@ class VpnConnection extends ChangeNotifier { break; case VlessConnectionState.connecting: + if (_suppressNativeConnect || _userDisconnecting) return; _setStatus(VpnStatus.connecting, 'Establishing tunnel…'); break; @@ -196,6 +191,7 @@ class VpnConnection extends ChangeNotifier { break; case VlessConnectionState.unknown: + if (_suppressNativeConnect || _userDisconnecting) return; if (_status != VpnStatus.connected && _status != VpnStatus.disconnected) { _setStatus(VpnStatus.error, 'Connection failed'); @@ -205,27 +201,34 @@ class VpnConnection extends ChangeNotifier { } Future connect({bool skipAdBypass = false}) async { - if (_status == VpnStatus.connected || _status == VpnStatus.connecting) { + if (_disposed || + _userDisconnecting || + _status == VpnStatus.connected || + _status == VpnStatus.connecting || + _status == VpnStatus.disconnecting) { return false; } - _cancelled = false; + final connectEpoch = ++_connectEpoch; + _suppressNativeConnect = false; _userDisconnecting = false; await ConnectionSettings.initialize(); + if (!_isCurrentConnect(connectEpoch)) return false; _activeMode = ConnectionSettings.mode; if (!kIsWeb && !_initialized) { + _suppressNativeConnect = true; _errorMessage = 'VPN service unavailable.'; _setStatus(VpnStatus.error, 'Service unavailable'); return false; } - // TUN needs the Android VPN permission; SOCKS5 proxy mode runs a local - // authenticated proxy without a VpnService, so no VPN permission is needed. if (!kIsWeb && _activeMode == ConnectionMode.tun) { final ok = await _vless.requestPermission(); + if (!_isCurrentConnect(connectEpoch)) return false; if (!ok) { + _suppressNativeConnect = true; _errorMessage = 'VPN permission denied.'; _setStatus(VpnStatus.error, 'Permission required'); return false; @@ -241,6 +244,7 @@ class VpnConnection extends ChangeNotifier { if (kIsWeb) { await Future.delayed(const Duration(seconds: 1)); + if (!_isCurrentConnect(connectEpoch)) return false; _setStatus(VpnStatus.connected, 'Secured (dev mode)'); return true; } @@ -252,6 +256,7 @@ class VpnConnection extends ChangeNotifier { realUrl = await HivemindService.fetchConfigDirectly( skipAdBypass: skipAdBypass, onAttempt: (attempt, total) { + if (!_isCurrentConnect(connectEpoch)) return; _setStatus( VpnStatus.connecting, 'Contacting server ($attempt/$total)…', @@ -259,9 +264,11 @@ class VpnConnection extends ChangeNotifier { }, ); } catch (e) { + if (!_isCurrentConnect(connectEpoch)) return false; debugPrint('[VPN] Config fetch error: $e'); final raw = e.toString().replaceAll('Exception: ', ''); if (raw.contains('Cancelled')) return false; + _suppressNativeConnect = true; if (raw.contains('timed out') || raw.contains('Session not activated')) { _errorMessage = 'The server did not respond in time.\nCheck your connection and try again.'; @@ -273,11 +280,7 @@ class VpnConnection extends ChangeNotifier { return false; } - if (_cancelled) { - _setStatus(VpnStatus.disconnected, 'Tap to connect'); - return false; - } - + if (!_isCurrentConnect(connectEpoch)) return false; _setStatus(VpnStatus.connecting, 'Starting secure route…'); try { @@ -285,6 +288,7 @@ class VpnConnection extends ChangeNotifier { final baseConfig = parsed.getFullConfiguration(); final remark = parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN'; final secureSocks = await SecureSocksSession.create(baseConfig); + if (!_isCurrentConnect(connectEpoch)) return false; final verifyLocalSocks = _activeMode == ConnectionMode.proxy; await _startRuntime( @@ -292,26 +296,45 @@ class VpnConnection extends ChangeNotifier { remark: remark, proxyOnly: verifyLocalSocks, ); + if (!_isCurrentConnect(connectEpoch)) return false; _setStatus( VpnStatus.connecting, - verifyLocalSocks ? 'Waiting for local SOCKS5…' : 'Waiting for VPN interface…', + verifyLocalSocks + ? 'Waiting for local SOCKS5…' + : 'Waiting for VPN interface…', ); - if (!await _waitForNativeConnected()) { + if (!await _waitForNativeConnected(connectEpoch)) { throw StateError('VPN runtime did not report CONNECTED'); } if (verifyLocalSocks) { + if (!_isCurrentConnect(connectEpoch)) return false; _setStatus(VpnStatus.connecting, 'Checking Local SOCKS5…'); - if (!await _waitForLocalSocksListener(secureSocks)) { + if (!await _waitForLocalSocksListener( + secureSocks, + connectEpoch, + )) { throw StateError('Local SOCKS5 listener did not become ready'); } } + if (!_isCurrentConnect(connectEpoch)) return false; _lastSecureSocks = secureSocks; } catch (e) { + if (!_isCurrentConnect(connectEpoch)) return false; debugPrint('[VPN] Tunnel start error: $e'); - await _stopRuntime(); + _suppressNativeConnect = true; + try { + await _stopRuntime(); + } catch (stopError) { + debugPrint('[VPN] Runtime cleanup failed after start error: $stopError'); + if (!_isCurrentConnect(connectEpoch)) return false; + _errorMessage = 'VPN failed to shut down cleanly.\nPlease restart the app.'; + _setStatus(VpnStatus.error, 'Shutdown failed'); + return false; + } + if (!_isCurrentConnect(connectEpoch)) return false; _clearRuntimeSnapshot(); _errorMessage = _activeMode == ConnectionMode.proxy ? 'SOCKS5 gateway failed to start.\nTry reconnecting.' @@ -320,6 +343,7 @@ class VpnConnection extends ChangeNotifier { return false; } + if (!_isCurrentConnect(connectEpoch)) return false; _setStatus(VpnStatus.connected, _connectedLabel); return true; } @@ -336,22 +360,20 @@ class VpnConnection extends ChangeNotifier { ); } - Future _waitForLocalSocksListener([ - SecureSocksSession? session, - ]) async { - final active = session ?? _lastSecureSocks; - if (active == null) return false; - + Future _waitForLocalSocksListener( + SecureSocksSession session, + int connectEpoch, + ) async { for (var attempt = 0; attempt < 4; attempt++) { + if (!_isCurrentConnect(connectEpoch)) return false; final result = await LocalSocksTester.testListener( host: '127.0.0.1', - port: active.port, - username: active.username, - password: active.password, + port: session.port, + username: session.username, + password: session.password, ); - if (result.ok) { - return true; - } + if (!_isCurrentConnect(connectEpoch)) return false; + if (result.ok) return true; if (attempt < 3) { await Future.delayed(const Duration(milliseconds: 250)); } @@ -359,54 +381,59 @@ class VpnConnection extends ChangeNotifier { return false; } - Future _waitForNativeConnected() async { - // startVless() queues the Android foreground service. Wait for the native - // service/core broadcast rather than treating MethodChannel completion as - // proof that a TUN interface was established. + Future _waitForNativeConnected(int connectEpoch) async { for (var attempt = 0; attempt < 24; attempt++) { + if (!_isCurrentConnect(connectEpoch)) return false; if (_status == VpnStatus.connected) return true; - if (_status == VpnStatus.error) return false; - if (_cancelled || _userDisconnecting) return false; + if (_status == VpnStatus.error || _status == VpnStatus.disconnected) { + return false; + } await Future.delayed(const Duration(milliseconds: 250)); } - return _status == VpnStatus.connected; + return _isCurrentConnect(connectEpoch) && + _status == VpnStatus.connected; } Future _stopRuntime() async { - try { - await _vless.stopVless().timeout(const Duration(seconds: 5)); - } catch (_) {} + await _vless.stopVless().timeout(const Duration(seconds: 8)); + } + + Future setNativeSessionDeadline(int remainingSeconds) async { + if (kIsWeb) return; + if (_disposed) throw StateError('VPN connection has been disposed'); + if (!_initialized) throw StateError('VPN native service is not initialized'); + if (remainingSeconds < 0) { + throw ArgumentError.value(remainingSeconds, 'remainingSeconds'); + } + await _nativeControl.invokeMethod( + 'setSessionDeadline', + {'remainingSeconds': remainingSeconds}, + ); } Future disconnect() async { - _cancelled = true; + if (_disposed || _status == VpnStatus.disconnecting) return; + + _connectEpoch++; + _suppressNativeConnect = true; _userDisconnecting = true; HivemindService.cancel(); - if (_status == VpnStatus.disconnected || - _status == VpnStatus.disconnecting) { - _clearRuntimeSnapshot(); - _userDisconnecting = false; - return; - } - _setStatus(VpnStatus.disconnecting, 'Tearing down…'); if (kIsWeb) { await Future.delayed(const Duration(milliseconds: 500)); + if (_disposed) return; _clearRuntimeSnapshot(); _setStatus(VpnStatus.disconnected, 'Tap to connect'); _userDisconnecting = false; return; } - bool timedOut = false; try { - await _vless.stopVless().timeout( - const Duration(seconds: 5), - onTimeout: () => timedOut = true, - ); + await _vless.stopVless().timeout(const Duration(seconds: 8)); } catch (e) { + if (_disposed) return; debugPrint('[VPN] VLESS stop error: $e'); _errorMessage = 'VPN shutdown error.\nPlease restart the app.'; _clearRuntimeSnapshot(); @@ -415,15 +442,7 @@ class VpnConnection extends ChangeNotifier { return; } - if (timedOut) { - debugPrint('[VPN] stopVless() timed out after 5 s.'); - _errorMessage = 'VPN did not shut down cleanly.\nPlease restart the app.'; - _clearRuntimeSnapshot(); - _setStatus(VpnStatus.error, 'Shutdown failed'); - _userDisconnecting = false; - return; - } - + if (_disposed) return; _errorMessage = null; _clearRuntimeSnapshot(); _setStatus(VpnStatus.disconnected, 'Tap to connect'); @@ -436,21 +455,27 @@ class VpnConnection extends ChangeNotifier { } void _setStatus(VpnStatus status, String message) { + if (_disposed) return; _status = status; _statusMessage = message; notifyListeners(); } Future _checkHealth() async { - // A live tunnel already proves reachability; only probe while disconnected - // so we don't add direct /health traffic while the VPN is active. - if (_status == VpnStatus.connected) return; - _serverReachable = await HivemindService.checkHealth(); + if (_disposed || _status == VpnStatus.connected) return; + final reachable = await HivemindService.checkHealth(); + if (_disposed || _status == VpnStatus.connected) return; + _serverReachable = reachable; notifyListeners(); } @override void dispose() { + _disposed = true; + _connectEpoch++; + _suppressNativeConnect = true; + _userDisconnecting = true; + HivemindService.cancel(); _healthTimer?.cancel(); _networkSubscription?.cancel(); // Provider/UI disposal is not a user disconnect command. Keeping teardown diff --git a/lib/main.dart b/lib/main.dart index b7d21a2..c76f5c5 100644 --- a/lib/main.dart +++ b/lib/main.dart @@ -7,7 +7,6 @@ import 'package:revoltvpn/logic/ad_manager.dart'; import 'package:revoltvpn/logic/app_colors.dart'; import 'package:revoltvpn/logic/connection_settings.dart'; import 'package:revoltvpn/logic/haptic_settings.dart'; -import 'package:revoltvpn/logic/server_list.dart'; import 'package:revoltvpn/logic/session_timer.dart'; import 'package:revoltvpn/logic/vpn_connection.dart'; import 'package:revoltvpn/screens/intro.dart'; @@ -26,13 +25,10 @@ Future main() async { systemNavigationBarIconBrightness: Brightness.light, )); - FlutterError.onError = (details) { - debugPrint('[FlutterError] ${details.exception}'); - }; - + FlutterError.onError = FlutterError.presentError; PlatformDispatcher.instance.onError = (error, stack) { debugPrint('[PlatformError] $error\n$stack'); - return true; + return false; }; runApp(const ReVoltApp()); @@ -47,8 +43,6 @@ class ReVoltApp extends StatelessWidget { providers: [ ChangeNotifierProvider(create: (_) => VpnConnection(), lazy: false), ChangeNotifierProxyProvider( - // Eager, like VpnConnection: the timer has to be listening before the - // engine reports an already-running tunnel, not after the intro. lazy: false, create: (ctx) => SessionTimer(vpnConnection: ctx.read()), @@ -56,10 +50,6 @@ class ReVoltApp extends StatelessWidget { prev ?? SessionTimer(vpnConnection: vpn), ), ChangeNotifierProvider(create: (_) => AdManager()), - ChangeNotifierProvider( - create: (_) => ServerList()..init(), - lazy: false, - ), ], child: MaterialApp( title: 'ReVolt VPN', diff --git a/lib/screens/intro.dart b/lib/screens/intro.dart index cc44177..0338d18 100644 --- a/lib/screens/intro.dart +++ b/lib/screens/intro.dart @@ -2,7 +2,6 @@ import 'dart:async'; import 'package:flutter/material.dart'; import 'package:provider/provider.dart'; import 'package:revoltvpn/logic/app_colors.dart'; -import 'package:revoltvpn/logic/haptic_settings.dart'; import 'package:revoltvpn/logic/vpn_connection.dart'; import 'package:revoltvpn/screens/main_screen.dart'; import 'package:revoltvpn/screens/settings/in_settings/rain.dart'; @@ -45,11 +44,10 @@ class _IntroScreenState extends State with WidgetsBindingObserver { final elapsed = Stopwatch()..start(); final vpn = context.read(); - // The overlays and haptic layer read these before MainScreen mounts. + // Haptics is initialized before runApp. Only visual preferences remain. final settingsPrefs = Future.wait([ loadRainPref(), loadLightningPref(), - HapticSettings.initialize(), ]); try { @@ -80,11 +78,10 @@ class _IntroScreenState extends State with WidgetsBindingObserver { void _navigateIfReady() { if (!mounted || _navigated || !_bootComplete) return; - if (WidgetsBinding.instance.lifecycleState == AppLifecycleState.paused) { - return; - } - _navigated = true; + final lifecycle = WidgetsBinding.instance.lifecycleState; + if (lifecycle != null && lifecycle != AppLifecycleState.resumed) return; + _navigated = true; Navigator.of(context).pushReplacement( PageRouteBuilder( transitionDuration: const Duration(milliseconds: 400), diff --git a/lib/screens/server_selector/selection_screen.dart b/lib/screens/server_selector/selection_screen.dart deleted file mode 100644 index 7d5dba1..0000000 --- a/lib/screens/server_selector/selection_screen.dart +++ /dev/null @@ -1,63 +0,0 @@ -import 'package:flutter/material.dart'; -import 'package:provider/provider.dart'; -import 'package:revoltvpn/logic/app_colors.dart'; -import 'package:revoltvpn/logic/server_list.dart'; - -// ── lib/screens/server_selector/selection_screen.dart ────────────────────── -// Server picker — reads the server list from the ServerList provider. -// Each row shows a flag + city name. Tapping a row persists the choice -// and pops back. No latency measurement — the app runs inside a Reality -// tunnel and must not emit separate probe traffic. - -class SelectionScreen extends StatelessWidget { - const SelectionScreen({super.key}); - - @override - Widget build(BuildContext context) { - final serverList = context.watch(); - - return Scaffold( - backgroundColor: AppColors.bgDeep, - appBar: AppBar( - backgroundColor: AppColors.bgSurface, - elevation: 0, - leading: IconButton( - icon: const Icon(Icons.arrow_back, color: AppColors.textWhite), - onPressed: () => Navigator.of(context).pop(), - ), - title: const Text( - 'Select Server', - style: TextStyle( - color: AppColors.textWhite, - fontWeight: FontWeight.w600, - ), - ), - ), - body: ListView.builder( - itemCount: serverList.all.length, - itemBuilder: (context, index) { - final server = serverList.all[index]; - final isSelected = index == serverList.selectedIndex; - - return ListTile( - leading: Image.asset(server.flagAsset, width: 28, height: 28), - title: Text(server.name, - style: TextStyle( - color: isSelected ? AppColors.accent : AppColors.textWhite, - fontWeight: FontWeight.w600, - )), - trailing: isSelected - ? const Icon(Icons.check, color: AppColors.accent) - : null, - onTap: () { - serverList.select(index); - Navigator.of(context).pop(); - }, - contentPadding: - const EdgeInsets.symmetric(horizontal: 20, vertical: 8), - ); - }, - ), - ); - } -} diff --git a/lib/screens/settings/in_settings/background_reliability.dart b/lib/screens/settings/in_settings/background_reliability.dart index 5b74118..db65fdf 100644 --- a/lib/screens/settings/in_settings/background_reliability.dart +++ b/lib/screens/settings/in_settings/background_reliability.dart @@ -2,12 +2,9 @@ import 'package:flutter/material.dart'; import 'package:revoltvpn/logic/app_colors.dart'; import 'package:revoltvpn/logic/power_settings.dart'; -/// Keeping the tunnel alive is an OS concern, not an app one. -/// -/// Android stops background services of apps that are not exempt from Doze, and -/// removes the whole process group when its task is swiped away. There are -/// exactly two sanctioned ways around that, both requiring one user tap, and -/// neither can be enabled programmatically. This tile surfaces both. +/// Android may restrict background work when battery optimisation is active. +/// Surface the OS setting we can actually detect and request; do not promise +/// reboot/Always-on restoration that the per-session runtime cannot guarantee. class BackgroundReliabilityTile extends StatefulWidget { const BackgroundReliabilityTile({super.key}); @@ -35,8 +32,6 @@ class _BackgroundReliabilityTileState extends State @override void didChangeAppLifecycleState(AppLifecycleState state) { - // The exemption is granted in a system dialog, so the only reliable moment - // to re-read it is when we come back to the foreground. if (state == AppLifecycleState.resumed) _refresh(); } @@ -68,8 +63,8 @@ class _BackgroundReliabilityTileState extends State style: TextStyle(color: AppColors.textWhite, fontSize: 15), ), subtitle: Text( - 'Android stops background apps to save power. Disabling battery ' - 'optimisation is what keeps the VPN running when the app is closed.', + 'Android may restrict background work to save power. ReVolt only ' + 'shows the system control it can verify.', style: TextStyle(color: AppColors.textDim, fontSize: 12), ), ), @@ -83,8 +78,8 @@ class _BackgroundReliabilityTileState extends State ? 'Battery optimisation: checking…' : exempt ? 'Battery optimisation: disabled for Revolt VPN ✓' - : 'Battery optimisation: still active — the system may ' - 'stop the VPN in the background.', + : 'Battery optimisation: active — Android may stop ' + 'background VPN work.', style: TextStyle( color: exempt == true ? AppColors.accent : AppColors.textMuted, fontSize: 12, diff --git a/lib/screens/settings/in_settings/connection_mode.dart b/lib/screens/settings/in_settings/connection_mode.dart index 021c3b0..dde1703 100644 --- a/lib/screens/settings/in_settings/connection_mode.dart +++ b/lib/screens/settings/in_settings/connection_mode.dart @@ -51,8 +51,14 @@ class _ConnectionModeTileState extends State { return; } - await ConnectionSettings.setMode(next); + final saved = await ConnectionSettings.setMode(next); if (!mounted) return; + if (!saved) { + ScaffoldMessenger.of(context).showSnackBar( + const SnackBar(content: Text('Could not save connection mode.')), + ); + return; + } setState(() { _mode = next; @@ -61,10 +67,6 @@ class _ConnectionModeTileState extends State { widget.onChanged?.call(next); } - /// Recovers from an orphaned proxy: tear the runtime down and start a fresh - /// session so a readable set of credentials exists again. No rewarded ad — - /// the user is repairing a connection they already paid for, not opening a - /// new one. Future _reconnect() async { if (_reconnecting) return; final vpn = context.read(); @@ -168,11 +170,6 @@ class _ConnectionModeTileState extends State { builder: (context, vpn, _) { final session = vpn.activeSocksSession; if (session == null) { - // The proxy can be running while this session is unknown: - // Android killed the app process, the foreground service kept - // the listener alive, and its credentials existed only in the - // memory that died with it. Saying "Connect" there would be a - // lie — the user is already connected. final orphaned = vpn.status == VpnStatus.connected && vpn.adoptedRunningRuntime; if (orphaned) { diff --git a/lib/screens/settings/in_settings/lightning.dart b/lib/screens/settings/in_settings/lightning.dart index 944b6ff..4cfba72 100644 --- a/lib/screens/settings/in_settings/lightning.dart +++ b/lib/screens/settings/in_settings/lightning.dart @@ -2,9 +2,6 @@ import 'package:flutter/material.dart'; import 'package:shared_preferences/shared_preferences.dart'; import 'package:revoltvpn/logic/app_colors.dart'; -// ── lib/screens/settings/in_settings/lightning.dart ───────────────────────── -// Toggle for the lightning strike overlay on the main screen. - final ValueNotifier lightningEnabled = ValueNotifier(true); Future loadLightningPref() async { @@ -35,7 +32,9 @@ class _LightningToggleTileState extends State { Future _toggle(bool value) async { final prefs = await SharedPreferences.getInstance(); - await prefs.setBool('lightning_effect_enabled', value); + final saved = await prefs.setBool('lightning_effect_enabled', value); + if (!saved || !mounted) return; + lightningEnabled.value = value; setState(() => _on = value); } diff --git a/lib/screens/settings/in_settings/rain.dart b/lib/screens/settings/in_settings/rain.dart index 929b228..d894f82 100644 --- a/lib/screens/settings/in_settings/rain.dart +++ b/lib/screens/settings/in_settings/rain.dart @@ -2,9 +2,6 @@ import 'package:flutter/material.dart'; import 'package:shared_preferences/shared_preferences.dart'; import 'package:revoltvpn/logic/app_colors.dart'; -// ── lib/screens/settings/in_settings/rain.dart ────────────────────────────── -// Toggle for the animated rain overlay on the main screen. - final ValueNotifier rainEnabled = ValueNotifier(true); Future loadRainPref() async { @@ -35,7 +32,9 @@ class _RainToggleTileState extends State { Future _toggle(bool value) async { final prefs = await SharedPreferences.getInstance(); - await prefs.setBool('rain_effect_enabled', value); + final saved = await prefs.setBool('rain_effect_enabled', value); + if (!saved || !mounted) return; + rainEnabled.value = value; setState(() => _on = value); } diff --git a/local_packages/flutter_vless_android-1.1.5/.metadata b/local_packages/flutter_vless_android-1.1.5/.metadata new file mode 100644 index 0000000..fe7c308 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/.metadata @@ -0,0 +1,30 @@ +# This file tracks properties of this Flutter project. +# Used by Flutter tool to assess capabilities and perform upgrades etc. +# +# This file should be version controlled and should not be manually edited. + +version: + revision: "adc901062556672b4138e18a4dc62a4be8f4b3c2" + channel: "stable" + +project_type: plugin + +# Tracks metadata for the flutter migrate command +migration: + platforms: + - platform: root + create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2 + base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2 + - platform: android + create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2 + base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2 + + # User provided section + + # List of Local paths (relative to this file) that should be + # ignored by the migrate tool. + # + # Files that are not part of the templates will be ignored by default. + unmanaged_files: + - 'lib/main.dart' + - 'ios/Runner.xcodeproj/project.pbxproj' diff --git a/local_packages/flutter_vless_android-1.1.5/CHANGELOG.md b/local_packages/flutter_vless_android-1.1.5/CHANGELOG.md new file mode 100644 index 0000000..d188bf1 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/CHANGELOG.md @@ -0,0 +1,49 @@ +## 1.1.5 + +* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.7.11`. +* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.7.11`. +* Fixed Android VPN app routing: all configured blocked apps are now applied to `VpnService.Builder` as disallowed applications and bypass the Xray VPN tunnel. + +## 1.1.4 + +* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.27.1`. +* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.27`. + +## 1.1.3 + +* Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.22`. +* Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.22`. + +## 1.1.2 + +* Clarified that Android device and emulator runtime binaries are delivered through the main Maven `xray-android` AAR. +* Kept the Android runtime dependency on `dev.tfox.fluttervless:xray-android:26.6.1.1`. + +## 1.1.1 + +* Updated the Android device runtime `libxray.so` binaries to Xray-core `v26.6.1`. +* Kept Android 15+ 16KB page-size linker alignment for the rebuilt ARM binaries. +* Moved Android runtime binaries and geodata into the Maven `dev.tfox.fluttervless:xray-android:26.6.1.1` AAR dependency. +* Included device and emulator ABIs (`armeabi-v7a`, `arm64-v8a`, `x86`, `x86_64`) in the main Maven runtime AAR. +* Removed raw device `jniLibs` and geodata files from the Pub.dev wrapper package; the wrapper now resolves the runtime from Maven Central. + +## 1.1.0 + +* Replaced Android Dart boilerplate with the shared `VlessMethodChannelAdapter`. +* Removed template `getPlatformVersion` scaffold files. +* Moved `flutter_lints` to `dev_dependencies`. +* Removed publish-time dependency overrides from `pubspec.yaml`. + +## 1.0.2 + +* XRay version up + +## 1.0.1 + +* XRay version up + +## 1.0.0 + +* Initial release of the Android implementation for `flutter_vless`. +* Supports VLESS/VMESS protocols using Xray core. +* Implements `VlessPlatform` interface. diff --git a/local_packages/flutter_vless_android-1.1.5/LICENSE b/local_packages/flutter_vless_android-1.1.5/LICENSE new file mode 100644 index 0000000..b560af6 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2024-2026 13FOX Studio / tfox.dev + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/local_packages/flutter_vless_android-1.1.5/NOTICE b/local_packages/flutter_vless_android-1.1.5/NOTICE new file mode 100644 index 0000000..d687308 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/NOTICE @@ -0,0 +1,13 @@ +flutter_vless_android + +Copyright (c) 2024-2026 13FOX Studio / tfox.dev. + +This package is the Android implementation of the official flutter_vless +project maintained by 13FOX Studio. + +Official project: https://github.com/XIIIFOX/flutter_vless +Official publisher: https://pub.dev/publishers/tfox.dev +Website: https://tfox.dev + +Redistributions, forks, and derived packages must preserve the copyright notice +and MIT license notice where required by the license. diff --git a/local_packages/flutter_vless_android-1.1.5/README.md b/local_packages/flutter_vless_android-1.1.5/README.md new file mode 100644 index 0000000..5451e26 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/README.md @@ -0,0 +1,14 @@ +# flutter_vless_android + +The Android implementation of the `flutter_vless` plugin. + +## Runtime + +Android runtime binaries and geodata are delivered through the Maven Central AAR dependency `dev.tfox.fluttervless:xray-android:26.7.11`. This keeps the Pub.dev package lightweight while preserving the same packaged Xray files in the final Android app. + +Do not add raw `android/src/main/jniLibs` or geodata files back to this package. Rebuild runtime files in `android_runtime/xray_android/src/main`, publish the Maven AAR, then publish this wrapper package. + +## Emulator Support + +The current Maven runtime AAR includes `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64`. +This covers both physical Android devices and Android emulators. diff --git a/local_packages/flutter_vless_android-1.1.5/UPSTREAM b/local_packages/flutter_vless_android-1.1.5/UPSTREAM new file mode 100644 index 0000000..6dbe705 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/UPSTREAM @@ -0,0 +1,4 @@ +Upstream: https://github.com/XIIIFOX/flutter_vless +Tag: v1.1.5 +Android package: flutter_vless_android 1.1.5 +ReVolt hardening is pre-applied to this vendored package. diff --git a/local_packages/flutter_vless_android-1.1.5/analysis_options.yaml b/local_packages/flutter_vless_android-1.1.5/analysis_options.yaml new file mode 100644 index 0000000..a5744c1 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/analysis_options.yaml @@ -0,0 +1,4 @@ +include: package:flutter_lints/flutter.yaml + +# Additional information about this file can be found at +# https://dart.dev/guides/language/analysis-options diff --git a/local_packages/flutter_vless_android-1.1.5/android/.gitignore b/local_packages/flutter_vless_android-1.1.5/android/.gitignore new file mode 100644 index 0000000..161bdcd --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/.gitignore @@ -0,0 +1,9 @@ +*.iml +.gradle +/local.properties +/.idea/workspace.xml +/.idea/libraries +.DS_Store +/build +/captures +.cxx diff --git a/local_packages/flutter_vless_android-1.1.5/android/XRAY_SETUP.md b/local_packages/flutter_vless_android-1.1.5/android/XRAY_SETUP.md new file mode 100644 index 0000000..db32077 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/XRAY_SETUP.md @@ -0,0 +1,92 @@ +# Xray & Tun2socks Android Build Guide + +This guide explains how to build the native libraries (`libxray.so` and `libtun2socks.so`) for the Flutter Vless plugin. + +Android runtime files are stored in `android_runtime/xray_android/src/main` and published as the Maven Central AAR `dev.tfox.fluttervless:xray-android`. They are not stored in the `flutter_vless_android` Pub.dev package. + +**Key Features:** +- ✅ **Android 15+ Support**: Builds with 16KB page size alignment. +- ✅ **Socket FD Passing**: `tun2socks` is patched to receive the TUN file descriptor via a Unix socket (bypassing Android process restrictions). + +## Prerequisites + +1. **Go (Golang)**: Version 1.21+ installed. +2. **Android NDK**: Version r27+ (recommended). +3. **macOS/Linux**: Build scripts are designed for Unix-like environments. + +## 1. Environment Setup + +Export the path to your Android NDK. + +```bash +# Example (Adjust path to your NDK installation) +export ANDROID_NDK_HOME="$HOME/Library/Android/sdk/ndk/27.0.12077973" +``` + +## 2. Build Xray (`libxray.so`) + +This script builds the Xray core for Android device and emulator architectures (`arm64-v8a`, `armeabi-v7a`, `x86`, `x86_64`) by default and writes them to the Maven runtime module. + +```bash +cd android +chmod +x build_xray.sh +./build_xray.sh +``` + +## 3. Build Tun2socks (`libtun2socks.so`) + +We use a custom Go-based build script (`build_tun2socks.sh`) instead of the old C-based one. This ensures 16KB page alignment and includes the socket-based FD passing logic. + +```bash +cd android +chmod +x build_tun2socks.sh +./build_tun2socks.sh +``` + +## 4. Verification (16KB Page Size) + +To confirm that the libraries are compatible with Android 15+ (16KB page size), check the `LOAD` segment alignment using `llvm-readelf`. + +```bash +# Check alignment (should be 0x4000) +$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/darwin-x86_64/bin/llvm-readelf -l ../../../android_runtime/xray_android/src/main/jniLibs/arm64-v8a/libtun2socks.so | grep LOAD | head -1 +``` + +**Expected Output:** +``` +LOAD ... 0x4000 +``` +If you see `0x1000`, it is **NOT** compatible with 16KB devices. + +## 5. Package The Maven Runtime AAR + +The `flutter_vless_android` Pub.dev package consumes the Android device runtime through the Maven artifact: + +```text +dev.tfox.fluttervless:xray-android:26.7.11 +``` + +After rebuilding `libxray.so`, `libtun2socks.so`, or the geodata files in `android_runtime/xray_android/src/main`, build the local Maven repository from the repository root: + +```bash +tool/build_android_runtime_maven.sh +``` + +For local Android wrapper or example builds before Maven Central publication, pass the local repository path: + +```bash +cd example/android +./gradlew :app:assembleDebug \ + -PflutterVlessAndroidRuntimeRepo="$PWD/../../android_runtime/xray_android/build/repo" +``` + +To upload the signed bundle to Maven Central, configure the Central Portal and signing environment variables documented in `android_runtime/xray_android/README.md`, then run: + +```bash +tool/publish_android_runtime_maven.sh +``` + +## 6. Troubleshooting + +- **"bad file descriptor"**: This means the socket FD passing failed. Ensure `XrayVPNService.kt` is correctly sending the FD to the socket path specified in `-sock-path`. +- **"permission denied"**: Ensure the app has permissions to write to the socket file in its private directory. diff --git a/local_packages/flutter_vless_android-1.1.5/android/build.gradle b/local_packages/flutter_vless_android-1.1.5/android/build.gradle new file mode 100644 index 0000000..0543d9b --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/build.gradle @@ -0,0 +1,95 @@ +group 'com.github.tfox.flutter_vless' +version '1.0' + +buildscript { + ext.kotlin_version = '2.2.20' + repositories { + google() + mavenCentral() + } + + dependencies { + classpath 'com.android.tools.build:gradle:8.1.0' + classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version" + } +} + +rootProject.allprojects { + repositories { + def localRuntimeRepo = findProperty('flutterVlessAndroidRuntimeRepo') ?: System.getenv('FLUTTER_VLESS_ANDROID_RUNTIME_REPO') + if (localRuntimeRepo) { + maven { url uri(localRuntimeRepo) } + } + google() + mavenCentral() + } +} + +apply plugin: 'com.android.library' +apply plugin: 'kotlin-android' + +android { + if (project.android.hasProperty("namespace")) { + namespace 'com.github.tfox.flutter_vless' + } + + compileSdkVersion 34 + compileOptions { + sourceCompatibility JavaVersion.VERSION_1_8 + targetCompatibility JavaVersion.VERSION_1_8 + } + + kotlinOptions { + jvmTarget = '1.8' + } + + defaultConfig { + minSdkVersion 23 + targetSdkVersion 35 + + // 16KB page size support for Android 15+ + ndk { + abiFilters 'armeabi-v7a', 'arm64-v8a', 'x86', 'x86_64' + } + } + + // Configure 16KB page alignment + buildFeatures { + prefab true + } + + dependencies { + testImplementation 'junit:junit:4.13.2' + testImplementation 'org.mockito:mockito-core:5.0.0' + testImplementation 'org.json:json:20240303' + } + + testOptions { + unitTests.returnDefaultValues = true + unitTests.all { + testLogging { + events "passed", "skipped", "failed", "standardOut", "standardError" + outputs.upToDateWhen {false} + showStandardStreams = true + } + } + } + + sourceSets { + main { + java.srcDirs += 'src/main/kotlin' + } + } + packaging { + jniLibs { + pickFirsts += ['lib/**/libc++_shared.so'] + } + } +} + +dependencies { + implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version" + implementation 'androidx.appcompat:appcompat:1.6.1' + implementation 'com.google.code.gson:gson:2.10.1' + implementation "dev.tfox.fluttervless:xray-android:${findProperty('flutterVlessXrayRuntimeVersion') ?: '26.7.11'}" +} diff --git a/local_packages/flutter_vless_android-1.1.5/android/build_tun2socks.sh b/local_packages/flutter_vless_android-1.1.5/android/build_tun2socks.sh new file mode 100755 index 0000000..f26a369 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/build_tun2socks.sh @@ -0,0 +1,122 @@ +#!/bin/bash +set -euo pipefail + +# Build script for tun2socks (Go version) with 16KB page size support +# This is required for Android 15+ compatibility + +# Configuration +TUN2SOCKS_REPO="https://github.com/xjasonlyu/tun2socks" +TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}" +NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}" + +# Check NDK +if [ ! -d "$NDK_PATH" ]; then + echo "Error: NDK not found at $NDK_PATH" + echo "Please export ANDROID_NDK_HOME pointing to your NDK installation." + exit 1 +fi + +echo "Using NDK at: $NDK_PATH" + +case "$(uname -s)" in + Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;; + Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;; + *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;; +esac +if [ ! -d "$TOOLCHAIN" ]; then + echo "Error: NDK toolchain not found at $TOOLCHAIN" + echo "Please check ANDROID_NDK_HOME and host OS." + exit 1 +fi + +# Clone tun2socks if not exists +if [ ! -d "tun2socks-go" ]; then + echo "Cloning tun2socks (Go version)..." + git clone "$TUN2SOCKS_REPO" tun2socks-go +else + echo "tun2socks-go directory exists, pulling latest..." + cd tun2socks-go && git pull && cd .. +fi + +# Build Function +build_tun2socks() { + local ARCH_NAME=$1 + local GO_ARCH=$2 + local GO_ARM=$3 + local ANDROID_TARGET=$4 + local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}" + + echo "Building tun2socks for ${ARCH_NAME}..." + + mkdir -p "$OUTPUT_DIR" + + export CGO_ENABLED=1 + export GOOS=android + export GOARCH=$GO_ARCH + export GOARM=$GO_ARM + + export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang" + export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++" + + # Verify compiler exists + if [ ! -f "$CC" ]; then + echo "Error: Compiler not found at $CC" + return 1 + fi + + cd tun2socks-go + + # Build with 16KB page alignment - same flags as xray + go build -v -trimpath -ldflags "-s -w -buildid= -linkmode=external -extldflags '-Wl,-z,max-page-size=16384'" -buildmode=pie -o "../${OUTPUT_DIR}/libtun2socks.so" . + + echo "Success: ${OUTPUT_DIR}/libtun2socks.so created." + + # Verify 16KB alignment + if [ -x "${TOOLCHAIN}/bin/llvm-readelf" ]; then + echo "Verifying 16KB alignment:" + ALIGN=$("${TOOLCHAIN}/bin/llvm-readelf" -l "../${OUTPUT_DIR}/libtun2socks.so" | grep "LOAD" | head -1 | awk '{print $NF}') + if [ "$ALIGN" = "0x4000" ]; then + echo "Alignment: $ALIGN (16KB) - correct" + else + echo "Warning: alignment is $ALIGN; expected 0x4000" + fi + fi + + cd .. +} + +# Build for Architectures +echo "Building tun2socks (Go version) with 16KB page size support..." + +# ARM64 +if [ "${TUN2SOCKS_BUILD_ARM64:-1}" = "1" ]; then + build_tun2socks "arm64-v8a" "arm64" "" "aarch64-linux-android21" +fi + +# ARMv7 +if [ "${TUN2SOCKS_BUILD_ARMV7:-1}" = "1" ]; then + build_tun2socks "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21" +fi + +# x86 is included in the main runtime AAR. +if [ "${TUN2SOCKS_BUILD_X86:-1}" = "1" ]; then + build_tun2socks "x86" "386" "" "i686-linux-android21" +fi + +# x86_64 is included in the main runtime AAR. +if [ "${TUN2SOCKS_BUILD_X86_64:-1}" = "1" ]; then + build_tun2socks "x86_64" "amd64" "" "x86_64-linux-android21" +fi + +echo "" +echo "=========================================" +echo "Build process finished!" +echo "=========================================" +echo "" +echo "Verification:" +echo "Run this command to check all libraries:" +echo "" +echo "for arch in armeabi-v7a arm64-v8a x86 x86_64; do" +echo " echo \"=== \$arch ===\";" +echo " ${TOOLCHAIN}/bin/llvm-readelf -l ${TARGET_DIR}/\$arch/libtun2socks.so | grep LOAD | head -1;" +echo "done" diff --git a/local_packages/flutter_vless_android-1.1.5/android/build_xray.sh b/local_packages/flutter_vless_android-1.1.5/android/build_xray.sh new file mode 100755 index 0000000..a743a0c --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/build_xray.sh @@ -0,0 +1,116 @@ +#!/bin/bash +set -euo pipefail + +# Configuration +XRAY_REPO="https://github.com/XTLS/Xray-core" +XRAY_VERSION="${XRAY_VERSION:-v26.7.11}" +TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}" +NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}" + +# Check NDK +if [ ! -d "$NDK_PATH" ]; then + echo "Error: NDK not found at $NDK_PATH" + echo "Please export ANDROID_NDK_HOME pointing to your NDK installation." + exit 1 +fi + +echo "Using NDK at: $NDK_PATH" + +# MacOS NDK Toolchain path +case "$(uname -s)" in + Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;; + Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;; + *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;; +esac +if [ ! -d "$TOOLCHAIN" ]; then + echo "Error: NDK toolchain not found at $TOOLCHAIN" + echo "Are you on macOS? If not, please edit the script to match your OS." + exit 1 +fi + +# Clone Xray if not exists +if [ ! -d "Xray-core" ]; then + echo "Cloning Xray-core..." + git clone "$XRAY_REPO" +else + echo "Xray-core directory exists, pulling latest..." + cd Xray-core && git fetch --tags && cd .. +fi + +cd Xray-core +git fetch --tags +git checkout "$XRAY_VERSION" +cd .. + +# Build Function +build_xray() { + local ARCH_NAME=$1 + local GO_ARCH=$2 + local GO_ARM=$3 + local ANDROID_TARGET=$4 + local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}" + + echo "Building for ${ARCH_NAME}..." + + mkdir -p "$OUTPUT_DIR" + + export CGO_ENABLED=1 + export GOOS=android + export GOARCH=$GO_ARCH + export GOARM=$GO_ARM + + export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang" + export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++" + + # 16KB page size support for Android 15+ + export LDFLAGS="-Wl,-z,max-page-size=16384" + + # Verify compiler exists + if [ ! -f "$CC" ]; then + echo "Error: Compiler not found at $CC" + # Try older NDK naming convention if new one fails (API 21 is standard) + # Some NDKs use specific API levels in clang name + return 1 + fi + + cd Xray-core + + # Build with 16KB page alignment + if go build -v -trimpath -buildvcs=false \ + -gcflags "all=-l=4" \ + -ldflags "-X github.com/xtls/xray-core/core.build=${XRAY_VERSION} -s -w -buildid= -checklinkname=0 -linkmode=external -extldflags=${LDFLAGS}" \ + -buildmode=pie \ + -o "../${OUTPUT_DIR}/libxray.so" ./main; then + echo "Success: ${OUTPUT_DIR}/libxray.so created." + else + echo "Failed to build for ${ARCH_NAME}" + return 1 + fi + + cd .. +} + +# Build for Architectures +# API Level 21 is generally safe for modern Flutter apps (Android 5.0+) + +# ARM64 +if [ "${XRAY_BUILD_ARM64:-1}" = "1" ]; then + build_xray "arm64-v8a" "arm64" "" "aarch64-linux-android21" +fi + +# ARMv7 +if [ "${XRAY_BUILD_ARMV7:-1}" = "1" ]; then + build_xray "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21" +fi + +# x86 is included in the main runtime AAR. +if [ "${XRAY_BUILD_X86:-1}" = "1" ]; then + build_xray "x86" "386" "" "i686-linux-android21" +fi + +# x86_64 is included in the main runtime AAR. +if [ "${XRAY_BUILD_X86_64:-1}" = "1" ]; then + build_xray "x86_64" "amd64" "" "x86_64-linux-android21" +fi + +echo "Build process finished." diff --git a/local_packages/flutter_vless_android-1.1.5/android/settings.gradle b/local_packages/flutter_vless_android-1.1.5/android/settings.gradle new file mode 100644 index 0000000..8df1cc5 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/settings.gradle @@ -0,0 +1 @@ +rootProject.name = 'flutter_vless_android' diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/main/AndroidManifest.xml b/local_packages/flutter_vless_android-1.1.5/android/src/main/AndroidManifest.xml new file mode 100644 index 0000000..55e0011 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/main/AndroidManifest.xml @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/FlutterVlessPlugin.kt b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/FlutterVlessPlugin.kt new file mode 100644 index 0000000..35cc1f7 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/FlutterVlessPlugin.kt @@ -0,0 +1,402 @@ +// Copyright (c) 2024-2026 13FOX Studio / tfox.dev. +// SPDX-License-Identifier: MIT + +package com.github.tfox.flutter_vless + +import android.Manifest +import android.app.Activity +import android.content.BroadcastReceiver +import android.content.Context +import android.content.Intent +import android.content.IntentFilter +import android.content.pm.PackageManager +import android.net.VpnService +import android.os.Build +import android.os.Handler +import android.os.Looper +import android.util.Log +import androidx.core.app.ActivityCompat +import androidx.core.content.ContextCompat +import com.github.tfox.flutter_vless.xray.dto.XrayConfig +import com.github.tfox.flutter_vless.xray.service.XrayVPNService +import com.github.tfox.flutter_vless.xray.utils.AppConfigs +import io.flutter.embedding.engine.plugins.FlutterPlugin +import io.flutter.embedding.engine.plugins.activity.ActivityAware +import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding +import io.flutter.plugin.common.EventChannel +import io.flutter.plugin.common.MethodCall +import io.flutter.plugin.common.MethodChannel +import io.flutter.plugin.common.PluginRegistry +import java.io.BufferedReader +import java.io.File +import java.io.InputStreamReader +import java.util.ArrayList +import java.util.UUID +import java.util.concurrent.Executors + +/** + * Main entry point for the Flutter Vless plugin on Android. + * + * ReVolt keeps this bridge deliberately narrow: start/stop, session deadline, + * permission handling, core version and private runtime status only. + */ +class FlutterVlessPlugin : FlutterPlugin, ActivityAware, PluginRegistry.ActivityResultListener, MethodChannel.MethodCallHandler { + + private val executor = Executors.newSingleThreadExecutor() + private lateinit var vpnControlMethod: MethodChannel + private lateinit var vpnStatusEvent: EventChannel + private var vpnStatusSink: EventChannel.EventSink? = null + private var activity: Activity? = null + private var xrayReceiver: BroadcastReceiver? = null + private var pendingResult: MethodChannel.Result? = null + private lateinit var context: Context + private var expectedRuntimeToken: String? = null + private var pendingStopResult: MethodChannel.Result? = null + private val mainHandler = Handler(Looper.getMainLooper()) + private val stopTimeoutRunnable = Runnable { + val pending = pendingStopResult ?: return@Runnable + pendingStopResult = null + pending.error("STOP_TIMEOUT", "VPN service did not confirm shutdown", null) + } + + companion object { + private const val TAG = "FlutterVlessPlugin" + private const val REQUEST_CODE_VPN_PERMISSION = 24 + private const val REQUEST_CODE_POST_NOTIFICATIONS = 1 + } + + override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) { + context = binding.applicationContext + vpnControlMethod = MethodChannel(binding.binaryMessenger, "flutter_vless") + vpnStatusEvent = EventChannel(binding.binaryMessenger, "flutter_vless/status") + + vpnControlMethod.setMethodCallHandler(this) + vpnStatusEvent.setStreamHandler(object : EventChannel.StreamHandler { + override fun onListen(arguments: Any?, events: EventChannel.EventSink?) { + vpnStatusSink = events + registerReceiver() + } + + override fun onCancel(arguments: Any?) { + vpnStatusSink = null + unregisterReceiver() + } + }) + } + + override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) { + when (call.method) { + "startVless" -> { + if (pendingStopResult != null) { + result.error("STOP_IN_PROGRESS", "VPN shutdown is still in progress", null) + return + } + + val config = XrayConfig() + val runtimeToken = UUID.randomUUID().toString() + expectedRuntimeToken = runtimeToken + config.RUNTIME_TOKEN = runtimeToken + config.REMARK = call.argument("remark") ?: "" + config.V2RAY_FULL_JSON_CONFIG = call.argument("config") ?: "" + config.BLOCKED_APPS = call.argument>("blocked_apps") ?: ArrayList() + config.BYPASS_SUBNETS = call.argument>("bypass_subnets") ?: ArrayList() + config.NOTIFICATION_DISCONNECT_BUTTON_NAME = call.argument("notificationDisconnectButtonName") ?: "Disconnect" + + if (AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME.isNotEmpty() && AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE.isNotEmpty()) { + config.NOTIFICATION_ICON_RESOURCE_NAME = AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME + config.NOTIFICATION_ICON_RESOURCE_TYPE = AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE + val resId = context.resources.getIdentifier( + AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME, + AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE, + context.packageName + ) + config.APPLICATION_ICON = resId + } + + if (call.argument("proxy_only") == true) { + AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.PROXY_ONLY + } else { + AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.VPN_TUN + } + + try { + val jsonConfig = org.json.JSONObject(config.V2RAY_FULL_JSON_CONFIG) + val outbounds = jsonConfig.optJSONArray("outbounds") + if (outbounds != null && outbounds.length() > 0) { + val firstOutbound = outbounds.getJSONObject(0) + val settings = firstOutbound.optJSONObject("settings") + val vnext = settings?.optJSONArray("vnext") + if (vnext != null && vnext.length() > 0) { + val server = vnext.getJSONObject(0) + config.CONNECTED_V2RAY_SERVER_ADDRESS = server.optString("address", "") + config.CONNECTED_V2RAY_SERVER_PORT = server.optInt("port", 0).toString() + } else if (settings != null) { + config.CONNECTED_V2RAY_SERVER_ADDRESS = settings.optString("address", "") + config.CONNECTED_V2RAY_SERVER_PORT = settings.optInt("port", 0).toString() + } + } + } catch (_: Exception) { + // Optional metadata only; runtime config validation happens downstream. + } + + val intent = Intent(context, XrayVPNService::class.java) + intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE) + intent.putExtra("V2RAY_CONFIG", config) + intent.putExtra("PROXY_ONLY", call.argument("proxy_only") ?: false) + + try { + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { + context.startForegroundService(intent) + } else { + context.startService(intent) + } + result.success(null) + } catch (e: Exception) { + if (expectedRuntimeToken == runtimeToken) expectedRuntimeToken = null + result.error("START_FAILED", e.message ?: "Could not start VPN service", null) + } + } + + "stopVless" -> { + if (pendingStopResult != null) { + result.error("STOP_IN_PROGRESS", "VPN shutdown is already in progress", null) + return + } + + // A STOP without a generation token can kill a newer runtime after + // UI/process churn. No token means this bridge owns nothing to stop. + val token = expectedRuntimeToken + if (token == null) { + result.success(null) + return + } + + val intent = Intent(context, XrayVPNService::class.java) + intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) + intent.putExtra("RUNTIME_TOKEN", token) + + try { + context.startService(intent) + pendingStopResult = result + mainHandler.removeCallbacks(stopTimeoutRunnable) + mainHandler.postDelayed(stopTimeoutRunnable, 6_000L) + } catch (e: Exception) { + pendingStopResult = null + mainHandler.removeCallbacks(stopTimeoutRunnable) + result.error("STOP_FAILED", e.message ?: "Could not stop VPN service", null) + } + } + + "setSessionDeadline" -> { + val token = expectedRuntimeToken + val remainingSeconds = call.argument("remainingSeconds")?.toLong() + if (token == null) { + result.error("NO_RUNTIME", "No active runtime token", null) + return + } + if (remainingSeconds == null || remainingSeconds < 0) { + result.error("INVALID_DEADLINE", "remainingSeconds must be non-negative", null) + return + } + + val intent = Intent(context, XrayVPNService::class.java) + intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE) + intent.putExtra("RUNTIME_TOKEN", token) + intent.putExtra("REMAINING_SECONDS", remainingSeconds) + try { + context.startService(intent) + result.success(null) + } catch (e: Exception) { + result.error("DEADLINE_FAILED", e.message ?: "Could not update session deadline", null) + } + } + + "initializeVless" -> { + val iconResourceName = call.argument("notificationIconResourceName") + val iconResourceType = call.argument("notificationIconResourceType") + if (iconResourceName != null && iconResourceType != null) { + AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME = iconResourceName + AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE = iconResourceType + } + result.success(null) + } + + "getCoreVersion" -> { + executor.submit { + try { + val nativeLibraryDir = context.applicationInfo.nativeLibraryDir + val xrayExecutable = File(nativeLibraryDir, "libxray.so") + if (xrayExecutable.exists()) { + val p = Runtime.getRuntime().exec(arrayOf(xrayExecutable.absolutePath, "-version")) + val reader = BufferedReader(InputStreamReader(p.inputStream)) + val version = reader.readLine() + result.success(version) + } else { + result.success("Xray not found") + } + } catch (e: Exception) { + result.success("Error: ${e.message}") + } + } + } + + "requestPermission" -> { + val currentActivity = activity + if (currentActivity == null) { + result.error("NO_ACTIVITY", "Activity is not attached", null) + return + } + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) { + if (ActivityCompat.checkSelfPermission(currentActivity, Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) { + ActivityCompat.requestPermissions(currentActivity, arrayOf(Manifest.permission.POST_NOTIFICATIONS), REQUEST_CODE_POST_NOTIFICATIONS) + } + } + val request = VpnService.prepare(currentActivity) + if (request != null) { + pendingResult = result + currentActivity.startActivityForResult(request, REQUEST_CODE_VPN_PERMISSION) + } else { + result.success(true) + } + } + + else -> result.notImplemented() + } + } + + private fun registerReceiver() { + if (activity == null) return + if (xrayReceiver == null) { + xrayReceiver = object : BroadcastReceiver() { + override fun onReceive(context: Context?, intent: Intent?) { + if (intent == null || vpnStatusSink == null) return + val state = intent.getSerializableExtra("STATE") as? AppConfigs.V2RAY_STATES + val runtimeToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty() + val runtimeReady = intent.getBooleanExtra("RUNTIME_READY", false) + val duration = intent.getStringExtra("DURATION") + val uploadSpeed = intent.getLongExtra("UPLOAD_SPEED", 0) + val downloadSpeed = intent.getLongExtra("DOWNLOAD_SPEED", 0) + val uploadTraffic = intent.getLongExtra("UPLOAD_TRAFFIC", 0) + val downloadTraffic = intent.getLongExtra("DOWNLOAD_TRAFFIC", 0) + + val currentToken = expectedRuntimeToken + if (currentToken == null) { + if (runtimeToken.isNotEmpty() && + (state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED || + state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING) + ) { + expectedRuntimeToken = runtimeToken + } else { + return + } + } else if (runtimeToken != currentToken) { + return + } + + val stateName = when (state) { + AppConfigs.V2RAY_STATES.V2RAY_CONNECTED -> if (runtimeReady) "CONNECTED" else "CONNECTING" + AppConfigs.V2RAY_STATES.V2RAY_CONNECTING -> "CONNECTING" + else -> "DISCONNECTED" + } + + val data = ArrayList() + data.add(duration ?: "0") + data.add(uploadSpeed.toString()) + data.add(downloadSpeed.toString()) + data.add(uploadTraffic.toString()) + data.add(downloadTraffic.toString()) + data.add(stateName) + + if (state == AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED && + runtimeToken.isNotEmpty() && runtimeToken == expectedRuntimeToken + ) { + expectedRuntimeToken = null + mainHandler.removeCallbacks(stopTimeoutRunnable) + pendingStopResult?.success(null) + pendingStopResult = null + } + + vpnStatusSink?.success(data) + } + } + } + + val filter = IntentFilter(AppConfigs.V2RAY_CONNECTION_INFO) + val currentActivity = activity ?: return + ContextCompat.registerReceiver( + currentActivity, + xrayReceiver, + filter, + ContextCompat.RECEIVER_NOT_EXPORTED, + ) + } + + private fun unregisterReceiver() { + val currentActivity = activity + val receiver = xrayReceiver + if (currentActivity != null && receiver != null) { + try { + currentActivity.unregisterReceiver(receiver) + } catch (e: Exception) { + Log.w(TAG, "Receiver was already detached during lifecycle cleanup", e) + } + } + xrayReceiver = null + } + + private fun failPendingPermission(code: String, message: String) { + pendingResult?.error(code, message, null) + pendingResult = null + } + + override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) { + mainHandler.removeCallbacks(stopTimeoutRunnable) + pendingStopResult?.error("ENGINE_DETACHED", "Flutter engine detached during VPN shutdown", null) + pendingStopResult = null + failPendingPermission("ENGINE_DETACHED", "Flutter engine detached during VPN permission request") + unregisterReceiver() + vpnControlMethod.setMethodCallHandler(null) + vpnStatusEvent.setStreamHandler(null) + executor.shutdown() + } + + override fun onAttachedToActivity(binding: ActivityPluginBinding) { + activity = binding.activity + binding.addActivityResultListener(this) + if (vpnStatusSink != null) { + registerReceiver() + } + } + + override fun onDetachedFromActivityForConfigChanges() { + unregisterReceiver() + activity = null + } + + override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) { + activity = binding.activity + binding.addActivityResultListener(this) + if (vpnStatusSink != null) { + registerReceiver() + } + } + + override fun onDetachedFromActivity() { + failPendingPermission("NO_ACTIVITY", "Activity detached during VPN permission request") + unregisterReceiver() + activity = null + } + + override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean { + if (requestCode == REQUEST_CODE_VPN_PERMISSION) { + if (resultCode == Activity.RESULT_OK) { + pendingResult?.success(true) + } else { + pendingResult?.success(false) + } + pendingResult = null + return true + } + return false + } +} diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManager.kt b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManager.kt new file mode 100644 index 0000000..54975b6 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManager.kt @@ -0,0 +1,642 @@ +package com.github.tfox.flutter_vless.xray.core + +import android.app.Notification +import android.app.NotificationChannel +import android.app.NotificationManager +import android.app.PendingIntent +import android.app.Service +import android.content.Context +import android.content.Intent +import android.content.pm.PackageManager +import android.graphics.Color +import android.os.Build +import android.os.CountDownTimer +import android.util.Log +import androidx.core.app.ActivityCompat +import androidx.core.app.NotificationCompat +import com.github.tfox.flutter_vless.xray.dto.XrayConfig +import com.github.tfox.flutter_vless.xray.service.XrayVPNService +import com.github.tfox.flutter_vless.xray.utils.AppConfigs +import com.github.tfox.flutter_vless.xray.utils.Utilities +import org.json.JSONObject +import org.json.JSONArray +import java.io.File +import java.io.FileOutputStream + +/** + * Manages the Xray Core process (libxray.so). + * + * This singleton object is responsible for: + * 1. Generating the final Xray configuration file (config.json). + * 2. Injecting necessary inbounds (SOCKS, HTTP, API) into the user-provided config. + * 3. Starting and monitoring the Xray process. + * 4. Collecting traffic statistics via the Xray API. + * 5. Showing the persistent foreground notification. + */ +object XrayCoreManager { + + private const val NOTIFICATION_ID = 1 + private const val TAG = "XrayCoreManager" + private var xrayProcess: Process? = null + private var countDownTimer: CountDownTimer? = null + private var seconds = 0 + + private fun deleteEphemeralConfigOnFailure(filesDir: File) { + try { + val config = File(filesDir, "config.json") + if (config.exists() && !config.delete()) { + Log.w(TAG, "Could not delete failed ephemeral Xray config") + } + } catch (e: Exception) { + Log.w(TAG, "Could not delete failed ephemeral Xray config", e) + } + } + + private fun nextFreePort(preferredPort: Int, usedPorts: Set): Int { + var port = preferredPort + while (usedPorts.contains(port)) { + port++ + } + return port + } + + private fun uniqueInboundTag(inbounds: JSONArray, preferredTag: String): String { + val tags = mutableSetOf() + for (i in 0 until inbounds.length()) { + val tag = inbounds.optJSONObject(i)?.optString("tag").orEmpty() + if (tag.isNotEmpty()) tags.add(tag) + } + + if (!tags.contains(preferredTag)) return preferredTag + + var index = 1 + var candidate = "${preferredTag}_$index" + while (tags.contains(candidate)) { + index++ + candidate = "${preferredTag}_$index" + } + return candidate + } + + private fun normalizeRuntimeConfig(value: Any?): Any? { + return when (value) { + is JSONObject -> { + val normalized = JSONObject() + val aliases = mapOf( + "xHTTPSettings" to "xhttpSettings", + "httpUpgradeSettings" to "httpupgradeSettings", + "splitHTTPSettings" to "splithttpSettings" + ) + val keys = value.keys() + while (keys.hasNext()) { + val key = keys.next() + if (key == "allowInsecure") continue + + val targetKey = aliases[key] ?: key + if (aliases.containsKey(key) && value.has(targetKey)) continue + + val normalizedValue = normalizeRuntimeConfig(value.opt(key)) + if (targetKey == "network" && normalizedValue is String) { + normalized.put(targetKey, normalizedValue.lowercase()) + } else { + normalized.put(targetKey, normalizedValue) + } + } + normalized + } + is JSONArray -> { + val normalized = JSONArray() + for (i in 0 until value.length()) { + normalized.put(normalizeRuntimeConfig(value.opt(i))) + } + normalized + } + else -> value + } + } + + private fun normalizeVlessOutbounds(configJson: JSONObject) { + val outbounds = configJson.optJSONArray("outbounds") ?: return + for (i in 0 until outbounds.length()) { + val outbound = outbounds.optJSONObject(i) ?: continue + if (outbound.optString("protocol") != "vless") continue + + val settings = outbound.optJSONObject("settings") ?: continue + if (settings.has("vnext")) continue + + val address = settings.optString("address") + val id = settings.optString("id") + val port = settings.optInt("port", 0) + if (address.isEmpty() || id.isEmpty() || port <= 0) continue + + val user = JSONObject() + user.put("id", id) + user.put("encryption", settings.optString("encryption", "none")) + user.put("flow", settings.optString("flow", "")) + user.put("level", settings.optInt("level", 8)) + + val server = JSONObject() + server.put("address", address) + server.put("port", port) + server.put("users", JSONArray().put(user)) + + val normalizedSettings = JSONObject() + normalizedSettings.put("vnext", JSONArray().put(server)) + outbound.put("settings", normalizedSettings) + Log.d(TAG, "Normalized flat VLESS outbound settings for $address:$port") + } + } + + private fun sanitizeLogPaths(configJson: JSONObject, filesDir: File) { + val log = configJson.optJSONObject("log") ?: return + + // The VPN client never needs destination/access logs. A server-provided + // config must not silently enable browsing metadata collection locally. + log.remove("access") + try { File(filesDir, "access.log").delete() } catch (_: Exception) {} + + val errorPath = log.optString("error") + if (errorPath.isNotEmpty()) { + log.put("error", File(filesDir, "error.log").absolutePath) + } + } + + internal fun buildRuntimeConfigJson(config: XrayConfig, filesDir: File): JSONObject { + val configJson = normalizeRuntimeConfig( + JSONObject(config.V2RAY_FULL_JSON_CONFIG) + ) as JSONObject + normalizeVlessOutbounds(configJson) + sanitizeLogPaths(configJson, filesDir) + + // ReVolt needs only its authenticated local SOCKS ingress. + val inbounds = configJson.optJSONArray("inbounds") ?: JSONArray() + var secureSocksEnabled = false + for (i in 0 until inbounds.length()) { + val inbound = inbounds.optJSONObject(i) ?: continue + if (inbound.optString("tag") != "revolt-secure-socks") continue + + val settings = inbound.optJSONObject("settings") + ?: throw IllegalStateException("Secure SOCKS5 settings are missing") + val users = settings.optJSONArray("users") + ?: throw IllegalStateException("Secure SOCKS5 users are missing") + val account = users.optJSONObject(0) + ?: throw IllegalStateException("Secure SOCKS5 account is missing") + val port = inbound.optInt("port", -1) + + if (inbound.optString("protocol") != "socks" || + inbound.optString("listen") != "127.0.0.1" || + port <= 1024 || port > 65535 || + settings.optString("auth") != "password" || + account.optString("user").isEmpty() || + account.optString("pass").isEmpty() + ) { + throw IllegalStateException("Secure SOCKS5 session is invalid") + } + + config.LOCAL_SOCKS5_PORT = port + config.LOCAL_HTTP_PORT = 0 + secureSocksEnabled = true + break + } + + val usedPorts = mutableSetOf() + var hasSocksOnLocalPort = false + var hasHttpOnLocalPort = false + for (i in 0 until inbounds.length()) { + val inbound = inbounds.getJSONObject(i) + val protocol = inbound.optString("protocol") + val port = inbound.optInt("port", -1) + if (port > 0) usedPorts.add(port) + if (protocol == "socks" && port == config.LOCAL_SOCKS5_PORT) hasSocksOnLocalPort = true + if (protocol == "http" && port == config.LOCAL_HTTP_PORT) hasHttpOnLocalPort = true + } + + if (!hasSocksOnLocalPort) { + if (usedPorts.contains(config.LOCAL_SOCKS5_PORT)) { + config.LOCAL_SOCKS5_PORT = nextFreePort(config.LOCAL_SOCKS5_PORT, usedPorts) + } + val socksInbound = JSONObject() + socksInbound.put("tag", uniqueInboundTag(inbounds, "socks")) + socksInbound.put("port", config.LOCAL_SOCKS5_PORT) + socksInbound.put("listen", "127.0.0.1") + socksInbound.put("protocol", "socks") + socksInbound.put("settings", JSONObject().put("auth", "noauth").put("udp", true)) + socksInbound.put( + "sniffing", + JSONObject().put("enabled", true).put("destOverride", JSONArray().put("http").put("tls")) + ) + inbounds.put(socksInbound) + usedPorts.add(config.LOCAL_SOCKS5_PORT) + Log.d(TAG, "Injected SOCKS inbound on port ${config.LOCAL_SOCKS5_PORT}") + } + + if (!secureSocksEnabled && !hasHttpOnLocalPort) { + if (usedPorts.contains(config.LOCAL_HTTP_PORT)) { + config.LOCAL_HTTP_PORT = nextFreePort(config.LOCAL_HTTP_PORT, usedPorts) + } + val httpInbound = JSONObject() + httpInbound.put("tag", uniqueInboundTag(inbounds, "http")) + httpInbound.put("port", config.LOCAL_HTTP_PORT) + httpInbound.put("listen", "127.0.0.1") + httpInbound.put("protocol", "http") + inbounds.put(httpInbound) + usedPorts.add(config.LOCAL_HTTP_PORT) + Log.d(TAG, "Injected HTTP inbound on port ${config.LOCAL_HTTP_PORT}") + } + + return configJson + } + + internal fun buildDelayConfigJson(configJson: String, proxyPort: Int, filesDir: File): Pair { + val delayConfig = XrayConfig( + V2RAY_FULL_JSON_CONFIG = configJson, + LOCAL_SOCKS5_PORT = proxyPort, + LOCAL_HTTP_PORT = proxyPort + 1, + LOCAL_API_PORT = proxyPort + 2 + ) + val runtimeJson = buildRuntimeConfigJson(delayConfig, filesDir) + return Pair(runtimeJson, delayConfig.LOCAL_SOCKS5_PORT) + } + + /** + * Starts the Xray Core process. + * + * @param context The service context (needed for file access and notifications). + * @param config The configuration object containing the user's settings. + * @return true if started successfully, false otherwise. + */ + fun startCore(context: Service, config: XrayConfig): Boolean { + AppConfigs.RUNTIME_READY = false + AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING + AppConfigs.V2RAY_CONFIG = config + + // 1. Prepare the configuration file + val configFilesDir = context.filesDir + + try { + val configJson = buildRuntimeConfigJson(config, configFilesDir) + val configFile = File(context.filesDir, "config.json") + configFile.writeText(configJson.toString()) + } catch (e: Exception) { + Log.e(TAG, "Failed to write config file", e) + deleteEphemeralConfigOnFailure(configFilesDir) + return false + } + + // 2. Find Xray executable (libxray.so) + val nativeLibraryDir = context.applicationInfo.nativeLibraryDir + val xrayExecutable = File(nativeLibraryDir, "libxray.so") + if (!xrayExecutable.exists()) { + Log.e(TAG, "Xray executable not found at ${xrayExecutable.absolutePath}") + deleteEphemeralConfigOnFailure(configFilesDir) + return false + } + + // 3. Prepare assets (geoip, geosite) + try { + Utilities.copyAssets(context) + } catch (e: Exception) { + Log.e(TAG, "Failed to prepare Xray assets", e) + deleteEphemeralConfigOnFailure(configFilesDir) + return false + } + + // 4. Run Xray + try { + val cmd = listOf( + xrayExecutable.absolutePath, + "-config", File(configFilesDir, "config.json").absolutePath + ) + val pb = ProcessBuilder(cmd) + pb.directory(configFilesDir) + pb.redirectErrorStream(true) + + // Set environment variables (XRAY_LOCATION_ASSET is crucial for finding geoip/geosite) + val env = pb.environment() + env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context) + + xrayProcess = pb.start() + Thread.sleep(300) + if (xrayProcess?.isAlive != true) { + val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty() + Log.e(TAG, "Xray process exited during startup. Output: $output") + xrayProcess = null + AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED + deleteEphemeralConfigOnFailure(configFilesDir) + return false + } + + // config.json contains per-session SOCKS credentials. Xray has + // consumed it after the startup liveness check, so remove it now. + try { + val ephemeralConfig = File(configFilesDir, "config.json") + if (ephemeralConfig.exists() && !ephemeralConfig.delete()) { + Log.w(TAG, "Could not delete ephemeral Xray config") + } + } catch (e: Exception) { + Log.w(TAG, "Could not delete ephemeral Xray config", e) + } + + AppConfigs.RUNTIME_READY = false + AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING + startTimer(context) + showNotification(context, config) + sendStatusBroadcast(context, config) + + val process = xrayProcess ?: return false + // Monitor process in a separate thread to detect crash + Thread { + try { + process.inputStream.bufferedReader().use { reader -> + reader.forEachLine { _ -> } + } + + val exitCode = process.waitFor() + Log.e(TAG, "Xray process exited with code $exitCode") + if (xrayProcess === process && + AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN == config.RUNTIME_TOKEN && + (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED || + AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING) + ) { + // Hold the Android TUN while the core is recovered. Killing + // the VPN service here would allow direct-network fallback. + xrayProcess = null + AppConfigs.RUNTIME_READY = false + AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING + sendStatusBroadcast(context, config) + if (context is XrayVPNService) { + context.handleXrayCoreExit(config) + } else { + stopCore(context) + } + } + } catch (e: java.io.InterruptedIOException) { + // Expected when stopping + } catch (e: InterruptedException) { + // Expected when stopping + } catch (e: Exception) { + Log.e(TAG, "Error reading xray output", e) + } + }.start() + + return true + + } catch (e: Exception) { + Log.e(TAG, "Failed to start Xray process", e) + deleteEphemeralConfigOnFailure(configFilesDir) + return false + } + } + + /** + * Stops the Xray Core process and cleans up notifications. + */ + fun stopCore(context: Service, confirmationToken: String? = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN) { + try { + xrayProcess?.destroy() + xrayProcess = null + } catch (e: Exception) { + Log.e(TAG, "Failed to destroy Xray process", e) + } + + AppConfigs.RUNTIME_READY = false + AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED + stopTimer() + val notificationManager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager + notificationManager.cancel(NOTIFICATION_ID) + sendDisconnectedBroadcast(context, confirmationToken.orEmpty()) + AppConfigs.V2RAY_CONFIG = null + } + + fun markRuntimeConnecting(context: Context, config: XrayConfig) { + if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return + AppConfigs.RUNTIME_READY = false + AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING + sendStatusBroadcast(context, config) + } + + fun markRuntimeReady(context: Service, config: XrayConfig) { + if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return + AppConfigs.RUNTIME_READY = true + AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED + showNotification(context, config) + sendStatusBroadcast(context, config) + } + + fun isXrayRunning(): Boolean { + // Check state instead of process because VPN runs in separate service process + return AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED || + AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING + } + + private fun startTimer(context: Context) { + countDownTimer?.cancel() + seconds = 0 + countDownTimer = object : CountDownTimer(Long.MAX_VALUE, 1000) { + override fun onTick(millisUntilFinished: Long) { + seconds++ + val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName) + intent.putExtra("STATE", AppConfigs.V2RAY_STATE) + intent.putExtra("RUNTIME_TOKEN", AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN.orEmpty()) + intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY) + intent.putExtra("DURATION", seconds.toString()) + + intent.putExtra("UPLOAD_SPEED", 0L) + intent.putExtra("DOWNLOAD_SPEED", 0L) + intent.putExtra("UPLOAD_TRAFFIC", 0L) + intent.putExtra("DOWNLOAD_TRAFFIC", 0L) + + context.sendBroadcast(intent) + } + + override fun onFinish() {} + }.start() + } + + private fun stopTimer() { + countDownTimer?.cancel() + countDownTimer = null + seconds = 0 + } + + fun sendStatusBroadcast(context: Context, config: XrayConfig) { + val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName) + intent.putExtra("STATE", AppConfigs.V2RAY_STATE) + intent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN) + intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY) + intent.putExtra("DURATION", seconds.toString()) + intent.putExtra("UPLOAD_SPEED", 0L) + intent.putExtra("DOWNLOAD_SPEED", 0L) + intent.putExtra("UPLOAD_TRAFFIC", 0L) + intent.putExtra("DOWNLOAD_TRAFFIC", 0L) + context.sendBroadcast(intent) + } + + private fun sendDisconnectedBroadcast(context: Context, runtimeToken: String) { + val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName) + intent.putExtra("STATE", AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED) + intent.putExtra("RUNTIME_TOKEN", runtimeToken) + intent.putExtra("RUNTIME_READY", false) + intent.putExtra("DURATION", "0") + intent.putExtra("UPLOAD_SPEED", 0L) + intent.putExtra("DOWNLOAD_SPEED", 0L) + intent.putExtra("UPLOAD_TRAFFIC", 0L) + intent.putExtra("DOWNLOAD_TRAFFIC", 0L) + context.sendBroadcast(intent) + } + + private fun showNotification(context: Service, config: XrayConfig) { + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) { + if (ActivityCompat.checkSelfPermission(context, android.Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) { + return + } + } + + val channelId = createNotificationChannel(context, config.APPLICATION_NAME) + + val launchIntent = context.packageManager.getLaunchIntentForPackage(context.packageName) + launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_NEW_TASK + + val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT else PendingIntent.FLAG_UPDATE_CURRENT + val contentPendingIntent = PendingIntent.getActivity(context, 0, launchIntent, flags) + + val stopIntent = Intent(context, XrayVPNService::class.java) + stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) + stopIntent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN) + val stopPendingIntent = PendingIntent.getService(context, 0, stopIntent, flags) + val smallIcon = if (config.APPLICATION_ICON != 0) config.APPLICATION_ICON else android.R.drawable.ic_dialog_info + + val builder = NotificationCompat.Builder(context, channelId) + .setSmallIcon(smallIcon) + .setContentTitle(config.REMARK) + .setContentText(if (AppConfigs.RUNTIME_READY) "Connected" else "Connecting") + .addAction(0, config.NOTIFICATION_DISCONNECT_BUTTON_NAME, stopPendingIntent) + .setContentIntent(contentPendingIntent) + .setPriority(NotificationCompat.PRIORITY_MIN) + .setOngoing(true) + .setShowWhen(true) + + context.startForeground(NOTIFICATION_ID, builder.build()) + } + + fun getConnectedV2rayServerDelay(context: Context, url: String): Long { + // Use the configured SOCKS port (default 10807) + val port = AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807 + Log.d(TAG, "getConnectedV2rayServerDelay: Testing delay to $url via SOCKS port $port") + + return try { + val start = System.currentTimeMillis() + val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", port)) + val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection + connection.connectTimeout = 5000 + connection.readTimeout = 5000 + connection.requestMethod = "HEAD" + val responseCode = connection.responseCode + val end = System.currentTimeMillis() + val delay = end - start + connection.disconnect() + Log.d(TAG, "getConnectedV2rayServerDelay: Success! Response code: $responseCode, Delay: ${delay}ms") + delay + } catch (e: Exception) { + Log.e(TAG, "getConnectedV2rayServerDelay: Failed to measure delay (VPN may not be running)", e) + -1L + } + } + + /** + * Measure delay for a server configuration (when not connected). + * Temporarily starts Xray with the provided config, measures delay, then stops it. + */ + fun getServerDelay(context: Context, configJson: String, url: String): Long { + Log.d(TAG, "getServerDelay: Starting temporary Xray instance") + + var tempProcess: Process? = null + try { + // Find a random free port to avoid conflict with running VPN + val freePort = try { + val socket = java.net.ServerSocket(0) + val port = socket.localPort + socket.close() + port + } catch (e: Exception) { + 10806 // Fallback + } + + val (json, socksPort) = buildDelayConfigJson(configJson, freePort, context.filesDir) + Log.d(TAG, "getServerDelay: Using SOCKS port $socksPort") + + // Write temp config file + val tempConfigFile = File(context.filesDir, "temp_delay_config.json") + tempConfigFile.writeText(json.toString()) + + // Copy assets + Utilities.copyAssets(context) + + // Start Xray process + val xrayExecutable = File(context.applicationInfo.nativeLibraryDir, "libxray.so") + if (!xrayExecutable.exists()) { + Log.e(TAG, "getServerDelay: Xray executable not found") + return -1L + } + + val cmd = listOf( + xrayExecutable.absolutePath, + "-config", tempConfigFile.absolutePath + ) + + val pb = ProcessBuilder(cmd) + pb.directory(context.filesDir) + val env = pb.environment() + env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context) + + tempProcess = pb.start() + + // Wait a bit for Xray to start + Thread.sleep(1000) + + // Measure delay + val delay = try { + val start = System.currentTimeMillis() + val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", socksPort)) + val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection + connection.connectTimeout = 5000 + connection.readTimeout = 5000 + connection.requestMethod = "HEAD" + val responseCode = connection.responseCode + val end = System.currentTimeMillis() + connection.disconnect() + val result = end - start + Log.d(TAG, "getServerDelay: Success! Response code: $responseCode, Delay: ${result}ms") + result + } catch (e: Exception) { + Log.e(TAG, "getServerDelay: Failed to measure delay", e) + -1L + } + + // Stop temp process + tempProcess?.destroy() + tempConfigFile.delete() + + return delay + + } catch (e: Exception) { + Log.e(TAG, "getServerDelay: Error starting temp Xray", e) + tempProcess?.destroy() + return -1L + } + } + + private fun createNotificationChannel(context: Context, appName: String): String { + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { + val channelId = "REVOLT_VPN_SERVICE" + val channelName = "$appName Background Service" + val channel = NotificationChannel(channelId, channelName, NotificationManager.IMPORTANCE_LOW) + channel.lightColor = Color.BLUE + channel.lockscreenVisibility = Notification.VISIBILITY_PRIVATE + val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager + manager.createNotificationChannel(channel) + return channelId + } + return "" + } +} diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/dto/XrayConfig.kt b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/dto/XrayConfig.kt new file mode 100644 index 0000000..aed207c --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/dto/XrayConfig.kt @@ -0,0 +1,71 @@ +package com.github.tfox.flutter_vless.xray.dto + +import java.io.Serializable +import java.util.ArrayList + +/** + * Data class representing the Xray configuration and app settings. + * + * This class is passed from Flutter to Android and contains: + * 1. The full Xray JSON configuration (V2RAY_FULL_JSON_CONFIG). + * 2. App-specific settings like blocked apps, notification text, etc. + * 3. Connection parameters (server address, ports). + */ +data class XrayConfig( + /** The IP address of the connected server (used to exclude it from VPN routing). */ + var CONNECTED_V2RAY_SERVER_ADDRESS: String = "", + + /** The port of the connected server. */ + var CONNECTED_V2RAY_SERVER_PORT: String = "", + + /** Local port for SOCKS5 proxy (default: 10807). used by tun2socks. */ + var LOCAL_SOCKS5_PORT: Int = 10807, + + /** Local port for HTTP proxy (default: 10808). */ + var LOCAL_HTTP_PORT: Int = 10808, + + /** Local port for Xray API (stats, etc.) (default: 10809). */ + var LOCAL_API_PORT: Int = 10809, + + /** Timeout for connections in milliseconds. */ + var ALLOWED_TIMEOUT_MS: Int = 0, + + /** List of subnets to bypass (not routed through VPN). */ + var BYPASS_SUBNETS: ArrayList = ArrayList(), + + /** List of app package names to exclude from VPN. */ + var BLOCKED_APPS: ArrayList = ArrayList(), + + /** The raw Xray configuration JSON string. */ + var V2RAY_FULL_JSON_CONFIG: String = "", + + /** Whether to enable traffic statistics collection. */ + var ENABLE_TRAFFIC_STATICS: Boolean = false, + + /** Remark/Name of the server configuration. */ + var REMARK: String = "", + + /** Name of the application (displayed in notification). */ + var APPLICATION_NAME: String = "Flutter Vless", + + /** Resource ID of the notification icon. */ + var APPLICATION_ICON: Int = 0, + + /** Resource name of the notification icon (e.g. "ic_notification"). */ + var NOTIFICATION_ICON_RESOURCE_NAME: String = "", + + /** Resource type of the notification icon (e.g. "drawable"). */ + var NOTIFICATION_ICON_RESOURCE_TYPE: String = "", + + /** Text for the disconnect button in the notification. */ + var NOTIFICATION_DISCONNECT_BUTTON_NAME: String = "Disconnect", + + /** Domain resolution strategy (e.g. "IPIfNonMatch"). */ + var DOMAIN_STRATEGY: String = "", + + /** Routing domain strategy. */ + var ROUTING_DOMAIN_STRATEGY: String = "", + + /** Unique generation token used to reject stale native runtime events. */ + var RUNTIME_TOKEN: String = "" +) : Serializable diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/service/XrayVPNService.kt b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/service/XrayVPNService.kt new file mode 100644 index 0000000..a1c06e1 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/service/XrayVPNService.kt @@ -0,0 +1,685 @@ +package com.github.tfox.flutter_vless.xray.service + +import android.app.AlarmManager +import android.app.PendingIntent +import android.content.Context +import android.content.Intent +import android.net.LocalSocket +import android.net.LocalSocketAddress +import android.net.VpnService +import android.os.Build +import android.os.Handler +import android.os.Looper +import android.os.ParcelFileDescriptor +import android.os.SystemClock +import android.util.Log +import com.github.tfox.flutter_vless.xray.core.XrayCoreManager +import com.github.tfox.flutter_vless.xray.dto.XrayConfig +import com.github.tfox.flutter_vless.xray.utils.AppConfigs +import org.json.JSONObject +import java.io.File + +/** + * Android VPN Service implementation. + * + * This service owns the TUN interface and keeps runtime state generation-scoped. + * Session deadlines are enforced both by an in-process monotonic timer and by + * AlarmManager, while only the non-secret token/deadline pair is persisted. + * Per-session VLESS/SOCKS credentials remain memory-only. + */ +class XrayVPNService : VpnService() { + + private var mInterface: ParcelFileDescriptor? = null + private var tun2socksProcess: Process? = null + @Volatile private var isRunning = false + @Volatile private var recoveringXray = false + @Volatile private var recoveringTun2socks = false + private var tun2socksRecoveryAttempt = 0 + private var currentConfig: XrayConfig? = null + private var currentProxyOnly = false + private var shuttingDownIntentionally = false + + private val deadlineHandler = Handler(Looper.getMainLooper()) + private var sessionDeadlineElapsed: Long? = null + private var sessionDeadlineToken: String? = null + private val sessionDeadlineRunnable = Runnable { enforceSessionDeadline() } + + override fun onCreate() { + super.onCreate() + } + + override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int { + if (intent == null) { + if (isRunning && currentConfig != null) return START_REDELIVER_INTENT + + // Session credentials intentionally stay memory-only. If Android + // cannot redeliver the original START intent, fail closed instead + // of rebuilding a tunnel from sensitive material stored on disk. + clearPersistedDeadline() + cancelSessionExpiryAlarm() + stopSelf() + return START_NOT_STICKY + } + + if (intent.getBooleanExtra(EXTRA_SESSION_EXPIRED, false)) { + enforcePersistedDeadline(intent.getStringExtra("RUNTIME_TOKEN").orEmpty()) + return START_NOT_STICKY + } + + val command = if (Build.VERSION.SDK_INT >= 33) { + intent.getSerializableExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS::class.java) + } else { + @Suppress("DEPRECATION") + intent.getSerializableExtra("COMMAND") as? AppConfigs.V2RAY_SERVICE_COMMANDS + } + + if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) { + val requestedToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty() + val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty() + if (requestedToken.isEmpty() || + (activeToken.isNotEmpty() && requestedToken != activeToken) + ) { + Log.w(TAG, "Ignoring STOP_SERVICE without matching runtime generation") + return START_NOT_STICKY + } + stopAll(requestedToken) + return START_NOT_STICKY + } + + if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE) { + updateSessionDeadline(intent) + return if (isRunning) START_REDELIVER_INTENT else START_NOT_STICKY + } + + createNotificationChannel() + val notification = createNotification("VPN Service Running") + try { + if (Build.VERSION.SDK_INT >= 34) { + startForeground(1, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE) + } else { + startForeground(1, notification) + } + } catch (e: Exception) { + Log.e(TAG, "Failed to start foreground", e) + clearPersistedDeadline() + cancelSessionExpiryAlarm() + stopSelf() + return START_NOT_STICKY + } + + if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE) { + val config = if (Build.VERSION.SDK_INT >= 33) { + intent.getSerializableExtra("V2RAY_CONFIG", XrayConfig::class.java) + } else { + @Suppress("DEPRECATION") + intent.getSerializableExtra("V2RAY_CONFIG") as? XrayConfig + } + + if (config != null) { + if (XrayCoreManager.isXrayRunning()) { + Log.w(TAG, "Stopping stale Xray core before restart") + XrayCoreManager.stopCore(this) + } + cleanup(clearDeadline = true) + shuttingDownIntentionally = false + currentConfig = config + + val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false) + currentProxyOnly = proxyOnly + armSessionDeadline(config, BOOTSTRAP_SESSION_SECONDS) + if (shuttingDownIntentionally) return START_NOT_STICKY + + if (XrayCoreManager.startCore(this, config)) { + if (!proxyOnly) { + setupVpn(config) + } else { + isRunning = true + Log.d(TAG, "Starting in PROXY_ONLY mode") + XrayCoreManager.markRuntimeReady(this, config) + } + } else { + stopAll(config.RUNTIME_TOKEN) + return START_NOT_STICKY + } + } else { + Log.e(TAG, "START_SERVICE missing V2RAY_CONFIG") + stopAll() + return START_NOT_STICKY + } + } else { + stopAll() + return START_NOT_STICKY + } + + return START_REDELIVER_INTENT + } + + private fun setupVpn(config: XrayConfig) { + try { + if (mInterface != null) { + mInterface?.close() + mInterface = null + } + + val builder = Builder() + builder.setSession(config.REMARK) + builder.setMtu(1500) + builder.addAddress("26.26.26.1", 30) + builder.addAddress("fd00:26:26::1", 126) + + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) { + builder.setMetered(false) + } + + if (config.BLOCKED_APPS.isNotEmpty()) { + throw IllegalStateException("Per-app VPN bypass is disabled in ReVolt") + } + try { + builder.addDisallowedApplication(packageName) + } catch (e: Exception) { + throw IllegalStateException("Failed to exclude ReVolt from its own VPN", e) + } + + builder.addRoute("0.0.0.0", 0) + builder.addRoute("::", 0) + + try { + builder.addDnsServer("8.8.8.8") + builder.addDnsServer("1.1.1.1") + } catch (e: Exception) { + throw IllegalStateException("Failed to configure VPN DNS", e) + } + + mInterface = builder.establish() + ?: throw IllegalStateException("Android refused to establish VPN interface") + isRunning = true + runTun2socks(config) + + } catch (e: Exception) { + Log.e(TAG, "Failed to setup VPN", e) + stopAll() + } + } + + private data class SecureSocksCredentials( + val port: Int, + val username: String, + val password: String, + ) + + private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? { + val inbounds = try { + JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds") + } catch (_: Exception) { + null + } ?: return null + + for (i in 0 until inbounds.length()) { + val inbound = inbounds.optJSONObject(i) ?: continue + if (inbound.optString("tag") != "revolt-secure-socks") continue + if (inbound.optString("protocol") != "socks" || + inbound.optString("listen") != "127.0.0.1" + ) return null + + val settings = inbound.optJSONObject("settings") ?: return null + if (settings.optString("auth") != "password") return null + val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null + val port = inbound.optInt("port", -1) + val username = user.optString("user") + val password = user.optString("pass") + if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) { + return null + } + return SecureSocksCredentials(port, username, password) + } + return null + } + + private fun scheduleTun2socksRecovery(config: XrayConfig, reason: String) { + if (!isRunning || currentConfig !== config || recoveringTun2socks) return + XrayCoreManager.markRuntimeConnecting(this, config) + recoveringTun2socks = true + val attempt = ++tun2socksRecoveryAttempt + val shift = (attempt - 1).coerceIn(0, 6) + val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L) + Log.w(TAG, "Scheduling tun2socks recovery attempt $attempt in ${delayMs}ms: $reason") + + Thread { + try { + Thread.sleep(delayMs) + } catch (_: InterruptedException) { + recoveringTun2socks = false + return@Thread + } + + recoveringTun2socks = false + if (isRunning && currentConfig === config) { + runTun2socks(config) + } + }.start() + } + + private fun runTun2socks(config: XrayConfig) { + val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath + val socketFile = File(filesDir, "sock_path") + if (socketFile.exists() && !socketFile.delete()) { + Log.w(TAG, "Could not delete stale tun2socks socket") + } + val sockPath = socketFile.absolutePath + + val secure = secureSocksCredentials(config) + ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing") + config.LOCAL_SOCKS5_PORT = secure.port + + val cmd = arrayListOf( + tun2socksPath, + "-sock-path", sockPath, + "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}", + "-mtu", "1500", + "-loglevel", "debug" + ) + + Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5") + + try { + val pb = ProcessBuilder(cmd) + pb.redirectErrorStream(true) + pb.directory(filesDir) + val process = pb.start() + tun2socksProcess = process + + Thread { + try { + process.inputStream.bufferedReader().use { reader -> + reader.forEachLine { _ -> } + } + + process.waitFor() + if (isRunning && tun2socksProcess === process && currentConfig === config) { + Log.e(TAG, "tun2socks exited unexpectedly; keeping TUN fail-closed") + tun2socksProcess = null + scheduleTun2socksRecovery(config, "process exited") + } + } catch (_: java.io.InterruptedIOException) { + // Expected when stopping + } catch (_: InterruptedException) { + // Expected when stopping + } catch (e: Exception) { + Log.e(TAG, "Error reading tun2socks output", e) + } + }.start() + + sendFd(process, config) + + } catch (e: Exception) { + Log.e(TAG, "Failed to start tun2socks; keeping TUN fail-closed", e) + scheduleTun2socksRecovery(config, "start failure") + } + } + + private fun sendFd(process: Process, config: XrayConfig) { + val fd = mInterface?.fileDescriptor ?: return + val sockFile = File(filesDir, "sock_path").absolutePath + + Thread { + var tries = 0 + while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) { + var localSocket: LocalSocket? = null + try { + Thread.sleep(500) + localSocket = LocalSocket() + localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM)) + val out = localSocket.outputStream + localSocket.setFileDescriptorsForSend(arrayOf(fd)) + out.write(32) + out.flush() + localSocket.setFileDescriptorsForSend(null) + localSocket.shutdownOutput() + localSocket.close() + if (isRunning && currentConfig === config && tun2socksProcess === process) { + tun2socksRecoveryAttempt = 0 + XrayCoreManager.markRuntimeReady(this, config) + } + return@Thread + } catch (_: Exception) { + tries++ + try { + localSocket?.close() + } catch (closeError: Exception) { + Log.w(TAG, "Failed to close tun2socks handoff socket", closeError) + } + } + } + + if (isRunning && tun2socksProcess === process) { + Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN") + try { + process.destroy() + } catch (e: Exception) { + Log.w(TAG, "Failed to recycle tun2socks after FD handoff failure", e) + } + } + }.start() + } + + fun handleXrayCoreExit(config: XrayConfig) { + if (!isRunning || currentConfig !== config || recoveringXray) return + XrayCoreManager.markRuntimeConnecting(this, config) + recoveringXray = true + + Thread { + var attempt = 0 + try { + while (isRunning && currentConfig === config) { + attempt++ + val shift = (attempt - 1).coerceIn(0, 6) + val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L) + Log.w(TAG, "Recovering Xray core attempt $attempt in ${delayMs}ms") + Thread.sleep(delayMs) + if (!isRunning || currentConfig !== config) break + + if (XrayCoreManager.startCore(this, config)) { + Log.w(TAG, "Xray core recovered without dropping TUN") + if (currentProxyOnly || (mInterface != null && tun2socksProcess?.isAlive == true)) { + XrayCoreManager.markRuntimeReady(this, config) + } + return@Thread + } + } + } catch (_: InterruptedException) { + // Expected when stopping + } finally { + recoveringXray = false + } + }.start() + } + + private fun cleanup(clearDeadline: Boolean = true) { + isRunning = false + if (clearDeadline) { + clearSessionDeadline() + } else { + deadlineHandler.removeCallbacks(sessionDeadlineRunnable) + sessionDeadlineElapsed = null + sessionDeadlineToken = null + } + recoveringXray = false + recoveringTun2socks = false + tun2socksRecoveryAttempt = 0 + currentProxyOnly = false + AppConfigs.RUNTIME_READY = false + tun2socksProcess?.destroy() + tun2socksProcess = null + try { + mInterface?.close() + mInterface = null + } catch (e: Exception) { + Log.w(TAG, "Failed to close VPN interface during cleanup", e) + } + } + + private fun stopAll(confirmationToken: String = currentConfig?.RUNTIME_TOKEN.orEmpty()) { + if (shuttingDownIntentionally) return + shuttingDownIntentionally = true + cleanup(clearDeadline = true) + currentConfig = null + XrayCoreManager.stopCore(this, confirmationToken) + stopForeground(true) + stopSelf() + } + + private fun armSessionDeadline(config: XrayConfig, remainingSeconds: Long) { + val boundedSeconds = remainingSeconds + .coerceAtLeast(0L) + .coerceAtMost(Long.MAX_VALUE / 1000L) + val delayMs = boundedSeconds * 1000L + val nowEpochMs = System.currentTimeMillis() + val epochDeadline = if (Long.MAX_VALUE - nowEpochMs < delayMs) { + Long.MAX_VALUE + } else { + nowEpochMs + delayMs + } + + sessionDeadlineToken = config.RUNTIME_TOKEN + sessionDeadlineElapsed = SystemClock.elapsedRealtime() + delayMs + + if (!persistDeadline(config.RUNTIME_TOKEN, epochDeadline) || + !scheduleSessionExpiryAlarm(config.RUNTIME_TOKEN, epochDeadline) + ) { + Log.e(TAG, "Could not arm OS-level session expiry; stopping fail-closed") + stopAll(config.RUNTIME_TOKEN) + return + } + + deadlineHandler.removeCallbacks(sessionDeadlineRunnable) + if (delayMs == 0L) deadlineHandler.post(sessionDeadlineRunnable) + else deadlineHandler.postDelayed(sessionDeadlineRunnable, delayMs) + } + + private fun clearSessionDeadline() { + deadlineHandler.removeCallbacks(sessionDeadlineRunnable) + sessionDeadlineElapsed = null + sessionDeadlineToken = null + clearPersistedDeadline() + cancelSessionExpiryAlarm() + } + + private fun enforceSessionDeadline() { + val token = sessionDeadlineToken ?: return + val deadline = sessionDeadlineElapsed ?: return + val config = currentConfig ?: return + if (config.RUNTIME_TOKEN != token) return + val remaining = deadline - SystemClock.elapsedRealtime() + if (remaining > 0L) { + deadlineHandler.postDelayed(sessionDeadlineRunnable, remaining) + return + } + Log.w(TAG, "Native session deadline expired; stopping runtime fail-closed") + stopAll(token) + } + + private fun updateSessionDeadline(intent: Intent) { + val config = currentConfig ?: return + val token = intent.getStringExtra("RUNTIME_TOKEN").orEmpty() + if (token.isEmpty() || token != config.RUNTIME_TOKEN) { + Log.w(TAG, "Ignoring session deadline update for stale runtime generation") + return + } + val remainingSeconds = intent.getLongExtra("REMAINING_SECONDS", -1L) + if (remainingSeconds < 0L) { + Log.w(TAG, "Ignoring invalid negative session deadline") + return + } + armSessionDeadline(config, remainingSeconds) + } + + private fun persistDeadline(runtimeToken: String, expiresAtEpochMs: Long): Boolean { + return try { + getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE) + .edit() + .putString(PREF_RUNTIME_TOKEN, runtimeToken) + .putLong(PREF_EXPIRES_AT_MS, expiresAtEpochMs) + .commit() + } catch (e: Exception) { + Log.e(TAG, "Failed to persist non-secret session deadline", e) + false + } + } + + private fun clearPersistedDeadline() { + try { + getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE) + .edit() + .remove(PREF_RUNTIME_TOKEN) + .remove(PREF_EXPIRES_AT_MS) + .apply() + } catch (e: Exception) { + Log.w(TAG, "Failed to clear persisted session deadline", e) + } + } + + private fun enforcePersistedDeadline(alarmToken: String) { + val stored = try { + val prefs = getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE) + prefs.getString(PREF_RUNTIME_TOKEN, null).orEmpty() to + prefs.getLong(PREF_EXPIRES_AT_MS, 0L) + } catch (e: Exception) { + Log.e(TAG, "Failed to read persisted session deadline", e) + clearPersistedDeadline() + cancelSessionExpiryAlarm() + stopSelf() + return + } + + val storedToken = stored.first + val storedDeadline = stored.second + if (alarmToken.isEmpty() || storedToken.isEmpty() || alarmToken != storedToken) { + Log.w(TAG, "Ignoring stale session-expiry alarm") + if (currentConfig == null) stopSelf() + return + } + + val remaining = storedDeadline - System.currentTimeMillis() + if (storedDeadline > 0L && remaining > 0L) { + if (!scheduleSessionExpiryAlarm(storedToken, storedDeadline)) { + Log.e(TAG, "Failed to re-arm early session-expiry alarm") + val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty() + if (activeToken == storedToken) stopAll(storedToken) else stopSelf() + return + } + // An alarm can wake a fresh service process after clock changes. + // If there is no live runtime in this process, do not leave a + // background service instance hanging around just to hold a timer. + if (currentConfig == null) stopSelf() + return + } + + Log.w(TAG, "OS session-expiry alarm fired; stopping runtime fail-closed") + val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty() + if (activeToken.isNotEmpty() && activeToken == storedToken) { + stopAll(storedToken) + } else { + clearPersistedDeadline() + cancelSessionExpiryAlarm() + stopForeground(true) + stopSelf() + } + } + + private fun scheduleSessionExpiryAlarm(runtimeToken: String, expiresAtEpochMs: Long): Boolean { + cancelSessionExpiryAlarm() + if (runtimeToken.isEmpty() || expiresAtEpochMs <= 0L) return false + + return try { + val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager + val pendingIntent = sessionExpiryPendingIntent(runtimeToken) + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) { + try { + alarmManager.setExactAndAllowWhileIdle( + AlarmManager.RTC_WAKEUP, + expiresAtEpochMs, + pendingIntent, + ) + } catch (_: SecurityException) { + Log.w(TAG, "Exact alarm unavailable; using inexact idle-capable expiry alarm") + alarmManager.setAndAllowWhileIdle( + AlarmManager.RTC_WAKEUP, + expiresAtEpochMs, + pendingIntent, + ) + } + } else { + alarmManager.setExact(AlarmManager.RTC_WAKEUP, expiresAtEpochMs, pendingIntent) + } + true + } catch (e: Exception) { + Log.e(TAG, "Failed to schedule OS session-expiry alarm", e) + false + } + } + + private fun cancelSessionExpiryAlarm() { + try { + val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager + alarmManager.cancel(sessionExpiryPendingIntent("")) + } catch (e: Exception) { + Log.w(TAG, "Failed to cancel session-expiry alarm", e) + } + } + + private fun sessionExpiryPendingIntent(runtimeToken: String): PendingIntent { + val intent = Intent(this, XrayVPNService::class.java) + .putExtra(EXTRA_SESSION_EXPIRED, true) + .putExtra("RUNTIME_TOKEN", runtimeToken) + val flags = PendingIntent.FLAG_UPDATE_CURRENT or + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0 + return PendingIntent.getService(this, SESSION_EXPIRY_REQUEST_CODE, intent, flags) + } + + override fun onDestroy() { + if (!shuttingDownIntentionally) { + val confirmationToken = currentConfig?.RUNTIME_TOKEN.orEmpty() + cleanup(clearDeadline = false) + currentConfig = null + XrayCoreManager.stopCore(this, confirmationToken) + stopForeground(true) + } + super.onDestroy() + } + + override fun onRevoke() { + stopAll() + super.onRevoke() + } + + private fun createNotificationChannel() { + if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { + val channelId = "REVOLT_VPN_SERVICE" + val channelName = "VPN Service" + val channel = android.app.NotificationChannel( + channelId, + channelName, + android.app.NotificationManager.IMPORTANCE_LOW + ) + val manager = getSystemService(android.app.NotificationManager::class.java) + manager?.createNotificationChannel(channel) + } + } + + private fun createNotification(content: String): android.app.Notification { + val channelId = "REVOLT_VPN_SERVICE" + val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { + android.app.Notification.Builder(this, channelId) + } else { + @Suppress("DEPRECATION") + android.app.Notification.Builder(this) + } + + val icon = android.R.drawable.ic_dialog_info + + val notification = builder + .setContentTitle("VPN Service") + .setContentText(content) + .setSmallIcon(icon) + .setOngoing(true) + .setAutoCancel(false) + .setOnlyAlertOnce(true) + .build() + + notification.flags = notification.flags or + android.app.Notification.FLAG_ONGOING_EVENT or + android.app.Notification.FLAG_NO_CLEAR + return notification + } + + companion object { + private const val TAG = "XrayVPNService" + private const val FOREGROUND_SERVICE_TYPE_SPECIAL_USE = 0x40000000 + private const val BOOTSTRAP_SESSION_SECONDS = 120L + private const val DEADLINE_PREFS = "revolt_session_deadline" + private const val PREF_RUNTIME_TOKEN = "runtime_token" + private const val PREF_EXPIRES_AT_MS = "expires_at_ms" + private const val EXTRA_SESSION_EXPIRED = "SESSION_EXPIRED" + private const val SESSION_EXPIRY_REQUEST_CODE = 1001 + } +} diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/AppConfigs.kt b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/AppConfigs.kt new file mode 100644 index 0000000..04bbc0b --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/AppConfigs.kt @@ -0,0 +1,49 @@ +package com.github.tfox.flutter_vless.xray.utils + +import com.github.tfox.flutter_vless.xray.dto.XrayConfig +import java.io.Serializable + +/** + * Global application configuration and state. + * + * This object holds: + * 1. Constants for Intent actions and Service commands. + * 2. Enums for connection states and modes. + * 3. Global state variables (current connection state, active config). + * 4. Static storage for notification icon resources (passed from Flutter). + */ +object AppConfigs { + const val V2RAY_CONNECTION_INFO = "com.github.tfox.flutter_vless.xray.V2RAY_CONNECTION_INFO" + + /** + * Commands sent to the XrayVPNService via Intent. + */ + enum class V2RAY_SERVICE_COMMANDS : Serializable { + START_SERVICE, STOP_SERVICE, RESTART_SERVICE, UPDATE_SESSION_DEADLINE + } + + /** + * Connection states for the Xray Core. + */ + enum class V2RAY_STATES : Serializable { + V2RAY_CONNECTED, V2RAY_DISCONNECTED, V2RAY_CONNECTING + } + + /** + * Connection modes: + * - VPN_TUN: Standard VPN mode using Android VpnService (TUN device). + * - PROXY_ONLY: Runs Xray as a local SOCKS/HTTP proxy without establishing a VPN tunnel. + */ + enum class V2RAY_CONNECTION_MODES : Serializable { + VPN_TUN, PROXY_ONLY + } + + var V2RAY_STATE: V2RAY_STATES = V2RAY_STATES.V2RAY_DISCONNECTED + @Volatile var RUNTIME_READY: Boolean = false + var V2RAY_CONFIG: XrayConfig? = null + var V2RAY_CONNECTION_MODE: V2RAY_CONNECTION_MODES = V2RAY_CONNECTION_MODES.VPN_TUN + + // Stores the resource name and type for the custom notification icon + var NOTIFICATION_ICON_RESOURCE_NAME: String = "" + var NOTIFICATION_ICON_RESOURCE_TYPE: String = "" +} diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/Utilities.kt b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/Utilities.kt new file mode 100644 index 0000000..d2b9576 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless/xray/utils/Utilities.kt @@ -0,0 +1,62 @@ +package com.github.tfox.flutter_vless.xray.utils + +import android.content.Context +import java.io.File +import java.io.FileOutputStream +import java.io.IOException +import java.io.InputStream +import java.io.OutputStream + +object Utilities { + + fun getUserAssetsPath(context: Context): String { + val dir = context.filesDir + if (!dir.exists()) { + dir.mkdirs() + } + return dir.absolutePath + } + + fun copyAssets(context: Context) { + val assets = context.assets + val files = assets.list("") ?: return + for (filename in files) { + if (filename == "geoip.dat" || filename == "geosite.dat") { + var `in`: InputStream? = null + var out: OutputStream? = null + try { + `in` = assets.open(filename) + val outFile = File(getUserAssetsPath(context), filename) + out = FileOutputStream(outFile) + copyFile(`in`, out) + } catch (e: IOException) { + e.printStackTrace() + } finally { + if (`in` != null) { + try { + `in`.close() + } catch (e: IOException) { + e.printStackTrace() + } + } + if (out != null) { + try { + out.close() + } catch (e: IOException) { + e.printStackTrace() + } + } + } + } + } + } + + @Throws(IOException::class) + private fun copyFile(`in`: InputStream, out: OutputStream) { + val buffer = ByteArray(1024) + var read: Int + while (`in`.read(buffer).also { read = it } != -1) { + out.write(buffer, 0, read) + } + } +} diff --git a/local_packages/flutter_vless_android-1.1.5/android/src/test/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManagerTest.kt b/local_packages/flutter_vless_android-1.1.5/android/src/test/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManagerTest.kt new file mode 100644 index 0000000..8e11f40 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/android/src/test/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManagerTest.kt @@ -0,0 +1,309 @@ +package com.github.tfox.flutter_vless.xray.core + +import com.github.tfox.flutter_vless.xray.dto.XrayConfig +import java.io.File +import org.json.JSONArray +import org.json.JSONObject +import org.junit.Assert.assertEquals +import org.junit.Assert.assertFalse +import org.junit.Assert.assertNotNull +import org.junit.Assert.assertTrue +import org.junit.Test + +class XrayCoreManagerTest { + @Test + fun buildRuntimeConfigJson_normalizesFlatVlessAndKeepsEncryption() { + val filesDir = File("build/test-files/android-normalize") + val config = XrayConfig( + V2RAY_FULL_JSON_CONFIG = """ + { + "log": { + "access": "/Users/dev/Desktop/access.log", + "error": "/Users/dev/Desktop/error.log" + }, + "inbounds": [], + "outbounds": [ + { + "tag": "proxy", + "protocol": "vless", + "settings": { + "address": "xhttp.example.com", + "port": 2043, + "id": "b94da146-a56e-49d7-af4c-a68c9065cbfd", + "encryption": "$vlessEncryption", + "flow": "xtls-rprx-vision", + "level": 8 + }, + "streamSettings": { + "network": "xhttp", + "security": "none" + } + } + ], + "routing": { "rules": [] } + } + """.trimIndent() + ) + + val output = XrayCoreManager.buildRuntimeConfigJson(config, filesDir) + val user = output + .getJSONArray("outbounds") + .getJSONObject(0) + .getJSONObject("settings") + .getJSONArray("vnext") + .getJSONObject(0) + .getJSONArray("users") + .getJSONObject(0) + val log = output.getJSONObject("log") + + assertEquals(vlessEncryption, user.getString("encryption")) + assertEquals("xtls-rprx-vision", user.getString("flow")) + assertEquals(File(filesDir, "access.log").absolutePath, log.getString("access")) + assertEquals(File(filesDir, "error.log").absolutePath, log.getString("error")) + assertTrue(output.has("api")) + assertTrue(output.has("stats")) + assertTrue(output.getJSONObject("policy").getJSONObject("system").getBoolean("statsOutboundDownlink")) + } + + @Test + fun buildRuntimeConfigJson_injectsUniqueInboundsAndApiRouteOnPortConflicts() { + val config = XrayConfig( + LOCAL_SOCKS5_PORT = 10807, + LOCAL_HTTP_PORT = 10808, + LOCAL_API_PORT = 10809, + V2RAY_FULL_JSON_CONFIG = """ + { + "inbounds": [ + { "tag": "socks", "protocol": "dokodemo-door", "port": 10807 }, + { "tag": "http", "protocol": "dokodemo-door", "port": 10808 }, + { "tag": "api", "protocol": "dokodemo-door", "port": 10809 } + ], + "outbounds": [ + { + "tag": "proxy", + "protocol": "shadowsocks", + "settings": { + "servers": [ + { + "address": "ss.example.com", + "port": 8388, + "method": "2022-blake3-aes-128-gcm", + "password": "secret" + } + ] + } + } + ] + } + """.trimIndent() + ) + + val output = XrayCoreManager.buildRuntimeConfigJson(config, File("build/test-files/android-conflicts")) + val inbounds = output.getJSONArray("inbounds") + val socks = findInbound(inbounds, "socks_1") + val http = findInbound(inbounds, "http_1") + val api = findInbound(inbounds, "api_1") + val routingRules = output.getJSONObject("routing").getJSONArray("rules") + val apiRule = routingRules.getJSONObject(routingRules.length() - 1) + + assertEquals(10810, config.LOCAL_SOCKS5_PORT) + assertEquals(10811, config.LOCAL_HTTP_PORT) + assertEquals(10812, config.LOCAL_API_PORT) + assertEquals("socks", socks.getString("protocol")) + assertEquals(10810, socks.getInt("port")) + assertEquals("http", http.getString("protocol")) + assertEquals(10811, http.getInt("port")) + assertEquals("dokodemo-door", api.getString("protocol")) + assertEquals(10812, api.getInt("port")) + assertEquals("api", apiRule.getString("outboundTag")) + assertEquals("api_1", apiRule.getJSONArray("inboundTag").getString(0)) + } + + @Test + fun buildRuntimeConfigJson_doesNotDuplicateExistingLocalSocksAndHttpInbounds() { + val config = XrayConfig( + LOCAL_SOCKS5_PORT = 10807, + LOCAL_HTTP_PORT = 10808, + V2RAY_FULL_JSON_CONFIG = """ + { + "inbounds": [ + { "tag": "socks", "protocol": "socks", "port": 10807 }, + { "tag": "http", "protocol": "http", "port": 10808 } + ], + "outbounds": [ + { + "tag": "proxy", + "protocol": "freedom" + } + ] + } + """.trimIndent() + ) + + val output = XrayCoreManager.buildRuntimeConfigJson(config, File("build/test-files/android-existing")) + val inbounds = output.getJSONArray("inbounds") + + assertEquals(3, inbounds.length()) + assertEquals(1, countInboundsByProtocol(inbounds, "socks")) + assertEquals(1, countInboundsByProtocol(inbounds, "http")) + assertFalse(output.toString().contains("socks_1")) + assertFalse(output.toString().contains("http_1")) + } + + @Test + fun buildDelayConfigJson_reusesRuntimeNormalizationForHappJson() { + val (output, socksPort) = XrayCoreManager.buildDelayConfigJson( + """ + { + "dns": { "queryStrategy": "UseIPv4" }, + "log": { + "access": "/Users/dev/Library/access.log", + "error": "/Users/dev/Library/error.log" + }, + "inbounds": [ + { "tag": "socks-in", "protocol": "socks", "port": 10808 } + ], + "outbounds": [ + { + "tag": "proxy", + "protocol": "vless", + "settings": { + "vnext": [ + { + "address": "reality.example.com", + "port": 443, + "users": [ + { + "id": "b94da146-a56e-49d7-af4c-a68c9065cbfd", + "encryption": "none", + "flow": "xtls-rprx-vision" + } + ] + } + ] + }, + "streamSettings": { + "network": "tcp", + "security": "reality" + } + } + ] + } + """.trimIndent(), + proxyPort = 19080, + filesDir = File("build/test-files/android-delay") + ) + val inbounds = output.getJSONArray("inbounds") + val delaySocks = findInbound(inbounds, "socks") + val user = output + .getJSONArray("outbounds") + .getJSONObject(0) + .getJSONObject("settings") + .getJSONArray("vnext") + .getJSONObject(0) + .getJSONArray("users") + .getJSONObject(0) + + assertEquals(19080, socksPort) + assertEquals(19080, delaySocks.getInt("port")) + assertEquals("none", user.getString("encryption")) + assertEquals("xtls-rprx-vision", user.getString("flow")) + assertTrue(output.getJSONObject("log").getString("access").endsWith("access.log")) + assertTrue(output.has("api")) + } + + @Test + fun buildRuntimeConfigJson_normalizesXray26RuntimeAliases() { + val filesDir = File("build/test-files/android-aliases") + val config = XrayConfig( + V2RAY_FULL_JSON_CONFIG = """ + { + "log": { + "access": "/Users/example/access.log", + "error": "/Users/example/error.log" + }, + "inbounds": [], + "outbounds": [ + { + "protocol": "vless", + "settings": { + "vnext": [ + { + "address": "example.com", + "port": 443, + "users": [ + { + "id": "11111111-1111-4111-8111-111111111111", + "encryption": "none" + } + ] + } + ] + }, + "streamSettings": { + "network": "XHTTP", + "security": "tls", + "tlsSettings": { + "allowInsecure": false, + "serverName": "example.com" + }, + "xHTTPSettings": { + "path": "/", + "mode": "auto" + }, + "httpUpgradeSettings": { + "path": "/upgrade" + }, + "splitHTTPSettings": { + "path": "/split" + } + } + } + ] + } + """.trimIndent() + ) + + val runtime = XrayCoreManager.buildRuntimeConfigJson(config, filesDir) + val stream = runtime + .getJSONArray("outbounds") + .getJSONObject(0) + .getJSONObject("streamSettings") + + assertEquals("xhttp", stream.getString("network")) + assertNotNull(stream.optJSONObject("xhttpSettings")) + assertNotNull(stream.optJSONObject("httpupgradeSettings")) + assertNotNull(stream.optJSONObject("splithttpSettings")) + assertFalse(stream.has("xHTTPSettings")) + assertFalse(stream.has("httpUpgradeSettings")) + assertFalse(stream.has("splitHTTPSettings")) + assertFalse(stream.getJSONObject("tlsSettings").has("allowInsecure")) + assertEquals(File(filesDir, "access.log").absolutePath, runtime.getJSONObject("log").getString("access")) + assertEquals(File(filesDir, "error.log").absolutePath, runtime.getJSONObject("log").getString("error")) + } + + private fun findInbound(inbounds: JSONArray, tag: String): JSONObject { + for (i in 0 until inbounds.length()) { + val inbound = inbounds.getJSONObject(i) + if (inbound.optString("tag") == tag) { + return inbound + } + } + error("Inbound $tag not found in $inbounds") + } + + private fun countInboundsByProtocol(inbounds: JSONArray, protocol: String): Int { + var count = 0 + for (i in 0 until inbounds.length()) { + if (inbounds.getJSONObject(i).optString("protocol") == protocol) { + count++ + } + } + return count + } + + private companion object { + const val vlessEncryption = + "mlkem768x25519plus.native.1rtt.100-500-2000.75-0-100.80-0-5000.gtmOXB2AN_r905czmOIr6dKq_YDdEJB8RWGqfsXurns" + } +} diff --git a/local_packages/flutter_vless_android-1.1.5/lib/flutter_vless_android.dart b/local_packages/flutter_vless_android-1.1.5/lib/flutter_vless_android.dart new file mode 100644 index 0000000..8e30737 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/lib/flutter_vless_android.dart @@ -0,0 +1,13 @@ +// Copyright (c) 2024-2026 13FOX Studio / tfox.dev. +// SPDX-License-Identifier: MIT + +import 'package:flutter_vless_platform_interface/flutter_vless_platform_interface.dart'; + +/// Android implementation of [VlessPlatform] using MethodChannel. +class FlutterVlessAndroid extends VlessMethodChannelAdapter { + /// Registers this class as the platform implementation. + /// This is called automatically by Flutter's plugin registry. + static void registerWith() { + VlessPlatform.instance = FlutterVlessAndroid(); + } +} diff --git a/local_packages/flutter_vless_android-1.1.5/pubspec.yaml b/local_packages/flutter_vless_android-1.1.5/pubspec.yaml new file mode 100644 index 0000000..abd0c63 --- /dev/null +++ b/local_packages/flutter_vless_android-1.1.5/pubspec.yaml @@ -0,0 +1,31 @@ +name: flutter_vless_android +description: Android implementation of the flutter_vless plugin. +version: 1.1.5 +homepage: https://tfox.dev +repository: https://github.com/XIIIFOX/flutter_vless +issue_tracker: https://github.com/XIIIFOX/flutter_vless/issues +documentation: https://github.com/XIIIFOX/flutter_vless/blob/main/doc/platform/android.md +funding: + - https://tfox.dev + +environment: + sdk: '>=3.4.0 <4.0.0' + flutter: '>=3.3.0' + +dependencies: + flutter: + sdk: flutter + flutter_vless_platform_interface: ^1.1.0 + +dev_dependencies: + flutter_test: + sdk: flutter + flutter_lints: ^6.0.0 + +flutter: + plugin: + implements: flutter_vless_platform_interface + platforms: + android: + package: com.github.tfox.flutter_vless + pluginClass: FlutterVlessPlugin diff --git a/pubspec.lock b/pubspec.lock index 1369a33..2af4fa8 100644 --- a/pubspec.lock +++ b/pubspec.lock @@ -65,14 +65,6 @@ packages: url: "https://pub.dev" source: hosted version: "3.0.7" - cupertino_icons: - dependency: "direct main" - description: - name: cupertino_icons - sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd" - url: "https://pub.dev" - source: hosted - version: "1.0.9" fake_async: dependency: transitive description: @@ -180,12 +172,11 @@ packages: source: hosted version: "1.1.5" flutter_vless_android: - dependency: transitive + dependency: "direct overridden" description: - name: flutter_vless_android - sha256: "5e6fe73d3606ed8c73e87fac15efa7631e12ce18d39a4bd4e13b6c097c6d52b9" - url: "https://pub.dev" - source: hosted + path: "local_packages/flutter_vless_android-1.1.5" + relative: true + source: path version: "1.1.5" flutter_vless_macos: dependency: transitive @@ -216,14 +207,6 @@ packages: description: flutter source: sdk version: "0.0.0" - google_fonts: - dependency: "direct main" - description: - name: google_fonts - sha256: ba03d03bcaa2f6cb7bd920e3b5027181db75ab524f8891c8bc3aa603885b8055 - url: "https://pub.dev" - source: hosted - version: "6.3.3" google_mobile_ads: dependency: "direct main" description: @@ -316,10 +299,10 @@ packages: dependency: transitive description: name: matcher - sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861 + sha256: "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd" url: "https://pub.dev" source: hosted - version: "0.12.19" + version: "0.12.20" material_color_utilities: dependency: transitive description: @@ -332,10 +315,10 @@ packages: dependency: transitive description: name: meta - sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349" + sha256: "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9" url: "https://pub.dev" source: hosted - version: "1.18.0" + version: "1.19.0" nested: dependency: transitive description: @@ -385,7 +368,7 @@ packages: source: hosted version: "1.9.1" path_provider: - dependency: "direct main" + dependency: transitive description: name: path_provider sha256: "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd" @@ -577,10 +560,10 @@ packages: dependency: transitive description: name: test_api - sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e" + sha256: "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11" url: "https://pub.dev" source: hosted - version: "0.7.11" + version: "0.7.12" typed_data: dependency: transitive description: @@ -665,10 +648,10 @@ packages: dependency: transitive description: name: vector_math - sha256: d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b + sha256: f36f9f3be64c6198714492bb455c11056e33e2f85d9a0b676a48301e44fdcf47 url: "https://pub.dev" source: hosted - version: "2.2.0" + version: "2.4.2" vm_service: dependency: transitive description: @@ -742,5 +725,5 @@ packages: source: hosted version: "3.1.3" sdks: - dart: ">=3.10.3 <4.0.0" + dart: ">=3.11.0-0 <4.0.0" flutter: ">=3.38.4" diff --git a/pubspec.yaml b/pubspec.yaml index 4308f0d..eb335df 100644 --- a/pubspec.yaml +++ b/pubspec.yaml @@ -1,21 +1,9 @@ name: revoltvpn description: ReVolt VPN — Secure VLESS tunnel for Android -# The following line prevents the package from being accidentally published to -# pub.dev using `pub publish`. This is preferred for private packages. -publish_to: "none" # Remove this line if you wish to publish to pub.dev +publish_to: "none" -# The following defines the version and build number for your application. -# A version number is three numbers separated by dots, like 1.2.43 -# followed by an optional build number separated by a +. -# Both the version and the builder number may be overridden in flutter -# build by specifying --build-name and --build-number, respectively. -# In Android, build-name is used as versionName while build-number used as versionCode. -# Read more about Android versioning at https://developer.android.com/studio/publish/versioning -# In iOS, build-name is used as CFBundleShortVersionString while build-number used as CFBundleVersion. -# Read more about iOS versioning at -# https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html -version: 3.3.4+30 +version: 3.3.5+31 environment: sdk: ">=3.0.0 <4.0.0" @@ -24,10 +12,6 @@ dependencies: flutter: sdk: flutter - # The following adds the Cupertino Icons font to your application. - # Use with the CupertinoIcons class for iOS style icons. - cupertino_icons: ^1.0.5 - google_fonts: ^6.1.0 provider: ^6.1.1 google_mobile_ads: ^4.0.0 flutter_vless: 1.1.5 @@ -36,7 +20,6 @@ dependencies: url_launcher: ^6.3.2 flutter_secure_storage: ^10.3.1 uuid: ^4.5.3 - path_provider: ^2.1.5 package_info_plus: ^6.0.0 dev_dependencies: @@ -44,42 +27,13 @@ dev_dependencies: sdk: flutter flutter_lints: ^3.0.0 -# For information on the generic Dart part of this file, see the -# following page: https://dart.dev/tools/pub/pubspec - -# The following section is specific to Flutter. flutter: - # The following line ensures that the Material Icons font is - # included with your application, so that you can use the icons in - # the material Icons class. uses-material-design: true - - # To add assets to your application, add an assets section, like this: assets: - - assets/ + - assets/background.png + - assets/brand.png + - assets/finland_flag_256.png - # An image asset can refer to one or more resolution-specific "variants", see - # https://flutter.dev/assets-and-images/#resolution-aware. - - # For details regarding adding assets from package dependencies, see - # https://flutter.dev/assets-and-images/#from-packages - - # To add custom fonts to your application, add a fonts section here, - # in this "flutter" section. Each entry in this list should have a - # "family" key with the font family name, and a "fonts" key with a - # list giving the asset and other descriptors for the font. For - # example: - # fonts: - # - family: Schyler - # fonts: - # - asset: fonts/Schyler-Regular.ttf - # - asset: fonts/Schyler-Italic.ttf - # style: italic - # - family: Trajan Pro - # fonts: - # - asset: fonts/TrajanPro.ttf - # - asset: fonts/TrajanPro_Bold.ttf - # weight: 700 - # - # For details regarding fonts from package dependencies, - # see https://flutter.dev/custom-fonts/#from-packages +dependency_overrides: + flutter_vless_android: + path: local_packages/flutter_vless_android-1.1.5 diff --git a/test/native_runtime_state_regression_test.dart b/test/native_runtime_state_regression_test.dart new file mode 100644 index 0000000..90b6a59 --- /dev/null +++ b/test/native_runtime_state_regression_test.dart @@ -0,0 +1,98 @@ +import 'dart:io'; +import 'package:flutter_test/flutter_test.dart'; + +void main() { + test('native runtime is generation-scoped, readiness-gated and deadline-bound', () { + const root = 'local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless'; + final plugin = File('$root/FlutterVlessPlugin.kt').readAsStringSync(); + final config = File('$root/xray/dto/XrayConfig.kt').readAsStringSync(); + final service = File('$root/xray/service/XrayVPNService.kt').readAsStringSync(); + final core = File('$root/xray/core/XrayCoreManager.kt').readAsStringSync(); + final timer = File('lib/logic/session_timer.dart').readAsStringSync(); + final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync(); + final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync(); + final main = File('lib/main.dart').readAsStringSync(); + final mainActivity = File( + 'android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt', + ).readAsStringSync(); + final support = File('lib/components/support_button.dart').readAsStringSync(); + final connectionSettings = + File('lib/logic/connection_settings.dart').readAsStringSync(); + + expect(config, contains('var RUNTIME_TOKEN: String = ""')); + expect(plugin, contains('expectedRuntimeToken')); + expect(plugin, contains('runtimeToken != currentToken')); + expect(plugin, contains('runtimeReady')); + expect(plugin, contains('STOP_TIMEOUT')); + expect(plugin, contains('setSessionDeadline')); + expect(plugin, contains('result.error("NO_ACTIVITY"')); + expect(plugin, isNot(contains('activity!!'))); + + expect(plugin, contains('if (token == null) {')); + expect(plugin, contains('intent.putExtra("RUNTIME_TOKEN", token)')); + expect( + plugin, + isNot(contains('if (token != null) intent.putExtra("RUNTIME_TOKEN", token)')), + ); + expect(plugin, isNot(contains('"getServerDelay" ->'))); + expect(plugin, isNot(contains('"getConnectedServerDelay" ->'))); + + expect( + service, + contains('val requestedToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()'), + ); + expect(service, contains('requestedToken.isEmpty() ||')); + expect(service, contains('requestedToken != activeToken')); + expect(service, contains('stopAll(requestedToken)')); + + expect(hivemind, contains('..followRedirects = false;')); + + expect(plugin, contains('failPendingPermission("ENGINE_DETACHED"')); + expect(plugin, contains('failPendingPermission("NO_ACTIVITY"')); + + expect(service, contains('BOOTSTRAP_SESSION_SECONDS = 120L')); + expect(service, contains('UPDATE_SESSION_DEADLINE')); + expect(service, contains('SystemClock.elapsedRealtime()')); + expect(service, contains('AlarmManager.RTC_WAKEUP')); + expect(service, contains('setExactAndAllowWhileIdle')); + expect(service, contains('setAndAllowWhileIdle')); + expect(service, contains('PREF_EXPIRES_AT_MS')); + expect(service, contains('PREF_RUNTIME_TOKEN')); + expect(service, contains('markRuntimeReady(this, config)')); + expect(service, contains('if (currentConfig == null) stopSelf()')); + expect(service, isNot(contains('sessionDeadlineEpochMs'))); + expect(service, isNot(contains('active_session.bin'))); + expect(service, isNot(contains('ObjectOutputStream'))); + + expect(core, contains('AppConfigs.RUNTIME_READY = false')); + expect(core, contains('fun markRuntimeReady')); + expect(timer, contains('setNativeSessionDeadline(_remainingAtLastSync)')); + expect(timer, contains('Future.microtask(_onVpnConnectionChanged)')); + expect(timer, contains('Completer? _syncCompletion')); + expect(timer, contains('await active.future;')); + expect(timer, contains('_sessionEpoch++;')); + expect(timer, contains('_supportStateEpoch++;')); + expect(timer, contains('_isDisconnecting = true;')); + + expect(vpn, contains('bool _disposed = false;')); + expect(vpn, contains('if (_disposed) return;')); + expect(vpn, contains('_connectEpoch++;')); + expect(vpn, contains('HivemindService.cancel();')); + + expect(main, contains('ChangeNotifierProxyProvider(')); + expect(main, contains('lazy: false')); + expect(support, contains('await timer.syncNow();')); + expect(vpn, contains("MethodChannel('flutter_vless')")); + + expect(mainActivity, contains('manager.activeNotifications')); + expect(mainActivity, contains('serviceStopAction')); + expect(mainActivity, isNot(contains('V2RAY_SERVICE_COMMANDS.STOP_SERVICE'))); + expect(mainActivity, isNot(contains('XrayVPNService::class.java'))); + + expect( + connectionSettings, + contains('storedMode == ConnectionMode.proxy.name'), + ); + expect(connectionSettings, isNot(contains("storedMode == 'ass'"))); + }); +} diff --git a/test/runtime_boundary_regression_test.dart b/test/runtime_boundary_regression_test.dart new file mode 100644 index 0000000..804e1fa --- /dev/null +++ b/test/runtime_boundary_regression_test.dart @@ -0,0 +1,58 @@ +import 'dart:io'; + +import 'package:flutter_test/flutter_test.dart'; + +void main() { + test('notification updates do not trust ActivityManager process visibility', () { + final source = File( + 'android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt', + ).readAsStringSync(); + + expect(source, isNot(contains('ActivityManager'))); + expect(source, isNot(contains('isVpnServiceProcessAlive'))); + expect(source, isNot(contains('VPN_PROCESS_SUFFIX'))); + expect(source, contains('NotificationManagerCompat.from(this).notify')); + }); + + test('SOCKS reads use one total deadline instead of per-chunk timeout', () { + final source = File('lib/logic/local_socks_tester.dart').readAsStringSync(); + + expect( + source, + contains('timeout.inMicroseconds - elapsed.elapsedMicroseconds'), + ); + expect( + source, + contains("throw TimeoutException('Socket read timed out', timeout);"), + ); + }); + + test('Hivemind captures cancellation generation before first async lookup', () { + final source = File('lib/logic/hivemind_service.dart').readAsStringSync(); + final callIdIndex = source.indexOf('final callId = ++_currentCallId;'); + final deviceIdIndex = + source.indexOf('final deviceId = await CryptoService.getDeviceId();'); + + expect(callIdIndex, greaterThanOrEqualTo(0)); + expect(deviceIdIndex, greaterThan(callIdIndex)); + expect( + source.substring(deviceIdIndex), + contains('_throwIfCancelled(callId);'), + ); + expect( + source, + contains('_currentCallId++;\n _expectedNonce = null;'), + ); + }); + + test('notification text is cached only after native update succeeds', () { + final source = + File('lib/logic/notification_service.dart').readAsStringSync(); + final invokeIndex = + source.indexOf("await _channel.invokeMethod('updateNotificationText'"); + final cacheIndex = source.indexOf('_lastText = text;'); + + expect(invokeIndex, greaterThanOrEqualTo(0)); + expect(cacheIndex, greaterThan(invokeIndex)); + }); +} diff --git a/test/security_regression_test.dart b/test/security_regression_test.dart new file mode 100644 index 0000000..1a43145 --- /dev/null +++ b/test/security_regression_test.dart @@ -0,0 +1,230 @@ +import 'dart:convert'; +import 'dart:io'; + +import 'package:flutter_test/flutter_test.dart'; +import 'package:revoltvpn/logic/secure_socks_session.dart'; + +void main() { + test('secure SOCKS session owns the entire inbound surface', () async { + final session = await SecureSocksSession.create(jsonEncode({ + 'inbounds': [ + { + 'tag': 'remote-listener', + 'listen': '0.0.0.0', + 'port': 9999, + 'protocol': 'dokodemo-door', + }, + { + 'tag': 'old-http', + 'listen': '127.0.0.1', + 'port': 8080, + 'protocol': 'http', + }, + ], + 'outbounds': [ + {'tag': 'proxy', 'protocol': 'freedom'} + ], + })); + + final decoded = jsonDecode(session.configJson) as Map; + final inbounds = decoded['inbounds'] as List; + expect(inbounds, hasLength(1)); + + final inbound = inbounds.single as Map; + expect(inbound['tag'], SecureSocksSession.inboundTag); + expect(inbound['listen'], '127.0.0.1'); + expect(inbound['protocol'], 'socks'); + expect(inbound['port'], session.port); + + final settings = inbound['settings'] as Map; + expect(settings['auth'], 'password'); + final users = settings['users'] as List; + expect(users, hasLength(1)); + final account = users.single as Map; + expect(account['user'], session.username); + expect(account['pass'], session.password); + }); + + test('vendored native source keeps full-tunnel and private IPC invariants', () { + const root = + 'local_packages/flutter_vless_android-1.1.5/android/src/main'; + final service = File( + '$root/kotlin/com/github/tfox/flutter_vless/xray/service/XrayVPNService.kt', + ).readAsStringSync(); + final core = File( + '$root/kotlin/com/github/tfox/flutter_vless/xray/core/XrayCoreManager.kt', + ).readAsStringSync(); + final plugin = File( + '$root/kotlin/com/github/tfox/flutter_vless/FlutterVlessPlugin.kt', + ).readAsStringSync(); + final manifest = File('$root/AndroidManifest.xml').readAsStringSync(); + + expect(service, contains('builder.addRoute("0.0.0.0", 0)')); + expect(service, contains('builder.addRoute("::", 0)')); + expect(service, contains('Android refused to establish VPN interface')); + expect(service, contains('Per-app VPN bypass is disabled in ReVolt')); + expect(service, contains('Failed to configure VPN DNS')); + expect(service, contains('reader.forEachLine { _ -> }')); + + expect(plugin, contains('ContextCompat.RECEIVER_NOT_EXPORTED')); + expect(core, contains('.setPackage(context.packageName)')); + expect(core, contains('REVOLT_VPN_SERVICE')); + expect(core, contains('NotificationManager.IMPORTANCE_LOW')); + expect(core, contains('deleteEphemeralConfigOnFailure')); + expect(core, contains('reader.forEachLine { _ -> }')); + + expect(manifest, contains('android:exported="false"')); + expect(manifest, contains('android:permission="android.permission.BIND_VPN_SERVICE"')); + expect(manifest, contains('android.net.VpnService.SUPPORTS_ALWAYS_ON')); + expect(manifest, contains('android:value="false"')); + expect(manifest, isNot(contains('android.permission.CHANGE_NETWORK_STATE'))); + expect(manifest, isNot(contains('android.permission.READ_EXTERNAL_STORAGE'))); + }); + + test('native app bridge keeps runtime adoption on private heartbeat only', () { + final source = File( + 'android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt', + ).readAsStringSync(); + final vpnSource = File('lib/logic/vpn_connection.dart').readAsStringSync(); + final powerSource = File('lib/logic/power_settings.dart').readAsStringSync(); + + expect(source, isNot(contains('openVpnSettings'))); + expect(source, isNot(contains('ACTION_VPN_SETTINGS'))); + expect(source, isNot(contains('FROM_DISCONNECT_BTN'))); + expect(source, isNot(contains('isVpnRuntimeAlive'))); + expect(source, isNot(contains('isVpnServiceProcessAlive'))); + expect(source, contains('REVOLT_VPN_SERVICE')); + + expect(vpnSource, contains('if (_connectEpoch == 0) _adoptedRunningRuntime = true;')); + expect(vpnSource, isNot(contains('PowerSettings.runtimeState'))); + expect(vpnSource, isNot(contains('_adoptRunningRuntime'))); + expect(powerSource, isNot(contains('runtimeState'))); + expect(powerSource, isNot(contains('VpnRuntimeState'))); + }); + + test('configured AdMob bypass contract remains intact', () { + final source = File('lib/logic/hivemind_service.dart').readAsStringSync(); + + expect(source, contains('await _runConfiguredBypass(deviceId, nonce);')); + expect( + source, + contains('/admob/callback?signature=test&key_id=test&custom_data='), + ); + }); + + test('local SOCKS diagnostics cannot fall back to unauthenticated legacy mode', () { + final source = File('lib/logic/local_socks_tester.dart').readAsStringSync(); + + expect(source, contains('required int port')); + expect(source, contains('required String username')); + expect(source, contains('required String password')); + expect(source, contains('const [0x05, 0x01, 0x02]')); + expect(source, isNot(contains('const [0x05, 0x01, 0x00]'))); + expect(source, isNot(contains('int port = 10807'))); + expect(source, isNot(contains('paladinvpn.duckdns.org'))); + expect(source, contains("String targetHost = 'example.com'")); + expect(source, contains('const totalTimeout = Duration(seconds: 8);')); + }); + + test('hivemind rejects missing nonce and stale session responses', () { + final source = File('lib/logic/hivemind_service.dart').readAsStringSync(); + + expect(source, contains('_expectedNonce != nonce ||')); + expect(source, contains('serverNonce is! String ||')); + expect( + source, + contains( + 'final session = await _fetchActiveSession(deviceId, nonce);\n' + ' _throwIfCancelled(callId);', + ), + ); + }); + + test('hivemind validates and pins session fields before constructing VLESS', () { + final source = File('lib/logic/hivemind_service.dart').readAsStringSync(); + + expect(source, contains('_uuidPattern')); + expect(source, contains('_maxControlResponseBytes = 256 * 1024')); + expect(source, contains('controlGet(')); + expect(source, contains('_validatedPublicIp(AppConfig.serverIp')); + expect(source, contains('const port = 443;')); + expect(source, contains("_requiredString(json, 'reality_pbk', maxLength: 128)")); + expect(source, contains('_validatedHost(')); + expect( + source, + contains("final pinnedHost = _validatedPublicIp(AppConfig.serverIp, 'serverIp');"), + ); + expect(source, contains('advertisedHost.trim() != pinnedHost')); + expect( + source, + isNot(contains("_stringOr(json['vless_ip'], AppConfig.serverIp)")), + ); + expect(source, contains('return Uri(')); + expect(source, contains('queryParameters: {')); + expect(source, isNot(contains("return 'vless://\$uuid@\$host:\$port'"))); + }); + + test('VPN connect work cannot outlive its generation', () { + final source = File('lib/logic/vpn_connection.dart').readAsStringSync(); + + expect(source, contains('int _connectEpoch = 0;')); + expect(source, contains('final connectEpoch = ++_connectEpoch;')); + expect(source, contains('epoch == _connectEpoch && !_userDisconnecting')); + expect(source, contains('_connectEpoch++;\n _suppressNativeConnect = true;')); + expect(source, contains('if (_suppressNativeConnect || _userDisconnecting) return;')); + expect(source, isNot(contains('bool _cancelled = false;'))); + }); + + test('native recovery is fail-closed without hot process restart loops', () { + const root = + 'local_packages/flutter_vless_android-1.1.5/android/src/main/kotlin/com/github/tfox/flutter_vless'; + final service = + File('$root/xray/service/XrayVPNService.kt').readAsStringSync(); + final core = File('$root/xray/core/XrayCoreManager.kt').readAsStringSync(); + + expect(service, contains('scheduleTun2socksRecovery')); + expect(service, contains('tun2socksRecoveryAttempt')); + expect(service, contains('coerceAtMost(30_000L)')); + expect(service, contains('recoveringTun2socks = false')); + expect(service, contains('tun2socksRecoveryAttempt = 0')); + expect(service, contains('XrayCoreManager.markRuntimeConnecting(this, config)')); + expect(service, isNot(contains('Thread.sleep(350)'))); + expect(service, isNot(contains('Thread.sleep(600)'))); + expect( + service, + isNot(contains('attempt = 0\n Thread.sleep(3000)')), + ); + + expect(core, contains('context.handleXrayCoreExit(config)')); + expect(core, contains('AppConfigs.RUNTIME_READY = false')); + }); + + test('data disclosure only persists an explicit acknowledged action', () { + final source = + File('lib/components/data_disclosure_dialog.dart').readAsStringSync(); + + expect(source, contains('final accepted = await showDialog(')); + expect(source, contains('if (accepted != true) return;')); + expect(source, contains('final saved = await prefs.setBool(_key, true);')); + expect(source, contains('if (!saved)')); + expect(source, contains('Navigator.of(context).pop(true)')); + expect(source, isNot(contains('prefs.setBool(_key, true);\n Navigator'))); + }); + + test('unsupported server picker is not wired into app state', () { + final mainSource = File('lib/main.dart').readAsStringSync(); + final statusBar = File('lib/components/status_bar.dart').readAsStringSync(); + + expect(mainSource, isNot(contains('ServerList'))); + expect(statusBar, isNot(contains('SelectionScreen'))); + }); + + test('session timer rejects stale session work by generation', () { + final source = File('lib/logic/session_timer.dart').readAsStringSync(); + + expect(source, contains('_sessionEpoch')); + expect(source, contains('Stopwatch')); + expect(source, contains("_doDisconnect('VPN entered error state')")); + expect(source, isNot(contains('_stopForVpnFailure'))); + }); +} diff --git a/tool/patch_flutter_vless_runtime_recovery.dart b/tool/patch_flutter_vless_runtime_recovery.dart deleted file mode 100644 index cdc676d..0000000 --- a/tool/patch_flutter_vless_runtime_recovery.dart +++ /dev/null @@ -1,119 +0,0 @@ -import 'dart:convert'; -import 'dart:io'; - -const packageName = 'flutter_vless_android'; -const expectedVersionFragment = 'flutter_vless_android-1.1.5'; - -Never fail(String message) { - stderr.writeln('[flutter_vless recovery patch] $message'); - exit(1); -} - -Directory packageRoot() { - final configFile = File('.dart_tool/package_config.json'); - if (!configFile.existsSync()) { - fail('.dart_tool/package_config.json is missing; run flutter pub get first'); - } - - final decoded = jsonDecode(configFile.readAsStringSync()); - if (decoded is! Map || decoded['packages'] is! List) { - fail('package_config.json is invalid'); - } - - Map? package; - for (final item in decoded['packages'] as List) { - if (item is Map && item['name'] == packageName) { - package = Map.from(item); - break; - } - } - if (package == null) fail('$packageName was not found'); - - final rootUriValue = package['rootUri']; - if (rootUriValue is! String || rootUriValue.isEmpty) { - fail('$packageName has no rootUri'); - } - - final rootUri = Uri.parse(rootUriValue); - final resolved = rootUri.hasScheme - ? rootUri - : configFile.parent.absolute.uri.resolveUri(rootUri); - if (resolved.scheme != 'file') fail('unsupported package URI: $resolved'); - - final root = Directory.fromUri(resolved); - final normalized = root.absolute.path.replaceAll('\\', '/'); - if (!normalized.contains(expectedVersionFragment)) { - fail('expected flutter_vless_android 1.1.5, got ${root.path}'); - } - if (!root.existsSync()) fail('package root does not exist: ${root.path}'); - return root; -} - -void replaceOnce( - File file, - String oldValue, - String newValue, - String marker, -) { - if (!file.existsSync()) fail('missing upstream source: ${file.path}'); - final text = file.readAsStringSync(); - if (text.contains(marker)) { - stdout.writeln('[flutter_vless recovery patch] already current: ${file.path}'); - return; - } - if (!text.contains(oldValue)) { - fail('upstream source changed; expected block not found in ${file.path}'); - } - file.writeAsStringSync(text.replaceFirst(oldValue, newValue)); - stdout.writeln('[flutter_vless recovery patch] patched: ${file.path}'); -} - -void main() { - final root = packageRoot(); - final kotlin = Directory( - '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless', - ); - - final serviceFile = File('${kotlin.path}/xray/service/XrayVPNService.kt'); - if (!serviceFile.existsSync()) { - fail('pinned Android runtime service source is missing'); - } - - // A fast reconnect must not leave the previous Xray process owning the local - // SOCKS/HTTP ports. - replaceOnce( - serviceFile, - ''' if (config != null) { - // Ensure clean state before starting - cleanup() -''', - ''' if (config != null) { - // A fast reconnect must not leave the previous Xray process - // owning the local SOCKS/HTTP ports. - if (XrayCoreManager.isXrayRunning()) { - Log.w(TAG, "Stopping stale Xray core before restart") - XrayCoreManager.stopCore(this) - } - cleanup() -''', - 'Stopping stale Xray core before restart', - ); - - // The tun2socks Unix socket must not survive a previous session. - replaceOnce( - serviceFile, - ''' val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath - val sockPath = File(filesDir, "sock_path").absolutePath -''', - ''' val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath - val socketFile = File(filesDir, "sock_path") - if (socketFile.exists() && !socketFile.delete()) { - Log.w(TAG, "Could not delete stale tun2socks socket") - } - val sockPath = socketFile.absolutePath -''', - 'Could not delete stale tun2socks socket', - ); - - stdout.writeln('[flutter_vless recovery patch] runtime recovery patch is ready'); -} diff --git a/tool/patch_flutter_vless_secure_socks_scope_fix.dart b/tool/patch_flutter_vless_secure_socks_scope_fix.dart deleted file mode 100644 index c157c5a..0000000 --- a/tool/patch_flutter_vless_secure_socks_scope_fix.dart +++ /dev/null @@ -1,154 +0,0 @@ -import 'dart:convert'; -import 'dart:io'; - -const packageName = 'flutter_vless_android'; -const expectedVersionFragment = 'flutter_vless_android-1.1.5'; - -Never fail(String message) { - stderr.writeln('[secure-socks scope fix] $message'); - exit(1); -} - -Directory packageRoot() { - final configFile = File('.dart_tool/package_config.json'); - if (!configFile.existsSync()) { - fail('.dart_tool/package_config.json is missing; run flutter pub get first'); - } - - final decoded = jsonDecode(configFile.readAsStringSync()); - if (decoded is! Map || decoded['packages'] is! List) { - fail('package_config.json is invalid'); - } - - Map? package; - for (final item in decoded['packages'] as List) { - if (item is Map && item['name'] == packageName) { - package = Map.from(item); - break; - } - } - if (package == null) fail('$packageName was not found'); - - final rootUriValue = package['rootUri']; - if (rootUriValue is! String || rootUriValue.isEmpty) { - fail('$packageName has no rootUri'); - } - - final rootUri = Uri.parse(rootUriValue); - final resolved = rootUri.hasScheme - ? rootUri - : configFile.parent.absolute.uri.resolveUri(rootUri); - if (resolved.scheme != 'file') fail('unsupported package URI: $resolved'); - - final root = Directory.fromUri(resolved); - final normalized = root.absolute.path.replaceAll('\\', '/'); - if (!normalized.contains(expectedVersionFragment)) { - fail('expected flutter_vless_android 1.1.5, got ${root.path}'); - } - return root; -} - -void patchCoreScope(File core) { - final before = core.readAsStringSync(); - - // The primary secure patcher used a file-wide check for - // `val process = pb.start()`. Stock 1.1.5 already contains that exact line - // in getV2rayTraffic(), so the startCore() capture could be skipped while - // its monitor was still rewritten to use `process`. Capture the active Xray - // process immediately before its monitor thread instead. This is deliberately - // a scope-only correction and does not alter the stable runtime sequence. - const directCapture = - ' val process = pb.start()\n xrayProcess = process\n'; - const scopedCapture = - ' val process = xrayProcess ?: return false\n // Monitor process in a separate thread to detect crash\n'; - const monitorMarker = - ' // Monitor process in a separate thread to detect crash\n'; - - if (before.contains(directCapture) || before.contains(scopedCapture)) { - stdout.writeln('[secure-socks scope fix] core already current: ${core.path}'); - return; - } - - if (!before.contains('process.inputStream.bufferedReader().use { reader ->') || - !before.contains('val exitCode = process.waitFor()') || - !before.contains('xrayProcess === process')) { - fail('secure Xray monitor patch is not in the expected state'); - } - if (!before.contains(' xrayProcess = pb.start()\n')) { - fail('stock Xray start assignment is missing'); - } - if (!before.contains(monitorMarker)) { - fail('Xray monitor insertion point is missing'); - } - - final after = before.replaceFirst(monitorMarker, scopedCapture); - core.writeAsStringSync(after); - stdout.writeln('[secure-socks scope fix] captured Xray process for monitor scope'); -} - -void patchOngoingNotification(File service) { - final before = service.readAsStringSync(); - - const marker = '.setOngoing(true)'; - if (before.contains(marker) && - before.contains('Notification.FLAG_NO_CLEAR') && - before.contains('.setAutoCancel(false)')) { - stdout.writeln('[secure-socks scope fix] notification already ongoing: ${service.path}'); - return; - } - - const oldBlock = r''' return builder - .setContentTitle("VPN Service") - .setContentText(content) - .setSmallIcon(icon) - .build() -'''; - - const newBlock = r''' val notification = builder - .setContentTitle("VPN Service") - .setContentText(content) - .setSmallIcon(icon) - .setOngoing(true) - .setAutoCancel(false) - .setOnlyAlertOnce(true) - .build() - - // Keep the active VPN notification attached to the foreground service - // and resistant to bulk clearing on Android versions that honor these - // flags. Android 14+ may still allow an explicit user swipe while the - // device is unlocked; apps are not allowed to override that system UI. - notification.flags = notification.flags or - android.app.Notification.FLAG_ONGOING_EVENT or - android.app.Notification.FLAG_NO_CLEAR - return notification -'''; - - if (!before.contains(oldBlock)) { - fail('VPN notification builder is not in the expected stock 1.1.5 state'); - } - - final after = before.replaceFirst(oldBlock, newBlock); - if (!after.contains(marker) || - !after.contains('Notification.FLAG_NO_CLEAR') || - !after.contains('.setAutoCancel(false)')) { - fail('ongoing VPN notification invariant failed'); - } - - service.writeAsStringSync(after); - stdout.writeln('[secure-socks scope fix] VPN notification marked ongoing/no-clear'); -} - -void main() { - final root = packageRoot(); - final kotlin = - '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless'; - final core = File('$kotlin/xray/core/XrayCoreManager.kt'); - final service = File('$kotlin/xray/service/XrayVPNService.kt'); - - if (!core.existsSync()) fail('XrayCoreManager.kt is missing'); - if (!service.existsSync()) fail('XrayVPNService.kt is missing'); - - patchCoreScope(core); - patchOngoingNotification(service); - stdout.writeln('[secure-socks scope fix] scope and notification patch ready'); -} diff --git a/tool/patch_flutter_vless_secure_socks_v2.dart b/tool/patch_flutter_vless_secure_socks_v2.dart deleted file mode 100644 index c68deb4..0000000 --- a/tool/patch_flutter_vless_secure_socks_v2.dart +++ /dev/null @@ -1,746 +0,0 @@ -import 'dart:convert'; -import 'dart:io'; - -const packageName = 'flutter_vless_android'; -const expectedVersionFragment = 'flutter_vless_android-1.1.5'; - -Never fail(String message) { - stderr.writeln('[secure-socks patch] $message'); - exit(1); -} - -Directory packageRoot() { - final configFile = File('.dart_tool/package_config.json'); - if (!configFile.existsSync()) { - fail('.dart_tool/package_config.json is missing; run flutter pub get first'); - } - final decoded = jsonDecode(configFile.readAsStringSync()); - if (decoded is! Map || decoded['packages'] is! List) { - fail('package_config.json is invalid'); - } - - Map? package; - for (final item in decoded['packages'] as List) { - if (item is Map && item['name'] == packageName) { - package = Map.from(item); - break; - } - } - if (package == null) fail('$packageName was not found'); - - final rootUriValue = package['rootUri']; - if (rootUriValue is! String || rootUriValue.isEmpty) { - fail('$packageName has no rootUri'); - } - final rootUri = Uri.parse(rootUriValue); - final resolved = rootUri.hasScheme - ? rootUri - : configFile.parent.absolute.uri.resolveUri(rootUri); - if (resolved.scheme != 'file') fail('unsupported package URI: $resolved'); - - final root = Directory.fromUri(resolved); - final normalized = root.absolute.path.replaceAll('\\', '/'); - if (!normalized.contains(expectedVersionFragment)) { - fail('expected flutter_vless_android 1.1.5, got ${root.path}'); - } - return root; -} - -String replaceOnce( - String text, - String oldValue, - String newValue, - String label, -) { - if (text.contains(newValue)) return text; - if (!text.contains(oldValue)) fail('missing expected source block: $label'); - return text.replaceFirst(oldValue, newValue); -} - -void writeIfChanged(File file, String before, String after) { - if (before == after) { - stdout.writeln('[secure-socks patch] already current: ${file.path}'); - return; - } - file.writeAsStringSync(after); - stdout.writeln('[secure-socks patch] patched: ${file.path}'); -} - -void patchCore(File file) { - final before = file.readAsStringSync(); - var text = before; - - const secureValidation = r''' var secureSocksEnabled = false - for (i in 0 until inbounds.length()) { - val inbound = inbounds.optJSONObject(i) ?: continue - if (inbound.optString("tag") != "revolt-secure-socks") continue - - val settings = inbound.optJSONObject("settings") - ?: throw IllegalStateException("Secure SOCKS5 settings are missing") - val users = settings.optJSONArray("users") - ?: throw IllegalStateException("Secure SOCKS5 users are missing") - val account = users.optJSONObject(0) - ?: throw IllegalStateException("Secure SOCKS5 account is missing") - val port = inbound.optInt("port", -1) - - if (inbound.optString("protocol") != "socks" || - inbound.optString("listen") != "127.0.0.1" || - port <= 1024 || port > 65535 || - settings.optString("auth") != "password" || - account.optString("user").isEmpty() || - account.optString("pass").isEmpty() - ) { - throw IllegalStateException("Secure SOCKS5 session is invalid") - } - - config.LOCAL_SOCKS5_PORT = port - config.LOCAL_HTTP_PORT = 0 - secureSocksEnabled = true - break - } - -'''; - - if (!text.contains('var secureSocksEnabled = false')) { - text = replaceOnce( - text, - ' val usedPorts = mutableSetOf()\n', - '$secureValidation val usedPorts = mutableSetOf()\n', - 'secure SOCKS validation insertion', - ); - } - - text = replaceOnce( - text, - ' if (!hasHttpOnLocalPort) {\n', - ' if (!secureSocksEnabled && !hasHttpOnLocalPort) {\n', - 'disable unauthenticated HTTP proxy in secure mode', - ); - - if (!text.contains('val process = pb.start()')) { - text = replaceOnce( - text, - ' xrayProcess = pb.start()\n', - ' val process = pb.start()\n xrayProcess = process\n', - 'capture Xray process identity', - ); - text = replaceOnce( - text, - ' if (xrayProcess?.isAlive != true) {\n', - ' if (!process.isAlive) {\n', - 'Xray startup liveness', - ); - text = replaceOnce( - text, - ' val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()\n', - ' val output = process.inputStream.bufferedReader().readText()\n', - 'Xray startup output', - ); - } - - if (!text.contains('Could not delete ephemeral Xray config')) { - const connectedLine = - ' AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED\n'; - const deleteConfig = r''' // config.json contains per-session SOCKS credentials. Xray has - // consumed it after the startup liveness check, so remove it now. - try { - val ephemeralConfig = File(configFilesDir, "config.json") - if (ephemeralConfig.exists() && !ephemeralConfig.delete()) { - Log.w(TAG, "Could not delete ephemeral Xray config") - } - } catch (e: Exception) { - Log.w(TAG, "Could not delete ephemeral Xray config", e) - } - -'''; - text = replaceOnce( - text, - connectedLine, - '$deleteConfig$connectedLine', - 'ephemeral config deletion', - ); - } - - if (!text.contains('context.handleXrayCoreExit(config)')) { - text = replaceOnce( - text, - ' xrayProcess?.inputStream?.bufferedReader()?.use { reader ->\n', - ' process.inputStream.bufferedReader().use { reader ->\n', - 'Xray monitor process stream', - ); - text = replaceOnce( - text, - ' val exitCode = xrayProcess?.waitFor()\n', - ' val exitCode = process.waitFor()\n', - 'Xray monitor process wait', - ); - - const oldExit = r''' if (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED) { - // Unexpected exit - stopCore(context) - } -'''; - const newExit = r''' if (xrayProcess === process && - AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED - ) { - // Hold the Android TUN while the core is recovered. Killing - // the VPN service here would allow direct-network fallback. - xrayProcess = null - AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING - if (context is XrayVPNService) { - context.handleXrayCoreExit(config) - } else { - stopCore(context) - } - } -'''; - text = replaceOnce(text, oldExit, newExit, 'Xray fail-closed recovery'); - } - - writeIfChanged(file, before, text); -} - -void patchService(File file) { - final before = file.readAsStringSync(); - var text = before; - - if (!text.contains('private var recoveringXray = false')) { - text = replaceOnce( - text, - ' private var isRunning = false\n', - ' @Volatile private var isRunning = false\n' - ' @Volatile private var recoveringXray = false\n' - ' private var currentConfig: XrayConfig? = null\n', - 'service recovery fields', - ); - } - - if (!text.contains('private data class PersistedSession(')) { - const persistenceHelpers = r''' private data class PersistedSession( - val proxyOnly: Boolean, - val config: XrayConfig, - val sessionExpiresAtMs: Long, - ) : java.io.Serializable - - private var proxyOnlyMode = false - private var sessionExpiresAtMs = 0L - - private val expiryHandler = android.os.Handler(android.os.Looper.getMainLooper()) - private val expiryRunnable = Runnable { - if (sessionExpiresAtMs > 0 && System.currentTimeMillis() >= sessionExpiresAtMs) { - Log.w(TAG, "Session expired; tearing down VPN") - sessionExpiresAtMs = 0L - cancelExpiryAlarm() - postSessionExpiredNotification() - deletePersistedSession() - stopAll() - } - } - - private fun scheduleExpiryCheck() { - expiryHandler.removeCallbacks(expiryRunnable) - if (sessionExpiresAtMs > 0) { - val delay = (sessionExpiresAtMs - System.currentTimeMillis()).coerceAtLeast(0) - expiryHandler.postDelayed(expiryRunnable, delay) - } - scheduleExpiryAlarm() - } - - private fun scheduleExpiryAlarm() { - cancelExpiryAlarm() - if (sessionExpiresAtMs <= 0) return - try { - val alarmManager = getSystemService(android.content.Context.ALARM_SERVICE) as android.app.AlarmManager - try { - alarmManager.setExactAndAllowWhileIdle( - android.app.AlarmManager.RTC_WAKEUP, - sessionExpiresAtMs, - sessionExpiredPendingIntent(), - ) - } catch (e: SecurityException) { - alarmManager.setAndAllowWhileIdle( - android.app.AlarmManager.RTC_WAKEUP, - sessionExpiresAtMs, - sessionExpiredPendingIntent(), - ) - } - } catch (e: Exception) { - Log.w(TAG, "Failed to schedule expiry alarm", e) - } - } - - private fun cancelExpiryAlarm() { - try { - val alarmManager = getSystemService(android.content.Context.ALARM_SERVICE) as android.app.AlarmManager - alarmManager.cancel(sessionExpiredPendingIntent()) - } catch (e: Exception) { - } - } - - private fun sessionExpiredPendingIntent(): android.app.PendingIntent { - val intent = Intent(this, XrayVPNService::class.java) - intent.putExtra("SESSION_EXPIRED", true) - val flags = android.app.PendingIntent.FLAG_UPDATE_CURRENT or - if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) { - android.app.PendingIntent.FLAG_IMMUTABLE - } else { - 0 - } - return android.app.PendingIntent.getService(this, 1001, intent, flags) - } - - private fun persistSession() { - val config = currentConfig ?: return - try { - java.io.ObjectOutputStream( - java.io.FileOutputStream(File(filesDir, "active_session.bin")), - ).use { it.writeObject(PersistedSession(proxyOnlyMode, config, sessionExpiresAtMs)) } - } catch (e: Exception) { - Log.w(TAG, "Failed to persist active session", e) - } - } - - private fun loadPersistedSession(): PersistedSession? { - return try { - val file = File(filesDir, "active_session.bin") - if (!file.exists()) return null - java.io.ObjectInputStream(java.io.FileInputStream(file)).use { - it.readObject() as? PersistedSession - } - } catch (e: Exception) { - Log.w(TAG, "Failed to restore persisted session", e) - null - } - } - - private fun deletePersistedSession() { - try { - File(filesDir, "active_session.bin").delete() - } catch (e: Exception) { - Log.w(TAG, "Failed to delete persisted session", e) - } - } - - private fun postSessionExpiredNotification() { - try { - createNotificationChannel() - val launchIntent = packageManager.getLaunchIntentForPackage(packageName) - val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) { - android.app.PendingIntent.FLAG_IMMUTABLE or android.app.PendingIntent.FLAG_UPDATE_CURRENT - } else { - android.app.PendingIntent.FLAG_UPDATE_CURRENT - } - val contentIntent = if (launchIntent != null) { - android.app.PendingIntent.getActivity(this, 0, launchIntent, flags) - } else { - null - } - val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) { - android.app.Notification.Builder(this, "vpn_service_channel") - } else { - @Suppress("DEPRECATION") - android.app.Notification.Builder(this) - } - builder - .setContentTitle("Revolt VPN") - .setContentText("Session expired. Reconnect to continue.") - .setSmallIcon(android.R.drawable.ic_dialog_info) - .setAutoCancel(true) - if (contentIntent != null) { - builder.setContentIntent(contentIntent) - } - val manager = getSystemService(android.app.NotificationManager::class.java) - manager?.notify(2, builder.build()) - } catch (e: Exception) { - Log.w(TAG, "Failed to post session expired notification", e) - } - } -'''; - text = replaceOnce( - text, - ' override fun onCreate() {\n super.onCreate()\n }\n', - ' override fun onCreate() {\n super.onCreate()\n }\n\n$persistenceHelpers', - 'session persistence helpers', - ); - } - - // Snapshot the running config so a START_STICKY restart can re-establish it. - if (!text.contains(' currentConfig = config\n')) { - text = replaceOnce( - text, - ' cleanup()\n', - ' cleanup()\n currentConfig = config\n', - 'runtime config snapshot', - ); - } - - text = replaceOnce( - text, - ' val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)\n', - ' val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)\n proxyOnlyMode = proxyOnly\n persistSession()\n', - 'persist session snapshot', - ); - - text = replaceOnce( - text, - ' if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {\n stopAll()\n return START_NOT_STICKY\n }\n', - ' if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {\n deletePersistedSession()\n stopAll()\n return START_NOT_STICKY\n }\n', - 'delete session on explicit stop', - ); - - const oldNullIntent = r''' if (intent == null) { - stopSelf() - return START_NOT_STICKY - } -'''; - const newNullIntent = r''' if (intent == null) { - if (isRunning && currentConfig != null) return START_STICKY - val persisted = loadPersistedSession() - if (persisted != null) { - Log.w(TAG, "Re-establishing VPN from persisted session") - createNotificationChannel() - val notification = createNotification("VPN Service Running") - try { - if (Build.VERSION.SDK_INT >= 34) { - startForeground(1, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE) - } else { - startForeground(1, notification) - } - } catch (e: Exception) { - Log.e(TAG, "Failed to start foreground", e) - } - if (XrayCoreManager.isXrayRunning()) { - Log.w(TAG, "Stopping stale Xray core before restart") - XrayCoreManager.stopCore(this) - } - cleanup() - currentConfig = persisted.config - proxyOnlyMode = persisted.proxyOnly - sessionExpiresAtMs = persisted.sessionExpiresAtMs - if (XrayCoreManager.startCore(this, persisted.config)) { - if (!persisted.proxyOnly) { - setupVpn(persisted.config) - } else { - isRunning = true - } - scheduleExpiryCheck() - } else { - stopSelf() - return START_NOT_STICKY - } - return START_STICKY - } - stopSelf() - return START_NOT_STICKY - } -'''; - text = replaceOnce( - text, - oldNullIntent, - newNullIntent, - 'null intent lifecycle', - ); - - text = replaceOnce( - text, - ' val command = if (Build.VERSION.SDK_INT >= 33) {\n', - ' if (intent.getBooleanExtra("SESSION_EXPIRED", false)) {\n Log.w(TAG, "Session-expiry alarm fired; tearing down VPN")\n sessionExpiresAtMs = 0L\n cancelExpiryAlarm()\n deletePersistedSession()\n postSessionExpiredNotification()\n stopAll()\n return START_NOT_STICKY\n }\n\n if (intent.hasExtra("SESSION_EXPIRES_AT_MS")) {\n sessionExpiresAtMs = intent.getLongExtra("SESSION_EXPIRES_AT_MS", 0L)\n scheduleExpiryCheck()\n persistSession()\n return if (isRunning && currentConfig != null) START_STICKY else START_NOT_STICKY\n }\n\n val command = if (Build.VERSION.SDK_INT >= 33) {\n', - 'session expiry update', - ); - - - if (!text.contains('private data class SecureSocksCredentials(')) { - const credentialsHelper = r''' private data class SecureSocksCredentials( - val port: Int, - val username: String, - val password: String, - ) - - private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? { - val inbounds = try { - JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds") - } catch (_: Exception) { - null - } ?: return null - - for (i in 0 until inbounds.length()) { - val inbound = inbounds.optJSONObject(i) ?: continue - if (inbound.optString("tag") != "revolt-secure-socks") continue - if (inbound.optString("protocol") != "socks" || - inbound.optString("listen") != "127.0.0.1" - ) return null - - val settings = inbound.optJSONObject("settings") ?: return null - if (settings.optString("auth") != "password") return null - val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null - val port = inbound.optInt("port", -1) - val username = user.optString("user") - val password = user.optString("pass") - if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) { - return null - } - return SecureSocksCredentials(port, username, password) - } - return null - } - -'''; - const runComment = r''' /** - * Starts the tun2socks process and initiates the FD transfer. - */ - private fun runTun2socks(config: XrayConfig) { -'''; - text = replaceOnce( - text, - runComment, - '$credentialsHelper$runComment', - 'secure credentials helper', - ); - } - - if (!text.contains('Authenticated ReVolt SOCKS5 inbound missing')) { - const commandComment = r''' // Command to start tun2socks. - // Note: We pass -sock-path to tell it where to listen for the FD. -'''; - const securePrelude = r''' val secure = secureSocksCredentials(config) - ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing") - config.LOCAL_SOCKS5_PORT = secure.port - -'''; - text = replaceOnce( - text, - commandComment, - '$securePrelude$commandComment', - 'secure tun2socks credentials', - ); - text = replaceOnce( - text, - r''' "-proxy", "socks5://127.0.0.1:${config.LOCAL_SOCKS5_PORT}", -''', - r''' "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}", -''', - 'authenticated tun2socks URL', - ); - text = replaceOnce( - text, - r''' Log.d(TAG, "tun2socks command: ${cmd.joinToString(" ")}") -''', - ' Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")\n', - 'credential-safe logging', - ); - } - - if (!text.contains('val process = pb.start()\n tun2socksProcess = process')) { - text = replaceOnce( - text, - ' tun2socksProcess = pb.start()\n', - ' val process = pb.start()\n tun2socksProcess = process\n', - 'capture tun2socks process identity', - ); - text = replaceOnce( - text, - ' tun2socksProcess?.inputStream?.bufferedReader()?.use { reader ->\n', - ' process.inputStream.bufferedReader().use { reader ->\n', - 'tun2socks monitor stream', - ); - text = replaceOnce( - text, - ' tun2socksProcess?.waitFor()\n', - ' process.waitFor()\n', - 'tun2socks monitor wait', - ); - - const oldRestart = r''' if (isRunning) { - // Restart if crashed and still supposed to be running - Log.e(TAG, "tun2socks exited unexpectedly, restarting...") - runTun2socks(config) - } -'''; - const newRestart = r''' if (isRunning && tun2socksProcess === process && currentConfig === config) { - Log.e(TAG, "tun2socks exited unexpectedly, recycling without dropping TUN") - Thread.sleep(350) - if (isRunning && currentConfig === config) runTun2socks(config) - } -'''; - text = replaceOnce( - text, - oldRestart, - newRestart, - 'tun2socks crash recovery', - ); - text = replaceOnce( - text, - ' sendFd()\n', - ' sendFd(process)\n', - 'FD handoff process identity', - ); - } - - const oldStartFailure = r''' } catch (e: Exception) { - Log.e(TAG, "Failed to start tun2socks", e) - stopAll() - } -'''; - const newStartFailure = r''' } catch (e: Exception) { - Log.e(TAG, "Failed to start tun2socks; retrying with TUN held", e) - if (isRunning && currentConfig === config) { - Thread { - try { - Thread.sleep(600) - if (isRunning && currentConfig === config) runTun2socks(config) - } catch (_: InterruptedException) {} - }.start() - } - } -'''; - text = replaceOnce( - text, - oldStartFailure, - newStartFailure, - 'tun2socks start failure recovery', - ); - - if (!text.contains('FD handoff failed; recycling tun2socks without dropping TUN')) { - const oldSendFd = r''' private fun sendFd() { - val fd = mInterface?.fileDescriptor ?: return - val sockFile = File(filesDir, "sock_path").absolutePath - - Thread { - var tries = 0 - while (tries < 10) { - try { - Thread.sleep(500) - val localSocket = LocalSocket() - localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM)) - val out = localSocket.outputStream - // This magic call attaches the FD to the socket message - localSocket.setFileDescriptorsForSend(arrayOf(fd)) - out.write(32) // Send a dummy byte to trigger the transfer - localSocket.setFileDescriptorsForSend(null) - localSocket.shutdownOutput() - localSocket.close() - break - } catch (e: Exception) { - tries++ - } - } - }.start() - } -'''; - const newSendFd = r''' private fun sendFd(process: Process) { - val fd = mInterface?.fileDescriptor ?: return - val sockFile = File(filesDir, "sock_path").absolutePath - - Thread { - var tries = 0 - while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) { - var localSocket: LocalSocket? = null - try { - Thread.sleep(500) - localSocket = LocalSocket() - localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM)) - val out = localSocket.outputStream - localSocket.setFileDescriptorsForSend(arrayOf(fd)) - out.write(32) - out.flush() - localSocket.setFileDescriptorsForSend(null) - localSocket.shutdownOutput() - localSocket.close() - return@Thread - } catch (_: Exception) { - tries++ - try { localSocket?.close() } catch (_: Exception) {} - } - } - - if (isRunning && tun2socksProcess === process) { - Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN") - try { process.destroy() } catch (_: Exception) {} - } - }.start() - } -'''; - text = replaceOnce(text, oldSendFd, newSendFd, 'bounded FD recovery'); - } - - if (!text.contains('fun handleXrayCoreExit(config: XrayConfig)')) { - const cleanupComment = r''' /** - * Cleans up resources (tun2socks process, VPN interface) without stopping the service completely. - * Used when restarting or switching configurations. - */ -'''; - const recovery = r''' fun handleXrayCoreExit(config: XrayConfig) { - if (!isRunning || currentConfig !== config || recoveringXray) return - recoveringXray = true - - Thread { - var attempt = 0 - try { - while (isRunning && currentConfig === config) { - attempt++ - Thread.sleep(400L * attempt.coerceAtMost(5)) - if (!isRunning || currentConfig !== config) break - - Log.w(TAG, "Recovering Xray core attempt $attempt") - if (XrayCoreManager.startCore(this, config)) { - Log.w(TAG, "Xray core recovered without dropping TUN") - return@Thread - } - - if (attempt >= 3) { - attempt = 0 - Thread.sleep(3000) - } - } - } catch (_: InterruptedException) { - } finally { - recoveringXray = false - } - }.start() - } - -'''; - text = replaceOnce( - text, - cleanupComment, - '$recovery$cleanupComment', - 'Xray recovery loop', - ); - } - - if (!text.contains(' cancelExpiryAlarm()\n tun2socksProcess?.destroy()')) { - text = replaceOnce( - text, - ' isRunning = false\n tun2socksProcess?.destroy()\n', - ' isRunning = false\n recoveringXray = false\n expiryHandler.removeCallbacks(expiryRunnable)\n cancelExpiryAlarm()\n tun2socksProcess?.destroy()\n', - 'cancel recovery and expiry on cleanup', - ); - } - - if (!text.contains(' currentConfig = null\n XrayCoreManager.stopCore(this)')) { - text = replaceOnce( - text, - ' cleanup()\n XrayCoreManager.stopCore(this)\n', - ' cleanup()\n currentConfig = null\n XrayCoreManager.stopCore(this)\n', - 'clear config on explicit stop', - ); - } - - writeIfChanged(file, before, text); -} - -void main() { - final root = packageRoot(); - final kotlin = Directory( - '${root.path}/android/src/main/kotlin/com/github/tfox/flutter_vless', - ); - final core = File('${kotlin.path}/xray/core/XrayCoreManager.kt'); - final service = File('${kotlin.path}/xray/service/XrayVPNService.kt'); - if (!core.existsSync() || !service.existsSync()) { - fail('pinned Android runtime sources are missing'); - } - - patchCore(core); - patchService(service); - stdout.writeln('[secure-socks patch] stable-core security patch is ready'); -}