ac/android_cast
1
0
Fork 0
mirror of git://f0xx.org/android_cast synced 2026-07-29 05:58:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

vpn service sync

Browse Source
This commit is contained in:
Anton Afanasyeu
2026-06-11 13:43:15 +02:00
parent 6ed53e80ab
commit 8735fe4177
43 changed files with 1185 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/REMOTE_ACCESS_IMPL.md
View File

@@ -25,7 +25,7 @@ See the full proposal: [20260602_REVERSE_SSH_proposals_summary.md](20260602_REVE
- **WireGuard:** foreground service; jittered poll **1–7 min** → `heartbeat.php` with `type: ra`
- Heartbeat URL derived from crash upload URL (`…/api/heartbeat.php`)
- Session credentials persisted until `expires_at`; expiry tears down tunnel locally
- Optional full userspace WG via `third-party/wireguard-android` (`:tunnel`); otherwise `RemoteAccessVpnService` TUN fallback
- Userspace WG via `third-party/wireguard-android` (`:tunnel` / `GoBackend`) in isolated process **`com.foxx.androidcast:vpn`**; main app controls via AIDL (`IVpnService` / `VpnServiceClient`); TUN fallback only if GoBackend fails
### Android VPN consent (WireGuard)
@@ -148,14 +148,28 @@ Internet UDP :51820 → FE DNAT → BE wg0 :51820
Hostname `ra.apps.f0xx.org` (or similar) should resolve to the FE public IP. Devices use `wg_endpoint` from config/connect payload.
## VPN process (AIDL)
| Component | Process | Role |
|-----------|---------|------|
| `VpnServiceClient` | main (`com.foxx.androidcast`) | Binds to `IVpnService`; async apply/tearDown + state callbacks |
| `AndroidCastVpnService` | `:vpn` | AIDL stub; worker thread for tunnel ops |
| `WireGuardVpnEngine` | `:vpn` | `GoBackend` + TUN fallback |
| `RemoteAccessVpnService` | `:vpn` | `VpnService` TUN when GoBackend fails |
| `GoBackend$VpnService` | `:vpn` | WireGuard tunnel library VPN entry (manifest merge) |
Developer settings still uses `VpnService.prepare(Activity)` for the one-time consent dialog (same app UID).
**Crash capture:** `CrashReporter.install()` registers uncaught handlers in `:vpn` (scenario `vpn_service`, process `com.foxx.androidcast:vpn`). Reports persist to shared app storage and upload via `:crashwatcher`. Lab: `scripts/simulate-vpn-crashes.sh` (debug APK + `MODE=device`, or `MODE=upload` for BE ingest validation).
## WireGuard third-party (Android)
```bash
bash scripts/init-wireguard-submodule.sh
./gradlew :app:assembleDebug # includes :tunnel when submodule present
bash scripts/init-third-party-submodules.sh # or ./rebuild.sh (includes init + :tunnel build)
./gradlew :tunnel:assembleDebug :app:assembleDebug
```
Without the submodule, `WireGuardTunnelBridge` uses `RemoteAccessVpnService` (TUN only — sufficient for lab; prefer `:tunnel` for production tunnels).
Gradle fails fast if the submodule is missing. VPN runs in `:vpn` (`AndroidCastVpnService` + AIDL); `WireGuardVpnEngine` uses `GoBackend` with TUN fallback in the same process.
## Tests