____ _ _______ __
/ __ \ | /| / / __/ |/ /
/ /_/ / |/ |/ / _// /
\____/|__/|__/___/_||_/
owenclave / app/src/main/java/io/nekohasekai/sagernet/fmt/trusttunnel/TrustTunnelBean.java
/******************************************************************************
* *
* Copyright (C) 2026 dyhkwong *
* *
* This program is free software: you can redistribute it and/or modify *
* it under the terms of the GNU General Public License as published by *
* the Free Software Foundation, either version 3 of the License, or *
* (at your option) any later version. *
* *
* This program is distributed in the hope that it will be useful, *
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
* GNU General Public License for more details. *
* *
* You should have received a copy of the GNU General Public License *
* along with this program. If not, see . *
* *
******************************************************************************/
package io.nekohasekai.sagernet.fmt.trusttunnel;
import androidx.annotation.NonNull;
import com.esotericsoftware.kryo.io.ByteBufferInput;
import com.esotericsoftware.kryo.io.ByteBufferOutput;
import org.jetbrains.annotations.NotNull;
import io.nekohasekai.sagernet.fmt.AbstractBean;
import io.nekohasekai.sagernet.fmt.KryoConverters;
import libexclavecore.Libexclavecore;
public class TrustTunnelBean extends AbstractBean {
public String protocol;
public String username;
public String password;
public String sni;
public String certificate;
public String utlsFingerprint;
public Boolean allowInsecure;
public String pinnedPeerCertificateChainSha256;
public String pinnedPeerCertificatePublicKeySha256;
public String pinnedPeerCertificateSha256;
public Boolean echEnabled;
public String echConfig;
public String mtlsCertificate;
public String mtlsCertificatePrivateKey;
public String serverNameToVerify;
@Override
public void initializeDefaultValues() {
super.initializeDefaultValues();
if (protocol == null) protocol = "https";
if (username == null) username = "";
if (password == null) password = "";
if (sni == null) sni = "";
if (certificate == null) certificate = "";
if (utlsFingerprint == null) utlsFingerprint = "";
if (allowInsecure == null) allowInsecure = false;
if (pinnedPeerCertificateChainSha256 == null) pinnedPeerCertificateChainSha256 = "";
if (pinnedPeerCertificatePublicKeySha256 == null) pinnedPeerCertificatePublicKeySha256 = "";
if (pinnedPeerCertificateSha256 == null) pinnedPeerCertificateSha256 = "";
if (echEnabled == null) echEnabled = false;
if (echConfig == null) echConfig = "";
if (mtlsCertificate == null) mtlsCertificate = "";
if (mtlsCertificatePrivateKey == null) mtlsCertificatePrivateKey = "";
if (serverNameToVerify == null) serverNameToVerify = "";
}
@Override
public void serialize(ByteBufferOutput output) {
output.writeInt(2);
super.serialize(output);
output.writeString(protocol);
output.writeString(username);
output.writeString(password);
output.writeString(sni);
output.writeString(certificate);
if (protocol.equals("https")) {
output.writeString(utlsFingerprint);
} else {
output.writeString("");
}
output.writeBoolean(allowInsecure);
output.writeString(pinnedPeerCertificateChainSha256);
output.writeString(pinnedPeerCertificatePublicKeySha256);
output.writeString(pinnedPeerCertificateSha256);
output.writeBoolean(echEnabled);
output.writeString(echConfig);
output.writeString(mtlsCertificate);
output.writeString(mtlsCertificatePrivateKey);
output.writeString(serverNameToVerify);
}
@Override
public void deserialize(ByteBufferInput input) {
int version = input.readInt();
super.deserialize(input);
protocol = input.readString();
username = input.readString();
password = input.readString();
sni = input.readString();
certificate = input.readString();
if (protocol.equals("https")) {
utlsFingerprint = input.readString();
} else {
input.readString();
utlsFingerprint = "";
}
if (version >= 1) {
allowInsecure = input.readBoolean();
}
if (version >= 2) {
pinnedPeerCertificateChainSha256 = input.readString();
pinnedPeerCertificatePublicKeySha256 = input.readString();
pinnedPeerCertificateSha256 = input.readString();
echEnabled = input.readBoolean();
echConfig = input.readString();
mtlsCertificate = input.readString();
mtlsCertificatePrivateKey = input.readString();
serverNameToVerify = input.readString();
}
}
@Override
public void applyFeatureSettings(AbstractBean other) {
if (!(other instanceof TrustTunnelBean bean)) return;
if (allowInsecure) {
bean.allowInsecure = true;
}
if (bean.certificate == null || bean.certificate.isEmpty() && !certificate.isEmpty()) {
bean.certificate = certificate;
}
bean.utlsFingerprint = utlsFingerprint;
if (bean.pinnedPeerCertificateChainSha256 == null || bean.pinnedPeerCertificateChainSha256.isEmpty() &&
!pinnedPeerCertificateChainSha256.isEmpty()) {
bean.pinnedPeerCertificateChainSha256 = pinnedPeerCertificateChainSha256;
}
if (bean.pinnedPeerCertificatePublicKeySha256 == null || bean.pinnedPeerCertificatePublicKeySha256.isEmpty() &&
!pinnedPeerCertificatePublicKeySha256.isEmpty()) {
bean.pinnedPeerCertificatePublicKeySha256 = pinnedPeerCertificatePublicKeySha256;
}
if (bean.pinnedPeerCertificateSha256 == null || bean.pinnedPeerCertificateSha256.isEmpty() &&
!pinnedPeerCertificateSha256.isEmpty()) {
bean.pinnedPeerCertificateSha256 = pinnedPeerCertificateSha256;
}
bean.echEnabled = echEnabled;
bean.echConfig = echConfig;
}
@NotNull
@Override
public TrustTunnelBean clone() {
return KryoConverters.deserialize(new TrustTunnelBean(), KryoConverters.serialize(this));
}
public static final Creator CREATOR = new CREATOR<>() {
@NonNull
@Override
public TrustTunnelBean newInstance() {
return new TrustTunnelBean();
}
@Override
public TrustTunnelBean[] newArray(int size) {
return new TrustTunnelBean[size];
}
};
@Override
public boolean isInsecure() {
if (Libexclavecore.isLoopbackIP(serverAddress) || serverAddress.equals("localhost")) {
return false;
}
if (!allowInsecure) {
return false;
}
if (!serverNameToVerify.isEmpty()) {
return false;
}
return true;
}
}