cebc9a1c4f
fix(client/macos+server): 隧道运行时打通——DNS 劫持 + 死锁/空指针修复
...
接续 447f3f4(系统扩展可加载),修复"扩展能起但连上无法上网"的运行时问题,
现已在 macOS 15(cara)端到端连通:出口=节点 IP、国外站可达、DNS 经隧道解析。
服务端(clientconfig.go):
- route.rules 首条加 {"action":"hijack-dns","port":[53]}(排在 LAN 直连规则前)。
否则发往隧道 DNS(172.19.0.2:53)的查询被 172.16.0.0/12 吞去直连,域名解析失败。
sing-box 1.13 按端口劫持(protocol:dns 需先 sniff,不稳)。
客户端——保留三个真 bug 修复:
- startTunnel 的 libbox 启动移到后台队列:避免在 provider 队列同步阻塞,与
openTun→setTunnelNetworkSettings 回调三方死锁(隧道永远卡 connecting)。
- startOrReloadService(options:) 传非空 LibboxOverrideOptions():传 nil 致空指针 SIGSEGV。
- startDefaultInterfaceMonitor 阻塞到首个 path 更新再返回:修 "no available network interface"。
- 清除排障期临时诊断代码;CFBundleVersion 递增(sysextd 按版本去重)。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
2026-06-22 08:57:55 +08:00
447f3f494e
feat(client/macos): P1 原生隧道——PacketTunnel 系统扩展可加载 + libbox 运行
...
经长链路排查(同机对照可工作的 Tailscale),修复 macOS 系统扩展 realize
失败(OSSystemExtensionErrorDomain code=4)与 libbox 运行时崩溃,使内嵌
sing-box 的系统扩展能在 macOS 15 上激活并启动隧道。
系统扩展 realize(三个叠加根因):
- 扩展自包含:PacketTunnel 加 OTHER_LDFLAGS="" 切断对项目级 CocoaPods 链接
标志的继承(原会把 flutter_secure_storage 链进扩展);Libbox.xcframework
改纯 Link(静态),从 Embed Frameworks 移除冗余内嵌
- bundle 名 = 标识符:PRODUCT_NAME 设为 com.pangolin.pangolin.PacketTunnel
- 扩展 Info.plist 补 NSSystemExtensionUsageDescription(网络扩展类别强制要求)
- App Group 改 macOS 原生格式 BYL4KQHMTN.com.pangolin.pangolin;NEMachServiceName
以其为前缀;扩展补 network.client/server;get-task-allow=false + 签名加 --timestamp
- CFBundleVersion 随构建递增(否则 sysextd 视为同版本不更新)
libbox 运行时:
- startOrReloadService(options:) 传 nil 致空指针 SIGSEGV → 传 LibboxOverrideOptions()
- 默认接口监控阻塞到首个 path 更新再返回,修 "no available network interface"
配套:
- scripts/local_test.sh:build/sign/notarize/copy/run 一条龙(Developer ID + 公证)
- client/macos/sign_libbox.sh:构建期以 Developer ID 重签内嵌 Libbox
- VpnChannel:401 自动刷新 token、详尽 os_log;auth/api 统一走 kApiBaseUrl
- docs/macos-sysext-realize-troubleshooting.html:完整踩坑复盘
WIP / 临时(后续清理):
- 隧道运行时仍在排查:剥离远程 rule-set 后 sing-box 启动卡点未定位
- 含临时诊断代码:main.swift stderr 重定向、box.log 输出、rule-set 剥离、debug 日志
- api_config 仍指向联调节点,发版前还原
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_01JEHzjEcFzvGwgbxT6Wbt6c
2026-06-21 21:18:33 +08:00
f2a4290602
feat(client/macos): PacketTunnel 转 System Extension(构建通过)
...
ci-pangolin / Lint — shellcheck (push) Has been cancelled
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
macOS 站外加载隧道必须 sysext(appex 仅 App Store 可加载)。转换:
- productType app-extension→system-extension;产物 .appex→.systemextension
- 嵌入路径 PlugIns→Contents/Library/SystemExtensions(SYSTEM_EXTENSIONS_FOLDER_PATH)
- main.swift 入口(NEProvider.startSystemExtensionMode + dispatchMain;sysext 是
可执行程序,需显式 main 而非 appex 的 NSExtensionMain)
- Info.plist 加 NEMachServiceName;entitlement 换回 packet-tunnel-provider-systemextension
CFBundlePackageType 自动 SYSX,Build Succeeded(关签名)。运行还需 Developer ID
签名 + systemextensionsctl developer on + OSSystemExtensionRequest 激活。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-19 15:51:29 +08:00
b621d1754a
feat(client/macos): PacketTunnelProvider libbox 集成(编译+链接通过)
...
ci-pangolin / Lint — shellcheck (push) Has been cancelled
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
CommandServer 装配(LibboxSetup→NewCommandServer→start→startOrReloadService)+
完整 LibboxPlatformInterface:openTun(TunOptions→NEPacketTunnelNetworkSettings,
getpeername+utun ctl_id 取 fd)、默认接口监控(NWPathMonitor)、接口枚举、socket
绑定;LibboxCommandServerHandler 回调。
gomobile 桥接要点:实现接口用 XxxProtocol、接口型参数/返回用 (any XxxProtocol)、
三个方法被 Swift 重命名(autoDetectControl/send/usePlatformAutoDetectControl)、
CTLIOCGINFO 按 _IOWR 定义计算。
链接需补系统框架:SystemConfiguration + AppKit + libresolv(libbox 内部
系统代理/网络监控代码引用)。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-19 15:20:50 +08:00
8367984e23
fix(client/macos): PacketTunnelProvider 改用 completion-handler 绕开 Swift 6.2 编译器崩溃
...
ci-pangolin / Lint — shellcheck (push) Has been cancelled
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Swift 6.2.3 在为 async 重写的 startTunnel 生成 ObjC 桥接 thunk 时崩溃
(emitInjectLoadableEnum)。改用 completion-handler 形式(直接是 @objc 原型)
绕开。startTunnel/stopTunnel/handleAppMessage 三个 override 同步改。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-19 14:30:11 +08:00
7e92a9a711
fix(client/macos): PacketTunnel 开发期用 appex NE 变体 packet-tunnel-provider
...
ci-pangolin / Lint — shellcheck (push) Has been cancelled
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
Xcode 把 target 建成 App Extension(.appex);sysext 变体 -systemextension 在
Apple Development 自动签名下签不了。开发期改用 appex 变体能编/签/本机调试;
上线转 System Extension + Developer ID 时再换回 -systemextension(注释已记)。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-19 14:20:21 +08:00
07272f5610
fix(client/macos): P1 骨架修正 — bundle id 统一 PacketTunnel + Info.plist 精简
...
ci-pangolin / Lint — shellcheck (push) Has been cancelled
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
- VpnChannel/Provider: 扩展 bundle id 统一为 com.pangolin.pangolin.PacketTunnel
(对齐 Xcode 新建 target 的实际 id)
- PacketTunnel/Info.plist: 去掉重复 CFBundlePackageType + 多余 NEMachServiceName,
只保留 NEProviderClasses(其余标准键由 GENERATE_INFOPLIST_FILE 合并)
- .gitignore: 忽略 Frameworks/Libbox.xcframework(204MB,build-libbox.sh 产出)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-19 13:50:51 +08:00
b25c8bbc2c
feat(client/macos): P1 方案B 骨架 — System Extension + NETunnelProviderManager 接线
...
ci-pangolin / Lint — shellcheck (push) Has been cancelled
ci-pangolin / OpenAPI Sync Check (push) Has been cancelled
ci-pangolin / Redline Scan — 脱敏 (UI 文案) (push) Has been cancelled
ci-pangolin / Flutter — analyze + test (push) Has been cancelled
把 PoC 的 sudo sing-box 外部二进制换成自包含、免 root 的 NEPacketTunnelProvider
(System Extension)+ 嵌入 libbox 的生产架构铺好骨架(不破坏现有 PoC 构建)。
- PacketTunnel/:扩展 target 源 — PacketTunnelProvider(LibboxSetup→NewService→start,
openTun 建 NEPacketTunnelNetworkSettings)、Info.plist(NEProviderClasses)、
entitlements(packet-tunnel-provider-systemextension + App Group)
- Runner/VpnChannel.swift:主 app 经 NETunnelProviderManager 启停 + 状态/速率回传,
对齐 Dart 侧 VpnNativeBridge 的 pangolin/vpn channel 契约
- vpn_bridge_provider.dart:kUseNativeVpnMacOS 开关(默认 false,联调通过后置 true)
- docs/p1-macos-system-extension.md:文件清单 + Xcode/签名步骤 + 待办
(Team BYL4KQHMTN;Network Extensions 已确认自助开通、无需 Apple 审批)
非破坏:新源文件未入 build target、注册行/app-group entitlements 均注释、gate 默认 false。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-19 11:07:36 +08:00
wangjia