wangjia
fb1ef9ba01
VpnChannel.activateSystemExtensionIfNeeded 实装:start 前请求系统加载/更新 PacketTunnel sysext;首启弹「隐私与安全性」待用户允许(await 阻塞到批准, 扩展没加载隧道起不来)。SysExtActivationDelegate 处理 finish/fail/replace。 至此 macOS 原生 VPN 栈构建完整:Runner 嵌入 sysext 到 Contents/Library/SystemExtensions,编译全过。运行待:sysext 签名放行 + systemextensionsctl developer on(或 Developer ID 公证)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
201 lines
9.2 KiB
Swift
201 lines
9.2 KiB
Swift
// VpnChannel.swift — 主 app 侧 VPN 控制(方案B / P1 骨架)
|
||
//
|
||
// 把 Flutter 的 pangolin/vpn(MethodChannel)+ pangolin/vpn/status、pangolin/vpn/stats
|
||
// (EventChannel)接到 NETunnelProviderManager:安装/启停 PacketTunnel System Extension、
|
||
// 回传状态与速率。契约对齐 client/lib/bridge/vpn_bridge.dart 的 VpnNativeBridge。
|
||
//
|
||
// 注册:在 MainFlutterWindow.awakeFromNib 里 `VpnChannel.register(with: flutterViewController)`。
|
||
//
|
||
// ⚠️ 站外分发首启需先**激活 System Extension**(OSSystemExtensionRequest,见
|
||
// activateSystemExtensionIfNeeded + 安装文档步骤 4),用户会在「系统设置→隐私与安全性」
|
||
// 点允许;激活成功后 NETunnelProviderManager 才能加载该 provider。
|
||
|
||
import FlutterMacOS
|
||
import NetworkExtension
|
||
import SystemExtensions
|
||
|
||
// NSLog 兼容老部署目标(Runner < macOS 11,os.Logger 不可用)。
|
||
private func vpnLog(_ message: String) { NSLog("[pangolin/vpn] %@", message) }
|
||
|
||
final class VpnChannel: NSObject {
|
||
private static let tunnelBundleId = "com.pangolin.pangolin.PacketTunnel"
|
||
|
||
private var statusSink: FlutterEventSink?
|
||
private var statsSink: FlutterEventSink?
|
||
private var statusObserver: NSObjectProtocol?
|
||
private var statsTimer: Timer?
|
||
private var manager: NETunnelProviderManager?
|
||
private var sysextDelegate: SysExtActivationDelegate?
|
||
|
||
static func register(with registrar: FlutterPluginRegistrar) {
|
||
let instance = VpnChannel()
|
||
let method = FlutterMethodChannel(name: "pangolin/vpn",
|
||
binaryMessenger: registrar.messenger)
|
||
method.setMethodCallHandler(instance.handle)
|
||
|
||
FlutterEventChannel(name: "pangolin/vpn/status", binaryMessenger: registrar.messenger)
|
||
.setStreamHandler(StatusStreamHandler(owner: instance))
|
||
FlutterEventChannel(name: "pangolin/vpn/stats", binaryMessenger: registrar.messenger)
|
||
.setStreamHandler(StatsStreamHandler(owner: instance))
|
||
|
||
instance.observeStatus()
|
||
}
|
||
|
||
// ── MethodChannel ───────────────────────────────────────────────
|
||
private func handle(_ call: FlutterMethodCall, _ result: @escaping FlutterResult) {
|
||
switch call.method {
|
||
case "start":
|
||
guard let configJson = call.arguments as? String else {
|
||
result(FlutterError(code: "bad_args", message: "expected config json", details: nil))
|
||
return
|
||
}
|
||
Task { await self.start(configJson, result) }
|
||
case "stop":
|
||
Task { await self.stop(result) }
|
||
case "getStatus":
|
||
result(Self.statusString(manager?.connection.status ?? .invalid))
|
||
case "selectOutbound":
|
||
// TODO: 经 sendProviderMessage / libbox CommandClient 切 outbound。
|
||
result(nil)
|
||
case "getActiveOutbound":
|
||
result("auto")
|
||
case "setKillSwitch":
|
||
// includeAllNetworks / on-demand 实现 kill switch(后续)。
|
||
result(nil)
|
||
default:
|
||
result(FlutterMethodNotImplemented)
|
||
}
|
||
}
|
||
|
||
private func start(_ configJson: String, _ result: @escaping FlutterResult) async {
|
||
do {
|
||
try await activateSystemExtensionIfNeeded()
|
||
let mgr = try await loadOrCreateManager()
|
||
self.manager = mgr
|
||
try mgr.connection.startVPNTunnel(options: [
|
||
"configContent": configJson as NSString,
|
||
])
|
||
result(nil)
|
||
} catch {
|
||
vpnLog("start failed: \(error.localizedDescription)")
|
||
result(FlutterError(code: "start_failed", message: error.localizedDescription, details: nil))
|
||
}
|
||
}
|
||
|
||
private func stop(_ result: @escaping FlutterResult) async {
|
||
manager?.connection.stopVPNTunnel()
|
||
result(nil)
|
||
}
|
||
|
||
// ── NETunnelProviderManager 装配 ────────────────────────────────
|
||
private func loadOrCreateManager() async throws -> NETunnelProviderManager {
|
||
let all = try await NETunnelProviderManager.loadAllFromPreferences()
|
||
let mgr = all.first ?? NETunnelProviderManager()
|
||
let proto = (mgr.protocolConfiguration as? NETunnelProviderProtocol) ?? NETunnelProviderProtocol()
|
||
proto.providerBundleIdentifier = Self.tunnelBundleId
|
||
proto.serverAddress = "Pangolin" // 仅展示用
|
||
mgr.protocolConfiguration = proto
|
||
mgr.localizedDescription = "Pangolin"
|
||
mgr.isEnabled = true
|
||
try await mgr.saveToPreferences()
|
||
try await mgr.loadFromPreferences() // 保存后重载,拿到有效 connection
|
||
return mgr
|
||
}
|
||
|
||
// 请求系统加载/更新 PacketTunnel System Extension。首启系统会弹「隐私与安全性」
|
||
// 让用户允许;允许后 didFinishWithResult 回来。已是最新则快速完成。
|
||
private func activateSystemExtensionIfNeeded() async throws {
|
||
try await withCheckedThrowingContinuation { (cont: CheckedContinuation<Void, Error>) in
|
||
let req = OSSystemExtensionRequest.activationRequest(
|
||
forExtensionWithIdentifier: Self.tunnelBundleId, queue: .main)
|
||
let delegate = SysExtActivationDelegate(continuation: cont)
|
||
self.sysextDelegate = delegate // 保活到回调结束
|
||
req.delegate = delegate
|
||
OSSystemExtensionManager.shared.submitRequest(req)
|
||
}
|
||
}
|
||
|
||
// ── 状态 / 速率回传 ─────────────────────────────────────────────
|
||
private func observeStatus() {
|
||
statusObserver = NotificationCenter.default.addObserver(
|
||
forName: .NEVPNStatusDidChange, object: nil, queue: .main
|
||
) { [weak self] note in
|
||
guard let conn = note.object as? NEVPNConnection else { return }
|
||
self?.statusSink?(Self.statusString(conn.status))
|
||
}
|
||
}
|
||
|
||
fileprivate func onStatusListen(_ sink: @escaping FlutterEventSink) {
|
||
statusSink = sink
|
||
sink(Self.statusString(manager?.connection.status ?? .invalid))
|
||
}
|
||
fileprivate func onStatusCancel() { statusSink = nil }
|
||
|
||
fileprivate func onStatsListen(_ sink: @escaping FlutterEventSink) {
|
||
statsSink = sink
|
||
// TODO(P1): 接 libbox CommandClient 订阅实时速率;骨架先每秒推占位 0。
|
||
statsTimer = Timer.scheduledTimer(withTimeInterval: 1, repeats: true) { [weak self] _ in
|
||
self?.statsSink?(["up": 0, "down": 0, "uplinkTotal": 0, "downlinkTotal": 0])
|
||
}
|
||
}
|
||
fileprivate func onStatsCancel() { statsTimer?.invalidate(); statsTimer = nil; statsSink = nil }
|
||
|
||
private static func statusString(_ s: NEVPNStatus) -> String {
|
||
switch s {
|
||
case .connected: return "on"
|
||
case .connecting, .reasserting: return "connecting"
|
||
case .disconnecting: return "disconnecting"
|
||
case .disconnected, .invalid: return "off"
|
||
@unknown default: return "error"
|
||
}
|
||
}
|
||
}
|
||
|
||
// EventChannel 流处理器。
|
||
private final class StatusStreamHandler: NSObject, FlutterStreamHandler {
|
||
weak var owner: VpnChannel?
|
||
init(owner: VpnChannel) { self.owner = owner }
|
||
func onListen(withArguments _: Any?, eventSink events: @escaping FlutterEventSink) -> FlutterError? {
|
||
owner?.onStatusListen(events); return nil
|
||
}
|
||
func onCancel(withArguments _: Any?) -> FlutterError? { owner?.onStatusCancel(); return nil }
|
||
}
|
||
|
||
private final class StatsStreamHandler: NSObject, FlutterStreamHandler {
|
||
weak var owner: VpnChannel?
|
||
init(owner: VpnChannel) { self.owner = owner }
|
||
func onListen(withArguments _: Any?, eventSink events: @escaping FlutterEventSink) -> FlutterError? {
|
||
owner?.onStatsListen(events); return nil
|
||
}
|
||
func onCancel(withArguments _: Any?) -> FlutterError? { owner?.onStatsCancel(); return nil }
|
||
}
|
||
|
||
// System Extension 激活请求回调。首启需用户在「系统设置→隐私与安全性」允许,
|
||
// 允许后收到 didFinishWithResult(故 await 会阻塞到用户批准 —— 这是对的,
|
||
// 扩展没加载前隧道起不来)。
|
||
private final class SysExtActivationDelegate: NSObject, OSSystemExtensionRequestDelegate {
|
||
private let continuation: CheckedContinuation<Void, Error>
|
||
private var resumed = false
|
||
init(continuation: CheckedContinuation<Void, Error>) { self.continuation = continuation }
|
||
|
||
func request(_ request: OSSystemExtensionRequest,
|
||
didFinishWithResult result: OSSystemExtensionRequest.Result) {
|
||
guard !resumed else { return }
|
||
resumed = true
|
||
continuation.resume()
|
||
}
|
||
func request(_ request: OSSystemExtensionRequest, didFailWithError error: Error) {
|
||
guard !resumed else { return }
|
||
resumed = true
|
||
continuation.resume(throwing: error)
|
||
}
|
||
func requestNeedsUserApproval(_ request: OSSystemExtensionRequest) {
|
||
vpnLog("system extension 待用户允许(系统设置 → 隐私与安全性)")
|
||
}
|
||
func request(_ request: OSSystemExtensionRequest,
|
||
actionForReplacingExtension existing: OSSystemExtensionProperties,
|
||
withExtension ext: OSSystemExtensionProperties) -> OSSystemExtensionRequest.ReplacementAction {
|
||
.replace
|
||
}
|
||
}
|