Global Proxy for Android

Only iptables needs to be run as root. Running daemons as root is a security risk.

As pid files created by daemons in previous version are owned by root, daemons run as unprivilleged user are not able to access it any more. Hence, the app data may need to be cleared (although I have not test whether it would work without a data clearing).

In some android 5,redsock will say about "too many open files",and does not work, because redsocks open socket connect too many than $(ulimit -n) so I add "ulimit -HSn 4096" let it be enough. poor English.Let me describe in Chinese. 我用了很多安卓手机，发现在许多安卓5上，会出现成功转发了数据包却没有成功代理， 于是把redsocks改成调试模式，发现"too many open files" 虽然不明白默认的上限$(ulimit -n)1024为什么会不够， 但是我把上限设置成4倍ulimit -HSn 4096，问题就不再出现了，

Hi,

I added some missing directories from your Mercurial repository on GoogleCode, and commented a line which makes compilation fail with the 'ant' compiler (ie. the command line).

Regards, Valentin

I am developer of VProxy, an HTTPS Forward proxy hidden in HTTPS web site.

VProxy pretends to be an HTTPS web site and only handles HTTPS proxy requests when the supplied credentials are valid. VProxy does not support challenge–response authentication for its HTTPS proxy because that would make it possible to detect it is running an HTTPS proxy.

As a result, VProxy works as reverse proxy when the credentials in HTTPS proxy request are missing or invalid. In this case, VProxy does not response HTTP error code 401 or 407 error challenge–response authentication will not be triggered.

This PR set basic authentization header by default when username and password are supplied. It will not break exsiting logic -- for classic http proxy when they response 401/407 error, the previous logic is applied.

if client requests with absolute uri: GET http://www.github.com HTTP/1.1 Host: www.github.com

tcp-relay will redirect it as: GET http://http://www.github.com HTTP/1.1 Host: www.github.com

On a userdebug build device with magisk installed, two su files exist on the same system:

• /system/xbin/su - added by userdebug config, restricted to root and shell users
• /sbin/su - added by magisk

Despite the fact that magisk's su is available, the default logic will attempt to test for /system/xbin/su first, resulting in a failed attempt and empty ScriptRunner result.

Given magisk has gained great popularity over the years, it may worth considering to move /sbin/su to the first of DEFAULT_ROOTS so as to improve the overall compatibility.

SuperSU 2.76 (maybe and some previous beta versions) moves su binary to /su/bin/su. It also makes an empty directory /su/xbin/. Both of them could be the path to get root shell. So now supports su in the following paths:

• /system/bin/su
• /system/xbin/su
• /su/bin/su
• /su/xbin/su

I know that there is HTTPS support in the app but it doesn't work with PAC files which contains something like HTTPS host:port in it. So I've made tiny change to add support to the feature. I didn't test it though.

E/ProxyDroidService(20295): Error setting up port forward during connect E/ProxyDroidService(20295): java.lang.NullPointerException: Attempt to invoke virtual method 'int java.lang.String.length()' on a null object reference E/ProxyDroidService(20295): at org.proxydroid.ProxyDroidService.enableProxy(ProxyDroidService.java:263) E/ProxyDroidService(20295): at org.proxydroid.ProxyDroidService.handleCommand(ProxyDroidService.java:394) E/ProxyDroidService(20295): at org.proxydroid.ProxyDroidService$3.run(ProxyDroidService.java:715) E/ProxyDroidService(20295): at java.lang.Thread.run(Thread.java:818)

China routes are gotten from https://github.com/17mon/china_ip_list Shrinked for better performance by remove subnets which have netmasks >= 20.

Tested on two phone: Nexus 5 and Nexus 5X. Both have rooted stock 6.0.1. No performance issue is found except a longer delay time when enable proxy.

The old CHN route includes some new Google IPs. So I made this pull request.

A new text preference field "certificate" is added to store the certificate. As specified in stunnel, the certificate should be in PEM format, starting with a private key and immediately followed by the corresponding certificate. Plain text certificate should not be included.

The content of such a PEM certificate is to be paste into the 'Certificate' field in the UI. The field will be enabled when proxyType "HTTPS" is selected. For HTTPS proxies which do not require a client certificate, the field may be leave empty.