laantungir/amethyst
1
0
Fork 0
mirror of https://github.com/vitorpamplona/amethyst.git synced 2026-08-11 08:47:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(strictmode): stop CleartextNetworkViolation noise from the Tor SOCKS proxy

Browse Source 
detectCleartextNetwork() is enforced by netd per-UID at the packet level: it
flags any socket whose first bytes aren't a TLS handshake, with no per-host
exemption. Every relay WebSocket tunneled over the embedded Arti Tor SOCKS
proxy on 127.0.0.1:17392 opens with a cleartext SOCKS5 greeting, so the
detector fired constantly on legitimate loopback traffic.

The Network-Security-Config localhost allowlist does NOT silence it — that flag
only governs the voluntary NetworkSecurityPolicy.isCleartextTrafficPermitted()
check that HTTP stacks consult, not netd's packet inspection. The old XML
comment claiming otherwise was wrong.

Drop the detector (the app already permits cleartext globally for ws:// relays,
so it produced little signal) and correct the misleading comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Vitor Pamplona
2026-07-15 10:33:14 -04:00
co-authored by Claude Opus 4.8
parent dfde5336f1
commit ac60b294ed
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
amethyst/src/main/java/com/vitorpamplona/amethyst/service/logging/Logging.kt
+8 -1
View File
@@ -43,7 +43,14 @@ class Logging {
.detectLeakedClosableObjects()
.detectLeakedRegistrationObjects()
.detectFileUriExposure()
.detectCleartextNetwork()
// detectCleartextNetwork() is intentionally NOT enabled. netd enforces it
// per-UID at the packet level (it flags a socket whose first bytes aren't a
// TLS handshake) and there is no per-host exemption. Every relay WebSocket
// tunneled over the embedded Arti Tor SOCKS proxy on 127.0.0.1:17392 opens
// with a cleartext SOCKS5 greeting, so this detector fires constantly on
// legitimate loopback traffic. The Network-Security-Config localhost
// allowlist does NOT silence it — that flag only governs the voluntary
// NetworkSecurityPolicy.isCleartextTrafficPermitted() check, not netd.
.detectContentUriWithoutPermission()
.apply {
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
amethyst/src/main/res/xml/network_security_config.xml
+5 -2
View File
@@ -1,8 +1,11 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
Cleartext traffic is permitted globally so user-configured ws:// relays keep working.
The explicit localhost domain-config silences StrictMode CleartextNetworkViolation
for the Tor SOCKS proxy on 127.0.0.1.
The explicit localhost domain-config keeps NetworkSecurityPolicy.isCleartextTrafficPermitted()
happy for loopback services (the Tor SOCKS proxy on 127.0.0.1:17392, the local Blossom cache
on :24242). Note: this does NOT silence StrictMode's detectCleartextNetwork() — that detector
runs in netd at the packet level and ignores this allowlist, which is why we don't enable it
(see Logging.kt).
-->
<network-security-config>
<base-config cleartextTrafficPermitted="true">