37 lines
1.9 KiB
Markdown
37 lines
1.9 KiB
Markdown
# tlskit
|
|
|
|
The HTTP/TLS client shared by the Android 2.2/2.3 apps: [Plexamp Lite](https://git.anosanube.ovh/xocko/plexamp-lite),
|
|
[Podlite](https://git.anosanube.ovh/xocko/podlite), [Noticias Lite](https://git.anosanube.ovh/xocko/noticias-lite)
|
|
and [Calendar Lite](https://git.anosanube.ovh/xocko/calendar-lite).
|
|
|
|
Android 2.x's own SSL stops at TLS 1.0 and lacks today's root certificates, so modern `https://` servers
|
|
(Let's Encrypt, Pangolin, Cloudflare…) refuse it. This kit brings its own TLS 1.2 instead:
|
|
|
|
- `net/Http.java`: a small HTTP/1.1 client on Bouncy Castle TLS 1.2 (renamed to `com.minamp.bc`, so it
|
|
doesn't clash with the old copy inside Android), with keep-alive pooling, session resumption and
|
|
chunked bodies
|
|
- `net/CertVerifier.java`: host name, validity dates and the chain up to a bundled Mozilla root; optionally one
|
|
pinned leaf certificate (SHA-256) for self-signed servers, with the fingerprint shown so the user can confirm it
|
|
- `net/AssetRoots.java` + `roots/`: Mozilla's root store (121 roots) as `assets/roots/<sha1(subject)>-<n>.der`
|
|
- `net/Threads.java`: threads with a 256 KB stack. Network work on Android 2.x must run on one, or the
|
|
handshake overflows the default stack
|
|
- `net/DiagLog.java`: connection log, with tokens removed from URLs
|
|
|
|
## Use
|
|
|
|
```sh
|
|
./install.sh <app dir> <java package> # e.g. ./install.sh ../noticias-lite org.freshmini.net
|
|
```
|
|
|
|
It copies `net/` into the app under that package and `roots/` into the app's `assets/`. Calendar Lite keeps
|
|
its copy under `android/org/gingercal/net` (copy by hand there). The apps carry copies, not a dependency:
|
|
when changing the kit, change it here and reinstall it into every app.
|
|
|
|
The Bouncy Castle sources come from Plexamp Lite's `tools/setup_toolchain.sh` (`~/android-toolchain/bcsrc`);
|
|
roots are regenerated with its `tools/make_roots.py`.
|
|
|
|
## Test
|
|
|
|
`test/KitTest.java` runs the client on a desktop JVM against real servers (FreshRSS, Nextcloud,
|
|
Audiobookshelf).
|