直连代理

Github-direct is an LSPosed/Xposed module for Android root environments. It provides selective direct connections to bypass DNS pollution, IP blocking, and TLS ClientHello interference for platforms like GitHub, Google, YouTube, Discord, and OpenAI. It does this without decrypting HTTPS or modifying SNI/certificates by default. For browsers/Electron-like hosts, an optional per-device CA + ECH-verified TLS termination can be enabled if ClientHello fragmentation alone is insufficient.

Supported platforms (baseline)

- GitHub: browser, HTTPS Git, API, Raw, static assets, Release downloads (fully verified). - Google, YouTube, Discord, OpenAI/ChatGPT: integrated with the same candidate/IPv6/TLS data plane; default profiles are marked NEEDS_VERIFY and disabled until device verification is confirmed.

Installation

1. Download and install the APK. 2. Enable the module in LSPosed (min API 101+). 3. In LSPosed, select only the platform clients, host apps, or browsers you want to manage (e.g., GitHub app, browser, Git client). Force stop and restart those apps. 4. Open the Github-direct app and grant root access. 5. In Root UID scope, select the same host packages you enabled in LSPosed. 6. If using a Cronet/Chromium-based client where normal DNS hooks don't apply, also enable "full TLS capture" for that package (do not enable for unrelated apps). 7. Enable services as needed (Google, YouTube, Discord, OpenAI) – they are off by default. 8. Optional: for browser TLS termination, generate and install the per-device CA, then enable the feature. Edge 151+ will have browser CA and DNS policies automatically verified. 9. Enable "auto-start on boot" if desired (off by default).

Basic Usage

- The app has a status page. Confirm: - LSPosed scope and Root UID scope match your selected apps. - Hook heartbeat shows target package names (Java DNS hits may be 0 for Chromium, which is normal). - Root service, active rule generation, and candidate counts are valid. - If TLS termination is enabled, CA shows TRUSTED and local TLS routes >0. - No failure phases or stale rule warnings.

Key Features

- Trusted candidate system: combines fixed IP Wire DoH, local DNS observations, and historical safe snapshots. Candidates must pass TCP, strict SNI, system trust chain, and hostname verification. - Real-IP redirection: for enabled platforms, IPv4 TCP/443 traffic from selected UIDs is intercepted. IPv4 QUIC is rejected/dropped to fall back to TCP. IPv6 remains native by default (except OpenAI NAT64 if explicitly enabled and verified). - TLS relay: caches multi-record ClientHello and routes by virtual IP, whitelisted SNI, or original IP; falls back to direct if unknown. - Candidate race: if the first candidate doesn't succeed within 225ms, the second candidate is raced (only before responding to the client). - Fail-open: stale ipset entries are cleaned automatically; minimal root daemon checks heartbeat and removes only GHD_* chains/rules. - Optional TLS termination: for user-authorized browsers/hosts, per-device CA + strict ECH verification. Edge 147+ CA/platform policies are validated before enabling. - Open NAT64 (optional, off by default): for OpenAI/ChatGPT domains, if the user provides a /96 and exit validation passes (auth edge, ASN, operator), AAAA answers may be suppressed to route clients through the managed IPv4 path.

Security Boundaries

- DNS pollution addresses are never promoted to upstream candidates. - GitHub Meta netblocks are used only for ownership checks and firewall ranges, not scanning. - TLS probes use system trust store and hostname verification – no TrustAll. - CA private key never leaves the app's private directory (root:root 0600); only the public certificate is stored in the APK/Edge policy. Uninstall removes only this module's CA. - TLS termination suffixes must come from explicitly enabled profile tags; real SNI must pass upstream certificate or ECH verification – otherwise the connection is closed. - Hook hot path uses read-only immutable snapshots; exceptions fall back to allowing the connection. - Target processes cannot modify Remote Preferences; the heartbeat endpoint validates token and Binder UID.

Compatibility (current)

- Android 12–16 (minSdk=26, targetSdk=36L) - LSPosed modern API 101+ (compiled with API 102) - Root: Magisk or KernelSU with su, iptables, and ip6tables (full IPv6 support requires ip6tables nat/OUTPUT, owner, REDIRECT, save/restore; if unavailable, only IPv4 is used) - ABIs: arm64-v8a, armeabi-v7a, x86_64 - Data plane: HTTPS/TCP 443; UDP/443 is only for QUIC fallback. Discord Voice UDP/3478 is not in scope.

Limitations

- Only supports Android 12–16 for the initial release scope. - Requires LSPosed and root (Magisk/KernelSU) with working iptables. - UDP/443 is rejected/dropped to force QUIC fallback to TCP – this may affect some QUIC-based services. - Discord Voice UDP/3478 is not handled. - IPv6 support requires full ip6tables NAT capability; if unavailable, only IPv4 redirection works. - Certificate-pinned native apps may still fail; the default path does not decrypt HTTPS. - SSH/22, UDP relay, ECH-ambiguous traffic, public scans, external proxies, and certificate bypass are not in scope. - Open NAT64 is off by default and requires explicit user configuration and validation; it does not guarantee account or application-level access.

Troubleshooting rollback order If issues occur, disable TLS termination first, then roll back in this order:

1. tls_termination (off) 2. tls_fragment_v2 (off) 3. real_ip_redirect (off) 4. adaptive_candidates (off)

License: Apache-2.0