GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship. It works by intercepting HTTPS CONNECT tunnels, detecting the TLS ClientHello, and splitting it into fragments (either TCP segments or valid TLS records) so that the SNI (Server Name Indication) containing the target hostname never appears whole in a single packet. DNS resolution is performed over encrypted channels (DoH/DoT) to prevent ISP-level blocking. The repository contains a complete TypeScript rewrite of the engine, a CLI tool (`gt`), and an Electron desktop app. The engine is deliberately separated from the OS proxy configuration (handled by `SystemProxy`) and from the CLI output, making it testable and crash-safe. The codebase demonstrates strong engineering practices: proper error handling (no silent catch-and-return), backpressure-aware socket writes, framing-aware HTTP request rewriting, and a crash-proof system-proxy snapshot/restore mechanism. The desktop app features a live log panel with virtual scrolling, a tray icon, and a modal star/share prompt scheduled over three asks. The repository is actively maintained with modern tooling (Node 24, TypeScript 6, Electron 43, Vitest 4) and has a comprehensive test suite and CI/CD pipeline.
This repository is a toolchain for generating Apple Configuration Profiles (.mobileconfig) that configure DNS over HTTPS (DoH) and DNS over TLS (DoT) on iOS, iPadOS, and macOS devices. It maintains a curated registry of public encrypted DNS providers (e.g., AdGuard, Cloudflare, Quad9, CleanBrowsing) with metadata such as server addresses, filtering capabilities, and region. The build pipeline reads provider definitions from JSON files under src/, generates unsigned profiles in profiles/, optionally signs them with CMS digital signatures using a user-provided ECC certificate, and places signed versions in signed/. It also produces multi-language README files (English, Simplified Chinese, Traditional Chinese) with provider tables and installation links. The architecture is a set of TypeScript scripts executed via npm commands (build, sign, new, test). There is no runtime server or daemon; the output is static files intended for manual installation by end users. The interactive CLI (npm run new) guides users through creating new provider profiles with validation and optional signing. The codebase demonstrates solid engineering practices: deterministic UUIDs (v5) for stable profile identifiers, CMS signing with both Node.js crypto and OpenSSL parity tests, and a modular design that separates provider data, language templates, and build logic. While the repository is primarily a build tool, it also serves as a reference for encrypted DNS provider capabilities and a practical solution for deploying encrypted DNS on Apple devices. The signed profiles provide authenticity verification, and the multi-language support broadens accessibility. The code is well-structured and maintainable, though it relies on external certificates for signing and manual updates to provider data when server endpoints change.