fix(android): allow private LAN pairing · openclaw/openclaw@ec3ac18

Recent Commits to openclaw:main

obviyus · 2026-05-28 · via Recent Commits to openclaw:main

File tree

- main/java/ai/openclaw/app
- test/java/ai/openclaw/app

Original file line number	Diff line number	Diff line change
`@@ -44,7 +44,7 @@ internal fun isLoopbackGatewayHost(`
`44`	`44`	`return isMappedIpv4 && address[12] == 127.toByte()`
`45`	`45`	`}`
`46`	`46`
`47`		`-internal fun isPrivateLanGatewayHost(`
	`47`	`+internal fun isLocalCleartextGatewayHost(`
`48`	`48`	`rawHost: String?,`
`49`	`49`	`allowEmulatorBridgeAlias: Boolean = isAndroidEmulatorRuntime(),`
`50`	`50`	`): Boolean {`

Original file line number	Diff line number	Diff line change
`@@ -632,7 +632,7 @@ class GatewaySession(`
`632`	`632`
`633`	`633`	`private fun shouldPersistBootstrapHandoffTokens(authSource: GatewayConnectAuthSource): Boolean {`
`634`	`634`	`if (authSource != GatewayConnectAuthSource.BOOTSTRAP_TOKEN) return false`
`635`		`-if (isLoopbackGatewayHost(endpoint.host)) return true`
	`635`	`+if (isLocalCleartextGatewayHost(endpoint.host)) return true`
`636`	`636`	`return tls != null`
`637`	`637`	`}`
`638`	`638`
`@@ -1212,9 +1212,7 @@ class GatewaySession(`
`1212`	`1212`	`endpoint: GatewayEndpoint,`
`1213`	`1213`	`tls: GatewayTlsParams?,`
`1214`	`1214`	`): Boolean {`
`1215`		`-if (isLoopbackGatewayHost(endpoint.host)) {`
`1216`		`-return true`
`1217`		`- }`
	`1215`	`+if (isLocalCleartextGatewayHost(endpoint.host)) return true`
`1218`	`1216`	`return tls?.expectedFingerprint?.trim()?.isNotEmpty() == true`
`1219`	`1217`	`}`
`1220`	`1218`	`}`

Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,7 @@ import ai.openclaw.app.gateway.GatewayClientInfo`
`8`	`8`	`import ai.openclaw.app.gateway.GatewayConnectOptions`
`9`	`9`	`import ai.openclaw.app.gateway.GatewayEndpoint`
`10`	`10`	`import ai.openclaw.app.gateway.GatewayTlsParams`
	`11`	`+import ai.openclaw.app.gateway.isLocalCleartextGatewayHost`
`11`	`12`	`import ai.openclaw.app.gateway.isLoopbackGatewayHost`
`12`	`13`	`import android.os.Build`
`13`	`14`
`@@ -35,7 +36,12 @@ class ConnectionManager(`
`35`	`36`	`val stableId = endpoint.stableId`
`36`	`37`	`val stored = storedFingerprint?.trim().takeIf { !it.isNullOrEmpty() }`
`37`	`38`	`val isManual = stableId.startsWith("manual\|")`
`38`		`-val cleartextAllowedHost = isLoopbackGatewayHost(endpoint.host)`
	`39`	`+val cleartextAllowedHost =`
	`40`	`+if (isManual) {`
	`41`	`+ isLocalCleartextGatewayHost(endpoint.host)`
	`42`	`+ } else {`
	`43`	`+ isLoopbackGatewayHost(endpoint.host)`
	`44`	`+ }`
`39`	`45`
`40`	`46`	`if (isManual) {`
`41`	`47`	`if (!manualTlsEnabled && cleartextAllowedHost) return null`

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`package ai.openclaw.app.ui`
`2`	`2`
`3`		`-import ai.openclaw.app.gateway.isLoopbackGatewayHost`
	`3`	`+import ai.openclaw.app.gateway.isLocalCleartextGatewayHost`
`4`	`4`	`import kotlinx.serialization.json.Json`
`5`	`5`	`import kotlinx.serialization.json.JsonObject`
`6`	`6`	`import kotlinx.serialization.json.JsonPrimitive`
`@@ -56,9 +56,9 @@ internal data class GatewayScannedSetupCodeResult(`
`56`	`56`
`57`	`57`	`private val gatewaySetupJson = Json { ignoreUnknownKeys = true }`
`58`	`58`	`private const val remoteGatewaySecurityRule =`
`59`		`-"Tailscale and public mobile nodes require wss:// or Tailscale Serve. ws:// is allowed only for localhost and the Android emulator."`
	`59`	`+"Public gateways require wss:// or Tailscale Serve. ws:// is allowed for localhost, the Android emulator, and private LAN IPs."`
`60`	`60`	`private const val remoteGatewaySecurityFix =`
`61`		`-"Use localhost/the Android emulator, or enable Tailscale Serve / expose a wss:// gateway URL."`
	`61`	`+"Use a private LAN IP for local setup, or enable Tailscale Serve / expose a wss:// gateway URL for remote access."`
`62`	`62`
`63`	`63`	`internal fun resolveGatewayConnectConfig(`
`64`	`64`	`useSetupCode: Boolean,`
`@@ -147,7 +147,7 @@ internal fun parseGatewayEndpointResult(rawInput: String): GatewayEndpointParseR`
`147`	`147`	`return GatewayEndpointParseResult(error = GatewayEndpointValidationError.INVALID_URL)`
`148`	`148`	`}`
`149`	`149`	`val tls = scheme == "wss" \|\| scheme == "https"`
`150`		`-if (!tls && !isLoopbackGatewayHost(host)) {`
	`150`	`+if (!tls && !isLocalCleartextGatewayHost(host)) {`
`151`	`151`	`return GatewayEndpointParseResult(error = GatewayEndpointValidationError.INSECURE_REMOTE_URL)`
`152`	`152`	`}`
`153`	`153`	`val defaultPort = if (tls) 443 else 18789`

Original file line number	Diff line number	Diff line change
`@@ -51,7 +51,7 @@ internal fun buildGatewayDiagnosticsReport(`
`51`	`51`	`Please:`
`52`	`52`	`- pick one route only: same machine, same LAN, Tailscale, or public URL`
`53`	`53`	`- classify this as pairing/auth, TLS trust, wrong advertised route, wrong address/port, or gateway down`
`54`		`- - remember: Tailscale/public mobile routes require wss:// or Tailscale Serve; ws:// is loopback-only`
	`54`	`+ - remember: public routes require wss:// or Tailscale Serve; ws:// is allowed for localhost, the Android emulator, and private LAN IPs`
`55`	`55`	`- quote the exact app status/error below`
`56`	`56`	- tell me whether `openclaw devices list` should show a pending pairing request
`57`	`57`	- if more signal is needed, ask for `openclaw qr --json`, `openclaw devices list`, and `openclaw nodes status`

Original file line number	Diff line number	Diff line change
`@@ -4,8 +4,8 @@ import ai.openclaw.app.LocationMode`
`4`	`4`	`import ai.openclaw.app.SecurePrefs`
`5`	`5`	`import ai.openclaw.app.VoiceWakeMode`
`6`	`6`	`import ai.openclaw.app.gateway.GatewayEndpoint`
	`7`	`+import ai.openclaw.app.gateway.isLocalCleartextGatewayHost`
`7`	`8`	`import ai.openclaw.app.gateway.isLoopbackGatewayHost`
`8`		`-import ai.openclaw.app.gateway.isPrivateLanGatewayHost`
`9`	`9`	`import ai.openclaw.app.protocol.OpenClawCallLogCommand`
`10`	`10`	`import ai.openclaw.app.protocol.OpenClawCameraCommand`
`11`	`11`	`import ai.openclaw.app.protocol.OpenClawCapability`
`@@ -109,7 +109,7 @@ class ConnectionManagerTest {`
`109`	`109`	`}`
`110`	`110`
`111`	`111`	`@Test`
`112`		`-fun resolveTlsParamsForEndpoint_manualPrivateLanForcesTlsWhenToggleIsOff() {`
	`112`	`+fun resolveTlsParamsForEndpoint_manualPrivateLanRespectsManualTlsToggle() {`
`113`	`113`	`val endpoint = GatewayEndpoint.manual(host = "192.168.1.20", port = 18789)`
`114`	`114`
`115`	`115`	`val params =`
`@@ -119,9 +119,7 @@ class ConnectionManagerTest {`
`119`	`119`	`manualTlsEnabled = false,`
`120`	`120`	`)`
`121`	`121`
`122`		`- assertEquals(true, params?.required)`
`123`		`- assertNull(params?.expectedFingerprint)`
`124`		`- assertEquals(false, params?.allowTOFU)`
	`122`	`+ assertNull(params)`
`125`	`123`	`}`
`126`	`124`
`127`	`125`	`@Test`
`@@ -245,11 +243,11 @@ class ConnectionManagerTest {`
`245`	`243`	`}`
`246`	`244`
`247`	`245`	`@Test`
`248`		`-fun isPrivateLanGatewayHost_acceptsLanIpsButRejectsMdnsAndTailnetHosts() {`
`249`		`- assertTrue(isPrivateLanGatewayHost("192.168.1.20"))`
`250`		`- assertFalse(isPrivateLanGatewayHost("gateway.local"))`
`251`		`- assertFalse(isPrivateLanGatewayHost("100.64.0.9"))`
`252`		`- assertFalse(isPrivateLanGatewayHost("gateway.tailnet.ts.net"))`
	`246`	`+fun isLocalCleartextGatewayHost_acceptsLanIpsButRejectsMdnsAndTailnetHosts() {`
	`247`	`+ assertTrue(isLocalCleartextGatewayHost("192.168.1.20"))`
	`248`	`+ assertFalse(isLocalCleartextGatewayHost("gateway.local"))`
	`249`	`+ assertFalse(isLocalCleartextGatewayHost("100.64.0.9"))`
	`250`	`+ assertFalse(isLocalCleartextGatewayHost("gateway.tailnet.ts.net"))`
`253`	`251`	`}`
`254`	`252`
`255`	`253`	`@Test`

Original file line number	Diff line number	Diff line change
`@@ -99,9 +99,18 @@ class GatewayConfigResolverTest {`
`99`	`99`	`}`
`100`	`100`
`101`	`101`	`@Test`
`102`		`-fun parseGatewayEndpointRejectsPrivateLanCleartextWsUrls() {`
	`102`	`+fun parseGatewayEndpointAllowsPrivateLanCleartextWsUrls() {`
`103`	`103`	`val parsed = parseGatewayEndpoint("ws://192.168.1.20:18789")`
`104`		`- assertNull(parsed)`
	`104`	`+`
	`105`	`+ assertEquals(`
	`106`	`+GatewayEndpointConfig(`
	`107`	`+ host = "192.168.1.20",`
	`108`	`+ port = 18789,`
	`109`	`+ tls = false,`
	`110`	`+ displayUrl = "http://192.168.1.20:18789",`
	`111`	`+ ),`
	`112`	`+ parsed,`
	`113`	`+ )`
`105`	`114`	`}`
`106`	`115`
`107`	`116`	`@Test`
`@@ -146,9 +155,13 @@ class GatewayConfigResolverTest {`
`146`	`155`	`}`
`147`	`156`
`148`	`157`	`@Test`
`149`		`-fun parseGatewayEndpointRejectsLinkLocalIpv6ZoneCleartextWsUrls() {`
	`158`	`+fun parseGatewayEndpointAllowsLinkLocalIpv6ZoneCleartextWsUrls() {`
`150`	`159`	`val parsed = parseGatewayEndpoint("ws://[fe80::1%25eth0]")`
`151`		`- assertNull(parsed)`
	`160`	`+`
	`161`	`+ assertEquals("fe80::1%25eth0", parsed?.host)`
	`162`	`+ assertEquals(18789, parsed?.port)`
	`163`	`+ assertEquals(false, parsed?.tls)`
	`164`	`+ assertEquals("http://[fe80::1%25eth0]:18789", parsed?.displayUrl)`
`152`	`165`	`}`
`153`	`166`
`154`	`167`	`@Test`
`@@ -249,6 +262,16 @@ class GatewayConfigResolverTest {`
`249`	`262`	`assertNull(resolved)`
`250`	`263`	`}`
`251`	`264`
	`265`	`+ @Test`
	`266`	`+fun resolveScannedSetupCodeAcceptsPrivateLanCleartextGateway() {`
	`267`	`+val setupCode =`
	`268`	`+ encodeSetupCode("""{"url":"ws://192.168.31.100:18789","bootstrapToken":"bootstrap-1"}""")`
	`269`	`+`
	`270`	`+val resolved = resolveScannedSetupCode(setupCode)`
	`271`	`+`
	`272`	`+ assertEquals(setupCode, resolved)`
	`273`	`+ }`
	`274`	`+`
`252`	`275`	`@Test`
`253`	`276`	`fun resolveScannedSetupCodeResultFlagsInsecureRemoteGateway() {`
`254`	`277`	`val setupCode =`
`@@ -277,10 +300,19 @@ class GatewayConfigResolverTest {`
`277`	`300`	`}`
`278`	`301`
`279`	`302`	`@Test`
`280`		`-fun parseGatewayEndpointResultFlagsInsecureLanCleartextGateway() {`
	`303`	`+fun parseGatewayEndpointResultAllowsPrivateLanCleartextGateway() {`
`281`	`304`	`val parsed = parseGatewayEndpointResult("ws://192.168.1.20:18789")`
`282`		`- assertNull(parsed.config)`
`283`		`- assertEquals(GatewayEndpointValidationError.INSECURE_REMOTE_URL, parsed.error)`
	`305`	`+`
	`306`	`+ assertEquals(`
	`307`	`+GatewayEndpointConfig(`
	`308`	`+ host = "192.168.1.20",`
	`309`	`+ port = 18789,`
	`310`	`+ tls = false,`
	`311`	`+ displayUrl = "http://192.168.1.20:18789",`
	`312`	`+ ),`
	`313`	`+ parsed.config,`
	`314`	`+ )`
	`315`	`+ assertNull(parsed.error)`
`284`	`316`	`}`
`285`	`317`
`286`	`318`	`@Test`
`@@ -421,7 +453,7 @@ class GatewayConfigResolverTest {`
`421`	`453`	`}`
`422`	`454`
`423`	`455`	`@Test`
`424`		`-fun resolveGatewayConnectConfigRejectsPrivateLanManualCleartextEndpoint() {`
	`456`	`+fun resolveGatewayConnectConfigAllowsPrivateLanManualCleartextEndpoint() {`
`425`	`457`	`val resolved =`
`426`	`458`	`resolveGatewayConnectConfig(`
`427`	`459`	`useSetupCode = false,`
`@@ -437,7 +469,9 @@ class GatewayConfigResolverTest {`
`437`	`469`	`fallbackPassword = "",`
`438`	`470`	`)`
`439`	`471`
`440`		`- assertNull(resolved)`
	`472`	`+ assertEquals("192.168.31.100", resolved?.host)`
	`473`	`+ assertEquals(18789, resolved?.port)`
	`474`	`+ assertEquals(false, resolved?.tls)`
`441`	`475`	`}`
`442`	`476`
`443`	`477`	`@Test`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main

File tree