flutter_sangfor_atrust

aTrust-specific connector and protocol implementation for the flutter_sangfor package family. Implements the full aTrust protocol core in pure Dart.

Features

  • HTTPS manifest and authentication-method discovery (/public/manifest, /passport/v1/public/authConfig).
  • Primary password exchange with server-provided RSA parameters.
  • SMS, TOTP, RADIUS, and generic code-challenge support via caller-provided callbacks.
  • Cookie/SID persistence, environment reporting, and online-user lookup.
  • Access checks, enhanced-auth continuation, and device binding.
  • Credential-free session snapshots (ATrustSessionSnapshot).
  • WAN/LAN node-group parsing with normalized tunnel endpoints.
  • Best-node selection (3x TCP latency probe, WAN-then-LAN fallback).
  • Query-IP acquisition of the client virtual IP.
  • L3 tunnel handshake (0x05 0xD0 / 0x53 envelope), VIP parsing, per-flow authenticated data frames with xRequestSig HMAC-SHA256 signing, conntrack TCP state machine with protocol-specific TTLs, heartbeat miss detection, and VIP updates.
  • SOCKS5-like TCP tunnel with dialTcp (raw + reuse modes, EOF signaling).
  • Anti-MITM challenge verification, response signature verification, and certificate identity pinning via SecurityContext.
  • dryRun connections that validate options without network I/O.

Status

Protocol cores are complete and covered by unit tests, but have not been exercised against authorized production deployments yet. See protocol evidence for details.

Usage

final connector = ATrustConnector(
  loginSession: ATrustLoginSession(client: apiClient),
  authMethod: ATrustAuthMethod.password,
);

final session = await connector.connect(
  SangforConnectOptions(
    server: Uri.parse('https://vpn.example.com'),
    username: 'user',
    password: 'password',
    loginDomain: 'default',
    deviceId: 'device-id',
  ),
);

if (session.state == SangforConnectionState.connected) {
  print('Virtual IP: ${session.virtualAddress}');
  // Dial TCP connections through the aTrust TCP tunnel.
  final stream = await connector.dialTcp('internal.example.com', 443);
}

License

MIT. See LICENSE.

Acknowledgments

The aTrust protocol implementation is an independent clean-room reimplementation of publicly observed wire behavior; no source code is copied from Mythologyli/zju-connect (AGPL-3.0), which was used as a behavior reference for the L3 tunnel, per-flow auth, conntrack, and TCP tunnel.

Libraries

flutter_sangfor_atrust
aTrust protocol core: login, L3 tunnel, TCP tunnel, and anti-MITM verification for the flutter_sangfor package family.