Commit Graph

63 Commits

Author SHA1 Message Date
klzgrad
ff1753d73b Add README 2021-09-24 23:48:11 +08:00
klzgrad
5739233d10 Add LICENSE 2021-09-24 23:48:11 +08:00
klzgrad
cfc3ce0b69 Add source import tool 2021-09-24 23:48:11 +08:00
klzgrad
3cc8f3a2db Fix QUIC version compatibility 2021-09-24 23:48:11 +08:00
klzgrad
7de9837543 Support SOCKS proxy authentication 2021-09-24 23:48:11 +08:00
klzgrad
c1e93b0a51 Raise initial padding number to 8
Protect initial handshake lengths.

Common client initial sequence:

- TLS: ClientHello
- TLS: ChangeCipherSpec, Finished
- H2: Magic, SETTINGS, WINDOW_UPDATE
- H2: HEADERS: GET
- H2: SETTINGS ACK

Common server initial sequence:

- TLS: ServerHello, ChangeCipherSpec, ...
- TLS: Certificate, ...
- H2: SETTINGS
- H2: WINDOW_UPDATE
- H2: SETTINGS ACK
- H2: HEADERS: 200 OK
2021-09-24 23:48:11 +08:00
klzgrad
d5f15d5416 Negotiate padding capability automatically
Client: On the first connection does a full Open and detects if the
server supports padding by checking for "Padding" header in the
response. Applies padding if the server does. In the following
connections it's back to Fast Open.

Server: Detects if the client supports padding by checking for "Padding"
header in the CONNECT request. Applies padding if the client does.

Both client and server always send "Padding" headers to somewhat protect
the request and response headers' packet lengths, even if the other side
may not acknowledge padding negotiation, either due to old version or
"Padding" headers being dropped by the frontend.

The manual option --padding is removed.
2021-09-24 23:48:11 +08:00
klzgrad
db4164c01e Prevents padding headers from being indexed 2021-09-24 23:48:10 +08:00
klzgrad
c3a5c229a8 Add option for concurrent transport
Useful only for high-end situations where a single connection
is throttled at 10MB/s somehow.

Makes traffic obfuscation less secure.
2021-09-24 23:48:10 +08:00
klzgrad
d7ac794e8a Add --extra-headers option 2021-09-24 23:48:10 +08:00
klzgrad
d8e05b74e7 Add cert net fetcher 2021-09-24 23:48:10 +08:00
klzgrad
5760246f8b Redirect DNS for redir://
Run a fake stub DNS resolver at the same port with redir://.
2021-09-24 23:48:10 +08:00
klzgrad
c5bb8f8e57 Support TCP transparent proxying
Enable with naive --listen=redir:// and iptables ... -j REDIRECT
--to-ports 1080.
2021-09-24 23:48:10 +08:00
klzgrad
cb12d6bfc7 Support loading config.json 2021-09-24 23:48:10 +08:00
klzgrad
97064315ec Add QUIC client 2021-09-24 23:48:10 +08:00
klzgrad
e0f123f1da Add http_proxy_socket to BUILD.gn 2021-09-24 23:48:10 +08:00
klzgrad
0a495f8736 Add server implementation and tunnel padding 2021-09-24 23:48:10 +08:00
klzgrad
2539ba9a01 Add Naive client to BUILD.gn 2021-09-24 23:48:10 +08:00
klzgrad
095578e02e Add initial implementation of Naive client 2021-09-24 23:48:10 +08:00
klzgrad
2140140f05 build: Handle empty pkgconfig in sysroot 2021-09-24 23:48:10 +08:00
klzgrad
1bef4df374 build: Add sysroot creator script 2021-09-24 23:48:10 +08:00
klzgrad
50f87566ad build: Add OpenWrt toolchains 2021-09-24 23:48:10 +08:00
klzgrad
8e18fe7a2d build: Support MIPS -mtune= flag 2021-09-24 23:48:10 +08:00
klzgrad
432ede7997 build: Support ARM build without FPU 2021-09-24 23:48:10 +08:00
klzgrad
d11c574391 build: Support -mcpu= on ARM and ARM64 2021-09-24 23:48:10 +08:00
klzgrad
f58183f60e allocator: Improve MIPS coverage of spinlocks 2021-09-24 23:48:10 +08:00
klzgrad
9a6d54b3c3 debug: Fix obsolete max check 2021-09-24 23:48:10 +08:00
klzgrad
f599db564d debug: Fix uClibc macro condition 2021-09-24 23:48:10 +08:00
klzgrad
61698866f8 base: Do not forward declare stat64 for Musl 2021-09-24 23:48:10 +08:00
klzgrad
ed164b3561 base: Fix narrowing casting on Musl 2021-09-24 23:15:58 +08:00
klzgrad
ece3518a42 base: Disable __close overloading in Musl 2021-09-24 23:15:58 +08:00
klzgrad
05c6ff4fb4 allocator: Disable uffd support for Musl 2021-09-24 23:15:58 +08:00
klzgrad
5c9943be9c process: Remove use of mallinfo under Musl 2021-09-24 23:15:58 +08:00
klzgrad
598e9fdcec base: Remove use of mallinfo under Musl 2021-09-24 23:15:58 +08:00
klzgrad
26a49f1d8a udp: Fix mmsghdr struct initializer
On OpenWrt x64 there are paddings fields in the struct, making
the initializer list not work.
2021-09-24 23:15:58 +08:00
klzgrad
2242523fed dns: Support Musl 2021-09-24 23:15:58 +08:00
klzgrad
25cf4ab8d2 dns: Fix iwyu 2021-09-24 23:15:58 +08:00
klzgrad
7fe5d2752c quic: Add support for HTTP/3 CONNECT Fast Open
SpdyProxyClientSocket uses read_callback_ for both Connect() and
Read(), and its OnIOComplete() calls read_callback_, thus its fast
connect code checks read_callback_. The code was ported to
QuicProxyClientSocket without much change.

But QuicProxyClientSocket uses a separate connect_callback_ apart from
read_callback_, and its OnIOComplete() calls connect_callback_, thus
when headers are received after Connect() it doesn't need to check
read_callback_ and should always avoid calling connect_callback_.
2021-09-24 23:15:58 +08:00
klzgrad
55721b6b8e h2: Pad RST_STREAM frames
Clients sending too many RST_STREAM is an irregular behavior.

Hack in a preceding END_STREAM DATA frame padded towards [48, 72]
before RST_STREAM so that the TLS record looks like a HEADERS frame.

The server often replies to this with a WINDOW_UPDATE because padding
is accounted in flow control. Whether this constitudes a new irregular
behavior is still unclear.
2021-09-24 23:15:58 +08:00
klzgrad
004bf356a3 h2: Add support for HTTP/2 CONNECT Fast Open
SpdyProxyClientSocket waits for 200 OK before returning OK for Connect.

Change that behavior to returning OK immediately after CONNECT header.

This feature is enabled by a "fastopen" header via the proxy delegate.

Design notes:

The current approach is better than the obvious TCP Fast Open style fake
Connect().

Fast Open should not be used for preconnects as preconnects need actual
connections set up. The Naive client does not use preconnects per se
(using "...RawConnect") but the user agent will use preconnects and the
Naive client has to infer that. Hence there is a need to check the
incoming socket for available bytes right before Connect() and configure
whether a socket should be connected with Fast Open. But fake Connect()
make it difficult to check the incoming socket because it immediately
returns and there is not enough time for the first read of the incoming
socket to arrive.

To check for preconnects it is best to push the first read of the
incoming socket to as late as possible. The other (wrong) way of doing
that is to pass in an early read callback and call it immediately after
sending HEADERS and then send the available bytes right there. This way
is wrong because it does not work with late binding, which assumes
Connect() is idempotent and causes sockets opened in this way to be
potentially bound to the wrong socket requests.

The current approach is to return OK in Connect() right after sending
HEADERS before getting the reply, which is to be received later. If the
reply is received during a subsequent Read() and the reply indicates an
error, the error is returned to the callback of the Read(); otherwise
the error is ignored with the connection disconnected and subsequent
Read() and Write() should discover the disconnection.
2021-09-24 23:15:58 +08:00
klzgrad
1b9641981d h2: Reduce warnings about RST on invalid streams
Per RFC 7540#6.4:

  However, after sending the RST_STREAM, the sending endpoint MUST be
  prepared to receive and process additional frames sent on the stream
  that might have been sent by the peer prior to the arrival of the
  RST_STREAM.
2021-09-24 23:15:58 +08:00
klzgrad
028798c90b socket: Fix a bug in TCPClientSocket
Needed by transparent proxying.
2021-09-24 23:15:58 +08:00
klzgrad
b7ac77a40f socket: Force tunneling for all sockets
In the socket system, only WebSocket sockets are allowed to tunnel
through HTTP/1 proxies. "Raw" sockets in the normal socket pool don't
have it, and their CONNECT headers are not sent, instead the raw
payload is sent as-is to the HTTP/1 proxy, breaking the proxying.

The socket system works like this:

- HTTP sockets via HTTP/1 proxies: normal pool, no tunneling.
- HTTPS sockets via HTTP/1 proxies: normal pool, no tunneling,
  but does its own proxy encapsulation.
- WS sockets via HTTP/1 proxies: WS pool, tunneling.

In Naive, we need the normal pool because the WS pool has some extra
restrictions but we also need tunneling to produce a client socket
with proxy tunneling built in.

Therefore force tunneling for all sockets and have them always send
CONNECT headers. This will otherwise break regular HTTP client sockets
via HTTP/1 proxies, but as we don't use this combination, it is ok.
2021-09-24 23:15:58 +08:00
klzgrad
b6629b29b7 socket: Allow higher limits for proxies
As an intermediary proxy we should not enforce stricter connection
limits in addition to what the user is already enforcing.
2021-09-24 23:15:58 +08:00
klzgrad
13541c137f socket: Add RawConnect method 2021-09-24 23:15:58 +08:00
klzgrad
9aefa7a155 build: Disable NSS
NSS is used to manage root trust store. This part is reimplemented.
2021-09-24 23:15:58 +08:00
klzgrad
522c095d81 cert: Handle AIA response in PKCS#7 format 2021-09-24 23:15:58 +08:00
klzgrad
c265c4089a cert: Use builtin verifier on Android and Linux 2021-09-24 23:15:58 +08:00
klzgrad
8e871b6a97 cert: Add SystemTrustStoreStaticUnix
It reads CA certificates from:

* The file in environment variable SSL_CERT_FILE
* The first available file of

/etc/ssl/certs/ca-certificates.crt (Debian/Ubuntu/Gentoo etc.)
/etc/pki/tls/certs/ca-bundle.crt (Fedora/RHEL 6)
/etc/ssl/ca-bundle.pem (OpenSUSE)
/etc/pki/tls/cacert.pem (OpenELEC)
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (CentOS/RHEL 7)
/etc/ssl/cert.pem (Alpine Linux)

* Files in the directory of environment variable SSL_CERT_DIR
* Files in the first available directory of

/etc/ssl/certs (SLES10/SLES11, https://golang.org/issue/12139)
/etc/pki/tls/certs (Fedora/RHEL)
/system/etc/security/cacerts (Android)
2021-09-24 23:15:58 +08:00
klzgrad
807b901889 libc++: Disable exceptions and RTTI
Except on Mac, where disabling exceptions doesn't work.
2021-09-24 23:15:58 +08:00