July 2020 - tor-commits - lists.torproject.org

[torspec/master] Run "reindex" script.
by nickm＠torproject.org 07 Jul '20

07 Jul '20

commit 66d780d87d50726f81043a8b4925ee6cc30fd174 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jul 6 13:38:23 2020 -0400 Run "reindex" script. --- proposals/000-index.txt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index 6e2e185..3ddeccd 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -244,6 +244,7 @@ Proposals by number: 321 Better performance and usability for the MyFamily option (v2) [OPEN] 322 Extending link specifiers to include the directory port [OPEN] 323 Specification for Walking Onions [DRAFT] +324 RTT-based Congestion Control for Tor [OPEN] Proposals by status: @@ -293,6 +294,7 @@ Proposals by status: 320 Removing TAP usage from v2 onion services 321 Better performance and usability for the MyFamily option (v2) 322 Extending link specifiers to include the directory port + 324 RTT-based Congestion Control for Tor ACCEPTED: 188 Bridge Guards and other anti-enumeration defenses 249 Allow CREATE cells with >505 bytes of handshake data

1 0

[snowflake-webext/master] Update proxy NAT type based on client's NAT type
by cohosh＠torproject.org 07 Jul '20

07 Jul '20

commit 12478006b99805c30a2d278c969937563ce507e1 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Mon Jun 22 14:29:09 2020 -0400 Update proxy NAT type based on client's NAT type --- broker.js | 4 ++-- snowflake.js | 12 ++++++++---- spec/broker.spec.js | 6 +++--- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/broker.js b/broker.js index e1aab0f..9d8b8b6 100644 --- a/broker.js +++ b/broker.js @@ -52,7 +52,7 @@ class Broker { case Broker.CODE.OK: var response = JSON.parse(xhr.responseText); if (response.Status == Broker.STATUS.MATCH) { - return fulfill(response.Offer); // Should contain offer. + return fulfill(response); // Should contain offer. } else if (response.Status == Broker.STATUS.TIMEOUT) { return reject(Broker.MESSAGE.TIMEOUT); } else { @@ -66,7 +66,7 @@ class Broker { } }; this._xhr = xhr; // Used by spec to fake async Broker interaction - var data = {"Version": "1.1", "Sid": id, "Type": this.config.proxyType, "NAT": this.natType}; + var data = {"Version": "1.2", "Sid": id, "Type": this.config.proxyType, "NAT": this.natType}; return this._postRequest(xhr, 'proxy', JSON.stringify(data)); }); } diff --git a/snowflake.js b/snowflake.js index 91a8d87..1937fdb 100644 --- a/snowflake.js +++ b/snowflake.js @@ -68,8 +68,9 @@ class Snowflake { } this.ui.setStatus(msg); recv = this.broker.getClientOffer(pair.id); - recv.then((desc) => { - if (!this.receiveOffer(pair, desc)) { + recv.then((resp) => { + var clientNAT = resp.NAT; + if (!this.receiveOffer(pair, resp.Offer)) { return pair.close(); } //set a timeout for channel creation @@ -81,8 +82,11 @@ class Snowflake { this.pollInterval = Math.min(this.pollInterval + this.config.pollAdjustment, this.config.slowestBrokerPollInterval); - // assume restricted NAT - this.ui.natType = "restricted"; + // if we fail to connect to a restricted client, assume restricted NAT + if (clientNAT == "restricted"){ + this.ui.natType = "restricted"; + console.log("Learned NAT type: restricted"); + } this.broker.setNATType(this.ui.natType); } else { // decrease poll interval diff --git a/spec/broker.spec.js b/spec/broker.spec.js index 28a66c4..cedf5f9 100644 --- a/spec/broker.spec.js +++ b/spec/broker.spec.js @@ -40,14 +40,14 @@ describe('Broker', function() { spyOn(b, '_postRequest').and.callFake(function() { b._xhr.readyState = b._xhr.DONE; b._xhr.status = Broker.CODE.OK; - b._xhr.responseText = '{"Status":"client match","Offer":"fake offer"}'; + b._xhr.responseText = '{"Status":"client match","Offer":"fake offer","NAT":"unknown"}'; return b._xhr.onreadystatechange(); }); poll = b.getClientOffer(); expect(poll).not.toBeNull(); expect(b._postRequest).toHaveBeenCalled(); - return poll.then(function(desc) { - expect(desc).toEqual('fake offer'); + return poll.then(function(resp) { + expect(resp.Offer).toEqual('fake offer'); return done(); }).catch(function() { fail('should not reject on Broker.CODE.OK');

1 0

[snowflake-webext/master] Advertise suspected NAT type to broker
by cohosh＠torproject.org 07 Jul '20

07 Jul '20

commit 60beedf8ddc2e322e5d668bfeafcdfa4ccd0a9d5 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Wed Jun 17 10:18:24 2020 -0400 Advertise suspected NAT type to broker This compliments the poll the rate adjustment on proxy failures to address proxy matching issues. Since we cannot determine our NAT type directly for browser-based proxies, we assume a restricted NAT type if the datachannel fails to open. --- broker.js | 8 +++++++- init-webext.js | 9 +++++++++ package.json | 2 +- snowflake.js | 4 ++++ spec/snowflake.spec.js | 12 +++++------- 5 files changed, 26 insertions(+), 9 deletions(-) diff --git a/broker.js b/broker.js index 84f0929..e1aab0f 100644 --- a/broker.js +++ b/broker.js @@ -17,10 +17,12 @@ class Broker { constructor(config) { this.getClientOffer = this.getClientOffer.bind(this); this._postRequest = this._postRequest.bind(this); + this.setNATType = this.setNATType.bind(this); this.config = config; this.url = config.brokerUrl; this.clients = 0; + this.natType = "unknown"; if (0 === this.url.indexOf('localhost', 0)) { // Ensure url has the right protocol + trailing slash. this.url = 'http://' + this.url; @@ -64,7 +66,7 @@ class Broker { } }; this._xhr = xhr; // Used by spec to fake async Broker interaction - var data = {"Version": "1.1", "Sid": id, "Type": this.config.proxyType}; + var data = {"Version": "1.1", "Sid": id, "Type": this.config.proxyType, "NAT": this.natType}; return this._postRequest(xhr, 'proxy', JSON.stringify(data)); }); } @@ -93,6 +95,10 @@ class Broker { return this._postRequest(xhr, 'answer', JSON.stringify(data)); } + setNATType(natType) { + this.natType = natType; + } + // urlSuffix for the broker is different depending on what action // is desired. _postRequest(xhr, urlSuffix, payload) { diff --git a/init-webext.js b/init-webext.js index 4b09988..3d7b1ea 100644 --- a/init-webext.js +++ b/init-webext.js @@ -13,6 +13,7 @@ class WebExtUI extends UI { this.onMessage = this.onMessage.bind(this); this.onDisconnect = this.onDisconnect.bind(this); this.initStats(); + this.initNATType(); chrome.runtime.onConnect.addListener(this.onConnect); } @@ -25,6 +26,14 @@ class WebExtUI extends UI { }), 60 * 60 * 1000); } + initNATType() { + this.natType = "unknown"; + // reset NAT type every 24 hours in case proxy location changed + setInterval((() => { + this.natType = "unknown"; + }), 24 * 60 * 60 * 1000); + } + tryProbe() { WS.probeWebsocket(config.relayAddr) .then( diff --git a/package.json b/package.json index d42a138..215e777 100644 --- a/package.json +++ b/package.json @@ -32,4 +32,4 @@ "ws": "^3.3.1", "xmlhttprequest": "^1.8.0" } -} \ No newline at end of file +} diff --git a/snowflake.js b/snowflake.js index 1021c78..91a8d87 100644 --- a/snowflake.js +++ b/snowflake.js @@ -21,6 +21,7 @@ class Snowflake { this.config = config; this.ui = ui; this.broker = broker; + this.broker.setNATType(ui.natType); this.proxyPairs = []; this.pollInterval = this.config.defaultBrokerPollInterval; if (void 0 === this.config.rateLimitBytes) { @@ -80,6 +81,9 @@ class Snowflake { this.pollInterval = Math.min(this.pollInterval + this.config.pollAdjustment, this.config.slowestBrokerPollInterval); + // assume restricted NAT + this.ui.natType = "restricted"; + this.broker.setNATType(this.ui.natType); } else { // decrease poll interval this.pollInterval = diff --git a/spec/snowflake.spec.js b/spec/snowflake.spec.js index 970947b..d9b97e8 100644 --- a/spec/snowflake.spec.js +++ b/spec/snowflake.spec.js @@ -36,26 +36,24 @@ class FakeBroker { return {}; }); } + setNATType(natType) { + } } describe('Snowflake', function() { it('constructs correctly', function() { var s; - s = new Snowflake(config, ui, { - fake: 'broker' - }); + s = new Snowflake(config, ui, new FakeBroker()); expect(s.rateLimit).not.toBeNull(); - expect(s.broker).toEqual({ - fake: 'broker' - }); + expect(s.broker).toEqual(new FakeBroker()); expect(s.ui).not.toBeNull(); expect(s.retries).toBe(0); }); it('sets relay address correctly', function() { var s; - s = new Snowflake(config, ui, null); + s = new Snowflake(config, ui, new FakeBroker()); s.setRelayAddr('foo'); expect(s.relayAddr).toEqual('foo'); });

1 0

[snowflake/master] Implement NAT discover for go standalone proxies
by cohosh＠torproject.org 07 Jul '20

07 Jul '20

commit f6cf9a453b0cae189e5ad6b25d57241fe418de91 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Tue Jun 16 17:10:56 2020 -0400 Implement NAT discover for go standalone proxies --- broker/broker.go | 2 +- common/messages/proxy.go | 30 +++++++++++++++++++----------- common/messages/proxy_test.go | 26 ++++++++++++++++++++++---- proxy/snowflake.go | 36 +++++++++++++++++++++++++++++++++++- 4 files changed, 77 insertions(+), 17 deletions(-) diff --git a/broker/broker.go b/broker/broker.go index d9ef111..2d3cd4b 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -170,7 +170,7 @@ func proxyPolls(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { return } - sid, proxyType, err := messages.DecodePollRequest(body) + sid, proxyType, _, err := messages.DecodePollRequest(body) if err != nil { w.WriteHeader(http.StatusBadRequest) return diff --git a/common/messages/proxy.go b/common/messages/proxy.go index 89dd43c..923189b 100644 --- a/common/messages/proxy.go +++ b/common/messages/proxy.go @@ -9,15 +9,16 @@ import ( "strings" ) -const version = "1.1" +const version = "1.2" -/* Version 1.1 specification: +/* Version 1.2 specification: == ProxyPollRequest == { Sid: [generated session id of proxy], - Version: 1.1, + Version: 1.2, Type: ["badge"|"webext"|"standalone"] + NAT: ["unknown"|"restricted"|"unrestricted"] } == ProxyPollResponse == @@ -44,7 +45,7 @@ HTTP 400 BadRequest == ProxyAnswerRequest == { Sid: [generated session id of proxy], - Version: 1.1, + Version: 1.2, Answer: { type: answer, @@ -76,37 +77,44 @@ type ProxyPollRequest struct { Sid string Version string Type string + NAT string } -func EncodePollRequest(sid string, proxyType string) ([]byte, error) { +func EncodePollRequest(sid string, proxyType string, natType string) ([]byte, error) { return json.Marshal(ProxyPollRequest{ Sid: sid, Version: version, Type: proxyType, + NAT: natType, }) } // Decodes a poll message from a snowflake proxy and returns the // sid and proxy type of the proxy on success and an error if it failed -func DecodePollRequest(data []byte) (string, string, error) { +func DecodePollRequest(data []byte) (string, string, string, error) { var message ProxyPollRequest err := json.Unmarshal(data, &message) if err != nil { - return "", "", err + return "", "", "", err } majorVersion := strings.Split(message.Version, ".")[0] if majorVersion != "1" { - return "", "", fmt.Errorf("using unknown version") + return "", "", "", fmt.Errorf("using unknown version") } // Version 1.x requires an Sid if message.Sid == "" { - return "", "", fmt.Errorf("no supplied session id") + return "", "", "", fmt.Errorf("no supplied session id") } - return message.Sid, message.Type, nil + natType := message.NAT + if natType == "" { + natType = "unknown" + } + + return message.Sid, message.Type, natType, nil } type ProxyPollResponse struct { @@ -159,7 +167,7 @@ type ProxyAnswerRequest struct { func EncodeAnswerRequest(answer string, sid string) ([]byte, error) { return json.Marshal(ProxyAnswerRequest{ - Version: "1.1", + Version: version, Sid: sid, Answer: answer, }) diff --git a/common/messages/proxy_test.go b/common/messages/proxy_test.go index 1570d4f..3aa67fb 100644 --- a/common/messages/proxy_test.go +++ b/common/messages/proxy_test.go @@ -13,6 +13,7 @@ func TestDecodeProxyPollRequest(t *testing.T) { for _, test := range []struct { sid string proxyType string + natType string data string err error }{ @@ -20,6 +21,7 @@ func TestDecodeProxyPollRequest(t *testing.T) { //Version 1.0 proxy message "ymbcCMto7KHNGYlp", "", + "unknown", `{"Sid":"ymbcCMto7KHNGYlp","Version":"1.0"}`, nil, }, @@ -27,44 +29,59 @@ func TestDecodeProxyPollRequest(t *testing.T) { //Version 1.1 proxy message "ymbcCMto7KHNGYlp", "standalone", + "unknown", `{"Sid":"ymbcCMto7KHNGYlp","Version":"1.1","Type":"standalone"}`, nil, }, + { + //Version 1.2 proxy message + "ymbcCMto7KHNGYlp", + "standalone", + "restricted", + `{"Sid":"ymbcCMto7KHNGYlp","Version":"1.2","Type":"standalone", "NAT":"restricted"}`, + nil, + }, { //Version 0.X proxy message: "", "", - "ymbcCMto7KHNGYlp", + "", + "", &json.SyntaxError{}, }, { + "", "", "", `{"Sid":"ymbcCMto7KHNGYlp"}`, fmt.Errorf(""), }, { + "", "", "", "{}", fmt.Errorf(""), }, { + "", "", "", `{"Version":"1.0"}`, fmt.Errorf(""), }, { + "", "", "", `{"Version":"2.0"}`, fmt.Errorf(""), }, } { - sid, proxyType, err := DecodePollRequest([]byte(test.data)) + sid, proxyType, natType, err := DecodePollRequest([]byte(test.data)) So(sid, ShouldResemble, test.sid) So(proxyType, ShouldResemble, test.proxyType) + So(natType, ShouldResemble, test.natType) So(err, ShouldHaveSameTypeAs, test.err) } @@ -73,11 +90,12 @@ func TestDecodeProxyPollRequest(t *testing.T) { func TestEncodeProxyPollRequests(t *testing.T) { Convey("Context", t, func() { - b, err := EncodePollRequest("ymbcCMto7KHNGYlp", "standalone") + b, err := EncodePollRequest("ymbcCMto7KHNGYlp", "standalone", "unknown") So(err, ShouldEqual, nil) - sid, proxyType, err := DecodePollRequest(b) + sid, proxyType, natType, err := DecodePollRequest(b) So(sid, ShouldEqual, "ymbcCMto7KHNGYlp") So(proxyType, ShouldEqual, "standalone") + So(natType, ShouldEqual, "unknown") So(err, ShouldEqual, nil) }) } diff --git a/proxy/snowflake.go b/proxy/snowflake.go index 4877e6f..ac67748 100644 --- a/proxy/snowflake.go +++ b/proxy/snowflake.go @@ -19,6 +19,7 @@ import ( "time" "git.torproject.org/pluggable-transports/snowflake.git/common/messages" + "git.torproject.org/pluggable-transports/snowflake.git/common/nat" "git.torproject.org/pluggable-transports/snowflake.git/common/safelog" "git.torproject.org/pluggable-transports/snowflake.git/common/util" "git.torproject.org/pluggable-transports/snowflake.git/common/websocketconn" @@ -30,6 +31,11 @@ const defaultBrokerURL = "https://snowflake-broker.bamsoftware.com/" const defaultRelayURL = "wss://snowflake.bamsoftware.com/" const defaultSTUNURL = "stun:stun.l.google.com:19302" const pollInterval = 5 * time.Second +const ( + NATUnknown = "unknown" + NATRestricted = "restricted" + NATUnrestricted = "unrestricted" +) //amount of time after sending an SDP answer before the proxy assumes the //client is not going to connect @@ -40,6 +46,8 @@ const readLimit = 100000 //Maximum number of bytes to be read from an HTTP reque var broker *Broker var relayURL string +var currentNATType = NATUnknown + const ( sessionIDLength = 16 ) @@ -174,7 +182,7 @@ func (b *Broker) pollOffer(sid string) *webrtc.SessionDescription { timeOfNextPoll = now } - body, err := messages.EncodePollRequest(sid, "standalone") + body, err := messages.EncodePollRequest(sid, "standalone", currentNATType) if err != nil { log.Printf("Error encoding poll message: %s", err.Error()) return nil @@ -485,9 +493,35 @@ func main() { tokens <- true } + // determine NAT type before polling + updateNATType(config.ICEServers) + log.Printf("NAT type: %s", currentNATType) + for { getToken() sessionID := genSessionID() runSession(sessionID) } } + +// use provided STUN server(s) to determine NAT type +func updateNATType(servers []webrtc.ICEServer) { + + var restrictedNAT bool + var err error + for _, server := range servers { + addr := strings.TrimPrefix(server.URLs[0], "stun:") + restrictedNAT, err = nat.CheckIfRestrictedNAT(addr) + if err == nil { + if restrictedNAT { + currentNATType = NATRestricted + } else { + currentNATType = NATUnrestricted + } + break + } + } + if err != nil { + currentNATType = NATUnknown + } +}

1 0

[snowflake/master] Add a new heap at the broker for restricted flakes
by cohosh＠torproject.org 07 Jul '20

07 Jul '20

commit 0052c0e10cfd8e270a57d85711064e8d9e064bf5 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Tue Jun 16 17:49:39 2020 -0400 Add a new heap at the broker for restricted flakes Now when proxies poll, they provide their NAT type to the broker. This introduces a new snowflake heap of just restricted snowflakes that the broker can pull from if the client has a known, unrestricted NAT. All other clients will pull from a heap of snowflakes with unrestricted or unknown NAT topologies. --- broker/broker.go | 67 ++++++++++++++++++++++++++++++----------- broker/snowflake-broker_test.go | 14 ++++----- 2 files changed, 57 insertions(+), 24 deletions(-) diff --git a/broker/broker.go b/broker/broker.go index 2d3cd4b..9297980 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -31,12 +31,18 @@ const ( ClientTimeout = 10 ProxyTimeout = 10 readLimit = 100000 //Maximum number of bytes to be read from an HTTP request + + NATUnknown = "unknown" + NATRestricted = "restricted" + NATUnrestricted = "unrestricted" ) type BrokerContext struct { - snowflakes *SnowflakeHeap - // Map keeping track of snowflakeIDs required to match SDP answers from - // the second http POST. + snowflakes *SnowflakeHeap + restrictedSnowflakes *SnowflakeHeap + // Maps keeping track of snowflakeIDs required to match SDP answers from + // the second http POST. Restricted snowflakes can only be matched up with + // clients behind an unrestricted NAT. idToSnowflake map[string]*Snowflake // Synchronization for the snowflake map and heap snowflakeLock sync.Mutex @@ -47,6 +53,8 @@ type BrokerContext struct { func NewBrokerContext(metricsLogger *log.Logger) *BrokerContext { snowflakes := new(SnowflakeHeap) heap.Init(snowflakes) + rSnowflakes := new(SnowflakeHeap) + heap.Init(rSnowflakes) metrics, err := NewMetrics(metricsLogger) if err != nil { @@ -58,10 +66,11 @@ func NewBrokerContext(metricsLogger *log.Logger) *BrokerContext { } return &BrokerContext{ - snowflakes: snowflakes, - idToSnowflake: make(map[string]*Snowflake), - proxyPolls: make(chan *ProxyPoll), - metrics: metrics, + snowflakes: snowflakes, + restrictedSnowflakes: rSnowflakes, + idToSnowflake: make(map[string]*Snowflake), + proxyPolls: make(chan *ProxyPoll), + metrics: metrics, } } @@ -79,7 +88,7 @@ type MetricsHandler struct { func (sh SnowflakeHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { w.Header().Set("Access-Control-Allow-Origin", "*") - w.Header().Set("Access-Control-Allow-Headers", "Origin, X-Session-ID") + w.Header().Set("Access-Control-Allow-Headers", "Origin, X-Session-ID, Snowflake-NAT-Type") // Return early if it's CORS preflight. if "OPTIONS" == r.Method { return @@ -101,15 +110,17 @@ func (mh MetricsHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { type ProxyPoll struct { id string proxyType string + natType string offerChannel chan []byte } // Registers a Snowflake and waits for some Client to send an offer, // as part of the polling logic of the proxy handler. -func (ctx *BrokerContext) RequestOffer(id string, proxyType string) []byte { +func (ctx *BrokerContext) RequestOffer(id string, proxyType string, natType string) []byte { request := new(ProxyPoll) request.id = id request.proxyType = proxyType + request.natType = natType request.offerChannel = make(chan []byte) ctx.proxyPolls <- request // Block until an offer is available, or timeout which sends a nil offer. @@ -122,7 +133,7 @@ func (ctx *BrokerContext) RequestOffer(id string, proxyType string) []byte { // client offer or nil on timeout / none are available. func (ctx *BrokerContext) Broker() { for request := range ctx.proxyPolls { - snowflake := ctx.AddSnowflake(request.id, request.proxyType) + snowflake := ctx.AddSnowflake(request.id, request.proxyType, request.natType) // Wait for a client to avail an offer to the snowflake. go func(request *ProxyPoll) { select { @@ -133,7 +144,11 @@ func (ctx *BrokerContext) Broker() { ctx.snowflakeLock.Lock() defer ctx.snowflakeLock.Unlock() if snowflake.index != -1 { - heap.Remove(ctx.snowflakes, snowflake.index) + if request.natType == NATRestricted { + heap.Remove(ctx.restrictedSnowflakes, snowflake.index) + } else { + heap.Remove(ctx.snowflakes, snowflake.index) + } delete(ctx.idToSnowflake, snowflake.id) close(request.offerChannel) } @@ -145,7 +160,7 @@ func (ctx *BrokerContext) Broker() { // Create and add a Snowflake to the heap. // Required to keep track of proxies between providing them // with an offer and awaiting their second POST with an answer. -func (ctx *BrokerContext) AddSnowflake(id string, proxyType string) *Snowflake { +func (ctx *BrokerContext) AddSnowflake(id string, proxyType string, natType string) *Snowflake { snowflake := new(Snowflake) snowflake.id = id snowflake.clients = 0 @@ -153,7 +168,11 @@ func (ctx *BrokerContext) AddSnowflake(id string, proxyType string) *Snowflake { snowflake.offerChannel = make(chan []byte) snowflake.answerChannel = make(chan []byte) ctx.snowflakeLock.Lock() - heap.Push(ctx.snowflakes, snowflake) + if natType == NATRestricted { + heap.Push(ctx.restrictedSnowflakes, snowflake) + } else { + heap.Push(ctx.snowflakes, snowflake) + } ctx.snowflakeLock.Unlock() ctx.idToSnowflake[id] = snowflake return snowflake @@ -170,7 +189,7 @@ func proxyPolls(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { return } - sid, proxyType, _, err := messages.DecodePollRequest(body) + sid, proxyType, natType, err := messages.DecodePollRequest(body) if err != nil { w.WriteHeader(http.StatusBadRequest) return @@ -187,7 +206,7 @@ func proxyPolls(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { } // Wait for a client to avail an offer to the snowflake, or timeout if nil. - offer := ctx.RequestOffer(sid, proxyType) + offer := ctx.RequestOffer(sid, proxyType, natType) var b []byte if nil == offer { ctx.metrics.lock.Lock() @@ -226,9 +245,23 @@ func clientOffers(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusBadRequest) return } + + natType := r.Header.Get("Snowflake-NAT-Type") + if natType == "" { + natType = NATUnknown + } + + // Only hand out known restricted snowflakes to unrestricted clients + var snowflakeHeap *SnowflakeHeap + if natType == NATUnrestricted { + snowflakeHeap = ctx.restrictedSnowflakes + } else { + snowflakeHeap = ctx.snowflakes + } + // Immediately fail if there are no snowflakes available. ctx.snowflakeLock.Lock() - numSnowflakes := ctx.snowflakes.Len() + numSnowflakes := snowflakeHeap.Len() ctx.snowflakeLock.Unlock() if numSnowflakes <= 0 { ctx.metrics.lock.Lock() @@ -240,7 +273,7 @@ func clientOffers(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { // Otherwise, find the most available snowflake proxy, and pass the offer to it. // Delete must be deferred in order to correctly process answer request later. ctx.snowflakeLock.Lock() - snowflake := heap.Pop(ctx.snowflakes).(*Snowflake) + snowflake := heap.Pop(snowflakeHeap).(*Snowflake) ctx.snowflakeLock.Unlock() snowflake.offerChannel <- offer diff --git a/broker/snowflake-broker_test.go b/broker/snowflake-broker_test.go index 18b83dd..91383a1 100644 --- a/broker/snowflake-broker_test.go +++ b/broker/snowflake-broker_test.go @@ -29,7 +29,7 @@ func TestBroker(t *testing.T) { Convey("Adds Snowflake", func() { So(ctx.snowflakes.Len(), ShouldEqual, 0) So(len(ctx.idToSnowflake), ShouldEqual, 0) - ctx.AddSnowflake("foo", "") + ctx.AddSnowflake("foo", "", NATUnknown) So(ctx.snowflakes.Len(), ShouldEqual, 1) So(len(ctx.idToSnowflake), ShouldEqual, 1) }) @@ -55,7 +55,7 @@ func TestBroker(t *testing.T) { Convey("Request an offer from the Snowflake Heap", func() { done := make(chan []byte) go func() { - offer := ctx.RequestOffer("test", "") + offer := ctx.RequestOffer("test", "", NATUnknown) done <- offer }() request := <-ctx.proxyPolls @@ -79,7 +79,7 @@ func TestBroker(t *testing.T) { Convey("with a proxy answer if available.", func() { done := make(chan bool) // Prepare a fake proxy to respond with. - snowflake := ctx.AddSnowflake("fake", "") + snowflake := ctx.AddSnowflake("fake", "", NATUnknown) go func() { clientOffers(ctx, w, r) done <- true @@ -97,7 +97,7 @@ func TestBroker(t *testing.T) { return } done := make(chan bool) - snowflake := ctx.AddSnowflake("fake", "") + snowflake := ctx.AddSnowflake("fake", "", NATUnknown) go func() { clientOffers(ctx, w, r) // Takes a few seconds here... @@ -147,7 +147,7 @@ func TestBroker(t *testing.T) { }) Convey("Responds to proxy answers...", func() { - s := ctx.AddSnowflake("test", "") + s := ctx.AddSnowflake("test", "", NATUnknown) w := httptest.NewRecorder() data := bytes.NewReader([]byte(`{"Version":"1.0","Sid":"test","Answer":"test"}`)) @@ -260,7 +260,7 @@ func TestBroker(t *testing.T) { // Manually do the Broker goroutine action here for full control. p := <-ctx.proxyPolls So(p.id, ShouldEqual, "ymbcCMto7KHNGYlp") - s := ctx.AddSnowflake(p.id, "") + s := ctx.AddSnowflake(p.id, "", NATUnknown) go func() { offer := <-s.offerChannel p.offerChannel <- offer @@ -537,7 +537,7 @@ func TestMetrics(t *testing.T) { So(err, ShouldBeNil) // Prepare a fake proxy to respond with. - snowflake := ctx.AddSnowflake("fake", "") + snowflake := ctx.AddSnowflake("fake", "", NATUnknown) go func() { clientOffers(ctx, w, r) done <- true

1 0

[snowflake/master] Have broker pass client NAT type to proxy
by cohosh＠torproject.org 07 Jul '20

07 Jul '20

commit 046dab865f18eb12a473b1a1c1d7aa15cf5883c7 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Mon Jun 22 14:04:29 2020 -0400 Have broker pass client NAT type to proxy This will allow browser-based proxies that are unable to determine their NAT type to conservatively label themselves as restricted NATs if they fail to work with clients that have restricted NATs. --- broker/broker.go | 31 ++++++++++++++++++++----------- broker/snowflake-broker_test.go | 26 +++++++++++++------------- broker/snowflake-heap.go | 2 +- common/messages/proxy.go | 24 ++++++++++++++++-------- common/messages/proxy_test.go | 16 +++++++++------- proxy/proxy-go_test.go | 2 +- proxy/snowflake.go | 2 +- 7 files changed, 61 insertions(+), 42 deletions(-) diff --git a/broker/broker.go b/broker/broker.go index 9297980..99f6c69 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -111,17 +111,17 @@ type ProxyPoll struct { id string proxyType string natType string - offerChannel chan []byte + offerChannel chan *ClientOffer } // Registers a Snowflake and waits for some Client to send an offer, // as part of the polling logic of the proxy handler. -func (ctx *BrokerContext) RequestOffer(id string, proxyType string, natType string) []byte { +func (ctx *BrokerContext) RequestOffer(id string, proxyType string, natType string) *ClientOffer { request := new(ProxyPoll) request.id = id request.proxyType = proxyType request.natType = natType - request.offerChannel = make(chan []byte) + request.offerChannel = make(chan *ClientOffer) ctx.proxyPolls <- request // Block until an offer is available, or timeout which sends a nil offer. offer := <-request.offerChannel @@ -165,7 +165,7 @@ func (ctx *BrokerContext) AddSnowflake(id string, proxyType string, natType stri snowflake.id = id snowflake.clients = 0 snowflake.proxyType = proxyType - snowflake.offerChannel = make(chan []byte) + snowflake.offerChannel = make(chan *ClientOffer) snowflake.answerChannel = make(chan []byte) ctx.snowflakeLock.Lock() if natType == NATRestricted { @@ -213,7 +213,7 @@ func proxyPolls(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { ctx.metrics.proxyIdleCount++ ctx.metrics.lock.Unlock() - b, err = messages.EncodePollResponse("", false) + b, err = messages.EncodePollResponse("", false, "") if err != nil { w.WriteHeader(http.StatusInternalServerError) return @@ -222,7 +222,7 @@ func proxyPolls(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { w.Write(b) return } - b, err = messages.EncodePollResponse(string(offer), true) + b, err = messages.EncodePollResponse(string(offer.sdp), true, offer.natType) if err != nil { w.WriteHeader(http.StatusInternalServerError) return @@ -232,28 +232,37 @@ func proxyPolls(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { } } +// Client offer contains an SDP and the NAT type of the client +type ClientOffer struct { + natType string + sdp []byte +} + /* Expects a WebRTC SDP offer in the Request to give to an assigned snowflake proxy, which responds with the SDP answer to be sent in the HTTP response back to the client. */ func clientOffers(ctx *BrokerContext, w http.ResponseWriter, r *http.Request) { + var err error + startTime := time.Now() - offer, err := ioutil.ReadAll(http.MaxBytesReader(w, r.Body, readLimit)) + offer := &ClientOffer{} + offer.sdp, err = ioutil.ReadAll(http.MaxBytesReader(w, r.Body, readLimit)) if nil != err { log.Println("Invalid data.") w.WriteHeader(http.StatusBadRequest) return } - natType := r.Header.Get("Snowflake-NAT-Type") - if natType == "" { - natType = NATUnknown + offer.natType = r.Header.Get("Snowflake-NAT-Type") + if offer.natType == "" { + offer.natType = NATUnknown } // Only hand out known restricted snowflakes to unrestricted clients var snowflakeHeap *SnowflakeHeap - if natType == NATUnrestricted { + if offer.natType == NATUnrestricted { snowflakeHeap = ctx.restrictedSnowflakes } else { snowflakeHeap = ctx.snowflakes diff --git a/broker/snowflake-broker_test.go b/broker/snowflake-broker_test.go index 91383a1..d03dca7 100644 --- a/broker/snowflake-broker_test.go +++ b/broker/snowflake-broker_test.go @@ -37,7 +37,7 @@ func TestBroker(t *testing.T) { Convey("Broker goroutine matches clients with proxies", func() { p := new(ProxyPoll) p.id = "test" - p.offerChannel = make(chan []byte) + p.offerChannel = make(chan *ClientOffer) go func(ctx *BrokerContext) { ctx.proxyPolls <- p close(ctx.proxyPolls) @@ -45,23 +45,23 @@ func TestBroker(t *testing.T) { ctx.Broker() So(ctx.snowflakes.Len(), ShouldEqual, 1) snowflake := heap.Pop(ctx.snowflakes).(*Snowflake) - snowflake.offerChannel <- []byte("test offer") + snowflake.offerChannel <- &ClientOffer{sdp: []byte("test offer")} offer := <-p.offerChannel So(ctx.idToSnowflake["test"], ShouldNotBeNil) - So(offer, ShouldResemble, []byte("test offer")) + So(offer.sdp, ShouldResemble, []byte("test offer")) So(ctx.snowflakes.Len(), ShouldEqual, 0) }) Convey("Request an offer from the Snowflake Heap", func() { - done := make(chan []byte) + done := make(chan *ClientOffer) go func() { offer := ctx.RequestOffer("test", "", NATUnknown) done <- offer }() request := <-ctx.proxyPolls - request.offerChannel <- []byte("test offer") + request.offerChannel <- &ClientOffer{sdp: []byte("test offer")} offer := <-done - So(offer, ShouldResemble, []byte("test offer")) + So(offer.sdp, ShouldResemble, []byte("test offer")) }) Convey("Responds to client offers...", func() { @@ -85,7 +85,7 @@ func TestBroker(t *testing.T) { done <- true }() offer := <-snowflake.offerChannel - So(offer, ShouldResemble, []byte("test")) + So(offer.sdp, ShouldResemble, []byte("test")) snowflake.answerChannel <- []byte("fake answer") <-done So(w.Body.String(), ShouldEqual, "fake answer") @@ -104,7 +104,7 @@ func TestBroker(t *testing.T) { done <- true }() offer := <-snowflake.offerChannel - So(offer, ShouldResemble, []byte("test")) + So(offer.sdp, ShouldResemble, []byte("test")) <-done So(w.Code, ShouldEqual, http.StatusGatewayTimeout) }) @@ -125,10 +125,10 @@ func TestBroker(t *testing.T) { // Pass a fake client offer to this proxy p := <-ctx.proxyPolls So(p.id, ShouldEqual, "ymbcCMto7KHNGYlp") - p.offerChannel <- []byte("fake offer") + p.offerChannel <- &ClientOffer{sdp: []byte("fake offer")} <-done So(w.Code, ShouldEqual, http.StatusOK) - So(w.Body.String(), ShouldEqual, `{"Status":"client match","Offer":"fake offer"}`) + So(w.Body.String(), ShouldEqual, `{"Status":"client match","Offer":"fake offer","NAT":""}`) }) Convey("return empty 200 OK when no client offer is available.", func() { @@ -141,7 +141,7 @@ func TestBroker(t *testing.T) { // nil means timeout p.offerChannel <- nil <-done - So(w.Body.String(), ShouldEqual, `{"Status":"no match","Offer":""}`) + So(w.Body.String(), ShouldEqual, `{"Status":"no match","Offer":"","NAT":""}`) So(w.Code, ShouldEqual, http.StatusOK) }) }) @@ -279,7 +279,7 @@ func TestBroker(t *testing.T) { <-polled So(wP.Code, ShouldEqual, http.StatusOK) - So(wP.Body.String(), ShouldResemble, `{"Status":"client match","Offer":"fake offer"}`) + So(wP.Body.String(), ShouldResemble, `{"Status":"client match","Offer":"fake offer","NAT":"unknown"}`) So(ctx.idToSnowflake["ymbcCMto7KHNGYlp"], ShouldNotBeNil) // Follow up with the answer request afterwards wA := httptest.NewRecorder() @@ -543,7 +543,7 @@ func TestMetrics(t *testing.T) { done <- true }() offer := <-snowflake.offerChannel - So(offer, ShouldResemble, []byte("test")) + So(offer.sdp, ShouldResemble, []byte("test")) snowflake.answerChannel <- []byte("fake answer") <-done diff --git a/broker/snowflake-heap.go b/broker/snowflake-heap.go index 19a64b2..12fe557 100644 --- a/broker/snowflake-heap.go +++ b/broker/snowflake-heap.go @@ -11,7 +11,7 @@ over the offer and answer channels. type Snowflake struct { id string proxyType string - offerChannel chan []byte + offerChannel chan *ClientOffer answerChannel chan []byte clients int index int diff --git a/common/messages/proxy.go b/common/messages/proxy.go index 923189b..2d9e58d 100644 --- a/common/messages/proxy.go +++ b/common/messages/proxy.go @@ -29,7 +29,8 @@ HTTP 200 OK { type: offer, sdp: [WebRTC SDP] - } + }, + NAT: ["unknown"|"restricted"|"unrestricted"] } 2) If a client is not matched: @@ -120,13 +121,15 @@ func DecodePollRequest(data []byte) (string, string, string, error) { type ProxyPollResponse struct { Status string Offer string + NAT string } -func EncodePollResponse(offer string, success bool) ([]byte, error) { +func EncodePollResponse(offer string, success bool, natType string) ([]byte, error) { if success { return json.Marshal(ProxyPollResponse{ Status: "client match", Offer: offer, + NAT: natType, }) } @@ -135,28 +138,33 @@ func EncodePollResponse(offer string, success bool) ([]byte, error) { }) } -// Decodes a poll response from the broker and returns an offer +// Decodes a poll response from the broker and returns an offer and the client's NAT type // If there is a client match, the returned offer string will be non-empty -func DecodePollResponse(data []byte) (string, error) { +func DecodePollResponse(data []byte) (string, string, error) { var message ProxyPollResponse err := json.Unmarshal(data, &message) if err != nil { - return "", err + return "", "", err } if message.Status == "" { - return "", fmt.Errorf("received invalid data") + return "", "", fmt.Errorf("received invalid data") } if message.Status == "client match" { if message.Offer == "" { - return "", fmt.Errorf("no supplied offer") + return "", "", fmt.Errorf("no supplied offer") } } else { message.Offer = "" } - return message.Offer, nil + natType := message.NAT + if natType == "" { + natType = "unknown" + } + + return message.Offer, natType, nil } type ProxyAnswerRequest struct { diff --git a/common/messages/proxy_test.go b/common/messages/proxy_test.go index 3aa67fb..f4191e1 100644 --- a/common/messages/proxy_test.go +++ b/common/messages/proxy_test.go @@ -109,7 +109,7 @@ func TestDecodeProxyPollResponse(t *testing.T) { }{ { "fake offer", - `{"Status":"client match","Offer":"fake offer"}`, + `{"Status":"client match","Offer":"fake offer","NAT":"unknown"}`, nil, }, { @@ -128,9 +128,9 @@ func TestDecodeProxyPollResponse(t *testing.T) { fmt.Errorf(""), }, } { - offer, err := DecodePollResponse([]byte(test.data)) - So(offer, ShouldResemble, test.offer) + offer, _, err := DecodePollResponse([]byte(test.data)) So(err, ShouldHaveSameTypeAs, test.err) + So(offer, ShouldResemble, test.offer) } }) @@ -138,16 +138,18 @@ func TestDecodeProxyPollResponse(t *testing.T) { func TestEncodeProxyPollResponse(t *testing.T) { Convey("Context", t, func() { - b, err := EncodePollResponse("fake offer", true) + b, err := EncodePollResponse("fake offer", true, "restricted") So(err, ShouldEqual, nil) - offer, err := DecodePollResponse(b) + offer, natType, err := DecodePollResponse(b) So(offer, ShouldEqual, "fake offer") + So(natType, ShouldEqual, "restricted") So(err, ShouldEqual, nil) - b, err = EncodePollResponse("", false) + b, err = EncodePollResponse("", false, "unknown") So(err, ShouldEqual, nil) - offer, err = DecodePollResponse(b) + offer, natType, err = DecodePollResponse(b) So(offer, ShouldEqual, "") + So(natType, ShouldEqual, "unknown") So(err, ShouldEqual, nil) }) } diff --git a/proxy/proxy-go_test.go b/proxy/proxy-go_test.go index 03d7307..168ca25 100644 --- a/proxy/proxy-go_test.go +++ b/proxy/proxy-go_test.go @@ -249,7 +249,7 @@ func TestBrokerInteractions(t *testing.T) { Convey("polls broker correctly", func() { var err error - b, err := messages.EncodePollResponse(sampleOffer, true) + b, err := messages.EncodePollResponse(sampleOffer, true, "unknown") So(err, ShouldEqual, nil) broker.transport = &MockTransport{ http.StatusOK, diff --git a/proxy/snowflake.go b/proxy/snowflake.go index ac67748..a1886c2 100644 --- a/proxy/snowflake.go +++ b/proxy/snowflake.go @@ -201,7 +201,7 @@ func (b *Broker) pollOffer(sid string) *webrtc.SessionDescription { log.Printf("error reading broker response: %s", err) } else { - offer, err := messages.DecodePollResponse(body) + offer, _, err := messages.DecodePollResponse(body) if err != nil { log.Printf("error reading broker response: %s", err.Error()) log.Printf("body: %s", body)

1 0

[snowflake/master] Implement NAT discovery (RFC 5780) at the client
by cohosh＠torproject.org 07 Jul '20

07 Jul '20

commit bf924445e36a1990ad1da89d99faeff17db9e42f Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Wed Jun 10 17:16:12 2020 -0400 Implement NAT discovery (RFC 5780) at the client Snowflake clients will now attempt NAT discovery using the provided STUN servers and report their NAT type to the Snowflake broker for matching. The three possibilities for NAT types are: - unknown (the client was unable to determine their NAT type), - restricted (the client has a restrictive NAT and can only be paired with unrestricted NATs) - unrestricted (the client can be paired with any other NAT). --- client/lib/rendezvous.go | 16 +++ client/snowflake.go | 26 +++++ common/nat/nat.go | 251 +++++++++++++++++++++++++++++++++++++++++++++++ go.mod | 1 + go.sum | 2 + 5 files changed, 296 insertions(+) diff --git a/client/lib/rendezvous.go b/client/lib/rendezvous.go index ca15d35..2702d4e 100644 --- a/client/lib/rendezvous.go +++ b/client/lib/rendezvous.go @@ -16,7 +16,9 @@ import ( "log" "net/http" "net/url" + "sync" + "git.torproject.org/pluggable-transports/snowflake.git/common/nat" "git.torproject.org/pluggable-transports/snowflake.git/common/util" "github.com/pion/webrtc/v2" ) @@ -36,6 +38,8 @@ type BrokerChannel struct { url *url.URL transport http.RoundTripper // Used to make all requests. keepLocalAddresses bool + NATType string + lock sync.Mutex } // We make a copy of DefaultTransport because we want the default Dial @@ -66,6 +70,7 @@ func NewBrokerChannel(broker string, front string, transport http.RoundTripper, bc.transport = transport bc.keepLocalAddresses = keepLocalAddresses + bc.NATType = nat.NATUnknown return bc, nil } @@ -110,6 +115,10 @@ func (bc *BrokerChannel) Negotiate(offer *webrtc.SessionDescription) ( if "" != bc.Host { // Set true host if necessary. request.Host = bc.Host } + // include NAT-TYPE + bc.lock.Lock() + request.Header.Set("Snowflake-NAT-TYPE", bc.NATType) + bc.lock.Unlock() resp, err := bc.transport.RoundTrip(request) if nil != err { return nil, err @@ -133,6 +142,13 @@ func (bc *BrokerChannel) Negotiate(offer *webrtc.SessionDescription) ( } } +func (bc *BrokerChannel) SetNATType(NATType string) { + bc.lock.Lock() + bc.NATType = NATType + bc.lock.Unlock() + log.Printf("NAT Type: %s", NATType) +} + // Implements the |Tongue| interface to catch snowflakes, using BrokerChannel. type WebRTCDialer struct { *BrokerChannel diff --git a/client/snowflake.go b/client/snowflake.go index d66225d..02bbf1e 100644 --- a/client/snowflake.go +++ b/client/snowflake.go @@ -16,6 +16,7 @@ import ( pt "git.torproject.org/pluggable-transports/goptlib.git" sf "git.torproject.org/pluggable-transports/snowflake.git/client/lib" + "git.torproject.org/pluggable-transports/snowflake.git/common/nat" "git.torproject.org/pluggable-transports/snowflake.git/common/safelog" "github.com/pion/webrtc/v2" ) @@ -158,6 +159,8 @@ func main() { if err != nil { log.Fatalf("parsing broker URL: %v", err) } + go updateNATType(iceServers, broker) + snowflakes.Tongue = sf.NewWebRTCDialer(broker, iceServers) // Use a real logger to periodically output how much traffic is happening. @@ -219,3 +222,26 @@ func main() { snowflakes.End() log.Println("snowflake is done.") } + +// loop through all provided STUN servers until we exhaust the list or find +// one that is compatable with RFC 5780 +func updateNATType(servers []webrtc.ICEServer, broker *sf.BrokerChannel) { + + var restrictedNAT bool + var err error + for _, server := range servers { + addr := strings.TrimPrefix(server.URLs[0], "stun:") + restrictedNAT, err = nat.CheckIfRestrictedNAT(addr) + if err == nil { + if restrictedNAT { + broker.SetNATType(nat.NATRestricted) + } else { + broker.SetNATType(nat.NATUnrestricted) + } + break + } + } + if err != nil { + broker.SetNATType(nat.NATUnknown) + } +} diff --git a/common/nat/nat.go b/common/nat/nat.go new file mode 100644 index 0000000..c9f16ad --- /dev/null +++ b/common/nat/nat.go @@ -0,0 +1,251 @@ +/* +The majority of this code is taken from a utility I wrote for pion/stun +https://github.com/pion/stun/blob/master/cmd/stun-nat-behaviour/main.go + +Copyright 2018 Pion LLC + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +*/ + +package nat + +import ( + "errors" + "fmt" + "github.com/pion/stun" + "log" + "net" + "time" +) + +var ErrTimedOut = errors.New("timed out waiting for response") + +const ( + NATUnknown = "unknown" + NATRestricted = "restricted" + NATUnrestricted = "unrestricted" +) + +// This function checks the NAT mapping and filtering +// behaviour and returns true if the NAT is restrictive +// (address-dependent mapping and/or port-dependent filtering) +// and false if the NAT is unrestrictive (meaning it +// will work with most other NATs), +func CheckIfRestrictedNAT(server string) (bool, error) { + result, err := isRestrictedMapping(server) + if err != nil { + return false, err + } + if !result { + // if the mapping is unrestrictive, we still need to check whether + // the filtering is restrictive + result, err = isRestrictedFiltering(server) + } + return result, err +} + +// Performs two tests from RFC 5780 to determine whether the mapping type +// of the client's NAT is address-independent or address-dependent +// Returns true if the mapping is address-dependent and false otherwise +func isRestrictedMapping(addrStr string) (bool, error) { + var xorAddr1 stun.XORMappedAddress + var xorAddr2 stun.XORMappedAddress + + mapTestConn, err := connect(addrStr) + if err != nil { + log.Printf("Error creating STUN connection: %s", err.Error()) + return false, err + } + + defer mapTestConn.Close() + + // Test I: Regular binding request + message := stun.MustBuild(stun.TransactionID, stun.BindingRequest) + + resp, err := mapTestConn.RoundTrip(message, mapTestConn.PrimaryAddr) + if err == ErrTimedOut { + log.Printf("Error: no response from server") + return false, err + } + if err != nil { + log.Printf("Error receiving response from server: %s", err.Error()) + return false, err + } + + // Decoding XOR-MAPPED-ADDRESS attribute from message. + if err = xorAddr1.GetFrom(resp); err != nil { + log.Printf("Error retrieving XOR-MAPPED-ADDRESS resonse: %s", err.Error()) + return false, err + } + + // Decoding OTHER-ADDRESS attribute from message. + var otherAddr stun.OtherAddress + if err = otherAddr.GetFrom(resp); err != nil { + log.Println("NAT discovery feature not supported by this server") + return false, err + } + + if err = mapTestConn.AddOtherAddr(otherAddr.String()); err != nil { + log.Printf("Failed to resolve address %s\t", otherAddr.String()) + return false, err + } + + // Test II: Send binding request to other address + resp, err = mapTestConn.RoundTrip(message, mapTestConn.OtherAddr) + if err == ErrTimedOut { + log.Printf("Error: no response from server") + return false, err + } + if err != nil { + log.Printf("Error retrieving server response: %s", err.Error()) + return false, err + } + + // Decoding XOR-MAPPED-ADDRESS attribute from message. + if err = xorAddr2.GetFrom(resp); err != nil { + log.Printf("Error retrieving XOR-MAPPED-ADDRESS resonse: %s", err.Error()) + return false, err + } + + return xorAddr1.String() != xorAddr2.String(), nil + +} + +// Performs two tests from RFC 5780 to determine whether the filtering type +// of the client's NAT is port-dependent. +// Returns true if the filtering is port-dependent and false otherwise +func isRestrictedFiltering(addrStr string) (bool, error) { + var xorAddr stun.XORMappedAddress + + mapTestConn, err := connect(addrStr) + if err != nil { + log.Printf("Error creating STUN connection: %s", err.Error()) + return false, err + } + + defer mapTestConn.Close() + + // Test I: Regular binding request + message := stun.MustBuild(stun.TransactionID, stun.BindingRequest) + + resp, err := mapTestConn.RoundTrip(message, mapTestConn.PrimaryAddr) + if err == ErrTimedOut { + log.Printf("Error: no response from server") + return false, err + } + if err != nil { + log.Printf("Error: %s", err.Error()) + return false, err + } + + // Decoding XOR-MAPPED-ADDRESS attribute from message. + if err = xorAddr.GetFrom(resp); err != nil { + log.Printf("Error retrieving XOR-MAPPED-ADDRESS from resonse: %s", err.Error()) + return false, err + } + + // Test III: Request port change + message.Add(stun.AttrChangeRequest, []byte{0x00, 0x00, 0x00, 0x02}) + + _, err = mapTestConn.RoundTrip(message, mapTestConn.PrimaryAddr) + if err != ErrTimedOut && err != nil { + // something else went wrong + log.Printf("Error reading response from server: %s", err.Error()) + return false, err + } + + return err == ErrTimedOut, nil +} + +// Given an address string, returns a StunServerConn +func connect(addrStr string) (*StunServerConn, error) { + // Creating a "connection" to STUN server. + addr, err := net.ResolveUDPAddr("udp4", addrStr) + if err != nil { + log.Printf("Error resolving address: %s\n", err.Error()) + return nil, err + } + + c, err := net.ListenUDP("udp4", nil) + if err != nil { + return nil, err + } + + mChan := listen(c) + + return &StunServerConn{ + conn: c, + PrimaryAddr: addr, + messageChan: mChan, + }, nil +} + +type StunServerConn struct { + conn net.PacketConn + PrimaryAddr *net.UDPAddr + OtherAddr *net.UDPAddr + messageChan chan *stun.Message +} + +func (c *StunServerConn) Close() { + c.conn.Close() +} + +func (c *StunServerConn) RoundTrip(msg *stun.Message, addr net.Addr) (*stun.Message, error) { + _, err := c.conn.WriteTo(msg.Raw, addr) + if err != nil { + return nil, err + } + + // Wait for response or timeout + select { + case m, ok := <-c.messageChan: + if !ok { + return nil, fmt.Errorf("error reading from messageChan") + } + return m, nil + case <-time.After(10 * time.Second): + return nil, ErrTimedOut + } +} + +func (c *StunServerConn) AddOtherAddr(addrStr string) error { + addr2, err := net.ResolveUDPAddr("udp4", addrStr) + if err != nil { + return err + } + c.OtherAddr = addr2 + return nil +} + +// taken from https://github.com/pion/stun/blob/master/cmd/stun-traversal/main.go +func listen(conn *net.UDPConn) chan *stun.Message { + messages := make(chan *stun.Message) + go func() { + for { + buf := make([]byte, 1024) + + n, _, err := conn.ReadFromUDP(buf) + if err != nil { + close(messages) + return + } + buf = buf[:n] + + m := new(stun.Message) + m.Raw = buf + err = m.Decode() + if err != nil { + close(messages) + return + } + + messages <- m + } + }() + return messages +} diff --git a/go.mod b/go.mod index 07c49a2..2ba1b2d 100644 --- a/go.mod +++ b/go.mod @@ -7,6 +7,7 @@ require ( github.com/golang/protobuf v1.3.1 // indirect github.com/gorilla/websocket v1.4.1 github.com/pion/sdp/v2 v2.3.4 + github.com/pion/stun v0.3.5 github.com/pion/webrtc/v2 v2.2.2 github.com/smartystreets/goconvey v1.6.4 github.com/xtaci/kcp-go/v5 v5.5.12 diff --git a/go.sum b/go.sum index 6768e02..9ccfb30 100644 --- a/go.sum +++ b/go.sum @@ -64,6 +64,8 @@ github.com/pion/srtp v1.2.7 h1:UYyLs5MXwbFtXWduBA5+RUWhaEBX7GmetXDZSKP+uPM= github.com/pion/srtp v1.2.7/go.mod h1:KIgLSadhg/ioogO/LqIkRjZrwuJo0c9RvKIaGQj4Yew= github.com/pion/stun v0.3.3 h1:brYuPl9bN9w/VM7OdNzRSLoqsnwlyNvD9MVeJrHjDQw= github.com/pion/stun v0.3.3/go.mod h1:xrCld6XM+6GWDZdvjPlLMsTU21rNxnO6UO8XsAvHr/M= +github.com/pion/stun v0.3.5 h1:uLUCBCkQby4S1cf6CGuR9QrVOKcvUwFeemaC865QHDg= +github.com/pion/stun v0.3.5/go.mod h1:gDMim+47EeEtfWogA37n6qXZS88L5V6LqFcf+DZA2UA= github.com/pion/transport v0.6.0/go.mod h1:iWZ07doqOosSLMhZ+FXUTq+TamDoXSllxpbGcfkCmbE= github.com/pion/transport v0.8.10 h1:lTiobMEw2PG6BH/mgIVqTV2mBp/mPT+IJLaN8ZxgdHk= github.com/pion/transport v0.8.10/go.mod h1:tBmha/UCjpum5hqTWhfAEs3CO4/tHSg0MYRhSzR+CZ8=

1 0

[torspec/master] Document relay commands for circpad cells.
by nickm＠torproject.org 07 Jul '20

07 Jul '20

commit 2c1d626b9f86a72c41f2b0768aa3e127cb7e4cb0 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Mon Jul 6 11:32:05 2020 -0500 Document relay commands for circpad cells. --- padding-spec.txt | 11 ++++++++--- tor-spec.txt | 2 ++ 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/padding-spec.txt b/padding-spec.txt index b9d99b7..f6356ed 100644 --- a/padding-spec.txt +++ b/padding-spec.txt @@ -309,8 +309,12 @@ the anonymity and load-balancing implications of their choices. Because circuit padding machines only become active at certain points in circuit lifetime, and because more than one padding machine may be active at - any given point in circuit lifetime, there is also a padding negotiation cell, - with fields as follows: + any given point in circuit lifetime, there is also a padding negotiation + cell and a negotiated response. These are relay commands 41 and 42, with + relay headers as per section 6.1 of tor-spec.txt. + + The fields of the relay cell Data payload of a negotiate request are + as follows: const CIRCPAD_COMMAND_STOP = 1; const CIRCPAD_COMMAND_START = 2; @@ -341,7 +345,8 @@ the anonymity and load-balancing implications of their choices. When a relay receives a circpad_negotiate cell, it checks that it supports the requested machine, and sends a circpad_negotiated cell, which is formatted - as follows: + in the data payload of a relay cell with command number 42 (see tor-spec.txt + section 6.1), as follows: struct circpad_negotiated { u8 version IN [0]; diff --git a/tor-spec.txt b/tor-spec.txt index 40ea4cc..af16fa4 100644 --- a/tor-spec.txt +++ b/tor-spec.txt @@ -1596,6 +1596,8 @@ see tor-design.pdf. 32..40 -- Used for hidden services; see rend-spec-{v2,v3}.txt. + 41..42 -- Used for circuit padding; see Section 3 of padding-spec.txt. + Commands labelled as "forward" must only be sent by the originator of the circuit. Commands labelled as "backward" must only be sent by other nodes in the circuit back to the originator. Commands marked

1 0

[translation/communitytpo-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-contentspot
by translation＠torproject.org 07 Jul '20

07 Jul '20

commit a6e41f4832f4d57d764366ce6a4110543a6e784b Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jul 6 16:15:12 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=communitytpo-conten… --- contents+fr.po | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/contents+fr.po b/contents+fr.po index b01d296dae..17392077e4 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -212,9 +212,9 @@ msgid "" "Onion services help you and your users defeat surveillance and censorship. " "Learn how you can deploy onion services." msgstr "" -"Les services Onion vous aide vous et vos utilisateurs à combattre la " -"surveillance et la censure. Apprenez comment vous pouvez déployez des " -"services onion." +"Les services onion vous aident, vous et vos utilisateurs, à déjouer la " +"surveillance et la censure. Apprenez comment pouvez déployez des services " +"onion." #: https//community.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrpage.cta) @@ -224,7 +224,7 @@ msgstr "Développez votre .onion" #: https//community.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrpage.body) msgid "##What are Onion Services?" -msgstr "##Que sont les Services Onion ?" +msgstr "##Que sont les services onion ?" #: https//community.torproject.org/onion-services/ #: (content/onion-services/contents+en.lrpage.body) @@ -233,10 +233,10 @@ msgid "" "onion service gives your users all the security of HTTPS with the added " "privacy benefits of Tor Browser." msgstr "" -"Les services onion sont des services qui ne peuvent être accédés que par " -"Tor. Faire tourner un service onion donne à vos utilisateurs toute la " -"sécurité du HTTPS avec les avantages de la confidentialité du Navigateur " -"Tor." +"Les services onion sont des services auxquels l’on ne peut accéder que par " +"Tor. Mettre en place un service onion donne à vos utilisateurs toute la " +"sécurité de HTTPS avec les avantages de protection des renseignements " +"personnels du Navigateur Tor." #: https//community.torproject.org/localization/ #: (content/localization/contents+en.lrpage.title)

1 0

[translation/tpo-web_completed] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web_completed
by translation＠torproject.org 06 Jul '20

06 Jul '20

commit 44e6a420ec3c8f5108dd52807382f79551617c4d Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jul 6 15:48:01 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web_completed --- contents+fr.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contents+fr.po b/contents+fr.po index ea3f6d5c2f..9cb33127e4 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -84,7 +84,7 @@ msgstr "" "Avez-vous besoin d’aide ? Visitez notre [portail " "d’assistance](https://support.torproject.org/fr/) pour obtenir des réponses " "aux questions les plus fréquentes sur la connexion à Tor, le contournement " -"de la censure, l’utilisation des services onion et plus encore." +"de la censure, l’utilisation des services onion et plus encore." #: https//www.torproject.org/download/ #: (content/download/contents+en.lrpage.title) @@ -1548,7 +1548,7 @@ msgstr "Le Navigateur Tor" #: templates/press.html:30 msgid "Onion Services" -msgstr "Les services onion" +msgstr "Les services onion" #: templates/press.html:40 msgid "Press Releases"

1 0