The old behavior closed the connection on handshake failure after:
* The first N bytes (random on a per-server basis).
* The first M seconds (random on a per-server basis).
Whichever came first. As Sergey Frolov kindly points out, depending on
which conditions cause termination, the server will send either a FIN or
a RST. This change will remove the "amount read" based termination
threshold, so that connections that cause failed handshakes will discard
all data received until the teardown time is reached.
Thanks to Sergey Frolov for bringing this issue to my attention.
This commit changes the upstream repo location to:
https://gitlab.com/yawning/obfs4.git
Additionally all the non-`main` sub-packages now have an import
comment annotation. As a matter of courtesy, I will continue to
push to both the existing github.com and git.torproject.org repos
for the foreseeable future, though I reserve the right to stop
doing so at any time.
It's supposed to use the one derived from the client's handshake
(assuming the clock skew is within acceptable limits), but it was using
the one based off the current system time.
It used to be that all of the bridge side parameters needed to be
manually specified together. This was somewhat nonsensical, and the IAT
mode can now be set as the only obfs4 option in a `ServerTransportOptions`
torrc directive.
Thanks to dcf for reporting the issue.
ClientFactories now have a Dial() method instead of a WrapConn()
method, so that it is possible to write something like meek-client
using the obfs4proxy framework.
This breaks the external interface if anyone is using obfs4proxy as
a library, but the new way of doing things is a trivial modification,
to a single routine that shouldn't have been very large to begin with.
The Go developers decided to move the go.crypto repository to
golang.org/x/crypto, and also to transition from hg to git. The tip of
tree code.google.com copy of the code is broken due to the import paths
pointing at the new repository.
While the change here is simple (just update the import location), this
affects packagers as it now expects the updated package. Sorry for the
inconveneince, I blame the Go people.
Exhaustively testing padding combinations is really slow, and was
causing timeouts during the Debian ARM package build process. Attempt
to improve the situation by:
* Reusing the client and server keypair for all of the tests, to cut
runtime down by ~50%.
* Splitting the client side and server side tests up, as it appears
the timeout is per-test case.
If this doesn't fix things, the next thing to try would be to reduce
the actual number of padding lengths tested, but that is a last resort
at the moment.
Instead of "node-id" and "public-key" that are Base16 encoded, use
"cert" which contains the "node-id" and "public-key" in Base64 encoded
form. This is more compact and cuts the length down by 49 characters.
Write an example client bridge line suitable for use with the running
obfs4 server instance to "obfs4_bridgeline.txt" for the convenience of
bridge operators.
* Unbreak inbound TYPE_PRNG_SEED processing.
* IAT obfuscation is now a per-bridge argument (iat-mode).
* 0 (default) = Disabled.
* 1 = Enabled, ScrambleSuit-style with bulk throughput optimizations.
* 2 = Paranoid, Each IAT write will send a length sampled from the
length distribution. (EXPENSIVE).
The "iat-mode" argument is mandatory on the Bridge lines, and as a
ServerTransportOption. Old statefiles will continue to load and use
the default value, edit it if your hat is made of tin foil.
WARNING: THIS BREAKS BACKWARD COMPATIBILITY.
This is primarily to work around bug #12930. Base16 was chosen over
unpadded Base64 because the go runtime Base64 decoder does not handle
omitting the padding.
May $deity have mercy on anyone who needs to hand-enter an obfs4 bridge
line because I will not.
Golang's command line parser is slightly cumbersome to use with
subcommands, so the arguments are "obfs4-iatObufscation" and
"obfs-distBias" instead of obfsproxy style subcommands.
* Changed obfs4proxy to be more like obfsproxy in terms of design,
including being an easy framework for developing new TCP/IP style
pluggable transports.
* Added support for also acting as an obfs2/obfs3 client or bridge
as a transition measure (and because the code itself is trivial).
* Massively cleaned up the obfs4 and related code to be easier to
read, and more idiomatic Go-like in style.
* To ease deployment, obfs4proxy will now autogenerate the node-id,
curve25519 keypair, and drbg seed if none are specified, and save
them to a JSON file in the pt_state directory (Fixes Tor bug #12605).