Commit Graph

72 Commits (3cf3f3bdd51434e155461e87c6601cc99ec33cdc)

Author SHA1 Message Date
klzgrad 3cf3f3bdd5 Use use_partition_alloc=false to reduce OpenWrt arm builds 2021-10-28 22:03:52 +08:00
klzgrad 090afa7492 Make --insecure-concurrency option public
Can't stop people who want to use it.
2021-10-28 20:57:33 +08:00
klzgrad c37f1a92d6 socket: Fix invalid SchemeHostPort of bracketless ipv6 hostnames 2021-10-28 20:20:53 +08:00
klzgrad c981e15e2d Update OpenWrt builds for 21.02.0
Removed useless parameter arm_version=0 in aarch64 builds.

Re-added arm_arm1176jzf-s_vfp, arm_arm926ej-s, arm_mpcore, arm_xscale
due to previously missing arm_use_thumb=false in build.

Re-added arm_cortex-a5_vfpv4, missing in 19.07.8 but back in 21.02.0.

Added arm_cortex-a7 (mediatek/mt7629), new in 21.02.0.

Removed arm_cortex-a8_neon (samsung/s5pv210), removed in 21.02.0.
2021-10-24 22:17:08 +08:00
klzgrad 8c58e4d252 libc++: Guard C++20 atomic type aliases
https://reviews.llvm.org/D75183
https://github.com/ziglang/zig/issues/6573
2021-10-24 21:14:00 +08:00
klzgrad a826b00930 Add tool to list OpenWrt architectures and targets 2021-10-24 21:11:51 +08:00
klzgrad a787cbd99d Add continuous integration and tests 2021-10-21 00:10:48 +08:00
klzgrad cf91d1c781 Add build scripts 2021-10-21 00:10:48 +08:00
klzgrad 2ed7eef87c Add example config.json 2021-10-21 00:10:48 +08:00
klzgrad 11a693390b Add README 2021-10-21 00:10:48 +08:00
klzgrad 2a592daa40 Add LICENSE 2021-10-21 00:10:48 +08:00
klzgrad 3b91aab128 Add source import tool 2021-10-21 00:10:48 +08:00
klzgrad 208da9a1e8 Fix QUIC version compatibility 2021-10-21 00:10:48 +08:00
klzgrad 2a8176906f Support SOCKS proxy authentication 2021-10-21 00:10:48 +08:00
klzgrad 574789ff66 Raise initial padding number to 8
Protect initial handshake lengths.

Common client initial sequence:

- TLS: ClientHello
- TLS: ChangeCipherSpec, Finished
- H2: Magic, SETTINGS, WINDOW_UPDATE
- H2: HEADERS: GET
- H2: SETTINGS ACK

Common server initial sequence:

- TLS: ServerHello, ChangeCipherSpec, ...
- TLS: Certificate, ...
- H2: SETTINGS
- H2: WINDOW_UPDATE
- H2: SETTINGS ACK
- H2: HEADERS: 200 OK
2021-10-21 00:10:48 +08:00
klzgrad cfb8494e39 Negotiate padding capability automatically
Client: On the first connection does a full Open and detects if the
server supports padding by checking for "Padding" header in the
response. Applies padding if the server does. In the following
connections it's back to Fast Open.

Server: Detects if the client supports padding by checking for "Padding"
header in the CONNECT request. Applies padding if the client does.

Both client and server always send "Padding" headers to somewhat protect
the request and response headers' packet lengths, even if the other side
may not acknowledge padding negotiation, either due to old version or
"Padding" headers being dropped by the frontend.

The manual option --padding is removed.
2021-10-21 00:10:48 +08:00
klzgrad 3d34bc7773 Prevents padding headers from being indexed 2021-10-21 00:10:48 +08:00
klzgrad 1f2ca97146 Add option for concurrent transport
Useful only for high-end situations where a single connection
is throttled at 10MB/s somehow.

Makes traffic obfuscation less secure.
2021-10-21 00:10:48 +08:00
klzgrad bade85c1dd Add --extra-headers option 2021-10-21 00:10:48 +08:00
klzgrad 989ebc34fd Add cert net fetcher 2021-10-21 00:10:48 +08:00
klzgrad a130e045c9 Redirect DNS for redir://
Run a fake stub DNS resolver at the same port with redir://.
2021-10-21 00:10:48 +08:00
klzgrad 63007b2d86 Support TCP transparent proxying
Enable with naive --listen=redir:// and iptables ... -j REDIRECT
--to-ports 1080.
2021-10-21 00:10:48 +08:00
klzgrad cbd271d4d2 Support loading config.json 2021-10-21 00:10:48 +08:00
klzgrad 5c8e8a9b96 Add QUIC client 2021-10-21 00:10:48 +08:00
klzgrad 9d2e9cd9ff Add http_proxy_socket to BUILD.gn 2021-10-21 00:10:48 +08:00
klzgrad 99d1a6e4c6 Add server implementation and tunnel padding 2021-10-21 00:10:48 +08:00
klzgrad 31b0bf9782 Add Naive client to BUILD.gn 2021-10-21 00:10:48 +08:00
klzgrad 3313a459d1 Add initial implementation of Naive client 2021-10-21 00:10:47 +08:00
klzgrad e87942efda allocator: Improve MIPS coverage of spinlocks 2021-10-21 00:08:06 +08:00
klzgrad 97bb5a14a3 debug: Fix uClibc macro condition 2021-10-21 00:08:06 +08:00
klzgrad b87637bf6e third_party: Fix missing sgidefs.h for Musl 2021-10-21 00:08:06 +08:00
klzgrad 72fb843b90 base: Do not forward declare stat64 for Musl 2021-10-21 00:08:06 +08:00
klzgrad 2cf40d4afa base: Fix narrowing casting for Musl 2021-10-21 00:08:06 +08:00
klzgrad 8a8cb17895 base: Disable __close overloading for Musl 2021-10-21 00:08:06 +08:00
klzgrad b82b1a7cc7 allocator: Disable uffd support for Musl 2021-10-21 00:08:06 +08:00
klzgrad d275a3f80b process: Remove use of mallinfo for Musl 2021-10-21 00:08:06 +08:00
klzgrad 814fd95322 base: Remove use of mallinfo for Musl 2021-10-21 00:08:06 +08:00
klzgrad 3bdc85dfdc udp: Fix mmsghdr struct initializer for Musl
On OpenWrt x64 there are paddings fields in the struct, making
the initializer list not work.
2021-10-21 00:08:06 +08:00
klzgrad de8ee2da54 dns: Support Musl 2021-10-21 00:08:06 +08:00
klzgrad 208c49c681 dns: Fix iwyu 2021-10-21 00:08:06 +08:00
klzgrad bea6b36ad0 debug: Fix obsolete max check 2021-10-21 00:08:06 +08:00
klzgrad 4979ce8ac9 build: Handle empty pkgconfig in sysroot 2021-10-21 00:08:06 +08:00
klzgrad 9797433197 build: Add sysroot creator script 2021-10-21 00:08:06 +08:00
klzgrad 13da013969 build: Add OpenWrt toolchains 2021-10-21 00:08:06 +08:00
klzgrad 100329bb50 build: Support MIPS -mtune= flag 2021-10-21 00:08:06 +08:00
klzgrad df14a472c5 build: Support ARM build without FPU 2021-10-21 00:08:06 +08:00
klzgrad ca13195646 build: Support -mcpu= on ARM and ARM64 2021-10-21 00:08:06 +08:00
klzgrad 9d521accbd quic: Add support for HTTP/3 CONNECT Fast Open
SpdyProxyClientSocket uses read_callback_ for both Connect() and
Read(), and its OnIOComplete() calls read_callback_, thus its fast
connect code checks read_callback_. The code was ported to
QuicProxyClientSocket without much change.

But QuicProxyClientSocket uses a separate connect_callback_ apart from
read_callback_, and its OnIOComplete() calls connect_callback_, thus
when headers are received after Connect() it doesn't need to check
read_callback_ and should always avoid calling connect_callback_.
2021-10-21 00:08:06 +08:00
klzgrad 4d07c6f2c6 h2: Pad RST_STREAM frames
Clients sending too many RST_STREAM is an irregular behavior.

Hack in a preceding END_STREAM DATA frame padded towards [48, 72]
before RST_STREAM so that the TLS record looks like a HEADERS frame.

The server often replies to this with a WINDOW_UPDATE because padding
is accounted in flow control. Whether this constitudes a new irregular
behavior is still unclear.
2021-10-21 00:08:06 +08:00
klzgrad 4e1f4c4e4a h2: Add support for HTTP/2 CONNECT Fast Open
SpdyProxyClientSocket waits for 200 OK before returning OK for Connect.

Change that behavior to returning OK immediately after CONNECT header.

This feature is enabled by a "fastopen" header via the proxy delegate.

Design notes:

The current approach is better than the obvious TCP Fast Open style fake
Connect().

Fast Open should not be used for preconnects as preconnects need actual
connections set up. The Naive client does not use preconnects per se
(using "...RawConnect") but the user agent will use preconnects and the
Naive client has to infer that. Hence there is a need to check the
incoming socket for available bytes right before Connect() and configure
whether a socket should be connected with Fast Open. But fake Connect()
make it difficult to check the incoming socket because it immediately
returns and there is not enough time for the first read of the incoming
socket to arrive.

To check for preconnects it is best to push the first read of the
incoming socket to as late as possible. The other (wrong) way of doing
that is to pass in an early read callback and call it immediately after
sending HEADERS and then send the available bytes right there. This way
is wrong because it does not work with late binding, which assumes
Connect() is idempotent and causes sockets opened in this way to be
potentially bound to the wrong socket requests.

The current approach is to return OK in Connect() right after sending
HEADERS before getting the reply, which is to be received later. If the
reply is received during a subsequent Read() and the reply indicates an
error, the error is returned to the callback of the Read(); otherwise
the error is ignored with the connection disconnected and subsequent
Read() and Write() should discover the disconnection.
2021-10-21 00:08:06 +08:00