Add CovertDTLSConfig

proxy/README.md

@@ -46,10 +46,10 @@ Usage of ./proxy:
         The URL of the broker server that the proxy will be using to find clients (default "https://snowflake-broker.torproject.net/")
   -capacity uint
         maximum concurrent clients (default is to accept an unlimited number of clients)
+  -covertdtls-config string
+    	Configuration of dtls mimicking and randomization: mimic, randomize, randomizemimic
   -disable-stats-logger
         disable the exposing mechanism for stats using logs
-  -dtls-mimic
-    	mimic DTLS client hello of Chrome and Firefox
   -dtls-randomize
     	randomize DTLS client hello
   -ephemeral-ports-range range

proxy/lib/snowflake.go

@@ -48,6 +48,7 @@ import (
 	"github.com/theodorsm/covert-dtls/pkg/randomize"
 	"github.com/theodorsm/covert-dtls/pkg/utils"
 
+	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/covertdtls"
 	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/event"
 	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/messages"
 	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/namematcher"
@@ -170,8 +171,7 @@ type SnowflakeProxy struct {
 	periodicProxyStats *periodicProxyStats
 	bytesLogger        bytesLogger
 
-	DTLSRandomize bool
-	DTLSMimic     bool
+	CovertDTLSConfig covertdtls.CovertDTLSConfig
 }
 
 // Checks whether an IP address is a remote address for the client
@@ -430,14 +430,21 @@ func (sf *SnowflakeProxy) makeWebRTCAPI() *webrtc.API {
 
 	settingsEngine.SetDTLSInsecureSkipHelloVerify(true)
 
-	if sf.DTLSRandomize {
-		rand := randomize.RandomizedMessageClientHello{RandomALPN: true}
-		settingsEngine.SetDTLSClientHelloMessageHook(rand.Hook)
-	} else if sf.DTLSMimic {
+	if sf.CovertDTLSConfig.Mimic {
 		mimic := &mimicry.MimickedClientHello{}
+		if sf.CovertDTLSConfig.Randomize {
+			err := mimic.LoadRandomFingerprint()
+			if err != nil {
+				log.Printf("makeWebRTCAPI ERROR: %s", err)
+				return nil
+			}
+		}
 		profiles := utils.DefaultSRTPProtectionProfiles()
 		settingsEngine.SetSRTPProtectionProfiles(profiles...)
 		settingsEngine.SetDTLSClientHelloMessageHook(mimic.Hook)
+	} else if sf.CovertDTLSConfig.Randomize {
+		rand := randomize.RandomizedMessageClientHello{RandomALPN: true}
+		settingsEngine.SetDTLSClientHelloMessageHook(rand.Hook)
 	}
 
 	return webrtc.NewAPI(webrtc.WithSettingEngine(settingsEngine))

proxy/main.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/ptutil/safelog"
+	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/covertdtls"
 	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/event"
 	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/version"
 	sf "gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/proxy/lib"
@@ -46,8 +47,7 @@ func main() {
 	verboseLogging := flag.Bool("verbose", false, "increase log verbosity")
 	ephemeralPortsRangeFlag := flag.String("ephemeral-ports-range", "", "Set the `range` of ports used for client connections (format:\"<min>:<max>\").\nIf omitted, the ports will be chosen automatically.")
 	versionFlag := flag.Bool("version", false, "display version info to stderr and quit")
-	dtlsRandomize := flag.Bool("dtls-randomize", false, "randomize DTLS client hello")
-	dtlsMimic := flag.Bool("dtls-mimic", false, "mimic DTLS client hello of Chrome and Firefox")
+	covertDTLSConfig := flag.String("covertdtls-config", "", "Configuration of dtls mimicking and randomization: mimic, randomize, randomizemimic")
 
 	var ephemeralPortsRange []uint16 = []uint16{0, 0}
 
@@ -66,10 +66,6 @@ func main() {
 		log.Fatal("Cannot keep local address candidates when outbound address is specified")
 	}
 
-	if *dtlsMimic && *dtlsRandomize {
-		log.Fatal("Cannot both Randomize and Mimic DTLS client hello")
-	}
-
 	eventLogger := event.NewSnowflakeEventDispatcher()
 
 	if *ephemeralPortsRangeFlag != "" {
@@ -117,9 +113,8 @@ func main() {
 		AllowProxyingToPrivateAddresses: *allowProxyingToPrivateAddresses,
 		AllowNonTLSRelay:                *allowNonTLSRelay,
 
-		SummaryInterval: *summaryInterval,
-		DTLSRandomize:   *dtlsRandomize,
-		DTLSMimic:       *dtlsMimic,
+		SummaryInterval:  *summaryInterval,
+		CovertDTLSConfig: covertdtls.ParseConfigString(*covertDTLSConfig),
 	}
 
 	var logOutput = io.Discard