Neel Chauhan
b882d9456b
Merge branch 'bug40378' into 'main'
...
resolve host to IP to check if it's local before connecting
See merge request tpo/anti-censorship/pluggable-transports/snowflake!413
2025-09-20 21:12:54 -04:00
WofWca
f3e040bbd8
improvement: less scary failed conn logs & metrics
...
...and adjust the `totalFailedConnections` metric name
and description.
This commit should make the periodic stats log messages
and the relevant metric look less scary to users:
P2P connection failures are relatively frequent and are usually
not indicative of the proxy operator having done something wrong.
So let's tone the wording down.
See the discussion: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/516#note_3173677 .
2025-03-15 11:15:22 -04:00
WofWca
46fdcce5c6
fix: data race warnings of tokens_t
...
This migrates from using `atomic.LoadInt64` on `int64`
to making the `clients` field itself `atomic.Int64`.
Also `count` now takes `*tokens_t` by reference,
which fixes a linter warning.
It's not clear to me why it warned about this,
but I simplified it anyway.
2025-03-12 09:53:40 -04:00
WofWca
730e400123
fix: periodicProxyStats.connectionCount race
...
And `failedConnectionCount`.
Convert the `int` / `uint` to `atomic.Int32` / `atomic.Uint32`.
The race was discovered by running a proxy with the `-race` flag.
2025-03-12 00:47:22 +04:00
WofWca
1923803124
fix: potential race conditions with non-local err
...
Some of the changes do not appear to have a potential race condition,
so there it is purely a refactor,
while in others (e.g. in broker.go and in proxy/lib/snowflake.go)
we do use the same variable from multiple threads / functions.
2025-03-12 00:47:07 +04:00
WofWca
01819eee32
fix(proxy): race condition warning for isClosing
...
It appears that there is no need for the `isClosing` var at all:
we can just `close(c.sendMoreCh)` to ensure that it doesn't block
any more `Write()`s.
This is a follow-up to
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/144 .
Related:
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/524 .
2025-03-11 15:50:53 -04:00
WofWca
583178f4f2
feat(proxy): add failed connection count stats
...
For the summary log and for Prometheus metrics.
Log output example:
> In the last 1h0m0s, there were 7 completed successful connections. 2 connections failed. Traffic Relayed ↓ 321 KB (0.10 KB/s), ↑ 123 KB (0.05 KB/s).
2025-03-11 13:12:44 +00:00
WofWca
50bed1e67a
refactor: docstring for checkIsRelayURLAcceptable
...
Related: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40378 .
2025-03-03 12:14:15 +00:00
WofWca
6384643109
fix(proxy): improve NAT test reliability
...
This is a hack, and I'm not entirely sure how it works,
but it appears to work, at least somewhat.
See https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40419#note_3141855 .
2025-02-17 11:47:11 +00:00
meskio
e345c3bac9
proxy: add country to prometheus metrics
2025-02-13 12:44:23 +01:00
meskio
b3c734ed63
proxy: webRTCconn gives the remote IP instead of the Address
...
We only use the IP part of the address.
2025-02-13 12:44:17 +01:00
WofWca
57eefd4b37
Temove outdated comment
...
As per https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/502#note_3159902 .
The comment was added in c28c8ca48983c01565ef
2025-02-12 11:50:29 -05:00
WofWca
cb0fb02cd5
fix(proxy): not answering before client timeout
...
This is related to
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40230 .
The initial MR that closed that issue,
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/391 ,
was not semantically correct, because `DataChannelTimeout`
starts after the client has already received the answer.
After
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/498#note_3156256
the code became not only semantically incorrect,
but also functionally incorrect because now if this timeout is hit
by the proxy, the client is guaranteed to be gone already.
This commit fixes it, by lowering the timeout.
This addresses a suggestion in
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40447 .
This also closes
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40381
and supersedes
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/415 .
2025-02-12 10:17:08 -05:00
WofWca
e038b68d79
refactor(proxy): simplify tokens.ret() on error
2025-01-04 19:31:44 +04:00
WofWca
85a93c5303
docs: clarify -ports-range is for port forwarding
2024-12-13 17:06:13 +04:00
WofWca
92521b6679
improvement: warn if ports-range is too narrow
...
...and improve the docstring for the parameter.
2024-12-13 17:06:11 +04:00
WofWca
cb32d008ca
docs: improve ephemeral-ports-range description
...
Clarify that the default range is wide.
2024-12-13 16:09:22 +04:00
Cecylia Bocovich
6ecd5bf6d7
Remove log when offer is nil
...
After !414 , we started returning a nil offer from pollOffer if the proxy
was not matched with a client. It's not longer an indication of failure,
so we should remove the "bad offer from broker" log message.
2024-12-03 15:05:44 -05:00
Cecylia Bocovich
5b479fdb13
Log EventOnCurrentNATTypeDetermined for proxy
2024-12-03 15:05:44 -05:00
WofWca
ae5bd52821
improvement: use SetIPFilter for local addrs
...
Closes https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40271 .
Supersedes https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/417 .
This simplifies the code and (probably) removes the need for
`StripLocalAddresses`, although makes us more dependent on Pion.
Signed-off-by: Cecylia Bocovich <cohosh@torproject.org>
2024-11-28 10:56:40 -05:00
Cecylia Bocovich
43799819a1
Suppress logs of proxy events by default
2024-11-28 10:42:54 -05:00
WofWca
c5d680342b
refactor: separate function for connectToRelay
...
This should make the code easier to glance over,
to understand that relay connection is performed from inside
the datachannel handler.
2024-11-21 14:55:28 +00:00
Shelikhoo
239357509f
update snowflake to use pion webrtc v4
2024-11-13 14:58:53 +00:00
Renovate Bot
290be512e3
chore(deps): update module github.com/pion/webrtc/v3 to v4
2024-11-11 18:45:36 +00:00
Cecylia Bocovich
aaf8826560
Add proxy event for when client has connected
...
This enables the usage of callbacks that will be called when a client
has opened a data channel connection to the proxy.
2024-11-06 10:31:33 -05:00
Waldemar Zimpel
028ff82683
Optionally enable local time for logging
...
Introduces the option `-log-local-time` which switches to local time
for logging instead of using UTC. Also if this option is applied, a message
is being output to the log on startup about the usage of local time
to draw attention, so the user/operator can take care of anonymity in case
the logs are going to be shared.
2024-10-28 16:23:44 +01:00
Neel Chauhan
f4305180b9
Remove the pollInterval loop from SignalingServer.pollOffer in the standalone proxy
...
Closes #40210 .
2024-10-22 14:50:43 -04:00
Neel Chauhan
2d128985ba
Enhance testing
2024-10-17 20:02:39 -04:00
Neel Chauhan
e22f397d84
Remove false positives
2024-10-17 19:49:55 -04:00
Neel Chauhan
f1e9f58b47
Move IP check
2024-10-17 23:25:03 +00:00
Neel Chauhan
990d165937
move IsHostnameLocal to common/util
2024-10-17 23:25:03 +00:00
Neel Chauhan
6fef2caaa8
Check error
2024-10-17 23:25:03 +00:00
Neel Chauhan
aaa59df308
Reduce network load
2024-10-17 23:25:03 +00:00
Neel Chauhan
5e4619bae1
Apply 1 suggestion(s) to 1 file(s)
...
Co-authored-by: Cecylia Bocovich <cohosh@torproject.org>
2024-10-17 23:25:03 +00:00
Neel Chauhan
7974463653
Revert "Add delay"
...
This reverts commit 97c73bcab662de0033bbaeadb76dea0a3ca274da.
2024-10-17 23:25:03 +00:00
Neel Chauhan
e983f7425c
Add delay
2024-10-17 23:25:03 +00:00
Neel Chauhan
37a2570643
Block remote IPs and not just hostnames
2024-10-17 23:25:03 +00:00
Neel Chauhan
c18a1b7e69
resolve host to IP to check if it's local before connecting
2024-10-17 23:25:03 +00:00
Neel Chauhan
8792771cdc
broker and proxy must not reject client offers with no ICE candidates
...
Fixes #40371 . Partially reverts !141 .
2024-10-17 15:46:02 -04:00
Neel Chauhan
9ff205dd7f
Probetest/proxy: Set multiple comma-separated default STUN URLs
...
This adds the BlackBerry STUN server alongside Google's. Closes #40392 .
2024-10-17 15:15:02 -04:00
WofWca
d346639eda
improvement(proxy): improve NAT check logging
2024-09-26 18:15:04 +01:00
WofWca
9b04728809
docs: improve proxy CLI param descriptions
...
Since the proxy component is the most dedicated for public use,
more comprehensive docs are good.
2024-09-25 16:50:18 +01:00
David Fifield
de61d7bb8d
Document relayURL return in SignalingServer.pollOffer.
...
The second return value was added in
863a8296e8
2024-09-21 18:28:17 +00:00
WofWca
0f0f118827
improvement(proxy): don't panic on invalid relayURL
...
Though prior to this change the panic could only happen
if the default relayURL set by the proxy is invalid,
since `datachannelHandler` is only called after a succesful
`checkIsRelayURLAcceptable()`, which ensures that it _is_ valid.
But in the case of invalid default relay URL, a warning is printed
already.
2024-09-21 18:20:31 +00:00
David Fifield
f752d2ab0c
Spell out EphemeralMinPort and EphemeralMaxPort in comment.
...
For searching purposes.
2024-09-21 14:30:59 +00:00
WofWca
daff4d8913
refactor(proxy): add comment about packet size
2024-09-19 19:14:04 +00:00
WofWca
51edbbfd26
fix(proxy): maybe memory leak on failed NAT check
...
Maybe related: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40243
2024-09-09 15:26:58 +01:00
WofWca
f44aa279fe
refactor(proxy): improve NAT check logging
...
4ed5da7f2f
2024-09-09 15:26:55 +01:00
WofWca
7f9fea5797
fix(proxy): send answer even if ICE gathering is not complete
...
Otherwise the connection is guaranteed to fail, even though
we actually might have gathered enough to make a successful
connection.
Closes https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40230
This is the standalone proxy counterpart of https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake-webext/-/merge_requests/55
2024-09-09 11:58:28 +01:00
WofWca
2bbd4d0643
refactor(proxy): better RelayURL description
...
It's the case that it's simply "default" after
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/merge_requests/87
Now the broker specifies the relay URL (see `ProxyPollResponse`).
2024-09-05 13:04:42 +01:00
