Closed
Milestone expired on Oct 15, 2024

2024.10 LEAP VPN Release

TIMING

  • Wk1 : 08.12 Planning and Scoping
  • Wk2 - 10: 08.19 Dev
  • Wk11: 10.14 Testing and release

RELEASES

Desktop client release: The upcoming release will be a maintenance/security release update of obfsvpn and a security fix. Plus, work on load balancing via initial geolocation dev and the invite system based on introducer implementation will be added for internal testing.. Release checklist: bitmask-vpn#893 (closed)

Android release The upcoming release will contain obf4 over kcp support. Integration of API v5 has been moved forward, but requires further work for full support of the new backend API. The new release contains an updated bitmask-core library with a added Java bindings to pass an invite code to the library. It's a public release and will contain all fixes and improvements developed of the beta releases 1.4.0RC1 and 1.4.0RC2, for example fixes for app crashes, memory leaks but also support for ed25519 private keys to setup VPN connections and updated translations. Release checklist: bitmask_android#9189 (closed)

Platform release The upcoming release will include several important updates. These include upgrading OpenVPN from version 2.5.1 to 2.6.3 and improving OpenVPN performance with a new flag to enable openvpn-dco. Additionally, we are switching the OpenVPN data cipher from AES-128-CBC to CHACHA20-POLY1305 for enhanced security. A new service , Introducer, will also be introduced, allowing connections to backend APIs from censored networks. Release checklist: leap/container-platform/lilypad#110 (closed)

Circumvention Tech There will be a refactor and release of obfsVPN to improve error handling for failing connections. This fix ensures that obfsvpn recovers from network failures and improves obfsvpn's overall robustness. Moreover obfsvpn in server mode now supports proxying TCP traffic, so that it can be used as an 'introducer' for the API. Moreover we developed and integrated QUIC as stream protocol into obfsVPN. It's a working proof of concept, which we will test in the field in our next test cycles. We finished field testing of port hopping via obfs4 and did the final preperations for use of obfs4+kcp via Bitmask. Release of obfs4+KCP checklist: obfsvpn#60

CIRCUMVENTION TECH

DELIVERABLES

DEVELOPMENT

FIELD TESTING

  • Finalize field testing and analysis of port hopping
  • Deploy Plotly dashboard on monitoring machine
  • Automated tests can be sent to infrastructure without user interaction
  • start experimenting with new PT, e.g. DNSTT
  • metrics documentation and write up

PROVIDER

INVITE SYSTEM

The Invite system will allow use of an invite code to establish connections with circumvention providers. It requires: 1) APIV5 implemented on the platform and clients, 2) The "Introducer", new proxy tech used for circumvention tech providers to protect the discovery process. In addition a Bucket system which creates resilency in the case of burnt bridges will be created, but is not neccessary to begin use. For desktop we will begin dev on the required bitmask multi-provider.

UX CHANGES

Create first run UX to include invite and implement it

UPGRADING to V5

ANDROID

BITMASK-CORE

INTRODUCER

ANDROID

BITMASK CORE

DESKTOP

  • Implement introducer flow for dev testing (env variable to set introducer)

LILYPAD

  • Configure obfsvpn-server to point to a menshen backend: obfsvpn#38 (closed) (8hrs)
  • Orchestration: deploy introducer within lilypad leap/container-platform/lilypad#90 (closed) (4hrs)
  • Test deployment with obfsvpn-client and curl (4hrs)
  • Stretch: make the API available to local network, only introducer speaks to api and close the public ports that expose the api and open vpn ports (6hrs)

BUCKET SYSTEM: work in progress, for next milestone.

LOAD BALANCING

Working to ease congestion of gateways is taking the following form:

GEO-LOCATION

CLIENTS

PLATFORM / MENSHEN

  • implement menshen api endpoint to find nearest gateway

BITMASK CORE

MENSHEN AGENT REPORTS CPU LOAD Next rounds

OPENVPNDCO AND OPENVPN OPTIMIZATION

  • openvpn container upgrade
  • openvpn-dco deployment and testing
  • Optimizing openVPN to help with congestion (syam) (16hrs)

GENERAL LEAP VPN IMPROVEMENTS

ANDROID

DESKTOP

PACKAGING

  • [CI] build packages for debian and ubuntu in different docker images and in separate jobs (6h) bitmask-vpn#858 (closed)
  • Sign and upload new version to ppa (0.24.8) (2h) bitmask-vpn#903 (closed)
  • Sign and upload new version to ppa (0.24.9) (2h)

INFRASTRUCTURE IMPROVEMENTS

PUBLIC FACE IMPROVEMENTS

  • Bitmask.net determination and strategy (2h)

TUNNEL-TELEMETRY IMPROVEMENTS