Pea Nut authored 8 months ago and jkito committed 5 months ago

Having a space in Str() is supoptimal:
> DBG Allowd gateway IP gateway ip: =51.158.144.32

jkito authored 7 months ago and jkito committed 5 months ago

this adds a new helper setDefaults() in the config
package and calls it when the config file  doesn't
exist, this provides a way for us to have  default
values for the config options

setDefaults currently only sets the UDP config  to
'true' since it is expected that UDP is enabled by
default

since obfs4 and kcp is disabled in the UI when provider
is riseup, transport needs to be set to openvpn to work
around config file with Obfs4 and KCP set to true  from
a previous version of the app

the Stop is blocking and cannot be called concurrently
with Start, when for some reason obfs4 client fails to
connect and has not yet returned from Start, a call to
Stop will block until Start has returned, which  makes
UI unresponsive for some time

calling it in a separate Go routine works around  this
issue as we can proceed to stop the openvpn process

jkito authored 8 months ago and jkito committed 8 months ago

in case of KCP the transport.Type is still obfs4, but it has
a different port than obfs4, without this commit KCP enabled
bridges were also considered as valid obfs4 bridges

in theory the same bridge can be running in both obfs4 and KCP
mode and listening on different ports, but the eip-service.json
schema separates this into different transport objects

this fixes a bug where after selecting obfs4 transport it was
trying connect to a KCP enabled bridge with plain obfs4 mode

jkito authored 8 months ago and jkito committed 8 months ago

during startVPN any error occuring are set but
this was not done for stopVPN

this was missed in 37a714e7 where the value of kcp
was written to the config file but during  parsing
the value was not added to the local struct

in b1796790 the config.Provider was changed from the provider
URL to the provider name but the check fetching motd expected
an URL this updates the case statement to match the  provider
name instead of the provider URL

this adds a new boolean "KCP" key to the systray.json
config file

kcp is linked to obfs4, so setting kcp to 'true' sets
obfs4 to also true

since io/ioutil package is deprecated now, this uses
equivalent functions from the os package

this adds a check box to the transport section of
preferences to enable KCP and makes the necessary
updates to SetTransport and GetTransport to allow
KCP to be used as a transport name

the startOpenVPN method fetches gateways for the requested transport
starts the local proxy, sets up firewall and then makes the call  to
start openvpn

this introduces helper methods to perform the preparatory tasks before
openvpn can be started, this makes it easier to navigate the function

cli (cmd/bitmask-helper/main.go and) and helpers (pkg/pickle/helpers.go)
were also fixed.

It only calls vpn.Init()

This was introduced in 970c3f4f where the code supported different api
versions, but there was not yet an implementation for v5.
The apiVersion can be set via env. In the future apiVersion will be
fetched from the API using the /providers.json URL"

It only calls config.ConfigureLogger which now get's called directly.

0xacab.org/leap/bitmask-core v0.0.0-20240529192952-8ea2f4de269e => 0xacab.org/leap/bitmask-core v0.0.0-20240705122443-e372171b7c36
golang.org/x/sys v0.17.0 => v0.22.0
github.com/rs/zerolog v1.32.0 => v1.33.0
github.com/stretchr/testify v1.8.4 => v1.9.0

jkito authored 9 months ago and jkito committed 8 months ago

this should help with debugging similar bugs which was
fixed in the previous commit

jkito authored 9 months ago and jkito committed 8 months ago

this fixes a bug where StartFirewall is called with an empty
'gateways' slice leading to blocking outgoing connections to
the openvpn gateway

in startOpenvpn func's global scope there's a 'gateways' var
which is passed to FirewallStart and the gateways are  added
to the firewall's allow list of IPs, this was re-declared in
the code branch for non-private bridge which is out of scope
where FirewallStart is called, leading to an empty 'gateways'
slice being passed to it

jkito authored 9 months ago and jkito committed 8 months ago

both the functions are used to start the obfs4 bridge proxy
one using the bridge connection parameters provided via env
another for starting with the parameters received from  the
api

this commit reuses a single function to start the proxy in both
the scenarios

jkito authored 9 months ago and jkito committed 8 months ago

this updates the helpers starting the obfsvpn bridge
to use the new client interface that was  introduced
in obfsvpn 1.0.0

Pea Nut authored 9 months ago and jkito committed 9 months ago

It does not have a value any more. Directly calling
GatewayPool.GetGatewaysByTimezone instead. Therefore making it public.

Pea Nut authored 9 months ago and jkito committed 9 months ago

It first checks if p.recommended is len=0, then iterates over it.

Pea Nut authored 9 months ago and jkito committed 9 months ago

After removing `Bitmask.ReloadFirewall()` there are no calls to `b.api.GetAllGateways()`
where the calling function actually need the gateways as return values. So I renamed the
function to FetchAllGateways. The function now only returns an error (instead of
`([]bonafide.Gateway, error)`). This simplifies the code of v5 a bit, as
we get rid of yet another function/abstraction. In v3 `gatewayPool.getAll()`
now also returns just an error.

Pea Nut authored 9 months ago and jkito committed 9 months ago

It's never called.

Pea Nut authored 9 months ago and jkito committed 9 months ago

This fixes a small logic error. Each gateway can be multiple times in
p.recommened (for each transport). If a location was selected manually,
each gateway was added twice to the returned list. The returned list is
the list of gateways we will connect to. For more information, please
check: !213

jkito authored 9 months ago and jkito committed 9 months ago

apart from its use in snowflake/bootstrap.go its also used
to form the path to eip-service.json file on disk and motd
package both expects the provider name instead of provider
url

As discussed in #838. This is a security fix. Normally this file is
deployed by the Debian packge (with 755).

Pea Nut authored 9 months ago and jkito committed 9 months ago

os.MkdirAll returns nil if the directory exists, so we don't check if
it exists.

currently the check expects only RSA private keys but
newer menshen could serve other keys as well

this updates the check to only look for 'PRIVATE KEY'
in the preamble instead of RSA PRIVATE KEY

the test is failing with the following error:
```
--- FAIL: TestLatency (0.00s)
    integration_test.go:65:
        	Error Trace:	/builds/jkito/bitmask-vpn/pkg/vpn/menshen/integration_test.go:65
        	Error:      	Received unexpected error:
        	            	socket: permission denied
        	Test:       	TestLatency
        	Messages:   	Could not calc latency
FAIL
FAIL	0xacab.org/leap/bitmask-vpn/pkg/vpn/menshen	0.029s
```

it is beacause of missing permissons, the pro-bing library attempts
to send an "unprivileged" ping via UDP. On Linux, this must be enabled
with a sysctl command

this removes the go generate way of generating the
pkg/config/version.go file and uses build time  ld
flags to set the version when building from git or
uses .gitattributes to set it during git archive