Add xormask option #121
Add xormask option #121
Conversation
|
I didn't test UDP because UDP wasn't working without any modifications |
| @@ -72,7 +75,7 @@ class NETCPLink: LinkInterface { | |||
| var newBuffer = buffer | |||
| newBuffer.append(contentsOf: data) | |||
| var until = 0 | |||
| let packets = PacketStream.packets(fromStream: newBuffer, until: &until) | |||
| let packets = PacketStream.packets(fromStream: newBuffer, until: &until, xorMask: self!.xorMask) | |||
There was a problem hiding this comment.
Unwrapped self here is very likely to raise unpredictable, obscure exceptions on disconnection. Better add a guard.
| packetsToUse = packets!.map({ (packet) -> Data in | ||
| return Data(bytes: packet.map{$0 ^ self!.xorMask}, count: packet.count) | ||
| }) | ||
| } |
There was a problem hiding this comment.
This code in dangerous. Replace _ in 61 and use it rather than self! for safety. Also, packets in the else block may be nil if xorMask != 0.
|
@XMB5 meanwhile could you send me an email to beta@passepartoutvpn.app from your main contact? Thank you! |
|
Sent it |
|
A follow-up: I think of postponing this because I'd like to evaluate pluggable transports in the (far) future. It's just that with a new API this code would need to be adjusted. I'll keep you updated along with my considerations. |
|
Is there any update on this? |
Not until I have time to test it thoroughly. It's a deep change for a stable app in production, I can't mess up. |
|
Isn't tls-crypt, which is already supported, more effective or the same in effectiveness in bypassing firewalls? I have customers happily using OpenVPN with tls-crypt enabled to bypass the GFW, without xorpatch. |
This PR adds the
scramble xormaskoption from the openvpn xor patch. This option XORs all incoming and outgoing bytes (except for packet lengths when using TCP) with any byte. This does not add security; instead it is for bypassing firewalls. This implementation only supports one-bytexormasks, for examplescramble xormask z. In this example, all incoming and outgoing bytes would be XORed with0x7A, the ascii value of z.The XORing happens in
ControlPacket.m. The rest of the changes are for parsing the option from an ovpn config file.Solves issue 38.