Rebase fixup

Update module github.com/refraction-networking/utls to v1.6.4

codecov.yaml

@@ -1,5 +1,4 @@
 coverage:
   status:
-    project:
-      default:
-        threshold: 1%
+    project: off
+    patch: off

go.mod

@@ -1,26 +1,30 @@
 module github.com/cbeuw/Cloak
 
-go 1.18
+go 1.21
+
+toolchain go1.22.2
 
 require (
 	github.com/cbeuw/connutil v0.0.0-20200411215123-966bfaa51ee3
-	github.com/gorilla/mux v1.8.0
-	github.com/gorilla/websocket v1.4.2
-	github.com/juju/ratelimit v1.0.1
-	github.com/sirupsen/logrus v1.8.1
-	github.com/stretchr/testify v1.7.1
-	gitlab.com/yawning/utls.git v0.0.12-1
-	go.etcd.io/bbolt v1.3.6
-	golang.org/x/crypto v0.1.0
+	github.com/gorilla/mux v1.8.1
+	github.com/gorilla/websocket v1.5.1
+	github.com/juju/ratelimit v1.0.2
+	github.com/refraction-networking/utls v1.6.4
+	github.com/sirupsen/logrus v1.9.3
+	github.com/stretchr/testify v1.9.0
+	go.etcd.io/bbolt v1.3.9
+	golang.org/x/crypto v0.22.0
 )
 
 require (
+	github.com/andybalholm/brotli v1.0.6 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/dsnet/compress v0.0.1 // indirect
-	github.com/kr/pretty v0.1.0 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	gitlab.com/yawning/bsaes.git v0.0.0-20190805113838-0a714cd429ec // indirect
-	golang.org/x/sys v0.1.0 // indirect
+	golang.org/x/net v0.21.0 // indirect
+	golang.org/x/sys v0.19.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,53 +1,52 @@
+github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI=
+github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/cbeuw/connutil v0.0.0-20200411215123-966bfaa51ee3 h1:LRxW8pdmWmyhoNh+TxUjxsAinGtCsVGjsl3xg6zoRSs=
 github.com/cbeuw/connutil v0.0.0-20200411215123-966bfaa51ee3/go.mod h1:6jR2SzckGv8hIIS9zWJ160mzGVVOYp4AXZMDtacL6LE=
+github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
+github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dsnet/compress v0.0.1 h1:PlZu0n3Tuv04TzpfPbrnI0HW/YwodEXDS+oPKahKF0Q=
-github.com/dsnet/compress v0.0.1/go.mod h1:Aw8dCMJ7RioblQeTqt88akK31OvO8Dhf5JflhBbQEHo=
-github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
-github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
-github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/juju/ratelimit v1.0.1 h1:+7AIFJVQ0EQgq/K9+0Krm7m530Du7tIz0METWzN0RgY=
-github.com/juju/ratelimit v1.0.1/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
-github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/juju/ratelimit v1.0.2 h1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=
+github.com/juju/ratelimit v1.0.2/go.mod h1:qapgC/Gy+xNh9UxzV13HGGl/6UXNN+ct+vwSgWNm/qk=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/refraction-networking/utls v1.6.4 h1:aeynTroaYn7y+mFtqv8D0bQ4bw0y9nJHneGxJ7lvRDM=
+github.com/refraction-networking/utls v1.6.4/go.mod h1:2VL2xfiqgFAZtJKeUTlf+PSYFs3Eu7km0gCtXJ3m8zs=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/ulikunitz/xz v0.5.6/go.mod h1:2bypXElzHzzJZwzH67Y6wb67pO62Rzfn7BSiF4ABRW8=
-gitlab.com/yawning/bsaes.git v0.0.0-20190805113838-0a714cd429ec h1:FpfFs4EhNehiVfzQttTuxanPIT43FtkkCFypIod8LHo=
-gitlab.com/yawning/bsaes.git v0.0.0-20190805113838-0a714cd429ec/go.mod h1:BZ1RAoRPbCxum9Grlv5aeksu2H8BiKehBYooU2LFiOQ=
-gitlab.com/yawning/utls.git v0.0.12-1 h1:RL6O0MP2YI0KghuEU/uGN6+8b4183eqNWoYgx7CXD0U=
-gitlab.com/yawning/utls.git v0.0.12-1/go.mod h1:3ONKiSFR9Im/c3t5RKmMJTVdmZN496FNyk3mjrY1dyo=
-go.etcd.io/bbolt v1.3.6 h1:/ecaJf0sk1l4l6V4awd65v2C3ILy7MSj+s/x1ADCIMU=
-go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/net v0.0.0-20190328230028-74de082e2cca/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190804053845-51ab0e2deafa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+go.etcd.io/bbolt v1.3.9 h1:8x7aARPEXiXbHmtUwAIv7eV2fQFHrLLavdiJ3uzJXoI=
+go.etcd.io/bbolt v1.3.9/go.mod h1:zaO32+Ti0PK1ivdPtgMESzuzL2VPoIG1PCQNvOdo/dE=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

internal/multiplex/datagramBufferedPipe.go

@@ -66,46 +66,6 @@ func (d *datagramBufferedPipe) Read(target []byte) (int, error) {
 	return dataLen, nil
 }
 
-func (d *datagramBufferedPipe) WriteTo(w io.Writer) (n int64, err error) {
-	d.rwCond.L.Lock()
-	defer d.rwCond.L.Unlock()
-	for {
-		if d.closed && len(d.pLens) == 0 {
-			return 0, io.EOF
-		}
-
-		hasRDeadline := !d.rDeadline.IsZero()
-		if hasRDeadline {
-			if time.Until(d.rDeadline) <= 0 {
-				return 0, ErrTimeout
-			}
-		}
-
-		if len(d.pLens) > 0 {
-			var dataLen int
-			dataLen, d.pLens = d.pLens[0], d.pLens[1:]
-			written, er := w.Write(d.buf.Next(dataLen))
-			n += int64(written)
-			if er != nil {
-				d.rwCond.Broadcast()
-				return n, er
-			}
-			d.rwCond.Broadcast()
-		} else {
-			if d.wtTimeout == 0 {
-				if hasRDeadline {
-					d.broadcastAfter(time.Until(d.rDeadline))
-				}
-			} else {
-				d.rDeadline = time.Now().Add(d.wtTimeout)
-				d.broadcastAfter(d.wtTimeout)
-			}
-
-			d.rwCond.Wait()
-		}
-	}
-}
-
 func (d *datagramBufferedPipe) Write(f *Frame) (toBeClosed bool, err error) {
 	d.rwCond.L.Lock()
 	defer d.rwCond.L.Unlock()
@@ -151,14 +111,6 @@ func (d *datagramBufferedPipe) SetReadDeadline(t time.Time) {
 	d.rwCond.Broadcast()
 }
 
-func (d *datagramBufferedPipe) SetWriteToTimeout(t time.Duration) {
-	d.rwCond.L.Lock()
-	defer d.rwCond.L.Unlock()
-
-	d.wtTimeout = t
-	d.rwCond.Broadcast()
-}
-
 func (d *datagramBufferedPipe) broadcastAfter(t time.Duration) {
 	if d.timeoutTimer != nil {
 		d.timeoutTimer.Stop()

internal/multiplex/recvBuffer.go

@@ -14,12 +14,8 @@ type recvBuffer interface {
 	// Instead, it should behave as if it hasn't been closed. Closure is only relevant
 	// when the buffer is empty.
 	io.ReadCloser
-	io.WriterTo
 	Write(*Frame) (toBeClosed bool, err error)
 	SetReadDeadline(time time.Time)
-	// SetWriteToTimeout sets the duration a recvBuffer waits in a WriteTo call when nothing
-	// has been written for a while. After that duration it should return ErrTimeout
-	SetWriteToTimeout(d time.Duration)
 }
 
 // size we want the amount of unread data in buffer to grow before recvBuffer.Write blocks.

internal/multiplex/session_test.go

@@ -557,7 +557,7 @@ func BenchmarkRecvDataFromRemote(b *testing.B) {
 
 					go func() {
 						stream, _ := sesh.Accept()
-						stream.(*Stream).WriteTo(ioutil.Discard)
+						io.Copy(ioutil.Discard, stream)
 					}()
 
 					binaryFrames := [maxIter][]byte{}

internal/multiplex/stream.go

@@ -96,17 +96,6 @@ func (s *Stream) Read(buf []byte) (n int, err error) {
 	return
 }
 
-// WriteTo continuously write data Stream has received into the writer w.
-func (s *Stream) WriteTo(w io.Writer) (int64, error) {
-	// will keep writing until the underlying buffer is closed
-	n, err := s.recvBuf.WriteTo(w)
-	log.Tracef("%v read from stream %v with err %v", n, s.id, err)
-	if err == io.EOF {
-		return n, ErrBrokenStream
-	}
-	return n, nil
-}
-
 func (s *Stream) obfuscateAndSend(buf []byte, payloadOffsetInBuf int) error {
 	cipherTextLen, err := s.session.obfuscate(&s.writingFrame, buf, payloadOffsetInBuf)
 	s.writingFrame.Seq++
@@ -210,7 +199,6 @@ func (s *Stream) Close() error {
 func (s *Stream) LocalAddr() net.Addr  { return s.session.addrs.Load().([]net.Addr)[0] }
 func (s *Stream) RemoteAddr() net.Addr { return s.session.addrs.Load().([]net.Addr)[1] }
 
-func (s *Stream) SetWriteToTimeout(d time.Duration)  { s.recvBuf.SetWriteToTimeout(d) }
 func (s *Stream) SetReadDeadline(t time.Time) error  { s.recvBuf.SetReadDeadline(t); return nil }
 func (s *Stream) SetReadFromTimeout(d time.Duration) { s.readFromTimeout = d }
 

internal/multiplex/streamBuffer.go

@@ -13,7 +13,6 @@ package multiplex
 import (
 	"container/heap"
 	"fmt"
-	"io"
 	"sync"
 	"time"
 )
@@ -102,10 +101,6 @@ func (sb *streamBuffer) Read(buf []byte) (int, error) {
 	return sb.buf.Read(buf)
 }
 
-func (sb *streamBuffer) WriteTo(w io.Writer) (int64, error) {
-	return sb.buf.WriteTo(w)
-}
-
 func (sb *streamBuffer) Close() error {
 	sb.recvM.Lock()
 	defer sb.recvM.Unlock()
@@ -113,5 +108,4 @@ func (sb *streamBuffer) Close() error {
 	return sb.buf.Close()
 }
 
-func (sb *streamBuffer) SetReadDeadline(t time.Time)       { sb.buf.SetReadDeadline(t) }
-func (sb *streamBuffer) SetWriteToTimeout(d time.Duration) { sb.buf.SetWriteToTimeout(d) }
+func (sb *streamBuffer) SetReadDeadline(t time.Time) { sb.buf.SetReadDeadline(t) }

internal/multiplex/streamBufferedPipe.go

@@ -58,43 +58,6 @@ func (p *streamBufferedPipe) Read(target []byte) (int, error) {
 	return n, err
 }
 
-func (p *streamBufferedPipe) WriteTo(w io.Writer) (n int64, err error) {
-	p.rwCond.L.Lock()
-	defer p.rwCond.L.Unlock()
-	for {
-		if p.closed && p.buf.Len() == 0 {
-			return 0, io.EOF
-		}
-
-		hasRDeadline := !p.rDeadline.IsZero()
-		if hasRDeadline {
-			if time.Until(p.rDeadline) <= 0 {
-				return 0, ErrTimeout
-			}
-		}
-		if p.buf.Len() > 0 {
-			written, er := p.buf.WriteTo(w)
-			n += written
-			if er != nil {
-				p.rwCond.Broadcast()
-				return n, er
-			}
-			p.rwCond.Broadcast()
-		} else {
-			if p.wtTimeout == 0 {
-				if hasRDeadline {
-					p.broadcastAfter(time.Until(p.rDeadline))
-				}
-			} else {
-				p.rDeadline = time.Now().Add(p.wtTimeout)
-				p.broadcastAfter(p.wtTimeout)
-			}
-
-			p.rwCond.Wait()
-		}
-	}
-}
-
 func (p *streamBufferedPipe) Write(input []byte) (int, error) {
 	p.rwCond.L.Lock()
 	defer p.rwCond.L.Unlock()
@@ -131,14 +94,6 @@ func (p *streamBufferedPipe) SetReadDeadline(t time.Time) {
 	p.rwCond.Broadcast()
 }
 
-func (p *streamBufferedPipe) SetWriteToTimeout(d time.Duration) {
-	p.rwCond.L.Lock()
-	defer p.rwCond.L.Unlock()
-
-	p.wtTimeout = d
-	p.rwCond.Broadcast()
-}
-
 func (p *streamBufferedPipe) broadcastAfter(d time.Duration) {
 	if p.timeoutTimer != nil {
 		p.timeoutTimer.Stop()

internal/multiplex/stream_test.go

@@ -3,7 +3,6 @@ package multiplex
 import (
 	"bytes"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"testing"
 	"time"
@@ -373,31 +372,6 @@ func TestStream_Read(t *testing.T) {
 	}
 }
 
-func TestStream_SetWriteToTimeout(t *testing.T) {
-	seshes := map[string]*Session{
-		"ordered":   setupSesh(false, emptyKey, EncryptionMethodPlain),
-		"unordered": setupSesh(true, emptyKey, EncryptionMethodPlain),
-	}
-	for name, sesh := range seshes {
-		t.Run(name, func(t *testing.T) {
-			stream, _ := sesh.OpenStream()
-			stream.SetWriteToTimeout(100 * time.Millisecond)
-			done := make(chan struct{})
-			go func() {
-				stream.WriteTo(ioutil.Discard)
-				done <- struct{}{}
-			}()
-
-			select {
-			case <-done:
-				return
-			case <-time.After(500 * time.Millisecond):
-				t.Error("didn't timeout")
-			}
-		})
-	}
-}
-
 func TestStream_SetReadFromTimeout(t *testing.T) {
 	seshes := map[string]*Session{
 		"ordered":   setupSesh(false, emptyKey, EncryptionMethodPlain),

internal/server/TLSAux.go

@@ -164,12 +164,12 @@ func parseClientHello(data []byte) (ret *ClientHello, err error) {
 func composeServerHello(sessionId []byte, nonce [12]byte, encryptedSessionKeyWithTag [48]byte) []byte {
 	var serverHello [11][]byte
 	serverHello[0] = []byte{0x02}                                             // handshake type
-	serverHello[1] = []byte{0x00, 0x00, 0x76}                                 // length 77
+	serverHello[1] = []byte{0x00, 0x00, 0x76}                                 // length 118
 	serverHello[2] = []byte{0x03, 0x03}                                       // server version
 	serverHello[3] = append(nonce[0:12], encryptedSessionKeyWithTag[0:20]...) // random 32 bytes
 	serverHello[4] = []byte{0x20}                                             // session id length 32
 	serverHello[5] = sessionId                                                // session id
-	serverHello[6] = []byte{0xc0, 0x30}                                       // cipher suite TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+	serverHello[6] = []byte{0x13, 0x02}                                       // cipher suite TLS_AES_256_GCM_SHA384
 	serverHello[7] = []byte{0x00}                                             // compression method null
 	serverHello[8] = []byte{0x00, 0x2e}                                       // extensions length 46
 

libcloak/client/browsers/browser.go

@@ -1,52 +0,0 @@
-package browsers
-
-import (
-	"encoding/binary"
-	"encoding/hex"
-)
-
-type ClientHelloFields struct {
-	Random         []byte
-	SessionId      []byte
-	X25519KeyShare []byte
-	ServerName     string
-}
-
-func decodeHex(s string) []byte {
-	b, err := hex.DecodeString(s)
-	if err != nil {
-		panic(err)
-	}
-	return b
-}
-
-// Browser represents the signature of a browser at a particular version
-type Browser interface {
-	// ComposeClientHello produces the ClientHello message (without TLS record layer) as the mimicking browser would
-	ComposeClientHello(ClientHelloFields) []byte
-}
-
-// addExtensionRecord, add type, length to extension data
-func addExtRec(typ []byte, data []byte) []byte {
-	length := make([]byte, 2)
-	binary.BigEndian.PutUint16(length, uint16(len(data)))
-	ret := make([]byte, 2+2+len(data))
-	copy(ret[0:2], typ)
-	copy(ret[2:4], length)
-	copy(ret[4:], data)
-	return ret
-}
-
-func generateSNI(serverName string) []byte {
-	serverNameListLength := make([]byte, 2)
-	binary.BigEndian.PutUint16(serverNameListLength, uint16(len(serverName)+3))
-	serverNameType := []byte{0x00} // host_name
-	serverNameLength := make([]byte, 2)
-	binary.BigEndian.PutUint16(serverNameLength, uint16(len(serverName)))
-	ret := make([]byte, 2+1+2+len(serverName))
-	copy(ret[0:2], serverNameListLength)
-	copy(ret[2:3], serverNameType)
-	copy(ret[3:5], serverNameLength)
-	copy(ret[5:], serverName)
-	return ret
-}

libcloak/client/browsers/browser_test.go

@@ -1,39 +0,0 @@
-package browsers
-
-import (
-	"encoding/hex"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func htob(s string) []byte {
-	b, _ := hex.DecodeString(s)
-	return b
-}
-
-func TestMakeServerName(t *testing.T) {
-	type testingPair struct {
-		serverName string
-		target     []byte
-	}
-
-	pairs := []testingPair{
-		{
-			"www.google.com",
-			htob("001100000e7777772e676f6f676c652e636f6d"),
-		},
-		{
-			"www.gstatic.com",
-			htob("001200000f7777772e677374617469632e636f6d"),
-		},
-		{
-			"googleads.g.doubleclick.net",
-			htob("001e00001b676f6f676c656164732e672e646f75626c65636c69636b2e6e6574"),
-		},
-	}
-
-	for _, p := range pairs {
-		assert.Equal(t, p.target, generateSNI(p.serverName))
-	}
-}

libcloak/client/browsers/chrome.go

@@ -1,120 +0,0 @@
-// Fingerprint of Chrome 112
-
-package browsers
-
-import (
-	"encoding/binary"
-	"github.com/cbeuw/Cloak/internal/common"
-	"math/rand"
-)
-
-type Chrome struct{}
-
-func makeGREASE() []byte {
-	// see https://tools.ietf.org/html/draft-davidben-tls-grease-01
-	// This is exclusive to Chrome.
-	var one [1]byte
-	common.CryptoRandRead(one[:])
-	sixteenth := one[0] % 16
-	monoGREASE := sixteenth*16 + 0xA
-	doubleGREASE := []byte{monoGREASE, monoGREASE}
-	return doubleGREASE
-}
-
-func (c *Chrome) composeExtensions(serverName string, keyShare []byte) []byte {
-
-	makeSupportedGroups := func() []byte {
-		suppGroupListLen := []byte{0x00, 0x08}
-		ret := make([]byte, 2+8)
-		copy(ret[0:2], suppGroupListLen)
-		copy(ret[2:4], makeGREASE())
-		copy(ret[4:], []byte{0x00, 0x1d, 0x00, 0x17, 0x00, 0x18})
-		return ret
-	}
-
-	makeKeyShare := func(hidden []byte) []byte {
-		ret := make([]byte, 43)
-		ret[0], ret[1] = 0x00, 0x29 // length 41
-		copy(ret[2:4], makeGREASE())
-		ret[4], ret[5] = 0x00, 0x01 // length 1
-		ret[6] = 0x00
-		ret[7], ret[8] = 0x00, 0x1d  // group x25519
-		ret[9], ret[10] = 0x00, 0x20 // length 32
-		copy(ret[11:43], hidden)
-		return ret
-	}
-
-	shuffle := func(exts [][]byte) {
-		var qword [8]byte
-		common.CryptoRandRead(qword[:])
-		seed := int64(binary.BigEndian.Uint64(qword[:]))
-		source := rand.NewSource(seed)
-		r := rand.New(source)
-		r.Shuffle(len(exts), func(i, j int) { exts[i], exts[j] = exts[j], exts[i] })
-	}
-
-	// extension length is always 403, and server name length is variable
-	var ext [18][]byte
-	ext[0] = addExtRec(makeGREASE(), nil) // First GREASE
-
-	// Start shufflable extensions: https://chromestatus.com/feature/5124606246518784
-	ext[1] = addExtRec([]byte{0x00, 0x00}, generateSNI(serverName)) // server name indication
-	sniLen := len(ext[1])
-	ext[2] = addExtRec([]byte{0x00, 0x17}, nil)                                               // extended_master_secret
-	ext[3] = addExtRec([]byte{0xff, 0x01}, []byte{0x00})                                      // renegotiation_info
-	ext[4] = addExtRec([]byte{0x00, 0x0a}, makeSupportedGroups())                             // supported groups
-	ext[5] = addExtRec([]byte{0x00, 0x0b}, []byte{0x01, 0x00})                                // ec point formats
-	ext[6] = addExtRec([]byte{0x00, 0x23}, nil)                                               // Session tickets
-	ext[7] = addExtRec([]byte{0x00, 0x10}, decodeHex("000c02683208687474702f312e31"))         // app layer proto negotiation
-	ext[8] = addExtRec([]byte{0x00, 0x05}, []byte{0x01, 0x00, 0x00, 0x00, 0x00})              // status request
-	ext[9] = addExtRec([]byte{0x00, 0x0d}, decodeHex("001004030804040105030805050108060601")) // Signature Algorithms
-	ext[10] = addExtRec([]byte{0x00, 0x12}, nil)                                              // signed cert timestamp
-	ext[11] = addExtRec([]byte{0x00, 0x33}, makeKeyShare(keyShare))                           // key share
-	ext[12] = addExtRec([]byte{0x00, 0x2d}, []byte{0x01, 0x01})                               // psk key exchange modes
-	suppVersions := decodeHex("069A9A03040303")                                               // 9A9A needs to be a GREASE
-	copy(suppVersions[1:3], makeGREASE())
-	ext[13] = addExtRec([]byte{0x00, 0x2b}, suppVersions)             // supported versions
-	ext[14] = addExtRec([]byte{0x00, 0x1b}, []byte{0x02, 0x00, 0x02}) // compress certificate
-	ext[15] = addExtRec([]byte{0x44, 0x69}, decodeHex("0003026832"))  // application settings
-	// End shufflable extensions
-
-	shuffle(ext[1:16])
-
-	ext[16] = addExtRec(makeGREASE(), []byte{0x00}) // Last GREASE
-	// sniLen + len(all other ext) + len(ext[17]) = 403
-	// len(all other ext) = 175
-	// len(ext[17]) = 228 - sniLen
-	// 2+2+len(padding) = 228 - sniLen
-	// len(padding) = 224 - sniLen
-	ext[17] = addExtRec([]byte{0x00, 0x15}, make([]byte, 224-sniLen)) // padding
-	var ret []byte
-	for _, e := range ext {
-		ret = append(ret, e...)
-	}
-	return ret
-}
-
-func (c *Chrome) ComposeClientHello(hd ClientHelloFields) (ch []byte) {
-	var clientHello [12][]byte
-	clientHello[0] = []byte{0x01}                                                                                       // handshake type
-	clientHello[1] = []byte{0x00, 0x01, 0xfc}                                                                           // length 508
-	clientHello[2] = []byte{0x03, 0x03}                                                                                 // client version
-	clientHello[3] = hd.Random                                                                                          // random
-	clientHello[4] = []byte{0x20}                                                                                       // session id length 32
-	clientHello[5] = hd.SessionId                                                                                       // session id
-	clientHello[6] = []byte{0x00, 0x20}                                                                                 // cipher suites length 32
-	clientHello[7] = append(makeGREASE(), decodeHex("130113021303c02bc02fc02cc030cca9cca8c013c014009c009d002f0035")...) // cipher suites
-	clientHello[8] = []byte{0x01}                                                                                       // compression methods length 1
-	clientHello[9] = []byte{0x00}                                                                                       // compression methods
-
-	extensions := c.composeExtensions(hd.ServerName, hd.X25519KeyShare)
-	clientHello[10] = []byte{0x00, 0x00}
-	binary.BigEndian.PutUint16(clientHello[10], uint16(len(extensions))) // extension length
-	clientHello[11] = extensions
-
-	var ret []byte
-	for _, c := range clientHello {
-		ret = append(ret, c...)
-	}
-	return ret
-}

libcloak/client/browsers/chrome_test.go

@@ -1,60 +0,0 @@
-package browsers
-
-import (
-	"encoding/hex"
-	"testing"
-)
-
-func TestMakeGREASE(t *testing.T) {
-	a := hex.EncodeToString(makeGREASE())
-	if a[1] != 'a' || a[3] != 'a' {
-		t.Errorf("GREASE got %v", a)
-	}
-
-	var GREASEs []string
-	for i := 0; i < 50; i++ {
-		GREASEs = append(GREASEs, hex.EncodeToString(makeGREASE()))
-	}
-	var eqCount int
-	for _, g := range GREASEs {
-		if a == g {
-			eqCount++
-		}
-	}
-	if eqCount > 40 {
-		t.Error("GREASE is not random", GREASEs)
-	}
-}
-
-//func TestChromeJA3(t *testing.T) {
-//	result := common.AddRecordLayer((&Chrome{}).ComposeClientHello(hd), common.Handshake, common.VersionTLS11)
-//	assert.Equal(t, 517, len(result))
-//
-//	hello := tlsx.ClientHelloBasic{}
-//	err := hello.Unmarshal(result)
-//	assert.Nil(t, err)
-//
-//	// Chrome shuffles the order of extensions, so it needs special handling
-//	full := string(ja3.Bare(&hello))
-//	// TLSVersion,Ciphers,Extensions,EllipticCurves,EllipticCurvePointFormats
-//	parts := strings.Split(full, ",")
-//
-//	// TLSVersion,Ciphers
-//	assert.Equal(t,
-//		[]string{
-//			"771",
-//			"4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53",
-//		}, parts[0:2])
-//	// EllipticCurves,EllipticCurvePointFormats
-//	assert.Equal(t,
-//		[]string{
-//			"29-23-24", "0",
-//		}, parts[3:5])
-//
-//	normaliseExtensions := func(extensions string) []string {
-//		extensionParts := strings.Split(parts[2], "-")
-//		sort.Strings(extensionParts)
-//		return extensionParts
-//	}
-//	assert.Equal(t, normaliseExtensions("10-5-45-0-17513-13-18-11-23-16-35-27-65281-43-51-21"), normaliseExtensions(parts[2]))
-//}

libcloak/client/browsers/firefox.go

@@ -1,73 +0,0 @@
-// Fingerprint of Firefox 112
-
-package browsers
-
-import (
-	"encoding/binary"
-	"github.com/cbeuw/Cloak/internal/common"
-)
-
-type Firefox struct{}
-
-func (f *Firefox) composeExtensions(serverName string, keyShare []byte) []byte {
-	composeKeyShare := func(hidden []byte) []byte {
-		ret := make([]byte, 107)
-		ret[0], ret[1] = 0x00, 0x69 // length 105
-		ret[2], ret[3] = 0x00, 0x1d // group x25519
-		ret[4], ret[5] = 0x00, 0x20 // length 32
-		copy(ret[6:38], hidden)
-		ret[38], ret[39] = 0x00, 0x17 // group secp256r1
-		ret[40], ret[41] = 0x00, 0x41 // length 65
-		common.CryptoRandRead(ret[42:107])
-		return ret
-	}
-	// extension length is always 401, and server name length is variable
-	var ext [13][]byte
-	ext[0] = addExtRec([]byte{0x00, 0x00}, generateSNI(serverName))                                        // server name indication
-	ext[1] = addExtRec([]byte{0x00, 0x17}, nil)                                                            // extended_master_secret
-	ext[2] = addExtRec([]byte{0xff, 0x01}, []byte{0x00})                                                   // renegotiation_info
-	ext[3] = addExtRec([]byte{0x00, 0x0a}, decodeHex("000c001d00170018001901000101"))                      // supported groups
-	ext[4] = addExtRec([]byte{0x00, 0x0b}, []byte{0x01, 0x00})                                             // ec point formats
-	ext[5] = addExtRec([]byte{0x00, 0x10}, decodeHex("000c02683208687474702f312e31"))                      // app layer proto negotiation
-	ext[6] = addExtRec([]byte{0x00, 0x05}, []byte{0x01, 0x00, 0x00, 0x00, 0x00})                           // status request
-	ext[7] = addExtRec([]byte{0x00, 0x22}, decodeHex("00080403050306030203"))                              // delegated credentials
-	ext[8] = addExtRec([]byte{0x00, 0x33}, composeKeyShare(keyShare))                                      // key share
-	ext[9] = addExtRec([]byte{0x00, 0x2b}, decodeHex("0403040303"))                                        // supported versions
-	ext[10] = addExtRec([]byte{0x00, 0x0d}, decodeHex("001604030503060308040805080604010501060102030201")) // Signature Algorithms
-	ext[11] = addExtRec([]byte{0x00, 0x1c}, []byte{0x40, 0x01})                                            // record size limit
-	// len(ext[0]) + len(all other ext) + len(len field of padding) + len(padding) = 401
-	// len(all other ext) = 228
-	// len(len field of padding) = 4
-	// len(padding) = 169 - len(ext[0])
-	ext[12] = addExtRec([]byte{0x00, 0x15}, make([]byte, 169-len(ext[0]))) // padding
-	var ret []byte
-	for _, e := range ext {
-		ret = append(ret, e...)
-	}
-	return ret
-}
-
-func (f *Firefox) ComposeClientHello(hd ClientHelloFields) (ch []byte) {
-	var clientHello [12][]byte
-	clientHello[0] = []byte{0x01}                                                                      // handshake type
-	clientHello[1] = []byte{0x00, 0x01, 0xfc}                                                          // length 508
-	clientHello[2] = []byte{0x03, 0x03}                                                                // client version
-	clientHello[3] = hd.Random                                                                         // random
-	clientHello[4] = []byte{0x20}                                                                      // session id length 32
-	clientHello[5] = hd.SessionId                                                                      // session id
-	clientHello[6] = []byte{0x00, 0x22}                                                                // cipher suites length 34
-	clientHello[7] = decodeHex("130113031302c02bc02fcca9cca8c02cc030c00ac009c013c014009c009d002f0035") // cipher suites
-	clientHello[8] = []byte{0x01}                                                                      // compression methods length 1
-	clientHello[9] = []byte{0x00}                                                                      // compression methods
-
-	extensions := f.composeExtensions(hd.ServerName, hd.X25519KeyShare)
-	clientHello[10] = []byte{0x00, 0x00}
-	binary.BigEndian.PutUint16(clientHello[10], uint16(len(extensions))) // extension length
-	clientHello[11] = extensions
-
-	var ret []byte
-	for _, c := range clientHello {
-		ret = append(ret, c...)
-	}
-	return ret
-}

libcloak/client/browsers/firefox_test.go

@@ -1,40 +0,0 @@
-package browsers
-
-import (
-	"encoding/hex"
-	"github.com/stretchr/testify/assert"
-	"strings"
-	"testing"
-)
-
-var hd = ClientHelloFields{
-	Random:         decodeHex("ed0117085ed70be0799b1fc96af7f675d4747f86cd03bb36392e03e8d1b0e9a0"),
-	SessionId:      decodeHex("47485f67c59ca787009bba83ede4da4f2397169c696c275d96c4c7af803019b9"),
-	X25519KeyShare: decodeHex("d395003163a6f751b4c68a67bcec1f883885a7ada8a63fda389b29986e51fa44"),
-	ServerName:     "github.com",
-}
-
-//func TestFirefoxJA3(t *testing.T) {
-//	result := common.AddRecordLayer((&Firefox{}).ComposeClientHello(hd), common.Handshake, common.VersionTLS11)
-//
-//	hello := tlsx.ClientHelloBasic{}
-//	err := hello.Unmarshal(result)
-//	assert.Nil(t, err)
-//
-//	digest := ja3.DigestHex(&hello)
-//	assert.Equal(t, "ad55557b7cbd735c2627f7ebb3b3d493", digest)
-//}
-
-func TestFirefoxComposeClientHello(t *testing.T) {
-	result := hex.EncodeToString((&Firefox{}).ComposeClientHello(hd))
-	target := "010001fc0303ed0117085ed70be0799b1fc96af7f675d4747f86cd03bb36392e03e8d1b0e9a02047485f67c59ca787009bba83ede4da4f2397169c696c275d96c4c7af803019b90022130113031302c02bc02fcca9cca8c02cc030c00ac009c013c014009c009d002f0035010001910000000f000d00000a6769746875622e636f6d00170000ff01000100000a000e000c001d00170018001901000101000b000201000010000e000c02683208687474702f312e310005000501000000000022000a000804030503060302030033006b0069001d0020d395003163a6f751b4c68a67bcec1f883885a7ada8a63fda389b29986e51fa440017004104c49751010e35370cf8e89c23471b40579387b3dd5ce6862c9850b121632b527128b75ef7051c5284ae94894d846cc3dc88ce01ce49b605167f63473c1d772b47002b00050403040303000d0018001604030503060308040805080604010501060102030201001c0002400100150096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
-
-	// skip random secp256r1
-	secp256r1 := "04c49751010e35370cf8e89c23471b40579387b3dd5ce6862c9850b121632b527128b75ef7051c5284ae94894d846cc3dc88ce01ce49b605167f63473c1d772b47"
-	start := strings.Index(target, secp256r1)
-
-	target = strings.Replace(target, secp256r1, "", 1)
-	result = strings.Replace(result, result[start:start+len(secp256r1)], "", 1)
-
-	assert.Equal(t, target, result)
-}

libcloak/client/browsers/safari.go

@@ -1,88 +0,0 @@
-// Fingerprint of Safari 16.4
-
-package browsers
-
-import (
-	"encoding/binary"
-)
-
-type Safari struct{}
-
-func (s *Safari) composeExtensions(serverName string, keyShare []byte) []byte {
-	makeSupportedGroups := func() []byte {
-		suppGroupListLen := []byte{0x00, 0x0a}
-		ret := make([]byte, 2+2+8)
-		copy(ret[0:2], suppGroupListLen)
-		copy(ret[2:4], makeGREASE())
-		copy(ret[4:], []byte{0x00, 0x1d, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19})
-		return ret
-	}
-
-	makeKeyShare := func(hidden []byte) []byte {
-		ret := make([]byte, 43)
-		ret[0], ret[1] = 0x00, 0x29 // length 41
-		copy(ret[2:4], makeGREASE())
-		ret[4], ret[5] = 0x00, 0x01 // length 1
-		ret[6] = 0x00
-		ret[7], ret[8] = 0x00, 0x1d  // group x25519
-		ret[9], ret[10] = 0x00, 0x20 // length 32
-		copy(ret[11:43], hidden)
-		return ret
-	}
-
-	// extension length is always 393, and server name length is variable
-	var ext [16][]byte
-	ext[0] = addExtRec(makeGREASE(), nil)                                                                 // First GREASE
-	ext[1] = addExtRec([]byte{0x00, 0x00}, generateSNI(serverName))                                       // server name indication
-	ext[2] = addExtRec([]byte{0x00, 0x17}, nil)                                                           // extended_master_secret
-	ext[3] = addExtRec([]byte{0xff, 0x01}, []byte{0x00})                                                  // renegotiation_info
-	ext[4] = addExtRec([]byte{0x00, 0x0a}, makeSupportedGroups())                                         // supported groups
-	ext[5] = addExtRec([]byte{0x00, 0x0b}, []byte{0x01, 0x00})                                            // ec point formats
-	ext[6] = addExtRec([]byte{0x00, 0x10}, decodeHex("000c02683208687474702f312e31"))                     // app layer proto negotiation
-	ext[7] = addExtRec([]byte{0x00, 0x05}, []byte{0x01, 0x00, 0x00, 0x00, 0x00})                          // status request
-	ext[8] = addExtRec([]byte{0x00, 0x0d}, decodeHex("001604030804040105030203080508050501080606010201")) // Signature Algorithms
-	ext[9] = addExtRec([]byte{0x00, 0x12}, nil)                                                           // signed cert timestamp
-	ext[10] = addExtRec([]byte{0x00, 0x33}, makeKeyShare(keyShare))                                       // key share
-	ext[11] = addExtRec([]byte{0x00, 0x2d}, []byte{0x01, 0x01})                                           // psk key exchange modes
-	suppVersions := decodeHex("0a5a5a0304030303020301")                                                   // 5a5a needs to be a GREASE
-	copy(suppVersions[1:3], makeGREASE())
-	ext[12] = addExtRec([]byte{0x00, 0x2b}, suppVersions)             // supported versions
-	ext[13] = addExtRec([]byte{0x00, 0x1b}, []byte{0x02, 0x00, 0x01}) // compress certificate
-	ext[14] = addExtRec(makeGREASE(), []byte{0x00})                   // Last GREASE
-	// len(ext[1]) + len(all other ext) + len(ext[15]) = 393
-	// len(all other ext) = 174
-	// len(ext[15]) = 219 - len(ext[1])
-	// 2+2+len(padding) = 219 - len(ext[1])
-	// len(padding) = 215 - len(ext[1])
-	ext[15] = addExtRec([]byte{0x00, 0x15}, make([]byte, 215-len(ext[1]))) // padding
-	var ret []byte
-	for _, e := range ext {
-		ret = append(ret, e...)
-	}
-	return ret
-}
-
-func (s *Safari) composeClientHello(hd ClientHelloFields) (ch []byte) {
-	var clientHello [12][]byte
-	clientHello[0] = []byte{0x01}                                                                                                           // handshake type
-	clientHello[1] = []byte{0x00, 0x01, 0xfc}                                                                                               // length 508
-	clientHello[2] = []byte{0x03, 0x03}                                                                                                     // client version
-	clientHello[3] = hd.Random                                                                                                              // random
-	clientHello[4] = []byte{0x20}                                                                                                           // session id length 32
-	clientHello[5] = hd.SessionId                                                                                                           // session id
-	clientHello[6] = []byte{0x00, 0x2a}                                                                                                     // cipher suites length 42
-	clientHello[7] = append(makeGREASE(), decodeHex("130113021303c02cc02bcca9c030c02fcca8c00ac009c014c013009d009c0035002fc008c012000a")...) // cipher suites
-	clientHello[8] = []byte{0x01}                                                                                                           // compression methods length 1
-	clientHello[9] = []byte{0x00}                                                                                                           // compression methods
-
-	extensions := s.composeExtensions(hd.ServerName, hd.X25519KeyShare)
-	clientHello[10] = []byte{0x00, 0x00}
-	binary.BigEndian.PutUint16(clientHello[10], uint16(len(extensions))) // extension length
-	clientHello[11] = extensions
-
-	var ret []byte
-	for _, c := range clientHello {
-		ret = append(ret, c...)
-	}
-	return ret
-}

libcloak/client/browsers/safari_test.go

@@ -1,38 +0,0 @@
-package browsers
-
-import (
-	"testing"
-)
-
-var safariHd = ClientHelloFields{
-	Random:         decodeHex("977ecef48c0fc5640fea4dbd638da89704d6d85ed2e81b8913ae5b27f9a5cc17"),
-	SessionId:      decodeHex("c2d5b91e77371bf154363b39194ac77c05617cc6164724d0ba7ded4aa349c6a3"),
-	X25519KeyShare: decodeHex("c99fbe80dda71f6e24d9b798dc3f3f33cef946f0b917fa90154a4b95114fae2a"),
-	ServerName:     "github.com",
-}
-
-//func TestSafariJA3(t *testing.T) {
-//	result := common.AddRecordLayer((&Safari{}).composeClientHello(safariHd), common.Handshake, common.VersionTLS11)
-//
-//	hello := tlsx.ClientHelloBasic{}
-//	err := hello.Unmarshal(result)
-//	assert.Nil(t, err)
-//
-//	digest := ja3.DigestHex(&hello)
-//	assert.Equal(t, "773906b0efdefa24a7f2b8eb6985bf37", digest)
-//}
-
-func TestSafariComposeClientHello(t *testing.T) {
-	result := (&Safari{}).composeClientHello(safariHd)
-	target := decodeHex("010001fc0303977ecef48c0fc5640fea4dbd638da89704d6d85ed2e81b8913ae5b27f9a5cc1720c2d5b91e77371bf154363b39194ac77c05617cc6164724d0ba7ded4aa349c6a3002acaca130113021303c02cc02bcca9c030c02fcca8c00ac009c014c013009d009c0035002fc008c012000a01000189fafa00000000000f000d00000a6769746875622e636f6d00170000ff01000100000a000c000a7a7a001d001700180019000b000201000010000e000c02683208687474702f312e31000500050100000000000d0018001604030804040105030203080508050501080606010201001200000033002b00297a7a000100001d0020c99fbe80dda71f6e24d9b798dc3f3f33cef946f0b917fa90154a4b95114fae2a002d00020101002b000b0a2a2a0304030303020301001b00030200017a7a000100001500c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
-	for p := 0; p < len(result); p++ {
-		if result[p] != target[p] {
-			if result[p]&0x0F == 0xA && target[p]&0x0F == 0xA &&
-				((p > 0 && result[p-1] == result[p] && target[p-1] == target[p]) ||
-					(p < len(result)-1 && result[p+1] == result[p] && target[p+1] == target[p])) {
-				continue
-			}
-			t.Errorf("inequality at %v", p)
-		}
-	}
-}

libcloak/client/config.go

@@ -3,7 +3,6 @@ package client
 import (
 	"fmt"
 	"github.com/cbeuw/Cloak/internal/common"
-	"github.com/cbeuw/Cloak/libcloak/client/browsers"
 	"github.com/cbeuw/Cloak/libcloak/client/transports"
 	"net"
 	"strings"
@@ -158,22 +157,6 @@ func (raw *Config) Process(worldState common.WorldState) (remote RemoteConnConfi
 
 	// Transport and (if TLS mode), browser
 	switch strings.ToLower(raw.Transport) {
-	case "direct", "":
-		var browser browsers.Browser
-		switch strings.ToLower(raw.BrowserSig) {
-		case "chrome", "":
-			browser = &browsers.Chrome{}
-		case "firefox":
-			browser = &browsers.Firefox{}
-		default:
-			err = fmt.Errorf("unknown browser signature %v", raw.BrowserSig)
-			return
-		}
-		remote.TransportMaker = func() transports.Transport {
-			return &transports.DirectTLS{
-				Browser: browser,
-			}
-		}
 	case "cdn":
 		cdnPort := raw.RemotePort
 		var cdnHost string
@@ -189,6 +172,24 @@ func (raw *Config) Process(worldState common.WorldState) (remote RemoteConnConfi
 				CDNPort: cdnPort,
 			}
 		}
+	case "direct", "":
+		var browser transports.Browser
+		switch strings.ToLower(raw.BrowserSig) {
+		case "firefox":
+			browser = transports.Firefox
+		case "safari":
+			browser = transports.Safari
+		case "chrome", "":
+			browser = transports.Chrome
+		default:
+			err = fmt.Errorf("unknown browser signature %v", raw.BrowserSig)
+			return
+		}
+		remote.TransportMaker = func() transports.Transport {
+			return &transports.DirectTLS{
+				Browser: browser,
+			}
+		}
 	default:
 		err = fmt.Errorf("unknown transport %v", raw.Transport)
 		return

libcloak/client/factory.go

@@ -44,8 +44,8 @@ func NewCloakClient(connConfig RemoteConnConfig, authInfo AuthInfo, dialer commo
 			transportConn := connConfig.TransportMaker()
 			sk, err := transportConn.Handshake(remoteConn, authInfo)
 			if err != nil {
-				transportConn.Close()
 				log.Errorf("Failed to prepare connection to remote: %v", err)
+				transportConn.Close()
 				time.Sleep(time.Second * 3)
 				goto makeconn
 			}

libcloak/client/transports/TLS.go

@@ -2,14 +2,76 @@ package transports
 
 import (
 	"github.com/cbeuw/Cloak/internal/common"
-	"github.com/cbeuw/Cloak/libcloak/client/browsers"
+	utls "github.com/refraction-networking/utls"
 	log "github.com/sirupsen/logrus"
 	"net"
 )
 
+type clientHelloFields struct {
+	random         []byte
+	sessionId      []byte
+	x25519KeyShare []byte
+	serverName     string
+}
+
+type Browser int
+
+const (
+	Chrome = iota
+	Firefox
+	Safari
+)
+
 type DirectTLS struct {
 	*common.TLSConn
-	Browser browsers.Browser
+	Browser Browser
+}
+
+func buildClientHello(browser Browser, fields clientHelloFields) ([]byte, error) {
+	// We don't use utls to handle connections (as it'll attempt a real TLS negotiation)
+	// We only want it to build the ClientHello locally
+	fakeConn := net.TCPConn{}
+	var helloID utls.ClientHelloID
+	switch browser {
+	case Chrome:
+		helloID = utls.HelloChrome_Auto
+	case Firefox:
+		helloID = utls.HelloFirefox_Auto
+	case Safari:
+		helloID = utls.HelloSafari_Auto
+	}
+
+	uclient := utls.UClient(&fakeConn, &utls.Config{ServerName: fields.serverName}, helloID)
+	if err := uclient.BuildHandshakeState(); err != nil {
+		return []byte{}, err
+	}
+	if err := uclient.SetClientRandom(fields.random); err != nil {
+		return []byte{}, err
+	}
+
+	uclient.HandshakeState.Hello.SessionId = make([]byte, 32)
+	copy(uclient.HandshakeState.Hello.SessionId, fields.sessionId)
+
+	// Find the X25519 key share and overwrite it
+	var extIndex int
+	var keyShareIndex int
+	for i, ext := range uclient.Extensions {
+		ext, ok := ext.(*utls.KeyShareExtension)
+		if ok {
+			extIndex = i
+			for j, keyShare := range ext.KeyShares {
+				if keyShare.Group == utls.X25519 {
+					keyShareIndex = j
+				}
+			}
+		}
+	}
+	copy(uclient.Extensions[extIndex].(*utls.KeyShareExtension).KeyShares[keyShareIndex].Data, fields.x25519KeyShare)
+
+	if err := uclient.BuildHandshakeState(); err != nil {
+		return []byte{}, err
+	}
+	return uclient.HandshakeState.Hello.Raw, nil
 }
 
 // Handshake handles the TLS handshake for a given conn and returns the sessionKey
@@ -17,16 +79,18 @@ type DirectTLS struct {
 func (tls *DirectTLS) Handshake(rawConn net.Conn, authInfo AuthInfo) (sessionKey [32]byte, err error) {
 	payload, sharedSecret := makeAuthenticationPayload(authInfo)
 
-	// random is marshalled ephemeral pub key 32 bytes
-	// The authentication ciphertext and its tag are then distributed among SessionId and X25519KeyShare
-	fields := browsers.ClientHelloFields{
-		Random:         payload.randPubKey[:],
-		SessionId:      payload.ciphertextWithTag[0:32],
-		X25519KeyShare: payload.ciphertextWithTag[32:64],
-		ServerName:     authInfo.MockDomain,
+	fields := clientHelloFields{
+		random:         payload.randPubKey[:],
+		sessionId:      payload.ciphertextWithTag[0:32],
+		x25519KeyShare: payload.ciphertextWithTag[32:64],
+		serverName:     authInfo.MockDomain,
+	}
+	var ch []byte
+	ch, err = buildClientHello(tls.Browser, fields)
+	if err != nil {
+		return
 	}
-	chOnly := tls.Browser.ComposeClientHello(fields)
-	chWithRecordLayer := common.AddRecordLayer(chOnly, common.Handshake, common.VersionTLS11)
+	chWithRecordLayer := common.AddRecordLayer(ch, common.Handshake, common.VersionTLS11)
 	_, err = rawConn.Write(chWithRecordLayer)
 	if err != nil {
 		return

libcloak/client/transports/websocket.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"github.com/cbeuw/Cloak/internal/common"
 	"github.com/gorilla/websocket"
-	utls "gitlab.com/yawning/utls.git"
+	utls "github.com/refraction-networking/utls"
 	"net"
 	"net/http"
 	"net/url"

renovate.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "packagePatterns": ["*"],
+      "excludePackagePatterns": ["utls"],
+      "enabled": false
+    }
+  ]
+}