Due to a bug (#40098), legacy oneshot connections have not worked for
awhile. Connections without the turbotunnel token would cause the server
to crash. This fixes that bug by removing support altogether and simply
closes the connection.

See also:
!72 (comment 2772839)

See also:
https://gitlab.torproject.org/shelikhoo/snowflake/-/jobs/86751

See also:
!67 (comment 2771666)

See also:
!67 (comment 2770482)

This name includes [E]vent to reduce merge conflict with forward proxy change set.

This event bus implementation favours simplicity over efficiency and is not suitable for frequent addition and removal of listeners.

shelikhoo authored 3 years ago and Cecylia Bocovich committed 3 years ago

See also:
tpo/anti-censorship/pluggable-transports/snowflake#40084

shelikhoo authored 3 years ago and Cecylia Bocovich committed 3 years ago

This is an amendment of tpo/anti-censorship/pluggable-transports/snowflake!30

Malicious clients and proxies can provide potentially malicious strings
in the polls. This validates the NAT type and proxy type strings to
ensure that malformed strings are not displayed on a web page
or passed to any of our monitoring infrastructure.

If a client or proxy supplies an invalid NAT type, we return an error
message. If a proxy supplies an unknown proxy type, we set the proxy
type to unknown.

go mod edit -dropreplace=github.com/pion/dtls/v2
go get github.com/pion/dtls/v2@v2.0.12

This is an update to
!66.

Debian packages Go 1.15 and 1.17, and we use 1.16 in Tor Browser.

Make sure we use a version of the DTLS library that contains the
following fingerprinting fixes:

Only send supported_groups extension in ClientHello
Do not include IP addresses as SNI values

These changes have been merged upstream into pion/dtls.

* https://github.com/golang/go/issues/33772

Adopted the change in according to the recommendation from

!62 (comment 2761566)

Adopted the change in according to the recommendation from

tpo/anti-censorship/pluggable-transports/snowflake!62 (comment 2761438)

Adopted the change in according to the recommendation from

!62 (comment 2761382)