Update data structure to support new obfuscation selection

10 files changed, 212 insertions, 72 deletions

diff --git a/ios/MullvadSettings/WireGuardObfuscationSettings.swift b/ios/MullvadSettings/WireGuardObfuscationSettings.swift
index e55ac8538a..98fab6ca2b 100644
--- a/ios/MullvadSettings/WireGuardObfuscationSettings.swift
+++ b/ios/MullvadSettings/WireGuardObfuscationSettings.swift
@@ -8,54 +8,158 @@
 
 import Foundation
 
-/// Whether UDP-over-TCP obfuscation is enabled
+/// Whether obfuscation is enabled and which method is used
 ///
 /// `.automatic` means an algorithm will decide whether to use it or not.
 public enum WireGuardObfuscationState: Codable {
-    case automatic
+    @available(*, deprecated, renamed: "udpOverTcp")
     case on
+
+    case automatic
+    case udpOverTcp
+    case shadowsocks
     case off
+
+    public init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+
+        var allKeys = ArraySlice(container.allKeys)
+        guard let key = allKeys.popFirst(), allKeys.isEmpty else {
+            throw DecodingError.typeMismatch(
+                WireGuardObfuscationState.self,
+                DecodingError.Context(
+                    codingPath: container.codingPath,
+                    debugDescription: "Invalid number of keys found, expected one.",
+                    underlyingError: nil
+                )
+            )
+        }
+
+        switch key {
+        case .automatic:
+            self = .automatic
+        case .on, .udpOverTcp:
+            self = .udpOverTcp
+        case .shadowsocks:
+            self = .shadowsocks
+        case .off:
+            self = .off
+        }
+    }
 }
 
-/// The port to select when using UDP-over-TCP obfuscation
-///
-/// `.automatic` means an algorith will decide between using `port80` or `port5001`
-public enum WireGuardObfuscationPort: UInt16, Codable, CaseIterable {
-    case automatic = 0
-    case port80 = 80
-    case port5001 = 5001
+public enum WireGuardObfuscationUdpOverTcpPort: Codable, Equatable, CustomStringConvertible {
+    case automatic
+    case port80
+    case port5001
 
-    /// The `UInt16` representation of the port.
-    /// - Returns: `0` if `.automatic`, `80` or `5001` otherwise.
-    public var portValue: UInt16 {
-        self == .automatic ? 0 : rawValue
+    public var portValue: UInt16? {
+        switch self {
+        case .automatic:
+            nil
+        case .port80:
+            80
+        case .port5001:
+            5001
+        }
     }
 
-    public init?(rawValue: UInt16) {
-        switch rawValue {
-        case 80:
-            self = .port80
-        case 5001:
-            self = .port5001
-        default: self = .automatic
+    public var description: String {
+        switch self {
+        case .automatic:
+            NSLocalizedString(
+                "WIREGUARD_OBFUSCATION_UDP_TCP_PORT_AUTOMATIC",
+                tableName: "VPNSettings",
+                value: "Automatic",
+                comment: ""
+            )
+        case .port80:
+            "80"
+        case .port5001:
+            "5001"
         }
     }
+}
 
-    public init(from decoder: Decoder) throws {
-        let container = try decoder.singleValueContainer()
-        let decodedValue = try? container.decode(UInt16.self)
+public enum WireGuardObfuscationShadowsockPort: Codable, Equatable, CustomStringConvertible {
+    case automatic
+    case custom(UInt16)
 
-        let port = WireGuardObfuscationPort.allCases.first(where: { $0.rawValue == decodedValue })
-        self = port ?? .automatic
+    public var portValue: UInt16? {
+        switch self {
+        case .automatic:
+            nil
+        case let .custom(port):
+            port
+        }
+    }
+
+    public var description: String {
+        switch self {
+        case .automatic:
+            NSLocalizedString(
+                "WIREGUARD_OBFUSCATION_SHADOWSOCKS_PORT_AUTOMATIC",
+                tableName: "VPNSettings",
+                value: "Automatic",
+                comment: ""
+            )
+        case let .custom(port):
+            String(port)
+        }
     }
 }
 
+// Can't deprecate the whole type since it'll yield a lint warning when decoding
+// port in `WireGuardObfuscationSettings`.
+private enum WireGuardObfuscationPort: UInt16, Codable {
+    @available(*, deprecated, message: "Use `udpOverTcpPort` instead")
+    case automatic = 0
+    @available(*, deprecated, message: "Use `udpOverTcpPort` instead")
+    case port80 = 80
+    @available(*, deprecated, message: "Use `udpOverTcpPort` instead")
+    case port5001 = 5001
+}
+
 public struct WireGuardObfuscationSettings: Codable, Equatable {
+    @available(*, deprecated, message: "Use `udpOverTcpPort` instead")
+    private var port: WireGuardObfuscationPort = .automatic
+
     public let state: WireGuardObfuscationState
-    public let port: WireGuardObfuscationPort
+    public let udpOverTcpPort: WireGuardObfuscationUdpOverTcpPort
+    public let shadowsocksPort: WireGuardObfuscationShadowsockPort
 
-    public init(state: WireGuardObfuscationState = .automatic, port: WireGuardObfuscationPort = .automatic) {
+    public init(
+        state: WireGuardObfuscationState = .automatic,
+        udpOverTcpPort: WireGuardObfuscationUdpOverTcpPort = .automatic,
+        shadowsocksPort: WireGuardObfuscationShadowsockPort = .automatic
+    ) {
         self.state = state
-        self.port = port
+        self.udpOverTcpPort = udpOverTcpPort
+        self.shadowsocksPort = shadowsocksPort
+    }
+
+    public init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+
+        state = try container.decode(WireGuardObfuscationState.self, forKey: .state)
+        shadowsocksPort = try container.decodeIfPresent(
+            WireGuardObfuscationShadowsockPort.self,
+            forKey: .shadowsocksPort
+        ) ?? .automatic
+
+        if let port = try? container.decodeIfPresent(WireGuardObfuscationUdpOverTcpPort.self, forKey: .udpOverTcpPort) {
+            udpOverTcpPort = port
+        } else if let port = try? container.decodeIfPresent(WireGuardObfuscationPort.self, forKey: .port) {
+            switch port {
+            case .automatic:
+                udpOverTcpPort = .automatic
+            case .port80:
+                udpOverTcpPort = .port80
+            case .port5001:
+                udpOverTcpPort = .port5001
+            }
+        } else {
+            udpOverTcpPort = .automatic
+        }
     }
 }
diff --git a/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsCellFactory.swift b/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsCellFactory.swift
index 51038d4b68..526fb1c16c 100644
--- a/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsCellFactory.swift
+++ b/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsCellFactory.swift
@@ -145,14 +145,16 @@ final class VPNSettingsCellFactory: CellFactoryProtocol {
                 value: "UDP-over-TCP",
                 comment: ""
             )
+
             #if DEBUG
             cell.detailTitleLabel.text = String(format: NSLocalizedString(
                 "WIREGUARD_OBFUSCATION_UDP_TCP_PORT",
                 tableName: "VPNSettings",
-                value: "Port: %d",
+                value: "Port: %@",
                 comment: ""
-            ), viewModel.obfuscationPort.portValue)
+            ), viewModel.obfuscationUpdOverTcpPort.description)
             #endif
+
             cell.accessibilityIdentifier = item.accessibilityIdentifier
             cell.applySubCellStyling()
 
@@ -169,14 +171,16 @@ final class VPNSettingsCellFactory: CellFactoryProtocol {
                 value: "Shadowsocks",
                 comment: ""
             )
+
             #if DEBUG
             cell.detailTitleLabel.text = String(format: NSLocalizedString(
                 "WIREGUARD_OBFUSCATION_SHADOWSOCKS_PORT",
                 tableName: "VPNSettings",
-                value: "Port: %d",
+                value: "Port: %@",
                 comment: ""
-            ), viewModel.obfuscationPort.portValue)
+            ), viewModel.obfuscationShadowsocksPort.description)
             #endif
+
             cell.accessibilityIdentifier = item.accessibilityIdentifier
             cell.applySubCellStyling()
 
@@ -199,7 +203,7 @@ final class VPNSettingsCellFactory: CellFactoryProtocol {
         case let .wireGuardObfuscationPort(port):
             guard let cell = cell as? SelectableSettingsCell else { return }
 
-            let portString = port == 0 ? "Automatic" : "\(port)"
+            let portString = port.description
             cell.titleLabel.text = NSLocalizedString(
                 "WIREGUARD_OBFUSCATION_PORT_LABEL",
                 tableName: "VPNSettings",
diff --git a/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsDataSource.swift b/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsDataSource.swift
index 5c0f8856d3..4adf52ce26 100644
--- a/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsDataSource.swift
+++ b/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsDataSource.swift
@@ -79,7 +79,7 @@ final class VPNSettingsDataSource: UITableViewDiffableDataSource<
         case wireGuardObfuscationUdpOverTcp
         case wireGuardObfuscationShadowsocks
         case wireGuardObfuscationOff
-        case wireGuardObfuscationPort(_ port: UInt16)
+        case wireGuardObfuscationPort(_ port: WireGuardObfuscationUdpOverTcpPort)
         case quantumResistanceAutomatic
         case quantumResistanceOn
         case quantumResistanceOff
@@ -107,7 +107,11 @@ final class VPNSettingsDataSource: UITableViewDiffableDataSource<
         }
 
         static var wireGuardObfuscationPort: [Item] {
-            [.wireGuardObfuscationPort(0), .wireGuardObfuscationPort(80), .wireGuardObfuscationPort(5001)]
+            [
+                .wireGuardObfuscationPort(.automatic),
+                .wireGuardObfuscationPort(.port80),
+                .wireGuardObfuscationPort(.port5001),
+            ]
         }
 
         static var quantumResistance: [Item] {
@@ -178,7 +182,8 @@ final class VPNSettingsDataSource: UITableViewDiffableDataSource<
     private var obfuscationSettings: WireGuardObfuscationSettings {
         WireGuardObfuscationSettings(
             state: viewModel.obfuscationState,
-            port: viewModel.obfuscationPort
+            udpOverTcpPort: viewModel.obfuscationUpdOverTcpPort,
+            shadowsocksPort: viewModel.obfuscationShadowsocksPort
         )
     }
 
@@ -192,7 +197,8 @@ final class VPNSettingsDataSource: UITableViewDiffableDataSource<
         let obfuscationStateItem: Item = switch viewModel.obfuscationState {
         case .automatic: .wireGuardObfuscationAutomatic
         case .off: .wireGuardObfuscationOff
-        case .on: .wireGuardObfuscationUdpOverTcp
+        case .on, .udpOverTcp: .wireGuardObfuscationUdpOverTcp
+        case .shadowsocks: .wireGuardObfuscationShadowsocks
         }
 
         let quantumResistanceItem: Item = switch viewModel.quantumResistance {
@@ -201,7 +207,7 @@ final class VPNSettingsDataSource: UITableViewDiffableDataSource<
         case .on: .quantumResistanceOn
         }
 
-        let obfuscationPortItem: Item = .wireGuardObfuscationPort(viewModel.obfuscationPort.portValue)
+        let obfuscationPortItem: Item = .wireGuardObfuscationPort(viewModel.obfuscationUpdOverTcpPort)
 
         return [
             wireGuardPortItem,
@@ -308,13 +314,13 @@ final class VPNSettingsDataSource: UITableViewDiffableDataSource<
             selectObfuscationState(.automatic)
             delegate?.didUpdateTunnelSettings(TunnelSettingsUpdate.obfuscation(obfuscationSettings))
         case .wireGuardObfuscationUdpOverTcp:
-            selectObfuscationState(.on)
+            selectObfuscationState(.udpOverTcp)
             delegate?.didUpdateTunnelSettings(TunnelSettingsUpdate.obfuscation(obfuscationSettings))
-        // TODO: When ready, add implementation for selected obfuscation.
+        // TODO: When ready, add implementation for selected obfuscation (navigate to new view etc).
         case .wireGuardObfuscationShadowsocks:
-            selectObfuscationState(.on)
+            selectObfuscationState(.shadowsocks)
             delegate?.didUpdateTunnelSettings(TunnelSettingsUpdate.obfuscation(obfuscationSettings))
-        // TODO: When ready, add implementation for selected obfuscation.
+        // TODO: When ready, add implementation for selected obfuscation (navigate to new view etc).
         case .wireGuardObfuscationOff:
             selectObfuscationState(.off)
             delegate?.didUpdateTunnelSettings(TunnelSettingsUpdate.obfuscation(obfuscationSettings))
@@ -656,9 +662,8 @@ extension VPNSettingsDataSource: VPNSettingsCellEventHandler {
         viewModel.setWireGuardObfuscationState(state)
     }
 
-    func selectObfuscationPort(_ port: UInt16) {
-        let selectedPort = WireGuardObfuscationPort(rawValue: port)!
-        viewModel.setWireGuardObfuscationPort(selectedPort)
+    func selectObfuscationPort(_ port: WireGuardObfuscationUdpOverTcpPort) {
+        viewModel.setWireGuardObfuscationUdpOverTcpPort(port)
     }
 
     func selectQuantumResistance(_ state: TunnelQuantumResistance) {
diff --git a/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsViewModel.swift b/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsViewModel.swift
index 457a8928ca..90e31ede73 100644
--- a/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsViewModel.swift
+++ b/ios/MullvadVPN/View controllers/VPNSettings/VPNSettingsViewModel.swift
@@ -97,7 +97,8 @@ struct VPNSettingsViewModel: Equatable {
     var availableWireGuardPortRanges: [[UInt16]] = []
 
     private(set) var obfuscationState: WireGuardObfuscationState
-    private(set) var obfuscationPort: WireGuardObfuscationPort
+    private(set) var obfuscationUpdOverTcpPort: WireGuardObfuscationUdpOverTcpPort
+    private(set) var obfuscationShadowsocksPort: WireGuardObfuscationShadowsockPort
 
     private(set) var quantumResistance: TunnelQuantumResistance
     private(set) var multihopState: MultihopState
@@ -178,8 +179,12 @@ struct VPNSettingsViewModel: Equatable {
         obfuscationState = newState
     }
 
-    mutating func setWireGuardObfuscationPort(_ newPort: WireGuardObfuscationPort) {
-        obfuscationPort = newPort
+    mutating func setWireGuardObfuscationShadowsockPort(_ newPort: WireGuardObfuscationShadowsockPort) {
+        obfuscationShadowsocksPort = newPort
+    }
+
+    mutating func setWireGuardObfuscationUdpOverTcpPort(_ newPort: WireGuardObfuscationUdpOverTcpPort) {
+        obfuscationUpdOverTcpPort = newPort
     }
 
     mutating func setQuantumResistance(_ newState: TunnelQuantumResistance) {
@@ -242,7 +247,8 @@ struct VPNSettingsViewModel: Equatable {
         wireGuardPort = tunnelSettings.relayConstraints.port.value
 
         obfuscationState = tunnelSettings.wireGuardObfuscation.state
-        obfuscationPort = tunnelSettings.wireGuardObfuscation.port
+        obfuscationUpdOverTcpPort = tunnelSettings.wireGuardObfuscation.udpOverTcpPort
+        obfuscationShadowsocksPort = tunnelSettings.wireGuardObfuscation.shadowsocksPort
 
         quantumResistance = tunnelSettings.tunnelQuantumResistance
         multihopState = tunnelSettings.tunnelMultihopState
diff --git a/ios/MullvadVPNTests/MullvadSettings/MigrationManagerTests.swift b/ios/MullvadVPNTests/MullvadSettings/MigrationManagerTests.swift
index c2a67d9cd7..99abde9169 100644
--- a/ios/MullvadVPNTests/MullvadSettings/MigrationManagerTests.swift
+++ b/ios/MullvadVPNTests/MullvadSettings/MigrationManagerTests.swift
@@ -136,7 +136,10 @@ final class MigrationManagerTests: XCTestCase {
 
         settingsV5.relayConstraints = relayConstraints
         settingsV5.tunnelQuantumResistance = .off
-        settingsV5.wireGuardObfuscation = WireGuardObfuscationSettings(state: .off, port: .automatic)
+        settingsV5.wireGuardObfuscation = WireGuardObfuscationSettings(
+            state: .off,
+            udpOverTcpPort: .automatic
+        )
         settingsV5.tunnelMultihopState = .off
 
         try migrateToLatest(settingsV5, version: .v5)
@@ -158,7 +161,10 @@ final class MigrationManagerTests: XCTestCase {
 
         settingsV4.relayConstraints = relayConstraints
         settingsV4.tunnelQuantumResistance = .off
-        settingsV4.wireGuardObfuscation = WireGuardObfuscationSettings(state: .off, port: .automatic)
+        settingsV4.wireGuardObfuscation = WireGuardObfuscationSettings(
+            state: .off,
+            udpOverTcpPort: .automatic
+        )
 
         try migrateToLatest(settingsV4, version: .v4)
 
@@ -178,7 +184,10 @@ final class MigrationManagerTests: XCTestCase {
 
         settingsV3.relayConstraints = relayConstraints
         settingsV3.dnsSettings = DNSSettings()
-        settingsV3.wireGuardObfuscation = WireGuardObfuscationSettings(state: .on, port: .port80)
+        settingsV3.wireGuardObfuscation = WireGuardObfuscationSettings(
+            state: .udpOverTcp,
+            udpOverTcpPort: .port80
+        )
 
         try migrateToLatest(settingsV3, version: .v3)
 
diff --git a/ios/MullvadVPNTests/MullvadSettings/TunnelSettingsUpdateTests.swift b/ios/MullvadVPNTests/MullvadSettings/TunnelSettingsUpdateTests.swift
index 881372d2be..b6cb2b7c57 100644
--- a/ios/MullvadVPNTests/MullvadSettings/TunnelSettingsUpdateTests.swift
+++ b/ios/MullvadVPNTests/MullvadSettings/TunnelSettingsUpdateTests.swift
@@ -35,11 +35,17 @@ final class TunnelSettingsUpdateTests: XCTestCase {
         var settings = LatestTunnelSettings()
 
         // When:
-        let update = TunnelSettingsUpdate.obfuscation(.init(state: .on, port: .port5001))
+        let update = TunnelSettingsUpdate.obfuscation(WireGuardObfuscationSettings(
+            state: .udpOverTcp,
+            udpOverTcpPort: .port5001
+        ))
         update.apply(to: &settings)
 
         // Then:
-        XCTAssertEqual(settings.wireGuardObfuscation, WireGuardObfuscationSettings(state: .on, port: .port5001))
+        XCTAssertEqual(settings.wireGuardObfuscation, WireGuardObfuscationSettings(
+            state: .udpOverTcp,
+            udpOverTcpPort: .port5001
+        ))
     }
 
     func testApplyRelayConstraints() {
@@ -50,7 +56,7 @@ final class TunnelSettingsUpdateTests: XCTestCase {
         let relayConstraints = RelayConstraints(
             exitLocations: .only(UserSelectedRelays(locations: [.country("zz")])),
             port: .only(9999),
-            filter: .only(.init(ownership: .rented, providers: .only(["foo", "bar"])))
+            filter: .only(RelayFilter(ownership: .rented, providers: .only(["foo", "bar"])))
         )
         let update = TunnelSettingsUpdate.relayConstraints(relayConstraints)
         update.apply(to: &settings)
diff --git a/ios/MullvadVPNTests/MullvadVPN/TunnelManager/TunnelSettingsStrategyTests.swift b/ios/MullvadVPNTests/MullvadVPN/TunnelManager/TunnelSettingsStrategyTests.swift
index 685c643d17..97986de037 100644
--- a/ios/MullvadVPNTests/MullvadVPN/TunnelManager/TunnelSettingsStrategyTests.swift
+++ b/ios/MullvadVPNTests/MullvadVPN/TunnelManager/TunnelSettingsStrategyTests.swift
@@ -74,12 +74,18 @@ final class TunnelSettingsStrategyTests: XCTestCase {
 
     func testConnectToCurrentRelayOnWireGuardObfuscationChange() {
         var currentSettings = LatestTunnelSettings()
-        TunnelSettingsUpdate.obfuscation(WireGuardObfuscationSettings(state: .off, port: .port80))
-            .apply(to: &currentSettings)
+        TunnelSettingsUpdate.obfuscation(WireGuardObfuscationSettings(
+            state: .off,
+            udpOverTcpPort: .port80
+        ))
+        .apply(to: &currentSettings)
 
         var updatedSettings = currentSettings
-        TunnelSettingsUpdate.obfuscation(WireGuardObfuscationSettings(state: .automatic, port: .automatic))
-            .apply(to: &updatedSettings)
+        TunnelSettingsUpdate.obfuscation(WireGuardObfuscationSettings(
+            state: .automatic,
+            udpOverTcpPort: .automatic
+        ))
+        .apply(to: &updatedSettings)
 
         let tunnelSettingsStrategy = TunnelSettingsStrategy()
         XCTAssertFalse(tunnelSettingsStrategy.shouldReconnectToNewRelay(
diff --git a/ios/PacketTunnelCore/Actor/ProtocolObfuscator.swift b/ios/PacketTunnelCore/Actor/ProtocolObfuscator.swift
index e5a0c694b6..d43fafa6f5 100644
--- a/ios/PacketTunnelCore/Actor/ProtocolObfuscator.swift
+++ b/ios/PacketTunnelCore/Actor/ProtocolObfuscator.swift
@@ -42,7 +42,7 @@ public class ProtocolObfuscator<Obfuscator: TunnelObfuscation>: ProtocolObfuscat
         let shouldObfuscate = switch settings.obfuscation.state {
         case .automatic:
             retryAttempts % 4 == 2 || retryAttempts % 4 == 3
-        case .on:
+        case .on, .udpOverTcp, .shadowsocks:
             true
         case .off:
             false
@@ -52,15 +52,15 @@ public class ProtocolObfuscator<Obfuscator: TunnelObfuscation>: ProtocolObfuscat
             tunnelObfuscator = nil
             return endpoint
         }
-        var tcpPort = settings.obfuscation.port
+        var tcpPort = settings.obfuscation.udpOverTcpPort
         if tcpPort == .automatic {
             tcpPort = retryAttempts % 2 == 0 ? .port80 : .port5001
         }
         let obfuscator = Obfuscator(
             remoteAddress: obfuscatedEndpoint.ipv4Relay.ip,
-            tcpPort: tcpPort.portValue
+            tcpPort: tcpPort.portValue ?? 0
         )
-        remotePort = tcpPort.portValue
+        remotePort = tcpPort.portValue ?? 0
         obfuscator.start()
         tunnelObfuscator = obfuscator
 
diff --git a/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift b/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift
index d3caaf70d1..d270700f42 100644
--- a/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift
+++ b/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift
@@ -30,7 +30,7 @@ extension SettingsReaderStub {
             tunnelSettings: LatestTunnelSettings(
                 relayConstraints: RelayConstraints(),
                 dnsSettings: DNSSettings(),
-                wireGuardObfuscation: WireGuardObfuscationSettings(state: .off, port: .automatic),
+                wireGuardObfuscation: WireGuardObfuscationSettings(state: .off),
                 tunnelQuantumResistance: .automatic,
                 tunnelMultihopState: .off,
                 daita: DAITASettings()
@@ -49,7 +49,7 @@ extension SettingsReaderStub {
             tunnelSettings: LatestTunnelSettings(
                 relayConstraints: RelayConstraints(),
                 dnsSettings: DNSSettings(),
-                wireGuardObfuscation: WireGuardObfuscationSettings(state: .off, port: .automatic),
+                wireGuardObfuscation: WireGuardObfuscationSettings(state: .off),
                 tunnelQuantumResistance: .on,
                 tunnelMultihopState: .off,
                 daita: DAITASettings()
diff --git a/ios/PacketTunnelCoreTests/ProtocolObfuscatorTests.swift b/ios/PacketTunnelCoreTests/ProtocolObfuscatorTests.swift
index 3e2c8b52ec..8a0923af41 100644
--- a/ios/PacketTunnelCoreTests/ProtocolObfuscatorTests.swift
+++ b/ios/PacketTunnelCoreTests/ProtocolObfuscatorTests.swift
@@ -41,7 +41,7 @@ final class ProtocolObfuscatorTests: XCTestCase {
     }
 
     func testObfuscateOnPort80() throws {
-        let settings = settings(.on, obfuscationPort: .port80, quantumResistance: .automatic)
+        let settings = settings(.udpOverTcp, obfuscationPort: .port80, quantumResistance: .automatic)
         let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings)
         let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
 
@@ -49,7 +49,7 @@ final class ProtocolObfuscatorTests: XCTestCase {
     }
 
     func testObfuscateOnPort5001() throws {
-        let settings = settings(.on, obfuscationPort: .port5001, quantumResistance: .automatic)
+        let settings = settings(.udpOverTcp, obfuscationPort: .port5001, quantumResistance: .automatic)
         let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings)
         let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
 
@@ -57,7 +57,7 @@ final class ProtocolObfuscatorTests: XCTestCase {
     }
 
     func testObfuscateOnPortAutomaticIsPort80OnEvenRetryAttempts() throws {
-        let settings = settings(.on, obfuscationPort: .automatic, quantumResistance: .automatic)
+        let settings = settings(.udpOverTcp, obfuscationPort: .automatic, quantumResistance: .automatic)
         let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings, retryAttempts: 2)
         let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
 
@@ -65,7 +65,7 @@ final class ProtocolObfuscatorTests: XCTestCase {
     }
 
     func testObfuscateOnPortAutomaticIsPort5001OnOddRetryAttempts() throws {
-        let settings = settings(.on, obfuscationPort: .automatic, quantumResistance: .automatic)
+        let settings = settings(.udpOverTcp, obfuscationPort: .automatic, quantumResistance: .automatic)
         let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings, retryAttempts: 3)
         let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
 
@@ -91,7 +91,7 @@ final class ProtocolObfuscatorTests: XCTestCase {
     private func validate(
         _ obfuscatedEndpoint: MullvadEndpoint,
         against obfuscationProtocol: TunnelObfuscationStub,
-        expect port: WireGuardObfuscationPort
+        expect port: WireGuardObfuscationUdpOverTcpPort
     ) {
         XCTAssertEqual(obfuscatedEndpoint.ipv4Relay.ip, .loopback)
         XCTAssertEqual(obfuscatedEndpoint.ipv4Relay.port, obfuscationProtocol.localUdpPort)
@@ -100,7 +100,7 @@ final class ProtocolObfuscatorTests: XCTestCase {
 
     private func settings(
         _ obfuscationState: WireGuardObfuscationState,
-        obfuscationPort: WireGuardObfuscationPort,
+        obfuscationPort: WireGuardObfuscationUdpOverTcpPort,
         quantumResistance: TunnelQuantumResistance
     ) -> Settings {
         Settings(
@@ -108,7 +108,7 @@ final class ProtocolObfuscatorTests: XCTestCase {
             interfaceAddresses: [IPAddressRange(from: "127.0.0.1/32")!],
             tunnelSettings: LatestTunnelSettings(wireGuardObfuscation: WireGuardObfuscationSettings(
                 state: obfuscationState,
-                port: obfuscationPort
+                udpOverTcpPort: obfuscationPort
             ))
         )
     }