Have the PacketTunnel use UDP-over-TCP Obfuscation

8 files changed, 168 insertions, 6 deletions

diff --git a/ios/PacketTunnelCoreTests/AppMessageHandlerTests.swift b/ios/PacketTunnelCoreTests/AppMessageHandlerTests.swift
index d11dd47802..79562eec28 100644
--- a/ios/PacketTunnelCoreTests/AppMessageHandlerTests.swift
+++ b/ios/PacketTunnelCoreTests/AppMessageHandlerTests.swift
@@ -88,7 +88,8 @@ final class AppMessageHandlerTests: XCTestCase {
         let selectedRelay = SelectedRelay(
             endpoint: selectorResult.endpoint,
             hostname: selectorResult.relay.hostname,
-            location: selectorResult.location
+            location: selectorResult.location,
+            retryAttempts: 0
         )
 
         _ = try? await appMessageHandler.handleAppMessage(
diff --git a/ios/PacketTunnelCoreTests/Mocks/PacketTunnelActor+Mocks.swift b/ios/PacketTunnelCoreTests/Mocks/PacketTunnelActor+Mocks.swift
index 3e01bec31c..c33f20457d 100644
--- a/ios/PacketTunnelCoreTests/Mocks/PacketTunnelActor+Mocks.swift
+++ b/ios/PacketTunnelCoreTests/Mocks/PacketTunnelActor+Mocks.swift
@@ -34,7 +34,8 @@ extension PacketTunnelActor {
             defaultPathObserver: defaultPathObserver,
             blockedStateErrorMapper: blockedStateErrorMapper,
             relaySelector: relaySelector,
-            settingsReader: settingsReader
+            settingsReader: settingsReader,
+            protocolObfuscator: ProtocolObfuscationStub()
         )
     }
 }
diff --git a/ios/PacketTunnelCoreTests/Mocks/ProtocolObfuscationStub.swift b/ios/PacketTunnelCoreTests/Mocks/ProtocolObfuscationStub.swift
new file mode 100644
index 0000000000..7426075b61
--- /dev/null
+++ b/ios/PacketTunnelCoreTests/Mocks/ProtocolObfuscationStub.swift
@@ -0,0 +1,17 @@
+//
+//  ProtocolObfuscationStub.swift
+//  PacketTunnelCoreTests
+//
+//  Created by Marco Nikic on 2023-11-20.
+//  Copyright © 2023 Mullvad VPN AB. All rights reserved.
+//
+
+import Foundation
+@testable import MullvadTypes
+@testable import PacketTunnelCore
+
+struct ProtocolObfuscationStub: ProtocolObfuscation {
+    func obfuscate(_ endpoint: MullvadEndpoint, settings: Settings, retryAttempts: UInt) -> MullvadEndpoint {
+        endpoint
+    }
+}
diff --git a/ios/PacketTunnelCoreTests/Mocks/RelaySelectorStub.swift b/ios/PacketTunnelCoreTests/Mocks/RelaySelectorStub.swift
index c601c860d4..4922c080c5 100644
--- a/ios/PacketTunnelCoreTests/Mocks/RelaySelectorStub.swift
+++ b/ios/PacketTunnelCoreTests/Mocks/RelaySelectorStub.swift
@@ -44,7 +44,7 @@ extension RelaySelectorStub {
                     cityCode: "got",
                     latitude: 0,
                     longitude: 0
-                )
+                ), retryAttempts: 0
             )
         }
     }
diff --git a/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift b/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift
index 1893f4363d..c95133b091 100644
--- a/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift
+++ b/ios/PacketTunnelCoreTests/Mocks/SettingsReaderStub.swift
@@ -7,6 +7,7 @@
 //
 
 import Foundation
+@testable import MullvadSettings
 import MullvadTypes
 import PacketTunnelCore
 import WireGuardKitTypes
@@ -27,7 +28,8 @@ extension SettingsReaderStub {
             privateKey: PrivateKey(),
             interfaceAddresses: [IPAddressRange(from: "127.0.0.1/32")!],
             relayConstraints: RelayConstraints(),
-            dnsServers: .gateway
+            dnsServers: .gateway,
+            obfuscation: WireGuardObfuscationSettings(state: .off, port: .automatic)
         )
 
         return SettingsReaderStub {
diff --git a/ios/PacketTunnelCoreTests/Mocks/TunnelObfuscationStub.swift b/ios/PacketTunnelCoreTests/Mocks/TunnelObfuscationStub.swift
new file mode 100644
index 0000000000..e070115986
--- /dev/null
+++ b/ios/PacketTunnelCoreTests/Mocks/TunnelObfuscationStub.swift
@@ -0,0 +1,24 @@
+//
+//  TunnelObfuscationStub.swift
+//  PacketTunnelCoreTests
+//
+//  Created by Marco Nikic on 2023-11-21.
+//  Copyright © 2023 Mullvad VPN AB. All rights reserved.
+//
+
+import Foundation
+import Network
+@testable import TunnelObfuscation
+
+struct TunnelObfuscationStub: TunnelObfuscation {
+    let remotePort: UInt16
+    init(remoteAddress: IPAddress, tcpPort: UInt16) {
+        remotePort = tcpPort
+    }
+
+    func start() {}
+
+    func stop() {}
+
+    var localUdpPort: UInt16 { 42 }
+}
diff --git a/ios/PacketTunnelCoreTests/PacketTunnelActorTests.swift b/ios/PacketTunnelCoreTests/PacketTunnelActorTests.swift
index 65c0fbcf09..dccadc3442 100644
--- a/ios/PacketTunnelCoreTests/PacketTunnelActorTests.swift
+++ b/ios/PacketTunnelCoreTests/PacketTunnelActorTests.swift
@@ -7,7 +7,7 @@
 //
 
 import Combine
-import MullvadSettings
+@testable import MullvadSettings
 import MullvadTypes
 import Network
 @testable import PacketTunnelCore
@@ -206,7 +206,8 @@ final class PacketTunnelActorTests: XCTestCase {
                     privateKey: PrivateKey(),
                     interfaceAddresses: [IPAddressRange(from: "127.0.0.1/32")!],
                     relayConstraints: RelayConstraints(),
-                    dnsServers: .gateway
+                    dnsServers: .gateway,
+                    obfuscation: WireGuardObfuscationSettings(state: .off, port: .automatic)
                 )
             }
         }
diff --git a/ios/PacketTunnelCoreTests/ProtocolObfuscatorTests.swift b/ios/PacketTunnelCoreTests/ProtocolObfuscatorTests.swift
new file mode 100644
index 0000000000..dd644a74e1
--- /dev/null
+++ b/ios/PacketTunnelCoreTests/ProtocolObfuscatorTests.swift
@@ -0,0 +1,116 @@
+//
+//  ProtocolObfuscatorTests.swift
+//  PacketTunnelCoreTests
+//
+//  Created by Marco Nikic on 2023-11-21.
+//  Copyright © 2023 Mullvad VPN AB. All rights reserved.
+//
+
+@testable import MullvadSettings
+@testable import MullvadTypes
+import Network
+@testable import PacketTunnelCore
+@testable import WireGuardKitTypes
+import XCTest
+
+final class ProtocolObfuscatorTests: XCTestCase {
+    var obfuscator: ProtocolObfuscator<TunnelObfuscationStub>!
+    var address: IPv4Address!
+    var gateway: IPv4Address!
+    var v4Endpoint: IPv4Endpoint!
+    var endpoint: MullvadEndpoint!
+
+    override func setUpWithError() throws {
+        obfuscator = ProtocolObfuscator<TunnelObfuscationStub>()
+        address = try XCTUnwrap(IPv4Address("1.2.3.4"))
+        gateway = try XCTUnwrap(IPv4Address("5.6.7.8"))
+        v4Endpoint = IPv4Endpoint(ip: address, port: 56)
+        endpoint = MullvadEndpoint(
+            ipv4Relay: v4Endpoint,
+            ipv4Gateway: gateway,
+            ipv6Gateway: .any,
+            publicKey: Data()
+        )
+    }
+
+    func testObfuscateOffDoesNotChangeEndpoint() {
+        let settings = settings(.off, obfuscationPort: .automatic)
+        let nonObfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings)
+
+        XCTAssertEqual(endpoint, nonObfuscatedEndpoint)
+    }
+
+    func testObfuscateOnPort80() throws {
+        let settings = settings(.on, obfuscationPort: .port80)
+        let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings)
+        let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
+
+        validate(obfuscatedEndpoint, against: obfuscationProtocol, expect: .port80)
+    }
+
+    func testObfuscateOnPort5001() throws {
+        let settings = settings(.on, obfuscationPort: .port5001)
+        let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings)
+        let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
+
+        validate(obfuscatedEndpoint, against: obfuscationProtocol, expect: .port5001)
+    }
+
+    func testObfuscateOnPortAutomaticIsPort80OnEvenRetryAttempts() throws {
+        let settings = settings(.on, obfuscationPort: .automatic)
+        let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings, retryAttempts: 2)
+        let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
+
+        validate(obfuscatedEndpoint, against: obfuscationProtocol, expect: .port80)
+    }
+
+    func testObfuscateOnPortAutomaticIsPort5001OnOddRetryAttempts() throws {
+        let settings = settings(.on, obfuscationPort: .automatic)
+        let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings, retryAttempts: 3)
+        let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
+
+        validate(obfuscatedEndpoint, against: obfuscationProtocol, expect: .port5001)
+    }
+
+    func testObfuscateAutomaticIsPort80EveryThirdAttempts() throws {
+        let settings = settings(.automatic, obfuscationPort: .automatic)
+        let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings, retryAttempts: 6)
+        let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
+
+        validate(obfuscatedEndpoint, against: obfuscationProtocol, expect: .port80)
+    }
+
+    func testObfuscateAutomaticIsPort5001EveryFourthAttempts() throws {
+        let settings = settings(.automatic, obfuscationPort: .automatic)
+        let obfuscatedEndpoint = obfuscator.obfuscate(endpoint, settings: settings, retryAttempts: 7)
+        let obfuscationProtocol = try XCTUnwrap(obfuscator.tunnelObfuscator as? TunnelObfuscationStub)
+
+        validate(obfuscatedEndpoint, against: obfuscationProtocol, expect: .port5001)
+    }
+
+    private func validate(
+        _ obfuscatedEndpoint: MullvadEndpoint,
+        against obfuscationProtocol: TunnelObfuscationStub,
+        expect port: WireGuardObfuscationPort
+    ) {
+        XCTAssertEqual(obfuscatedEndpoint.ipv4Relay.ip, .loopback)
+        XCTAssertEqual(obfuscatedEndpoint.ipv4Relay.port, obfuscationProtocol.localUdpPort)
+        XCTAssertEqual(obfuscationProtocol.remotePort, port.portValue)
+    }
+
+    private func settings(
+        _ obfuscationState: WireGuardObfuscationState,
+        obfuscationPort: WireGuardObfuscationPort
+    ) -> Settings {
+        Settings(
+            privateKey: PrivateKey(),
+            interfaceAddresses: [IPAddressRange(from: "127.0.0.1/32")!],
+            relayConstraints: RelayConstraints(),
+            dnsServers: .gateway,
+            obfuscation: WireGuardObfuscationSettings(
+                state: obfuscationState,
+                port: obfuscationPort
+            )
+        )
+    }
+}