Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding SNI config support #1396

Merged
merged 13 commits into from
Aug 5, 2024
Merged

Adding SNI config support #1396

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
ff4ef7a
Merge branch 'main' of github.com:getlantern/flashlight
WendelHime Jun 11, 2024
7ded24f
Merge branch 'main' of github.com:getlantern/flashlight
WendelHime Jun 14, 2024
bd87cf1
Merge branch 'main' of github.com:getlantern/flashlight
WendelHime Jul 10, 2024
1f0456c
feat: adding config fronting SNIs
WendelHime Jul 16, 2024
6f91aad
feat: moving SNI Config struct definition to fronted so we can avoid …
WendelHime Jul 17, 2024
31e60a2
chore: adding a small test for checking if it's loading the fronting …
WendelHime Jul 23, 2024
847fb2e
fix: adding a list of SNIs to the default list
WendelHime Jul 30, 2024
26bc68d
fix: using default config when region couldn't be found
WendelHime Jul 30, 2024
f2c553c
fix: checking if arbitrary region is empty and if it is use the defau…
WendelHime Jul 30, 2024
98e13f0
fix: updating fronted version
WendelHime Jul 30, 2024
d9f42b9
fix: using arbitrary SNIs by default
WendelHime Jul 30, 2024
ec17273
fix: setting default arbitrary SNIs use as false and check if for tha…
WendelHime Jul 30, 2024
6d1f124
feat: adding arbitrary sni list for cn
WendelHime Jul 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions config/client_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import (
"errors"

"github.com/getlantern/flashlight/v7/geolookup"
"github.com/getlantern/fronted"
)

Expand Down Expand Up @@ -40,6 +41,7 @@
Masquerades []*fronted.Masquerade
Validator *ValidatorConfig
PassthroughPatterns []string
FrontingSNIs map[string]*fronted.SNIConfig

Check failure on line 44 in config/client_config.go

View workflow job for this annotation

GitHub Actions / build 

undefined: fronted.SNIConfig
}

// returns a fronted.ResponseValidator specified by the
Expand Down Expand Up @@ -80,15 +82,24 @@

// Builds a list of fronted.Providers to use based on the configuration
func (c *ClientConfig) FrontedProviders() map[string]*fronted.Provider {
sniRegion := geolookup.GetCountry(0)
if sniRegion == "" {
sniRegion = "default"
}

providers := make(map[string]*fronted.Provider)
for pid, p := range c.Fronted.Providers {
sniConfig := p.FrontingSNIs[sniRegion]
if sniConfig != nil && sniConfig.UseArbitrarySNIs && len(sniConfig.ArbitrarySNIs) == 0 {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We want to fall back to the default SNI config if sniRegion does not appear in p.FrontingSNIs. Currently, if there is no entry in p.FrontingSNIs for sniRegion, then sniConfig will never be populated (sniConfig.UseArbitrarySNIs will be ignored because sniConfig != nil will fail).

I think we instead want something like:

sniConfig, ok := p.FrontingSNIs[sniRegion]
if !ok {
  sniConfig = p.FrontingSNIs["default"]
}

Or am I misunderstanding something?

Copy link
Contributor Author

@WendelHime WendelHime Jul 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aaaa I have misunderstood, I thought we only want to use the default arbitrary list when the region has an empty arbitrary list, will fix that soon

Copy link
Contributor Author

@WendelHime WendelHime Jul 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wait I didn't misunderstood, the provided example does mention that, if there are no arbitrary sni provided and we want to use it, we will use it from the default section (see cn example and comment):

fronting-snis:
  default:
    use-arbitrary-snis: false
    arbitrary-snis:
      - example.com
      - example2.com
      - ... etc ...
  ir:
    use-arbitrary-snis: true
    arbirtary-snis:
      - iran-example.com
      - iran-example2.com
      - ... etc ...
  cn:
    use-abritrary-snis: true
    # no abritrary-snis list; use list from default section

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The example looks good and your updated code implements it correctly!

sniConfig.ArbitrarySNIs = p.FrontingSNIs["default"].ArbitrarySNIs
}
providers[pid] = fronted.NewProvider(
p.HostAliases,
p.TestURL,
p.Masquerades,
p.GetResponseValidator(pid),
p.PassthroughPatterns,
sniConfig,

Check failure on line 102 in config/client_config.go

View workflow job for this annotation

GitHub Actions / build 

too many arguments in call to fronted.NewProvider
)
}
return providers
Expand Down
2 changes: 2 additions & 0 deletions config/embedded_global_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ func TestEmbeddedGlobal(t *testing.T) {
assert.NoError(t, err)

gl := global.(*Global)
assert.False(t, gl.Client.Fronted.Providers["akamai"].FrontingSNIs["default"].UseArbitrarySNIs)
assert.NotEmpty(t, gl.Client.Fronted.Providers["akamai"].FrontingSNIs["default"].ArbitrarySNIs)
assert.True(t, len(gl.Client.Fronted.Providers["akamai"].Masquerades) > 20)
assert.True(t, len(gl.Client.Fronted.Providers["cloudfront"].Masquerades) > 20)
assert.Containsf(t, gl.Client.Fronted.Providers["cloudfront"].HostAliases, "replica-search.lantern.io", "embedded global config does not contain replica-search cloudfront fronted provider")
Expand Down
12 changes: 12 additions & 0 deletions embeddedconfig/global.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,6 +255,18 @@ client:
testurl: https://fronted-ping.dsa.akamai.getiantem.org/ping
validator:
rejectstatus: [403]
frontingsnis:
default:
usearbitrarysnis: false
arbitrarysnis:
- amazon.com
- mercadopago.com
- facebook.com
- instagram.com
- twitter.com
WendelHime marked this conversation as resolved.
Show resolved Hide resolved
ir:
usearbitrarysnis: true
arbitrarysnis:
masquerades:
- domain: a248.e.akamai.net
ipaddress: 23.45.112.56
Expand Down
4 changes: 4 additions & 0 deletions embeddedconfig/global.yaml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,10 @@ client:
testurl: {{$p.TestURL}}{{if $p.Validator}}
validator:{{if $p.Validator.RejectStatus}}
rejectstatus: [{{range $i, $e := $p.Validator.RejectStatus}}{{if $i}}, {{end}}{{$e}}{{end}}]{{end}}{{end}}
frontingsnis: {{range $key, $cfg := $p.FrontingSNIs}}
{{$key}}:
usearbitrarysnis: {{$cfg.UseArbitrarySNIs}}
arbitrarysnis: [{{range $i, $sni := $cfg.ArbitrarySNIs}}{{if $i}}, {{end}}{{$sni}}{{end}}]{{end}}
masquerades: {{if eq $pid "cloudfront"}}&cfmasq{{end}}{{range $p.Masquerades}}
- domain: {{.Domain}}
ipaddress: {{.IpAddress}}{{end}}{{else}}{}{{end}}
Expand Down
Loading