ipn: impl rpn for warp

intra/backend/ipn_proxies.go

@@ -14,6 +14,8 @@ const ( // see ipn/proxies.go
 	Base    = "Base"        // does not proxy traffic; in sync w dnsx.NetNoProxy
 	Exit    = "Exit"        // always connects to the Internet (exit node); in sync w dnsx.NetExitProxy
 	Ingress = "Ingress"     // incoming connections
+	Auto    = "rpn"         // auto uses ipn.Exit or any of the RPN proxies
+	RpnWg   = WG + RPN      // RPN Warp
 	OrbotS5 = "OrbotSocks5" // Orbot: Base Tor-as-a-SOCKS5 proxy
 	OrbotH1 = "OrbotHttp1"  // Orbot: Base Tor-as-a-HTTP/1.1 proxy
 
@@ -27,6 +29,7 @@ const ( // see ipn/proxies.go
 	PIPWS    = "pipws"  // PIP: WebSockets proxy
 	NOOP     = "noop"   // No proxy, ex: Base, Block
 	INTERNET = "net"    // egress network, ex: Exit
+	RPN      = "rpn"    // Rethink Proxy Network
 
 	// status of proxies
 
@@ -38,6 +41,10 @@ const ( // see ipn/proxies.go
 	END = -3 // proxy stopped
 )
 
+type Rpn interface {
+	RegisterWarp(b64 string) ([]byte, error)
+}
+
 type Proxy interface {
 	// ID returns the ID of this proxy.
 	ID() string
@@ -68,6 +75,8 @@ type Proxies interface {
 	GetProxy(id string) (Proxy, error)
 	// Router returns a lowest common denomination router for this multi-transport.
 	Router() Router
+	// RPN returns the Rethink Proxy Network interface.
+	Rpn() Rpn
 	// Refresh re-registers proxies and returns a csv of active ones.
 	RefreshProxies() (string, error)
 }

intra/core/ip.go

@@ -0,0 +1,69 @@
+// Copyright (c) 2024 RethinkDNS and its authors.
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+//
+// This file incorporates work covered by the following copyright and
+// permission notice:
+//
+//    SPDX-License-Identifier: MIT
+
+// from: https://github.com/bepass-org/warp-plus/blob/19ac233cc/iputils/iputils.go
+
+package core
+
+import (
+	"errors"
+	"fmt"
+	"math/big"
+	"math/rand"
+	"net/netip"
+	"time"
+)
+
+// RandomIPFromPrefix returns a random IP from the provided CIDR prefix.
+// Supports IPv4 and IPv6. Does not support mapped inputs.
+func RandomIPFromPrefix(cidr netip.Prefix) (netip.Addr, error) {
+	startingAddress := cidr.Masked().Addr()
+	if startingAddress.Is4In6() {
+		return netip.Addr{}, errors.New("mapped v4 addresses not supported")
+	}
+
+	prefixLen := cidr.Bits()
+	if prefixLen == -1 {
+		return netip.Addr{}, fmt.Errorf("invalid cidr: %s", cidr)
+	}
+
+	// Initialise rand number generator
+	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
+
+	// Find the bit length of the Host portion of the provided CIDR
+	// prefix
+	hostLen := big.NewInt(int64(startingAddress.BitLen() - prefixLen))
+
+	// Find the max value for our random number
+	max := new(big.Int).Exp(big.NewInt(2), hostLen, nil)
+
+	// Generate the random number
+	randInt := new(big.Int).Rand(rng, max)
+
+	// Get the first address in the CIDR prefix in 16-bytes form
+	startingAddress16 := startingAddress.As16()
+
+	// Convert the first address into a decimal number
+	startingAddressInt := new(big.Int).SetBytes(startingAddress16[:])
+
+	// Add the random number to the decimal form of the starting address
+	// to get a random address in the desired range
+	randomAddressInt := new(big.Int).Add(startingAddressInt, randInt)
+
+	// Convert the random address from decimal form back into netip.Addr
+	randomAddress, ok := netip.AddrFromSlice(randomAddressInt.FillBytes(make([]byte, 16)))
+	if !ok {
+		return netip.Addr{}, fmt.Errorf("failed to generate random IP from CIDR: %s", cidr)
+	}
+
+	// Unmap any mapped v4 addresses before return
+	return randomAddress.Unmap(), nil
+}

intra/dialers/utls.go

@@ -0,0 +1,135 @@
+// Copyright (c) 2024 RethinkDNS and its authors.
+//
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+//
+// This file incorporates work covered by the following copyright and
+// permission notice:
+//
+//    SPDX-License-Identifier: MIT
+
+// from: github.com/bepass-org/warp-plus/blob/19ac233cc/warp/tlsdial.go
+
+package dialers
+
+import (
+	"io"
+	"net"
+
+	"github.com/celzero/firestack/intra/core"
+
+	utls "github.com/refraction-networking/utls"
+)
+
+const utlsExtSniCurveId uint16 = 0x15
+const sniCurveSize = 1200
+const utlsVer = utls.VersionTLS12
+
+var utlsDefaultCypherSuites = []uint16{
+	utls.GREASE_PLACEHOLDER,
+	utls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
+	utls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	utls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+	utls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+	utls.TLS_AES_128_GCM_SHA256, // tls 1.3
+	utls.FAKE_TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
+	utls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	utls.TLS_RSA_WITH_AES_256_CBC_SHA,
+}
+
+var utlsDefaultExt = []utls.TLSExtension{
+	&sniCurveExt{
+		curvelen: sniCurveSize,
+		pad:      true,
+	},
+	&utls.SupportedCurvesExtension{Curves: []utls.CurveID{utls.X25519, utls.CurveP256}},
+	&utls.SupportedPointsExtension{SupportedPoints: []byte{0}}, // uncompressed
+	&utls.SessionTicketExtension{},
+	&utls.ALPNExtension{AlpnProtocols: []string{"http/1.1"}},
+	&utls.SignatureAlgorithmsExtension{
+		SupportedSignatureAlgorithms: []utls.SignatureScheme{
+			utls.ECDSAWithP256AndSHA256,
+			utls.ECDSAWithP384AndSHA384,
+			utls.ECDSAWithP521AndSHA512,
+			utls.PSSWithSHA256,
+			utls.PSSWithSHA384,
+			utls.PSSWithSHA512,
+			utls.PKCS1WithSHA256,
+			utls.PKCS1WithSHA384,
+			utls.PKCS1WithSHA512,
+			utls.ECDSAWithSHA1,
+			utls.PKCS1WithSHA1,
+		},
+	},
+	&utls.KeyShareExtension{KeyShares: []utls.KeyShare{
+		{Group: utls.CurveID(utls.GREASE_PLACEHOLDER), Data: []byte{0}},
+		{Group: utls.X25519},
+	}},
+	&utls.PSKKeyExchangeModesExtension{Modes: []uint8{1}}, // pskModeDHE
+}
+
+// sniCurveExt implements SNICurve (0x15) extension
+type sniCurveExt struct {
+	*utls.GenericExtension
+	curvelen int
+	pad      bool // enabled if true
+}
+
+// Len returns the length of the SNICurveExtension.
+func (e *sniCurveExt) Len() int {
+	if e.pad {
+		return 4 + e.curvelen
+	} // extension disabled
+	return 0
+}
+
+// Read reads the SNICurveExtension.
+func (e *sniCurveExt) Read(b []byte) (n int, err error) {
+	if !e.pad { // extension disabled
+		return 0, io.EOF
+	}
+	if len(b) < e.Len() {
+		return 0, io.ErrShortBuffer
+	}
+	// https://tools.ietf.org/html/rfc7627
+	b[0] = byte(utlsExtSniCurveId >> 8)
+	b[1] = byte(utlsExtSniCurveId)
+	b[2] = byte(e.curvelen >> 8)
+	b[3] = byte(e.curvelen)
+
+	bptr := core.Alloc()
+	buf := *bptr
+	buf = buf[:cap(buf)]
+	defer func() {
+		*bptr = buf
+		core.Recycle(bptr)
+	}()
+
+	copy(b[4:], buf)
+	return e.Len(), io.EOF
+}
+
+// utlsHello creates a TLS hello packet with SNICurve.
+func utlsHello(conn net.Conn, config *utls.Config, sni string) (*utls.UConn, error) {
+	uconn := utls.UClient(conn, config, utls.HelloCustom)
+	spec := utls.ClientHelloSpec{
+		TLSVersMax:   utlsVer,
+		TLSVersMin:   utlsVer,
+		CipherSuites: utlsDefaultCypherSuites,
+		Extensions:   utlsDefaultExt,
+		GetSessionID: nil,
+	}
+	spec.Extensions = append(spec.Extensions, &utls.SNIExtension{ServerName: sni})
+	err := uconn.ApplyPreset(&spec)
+	if err != nil {
+		return nil, err
+	}
+
+	err = uconn.Handshake()
+	if err != nil {
+		return nil, err
+	}
+
+	return uconn, nil
+}