[client,server]: integrate WRAP per-packet obfuscation into relay datapath

Co-authored-by: Moroka8 <moroka8@mail.ru>
(ported from cacggghp/vk-turn-proxy PR cacggghp#162, commit 0f24441; cipher selection extended to aes-ctr/chacha20-xor)

Author: Moroka8

client/main.go

@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"github.com/cacggghp/vk-turn-proxy/internal/controlpath"
+	"github.com/cacggghp/vk-turn-proxy/internal/wrap"
 	"github.com/cacggghp/vk-turn-proxy/sessionproto"
 	"github.com/cbeuw/connutil"
 	"github.com/google/uuid"
@@ -1467,6 +1468,16 @@ type turnParams struct {
 	getCreds     getCredsFunc
 	resolver     *protectedResolver
 	credsManager *groupedCredsManager
+	// WRAP per-packet obfuscation. wrapCipher == WRAP_CIPHER_NONE /
+	// _UNSPECIFIED disables WRAP regardless of wrapKey.
+	wrapCipher sessionproto.WrapCipher
+	wrapKey    []byte
+	// wrapMode controls fallback semantics when WRAP is configured:
+	//   "off"       — never wrap (wrapCipher should already be NONE)
+	//   "preferred" — try WRAP, fall back to raw if no successfully unwrapped
+	//                 inbound packet arrives within wrapFallbackInboundTimeout
+	//   "required"  — fail hard if WRAP unwrap doesn't succeed; never fall back
+	wrapMode string
 }
 
 func oneTurnConnection(
@@ -1632,6 +1643,53 @@ func oneTurnConnection(
 			}
 		}
 	})
+	wrapCipher, err1 := wrap.New(turnParams.wrapCipher, turnParams.wrapKey)
+	if err1 != nil {
+		err = fmt.Errorf("WRAP cipher init failed: %s", err1)
+		return
+	}
+	wrapModeForAttempt := turnParams.wrapMode
+	// Fallback key is the peer (our server) address: WRAP support is a
+	// property of the peer, not of the VK TURN relay we route through.
+	fallbackKey := peer.String()
+	if wrapCipher != nil && wrapModeForAttempt == "preferred" && wrapDisabledForAddr(fallbackKey) {
+		log.Printf("[STREAM %d] WRAP marked unsupported for peer %s recently; using raw this attempt", streamID, fallbackKey)
+		wrapCipher = nil
+	}
+	if wrapCipher != nil {
+		log.Printf("[STREAM %d] WRAP active: cipher=%s mode=%s", streamID, turnParams.wrapCipher, wrapModeForAttempt)
+	}
+	var anyWrapInboundSuccess atomic.Bool
+	wrapActiveThisAttempt := wrapCipher != nil
+	// On return: if WRAP was active and no successful inbound unwrap
+	// happened (worker exited due to DTLS handshake timeout, peer
+	// closure, ctx cancellation, etc.), record peer as no-wrap so the
+	// maintain loop's next attempt goes raw within the TTL window.
+	defer func() {
+		if wrapActiveThisAttempt && wrapModeForAttempt == "preferred" && !anyWrapInboundSuccess.Load() {
+			markWrapDisabledForAddr(fallbackKey)
+			log.Printf("[STREAM %d] WRAP exit with no decoded inbound; disabling WRAP for peer %s", streamID, fallbackKey)
+		}
+	}()
+	if wrapActiveThisAttempt && wrapModeForAttempt == "preferred" {
+		go func() {
+			timer := time.NewTimer(wrapFallbackInboundTimeout)
+			defer timer.Stop()
+			select {
+			case <-turnctx.Done():
+				return
+			case <-timer.C:
+				if !anyWrapInboundSuccess.Load() {
+					markWrapDisabledForAddr(fallbackKey)
+					log.Printf(
+						"[STREAM %d] no WRAP-decoded inbound from peer %s in %s — disabling WRAP and reconnecting raw",
+						streamID, fallbackKey, wrapFallbackInboundTimeout,
+					)
+					turncancel()
+				}
+			}
+		}()
+	}
 	var addr atomic.Value
 	// Start read-loop on conn2 (output of DTLS)
 	go func() {
@@ -1654,7 +1712,16 @@ func oneTurnConnection(
 
 			addr.Store(addr1) // store peer
 
-			_, err1 = relayConn.WriteTo(buf[:n], peer)
+			payload := buf[:n]
+			if wrapCipher != nil {
+				sealed, sealErr := wrapCipher.Seal(payload)
+				if sealErr != nil {
+					log.Printf("[STREAM %d] WRAP seal failed: %s", streamID, sealErr)
+					return
+				}
+				payload = sealed
+			}
+			_, err1 = relayConn.WriteTo(payload, peer)
 			if err1 != nil {
 				if !shouldSuppressWorkerError(turnctx, err1) {
 					log.Printf("Failed: %s", err1)
@@ -1668,7 +1735,11 @@ func oneTurnConnection(
 	go func() {
 		defer wg.Done()
 		defer turncancel()
-		buf := make([]byte, 1600)
+		readBufLen := 1600
+		if wrapCipher != nil {
+			readBufLen += wrapCipher.Overhead()
+		}
+		buf := make([]byte, readBufLen)
 		for {
 			select {
 			case <-turnctx.Done():
@@ -1687,7 +1758,17 @@ func oneTurnConnection(
 				continue
 			}
 
-			_, err1 = conn2.WriteTo(buf[:n], addr1)
+			payload := buf[:n]
+			if wrapCipher != nil {
+				plain, openErr := wrapCipher.Open(payload)
+				if openErr != nil {
+					log.Printf("[STREAM %d] WRAP unwrap failed (%d bytes): %s", streamID, n, openErr)
+					continue
+				}
+				anyWrapInboundSuccess.Store(true)
+				payload = plain
+			}
+			_, err1 = conn2.WriteTo(payload, addr1)
 			if err1 != nil {
 				if !shouldSuppressWorkerError(turnctx, err1) {
 					log.Printf("Failed: %s", err1)
@@ -2016,6 +2097,10 @@ func main() { //nolint:cyclop
 		setStrategy := func(_ sessionproto.Mode, _ uint32, _ int) {}
 		return unifiedGetCreds, setStrategy
 	}
+	wrapCipherSel, wrapKey, wrapMode, err := resolveWrapConfig(opts.wrapMode, opts.wrapCipher, opts.wrapKeyHex)
+	if err != nil {
+		log.Panicf("WRAP config: %v", err)
+	}
 	params := &turnParams{
 		host:         opts.host,
 		port:         opts.port,
@@ -2024,6 +2109,9 @@ func main() { //nolint:cyclop
 		getCreds:     nil,
 		resolver:     peerResolver,
 		credsManager: vkLinkManager,
+		wrapCipher:   wrapCipherSel,
+		wrapKey:      wrapKey,
+		wrapMode:     wrapMode,
 	}
 	sessionID := []byte(nil)
 
@@ -2271,10 +2359,24 @@ func main() { //nolint:cyclop
 				false,
 			)
 			if !waitForReady(ctx, okchan, mainlineBootstrapTimeout) {
+				// If WRAP was attempted, the watchdog in each worker has
+				// by now marked the peer as no-wrap; pre-emptively mark
+				// it here too so any racing worker also goes raw. Give
+				// bootstrap one more shot before tearing the process
+				// down so Android does not enter a respawn loop that
+				// wipes the wrap-disabled cache each time.
+				if params.wrapMode == "preferred" {
+					markWrapDisabledForAddr(peer.String())
+					log.Printf("bootstrap timed out; forcing WRAP fallback for peer %s and retrying", peer.String())
+					if waitForReady(ctx, okchan, mainlineBootstrapTimeout) {
+						goto mainlineBootstrapDone
+					}
+				}
 				runtimeCancel()
 				runtimeWG.Wait()
 				log.Fatalf("failed to bootstrap mainline session")
 			}
+		mainlineBootstrapDone:
 
 			supportedVersion := waitForProbeVersion(ctx, probeResult, muProbeTimeout)
 			activeMainlineControl := waitForMainlineControlHandle(ctx, mainlineControl, muProbeTimeout)

client/options.go

@@ -50,6 +50,10 @@ type clientOptions struct {
 	roomExchangeDisplayName string
 	roomExchangeE2EEnabled  bool
 	roomExchangeE2ESecret   string
+
+	wrapMode   string // off|preferred|required (preferred ≡ required without negotiation in v1)
+	wrapCipher string // aes-ctr|chacha20-xor
+	wrapKeyHex string // 64-char hex (32 bytes); empty + mode!=off generates fresh key
 }
 
 func newClientFlagSet(program string, output io.Writer) (*flag.FlagSet, *clientOptions) {
@@ -93,6 +97,9 @@ func newClientFlagSet(program string, output io.Writer) (*flag.FlagSet, *clientO
 	fs.StringVar(&opts.roomExchangeDisplayName, "room-exchange-display-name", "", "display name delivered alongside the room id in the room-exchange handshake")
 	fs.BoolVar(&opts.roomExchangeE2EEnabled, "room-exchange-e2e-enabled", false, "advertise that wb-stream traffic will be E2E-encrypted")
 	fs.StringVar(&opts.roomExchangeE2ESecret, "room-exchange-e2e-secret", "", "optional base64-encoded E2E secret to share with the server")
+	fs.StringVar(&opts.wrapMode, "wrap-mode", "off", "WRAP per-packet obfuscation mode: off|preferred|required")
+	fs.StringVar(&opts.wrapCipher, "wrap-cipher", "aes-ctr", "WRAP cipher: aes-ctr|chacha20-xor")
+	fs.StringVar(&opts.wrapKeyHex, "wrap-key", "", "WRAP key (64-char hex, 32 bytes); empty + mode!=off generates a fresh key")
 	fs.Usage = func() {
 		cliutil.Fprintf(fs.Output(), "Usage:\n  %s -peer <host:port> -vk-link <link> [flags]\n  %s -peer <host:port> -yandex-link <link> [flags]\n\n", program, program)
 		cliutil.Fprintln(fs.Output(), "Examples:")
@@ -122,6 +129,19 @@ func parseClientOptions(args []string, program string, stdout, stderr io.Writer)
 		if opts.credsGroupSize < 1 {
 			opts.credsGroupSize = 1
 		}
+		opts.wrapMode = strings.ToLower(strings.TrimSpace(opts.wrapMode))
+		switch opts.wrapMode {
+		case "off", "preferred", "required":
+		default:
+			opts.wrapMode = "off"
+		}
+		opts.wrapCipher = strings.ToLower(strings.TrimSpace(opts.wrapCipher))
+		switch opts.wrapCipher {
+		case "aes-ctr", "chacha20-xor":
+		default:
+			opts.wrapCipher = "aes-ctr"
+		}
+		opts.wrapKeyHex = strings.TrimSpace(opts.wrapKeyHex)
 
 		opts.wbStreamRoomID = strings.TrimSpace(opts.wbStreamRoomID)
 		opts.wbStreamRoomIDs = strings.TrimSpace(opts.wbStreamRoomIDs)

client/wrap_config.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"log"
+
+	"github.com/cacggghp/vk-turn-proxy/internal/wrap"
+	"github.com/cacggghp/vk-turn-proxy/sessionproto"
+)
+
+// resolveWrapConfig validates and normalizes the WRAP CLI options into a
+// (cipher, key, mode) triple consumable by turnParams. Returns NONE/nil
+// when mode is "off". Generates a random key if mode is enabled and key
+// is empty.
+func resolveWrapConfig(mode, cipherStr, keyHex string) (sessionproto.WrapCipher, []byte, string, error) {
+	if mode == "off" || mode == "" {
+		return sessionproto.WrapCipher_WRAP_CIPHER_NONE, nil, "off", nil
+	}
+
+	var selected sessionproto.WrapCipher
+	switch cipherStr {
+	case "aes-ctr":
+		selected = sessionproto.WrapCipher_WRAP_CIPHER_AES_256_CTR
+	case "chacha20-xor":
+		selected = sessionproto.WrapCipher_WRAP_CIPHER_CHACHA20_XOR
+	default:
+		return 0, nil, "", fmt.Errorf("unsupported -wrap-cipher %q", cipherStr)
+	}
+
+	var key []byte
+	if keyHex == "" {
+		gen := make([]byte, wrap.KeyLen)
+		if _, err := rand.Read(gen); err != nil {
+			return 0, nil, "", fmt.Errorf("WRAP key generation: %w", err)
+		}
+		key = gen
+		log.Printf("WRAP: auto-generated key (set -wrap-key=%s on both ends to fix it)", hex.EncodeToString(key))
+	} else {
+		decoded, err := hex.DecodeString(keyHex)
+		if err != nil {
+			return 0, nil, "", fmt.Errorf("-wrap-key invalid hex: %w", err)
+		}
+		if len(decoded) != wrap.KeyLen {
+			return 0, nil, "", fmt.Errorf("-wrap-key must decode to %d bytes (got %d)", wrap.KeyLen, len(decoded))
+		}
+		key = decoded
+	}
+	return selected, key, mode, nil
+}

client/wrap_fallback.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"sync"
+	"time"
+)
+
+// Client-side WRAP fallback heuristic.
+//
+// WRAP wraps every datagram travelling between client and TURN relay
+// endpoint. DTLS handshake runs on top of (un)wrapped bytes, so a server
+// that does not speak WRAP simply cannot parse our wrapped ClientHello
+// and silently drops it — there is no in-band way to "downgrade" mid-DTLS.
+//
+// For mode "preferred" we therefore implement a heuristic: spawn a
+// watchdog when WRAP is active. If no datagram from the TURN relay is
+// successfully unwrapped within wrapFallbackInboundTimeout, mark the
+// server address as "WRAP unsupported" for wrapFallbackAddrTTL and tear
+// the worker down. The maintain loop reconnects and the next attempt
+// (within the TTL window) skips WRAP for that address.
+
+const (
+	// 5s gives DTLS time for ~3 retransmits (1s, 2s, 4s) — long enough to
+	// be sure the peer is not replying, short enough that two attempts
+	// (WRAP then raw) comfortably fit inside the 30s mainline bootstrap
+	// budget even when TURN allocate is slow.
+	wrapFallbackInboundTimeout = 5 * time.Second
+	wrapFallbackAddrTTL        = 5 * time.Minute
+)
+
+var wrapDisabledAddrs sync.Map // map[string]time.Time
+
+func wrapDisabledForAddr(addr string) bool {
+	v, ok := wrapDisabledAddrs.Load(addr)
+	if !ok {
+		return false
+	}
+	at, ok := v.(time.Time)
+	if !ok || time.Since(at) > wrapFallbackAddrTTL {
+		wrapDisabledAddrs.Delete(addr)
+		return false
+	}
+	return true
+}
+
+func markWrapDisabledForAddr(addr string) {
+	if addr == "" {
+		return
+	}
+	wrapDisabledAddrs.Store(addr, time.Now())
+}

internal/wrap/conn.go

@@ -3,6 +3,8 @@ package wrap
 import (
 	"log"
 	"net"
+
+	dtlsnet "github.com/pion/dtls/v3/pkg/net"
 )
 
 // readBufSize bounds how much we read from the underlying conn per packet.
@@ -61,3 +63,31 @@ func (w *wrappedConn) WriteTo(p []byte, addr net.Addr) (int, error) {
 	}
 	return len(p), nil
 }
+
+// PacketListener wraps a dtls.PacketListener so every accepted connection has
+// the supplied Cipher applied to its reads/writes.
+//
+// Returning the inner listener verbatim when cipher is nil keeps call-sites
+// symmetric for the "no obfuscation negotiated" path.
+func PacketListener(inner dtlsnet.PacketListener, c Cipher) dtlsnet.PacketListener {
+	if c == nil {
+		return inner
+	}
+	return &wrappedListener{inner: inner, cipher: c}
+}
+
+type wrappedListener struct {
+	inner  dtlsnet.PacketListener
+	cipher Cipher
+}
+
+func (l *wrappedListener) Accept() (net.PacketConn, net.Addr, error) {
+	pc, addr, err := l.inner.Accept()
+	if err != nil {
+		return pc, addr, err
+	}
+	return PacketConn(pc, l.cipher), addr, nil
+}
+
+func (l *wrappedListener) Close() error   { return l.inner.Close() }
+func (l *wrappedListener) Addr() net.Addr { return l.inner.Addr() }

internal/wrap/conn_test.go

@@ -37,14 +37,14 @@ func TestPacketConnRoundTrip(t *testing.T) {
 	ws := PacketConn(server, serverCipher)
 
 	payload := []byte("vk-turn obfuscation packet conn round-trip — should arrive intact")
-	if err := wc.SetWriteDeadline(time.Now().Add(2 * time.Second)); err != nil {
+	if err = wc.SetWriteDeadline(time.Now().Add(2 * time.Second)); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := wc.WriteTo(payload, server.LocalAddr()); err != nil {
+	if _, err = wc.WriteTo(payload, server.LocalAddr()); err != nil {
 		t.Fatalf("WriteTo: %v", err)
 	}
 
-	if err := ws.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
+	if err = ws.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
 		t.Fatal(err)
 	}
 	buf := make([]byte, 4096)