Merge main into update-sing-box-minimal

Resolve e2e.yaml conflicts by taking main's version which includes
all tested fixes from PRs #124-#126.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: myleshorton

.github/workflows/e2e.yaml

@@ -2,6 +2,12 @@ name: E2E Protocol Tests
 
 on:
   workflow_dispatch:
+  pull_request:
+    branches: [main]
+    paths-ignore:
+      - '.github/workflows/**'
+      - '*.md'
+      - 'LICENSE'
 
 env:
   DROPLET_NAME: "e2e-lantern-box-${{ github.run_id }}"
@@ -10,6 +16,7 @@ env:
 jobs:
   e2e:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 
@@ -24,20 +31,22 @@ jobs:
 
       - name: Build lantern-box (linux/amd64)
         run: |
-          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
+          CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build \
             -tags "with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api" \
+            -ldflags="-s -w" \
             -o lantern-box \
             ./cmd
+          ls -lh lantern-box
 
       - name: Generate test credentials
         id: creds
         run: |
           # Samizdat X25519 keypair
           openssl genpkey -algorithm X25519 -out samizdat_priv.pem
-          SAMIZDAT_PRIV=$(openssl pkey -in samizdat_priv.pem -text 2>/dev/null \
-            | grep -A2 'priv:' | tail -n+2 | tr -d ' :\n')
-          SAMIZDAT_PUB=$(openssl pkey -in samizdat_priv.pem -pubout -text 2>/dev/null \
-            | grep -A2 'pub:' | tail -n+2 | tr -d ' :\n')
+          SAMIZDAT_PRIV=$(openssl pkey -in samizdat_priv.pem -outform DER \
+            | tail -c 32 | xxd -p | tr -d '\n')
+          SAMIZDAT_PUB=$(openssl pkey -in samizdat_priv.pem -pubout -outform DER \
+            | tail -c 32 | xxd -p | tr -d '\n')
           SAMIZDAT_SHORT_ID=$(openssl rand -hex 8)
 
           # Self-signed TLS cert for Samizdat
@@ -47,16 +56,17 @@ jobs:
 
           # Locate plain.wasm from Go module cache
           WATER_MOD_DIR="$(go env GOPATH)/pkg/mod/github.com/refraction-networking/water@v0.7.1-alpha"
-          WASM_PATH="${WATER_MOD_DIR}/transport/v0/testdata/plain.wasm"
+          WASM_PATH="${WATER_MOD_DIR}/transport/v1/testdata/plain.wasm"
           if [ ! -f "$WASM_PATH" ]; then
             echo "plain.wasm not found at $WASM_PATH, downloading module..."
             go mod download github.com/refraction-networking/water@v0.7.1-alpha
             WATER_MOD_DIR="$(go env GOPATH)/pkg/mod/github.com/refraction-networking/water@v0.7.1-alpha"
-            WASM_PATH="${WATER_MOD_DIR}/transport/v0/testdata/plain.wasm"
+            WASM_PATH="${WATER_MOD_DIR}/transport/v1/testdata/plain.wasm"
           fi
           WASM_HASH=$(sha256sum "$WASM_PATH" | awk '{print $1}')
           cp "$WASM_PATH" plain.wasm
 
+          echo "::add-mask::$SAMIZDAT_PRIV"
           echo "samizdat_priv=$SAMIZDAT_PRIV" >> "$GITHUB_OUTPUT"
           echo "samizdat_pub=$SAMIZDAT_PUB" >> "$GITHUB_OUTPUT"
           echo "samizdat_short_id=$SAMIZDAT_SHORT_ID" >> "$GITHUB_OUTPUT"
@@ -82,7 +92,7 @@ jobs:
           # Create droplet
           DROPLET_ID=$(doctl compute droplet create "$DROPLET_NAME" \
             --image ubuntu-24-04-x64 \
-            --size s-1vcpu-1gb \
+            --size s-2vcpu-2gb \
             --region nyc3 \
             --ssh-keys "$SSH_KEY_ID" \
             --wait \
@@ -97,15 +107,21 @@ jobs:
           echo "Droplet $DROPLET_ID created at $DROPLET_IP"
 
           # Wait for SSH readiness
+          SSH_READY=0
           for i in $(seq 1 30); do
             if ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
               -i e2e_key root@"$DROPLET_IP" echo ready 2>/dev/null; then
               echo "SSH is ready"
+              SSH_READY=1
               break
             fi
             echo "Waiting for SSH... attempt $i/30"
             sleep 10
           done
+          if [ "$SSH_READY" -ne 1 ]; then
+            echo "ERROR: SSH never became ready after 30 attempts"
+            exit 1
+          fi
 
       - name: Deploy to droplet
         env:
@@ -114,22 +130,33 @@ jobs:
           SAMIZDAT_SHORT_ID: ${{ steps.creds.outputs.samizdat_short_id }}
           WASM_HASH: ${{ steps.creds.outputs.wasm_hash }}
         run: |
-          SSH_OPTS="-o StrictHostKeyChecking=no -i e2e_key"
+          SSH_OPTS="-o StrictHostKeyChecking=no -o ServerAliveInterval=30 -i e2e_key"
+
+          # Compress binary before upload
+          gzip -1 -c lantern-box > lantern-box.gz
+          ls -lh lantern-box.gz
 
           # Upload files
-          scp $SSH_OPTS lantern-box cert.pem key.pem plain.wasm root@"$DROPLET_IP":/root/
+          echo "Starting SCP upload..."
+          scp $SSH_OPTS lantern-box.gz cert.pem key.pem plain.wasm root@"$DROPLET_IP":/root/
+          echo "SCP upload complete"
 
-          # Make binary executable
-          ssh $SSH_OPTS root@"$DROPLET_IP" chmod +x /root/lantern-box
+          # Decompress and make binary executable
+          echo "Decompressing binary..."
+          ssh $SSH_OPTS root@"$DROPLET_IP" \
+            "gzip -d /root/lantern-box.gz && chmod +x /root/lantern-box"
+          echo "Binary ready"
 
           # Start Python HTTP server to serve plain.wasm (for WATER)
-          ssh $SSH_OPTS root@"$DROPLET_IP" \
-            "cd /root && nohup python3 -m http.server 8888 > /root/wasm-server.log 2>&1 &"
+          echo "Starting WASM HTTP server..."
+          ssh -f $SSH_OPTS root@"$DROPLET_IP" \
+            "cd /root && python3 -m http.server 8888 > /root/wasm-server.log 2>&1"
+          echo "WASM HTTP server started"
 
           # --- ALGeneva server config ---
           cat > /tmp/algeneva-server.json << 'JSONEOF'
           {
-            "log": {"level": "debug"},
+            "log": {"level": "trace"},
             "inbounds": [{
               "type": "algeneva",
               "tag": "algeneva-in",
@@ -178,7 +205,8 @@ jobs:
               "listen_port": 9003,
               "transport": "plain",
               "hashsum": "${WASM_HASH}",
-              "wasm_available_at": ["http://127.0.0.1:8888/plain.wasm"]
+              "wasm_available_at": ["http://127.0.0.1:8888/plain.wasm"],
+              "config": {}
             }],
             "outbounds": [{
               "type": "direct",
@@ -189,26 +217,45 @@ jobs:
           scp $SSH_OPTS /tmp/water-server.json root@"$DROPLET_IP":/root/water-server.json
 
           # Start all 3 server processes
-          ssh $SSH_OPTS root@"$DROPLET_IP" \
-            "nohup /root/lantern-box run --config /root/algeneva-server.json > /root/algeneva-server.log 2>&1 &
-             nohup /root/lantern-box run --config /root/samizdat-server.json > /root/samizdat-server.log 2>&1 &
-             nohup /root/lantern-box run --config /root/water-server.json > /root/water-server.log 2>&1 &"
-
-          # Wait for servers to start
-          sleep 5
-
-          # Verify server processes are running
-          ssh $SSH_OPTS root@"$DROPLET_IP" \
-            "pgrep -f 'lantern-box run' || (echo 'No lantern-box processes found!' && cat /root/*.log && exit 1)"
+          echo "Starting servers..."
+          ssh $SSH_OPTS root@"$DROPLET_IP" "nohup /root/lantern-box run --config /root/algeneva-server.json > /root/algeneva-server.log 2>&1 < /dev/null &
+          nohup /root/lantern-box run --config /root/samizdat-server.json > /root/samizdat-server.log 2>&1 < /dev/null &
+          nohup /root/lantern-box run --config /root/water-server.json > /root/water-server.log 2>&1 < /dev/null &
+          sleep 1"
+          echo "Servers launched"
+
+          # Wait for servers to be ready (WATER needs time to download/compile WASM)
+          echo "Checking port readiness..."
+          # Note: must use bash explicitly since Ubuntu default shell is dash (no /dev/tcp support)
+          ssh $SSH_OPTS root@"$DROPLET_IP" bash << 'READYEOF'
+            for port in 9001 9002 9003; do
+              echo "Waiting for port $port to be ready..."
+              for i in $(seq 1 60); do
+                if echo > /dev/tcp/127.0.0.1/$port 2>/dev/null; then
+                  echo "Port $port is ready"
+                  break
+                fi
+                if [ "$i" -eq 60 ]; then
+                  echo "Port $port not ready after 60 seconds" >&2
+                  cat /root/*.log
+                  exit 1
+                fi
+                sleep 1
+              done
+            done
+          READYEOF
 
       - name: Test ALGeneva
+        id: test_algeneva
+        continue-on-error: true
         env:
           DROPLET_IP: ${{ steps.droplet.outputs.droplet_ip }}
         run: |
           # Generate client config
+          # Use a simple strategy that only modifies the host header (not the CONNECT request line)
           cat > /tmp/algeneva-client.json << JSONEOF
           {
-            "log": {"level": "debug"},
+            "log": {"level": "trace"},
             "inbounds": [{
               "type": "mixed",
               "tag": "mixed-in",
@@ -220,7 +267,7 @@ jobs:
               "tag": "algeneva-out",
               "server": "${DROPLET_IP}",
               "server_port": 9001,
-              "strategy": "[HTTP:method:*]-insert{%0A:end:value:2}-|"
+              "strategy": "[HTTP:host:*]-changecase{lower}-|"
             }]
           }
           JSONEOF
@@ -238,11 +285,14 @@ jobs:
           fi
 
           # Test
+          set +e
           RESPONSE=$(curl -sf -x socks5h://127.0.0.1:1081 -m 30 http://example.com)
+          CURL_EXIT=$?
+          set -e
           if echo "$RESPONSE" | grep -q "Example Domain"; then
             echo "ALGeneva test PASSED"
           else
-            echo "ALGeneva test FAILED"
+            echo "ALGeneva test FAILED (curl exit code: $CURL_EXIT)"
             echo "Response: $RESPONSE"
             cat /tmp/algeneva-client.log
             kill $CLIENT_PID 2>/dev/null || true
@@ -252,6 +302,8 @@ jobs:
           kill $CLIENT_PID 2>/dev/null || true
 
       - name: Test Samizdat
+        id: test_samizdat
+        continue-on-error: true
         env:
           DROPLET_IP: ${{ steps.droplet.outputs.droplet_ip }}
           SAMIZDAT_PUB: ${{ steps.creds.outputs.samizdat_pub }}
@@ -288,11 +340,14 @@ jobs:
             exit 1
           fi
 
+          set +e
           RESPONSE=$(curl -sf -x socks5h://127.0.0.1:1082 -m 30 http://example.com)
+          CURL_EXIT=$?
+          set -e
           if echo "$RESPONSE" | grep -q "Example Domain"; then
             echo "Samizdat test PASSED"
           else
-            echo "Samizdat test FAILED"
+            echo "Samizdat test FAILED (curl exit code: $CURL_EXIT)"
             echo "Response: $RESPONSE"
             cat /tmp/samizdat-client.log
             kill $CLIENT_PID 2>/dev/null || true
@@ -302,6 +357,8 @@ jobs:
           kill $CLIENT_PID 2>/dev/null || true
 
       - name: Test WATER
+        id: test_water
+        continue-on-error: true
         env:
           DROPLET_IP: ${{ steps.droplet.outputs.droplet_ip }}
           WASM_HASH: ${{ steps.creds.outputs.wasm_hash }}
@@ -324,7 +381,8 @@ jobs:
               "hashsum": "${WASM_HASH}",
               "wasm_available_at": ["http://${DROPLET_IP}:8888/plain.wasm"],
               "download_timeout": "60s",
-              "water_dir": "/tmp/water"
+              "water_dir": "/tmp/water",
+              "config": {}
             }]
           }
           JSONEOF
@@ -339,11 +397,14 @@ jobs:
             exit 1
           fi
 
+          set +e
           RESPONSE=$(curl -sf -x socks5h://127.0.0.1:1083 -m 30 http://example.com)
+          CURL_EXIT=$?
+          set -e
           if echo "$RESPONSE" | grep -q "Example Domain"; then
             echo "WATER test PASSED"
           else
-            echo "WATER test FAILED"
+            echo "WATER test FAILED (curl exit code: $CURL_EXIT)"
             echo "Response: $RESPONSE"
             cat /tmp/water-client.log
             kill $CLIENT_PID 2>/dev/null || true
@@ -352,6 +413,35 @@ jobs:
 
           kill $CLIENT_PID 2>/dev/null || true
 
+      - name: Check test results
+        if: always()
+        run: |
+          FAILED=0
+          echo "=== E2E Test Results ==="
+          if [ "${{ steps.test_algeneva.outcome }}" = "success" ]; then
+            echo "ALGeneva:  PASSED"
+          else
+            echo "ALGeneva:  FAILED"
+            FAILED=1
+          fi
+          if [ "${{ steps.test_samizdat.outcome }}" = "success" ]; then
+            echo "Samizdat:  PASSED"
+          else
+            echo "Samizdat:  FAILED"
+            FAILED=1
+          fi
+          if [ "${{ steps.test_water.outcome }}" = "success" ]; then
+            echo "WATER:     PASSED"
+          else
+            echo "WATER:     FAILED"
+            FAILED=1
+          fi
+          echo "========================"
+          if [ "$FAILED" -ne 0 ]; then
+            echo "One or more tests failed"
+            exit 1
+          fi
+
       - name: Collect server logs
         if: always()
         env:
@@ -375,16 +465,32 @@ jobs:
 
       - name: Cleanup DO resources
         if: always()
+        env:
+          DO_API_TOKEN: ${{ secrets.DO_API_TOKEN }}
         run: |
           DROPLET_ID="${{ steps.droplet.outputs.droplet_id }}"
           SSH_KEY_ID="${{ steps.droplet.outputs.ssh_key_id }}"
 
-          if [ -n "$DROPLET_ID" ]; then
-            echo "Destroying droplet $DROPLET_ID..."
-            doctl compute droplet delete "$DROPLET_ID" --force || true
-          fi
-
-          if [ -n "$SSH_KEY_ID" ]; then
-            echo "Deleting SSH key $SSH_KEY_ID..."
-            doctl compute ssh-key delete "$SSH_KEY_ID" --force || true
+          # Fall back to DO API directly if doctl is not available
+          if command -v doctl &>/dev/null; then
+            if [ -n "$DROPLET_ID" ]; then
+              echo "Destroying droplet $DROPLET_ID..."
+              doctl compute droplet delete "$DROPLET_ID" --force || true
+            fi
+            if [ -n "$SSH_KEY_ID" ]; then
+              echo "Deleting SSH key $SSH_KEY_ID..."
+              doctl compute ssh-key delete "$SSH_KEY_ID" --force || true
+            fi
+          else
+            echo "doctl not available, using DO API directly"
+            if [ -n "$DROPLET_ID" ]; then
+              echo "Destroying droplet $DROPLET_ID..."
+              curl -sf -X DELETE "https://api.digitalocean.com/v2/droplets/$DROPLET_ID" \
+                -H "Authorization: Bearer $DO_API_TOKEN" || true
+            fi
+            if [ -n "$SSH_KEY_ID" ]; then
+              echo "Deleting SSH key $SSH_KEY_ID..."
+              curl -sf -X DELETE "https://api.digitalocean.com/v2/account/keys/$SSH_KEY_ID" \
+                -H "Authorization: Bearer $DO_API_TOKEN" || true
+            fi
           fi