Add WireGuard over Shadowsocks

android/lib/daemon-grpc/src/main/kotlin/net/mullvad/mullvadvpn/lib/daemon/grpc/mapper/ToDomain.kt

@@ -166,11 +166,13 @@ internal fun ManagementInterface.ObfuscationEndpoint.toDomain(): ObfuscationEndp
         obfuscationType = obfuscationType.toDomain()
     )
 
-internal fun ManagementInterface.ObfuscationType.toDomain(): ObfuscationType =
+internal fun ManagementInterface.ObfuscationEndpoint.ObfuscationType.toDomain(): ObfuscationType =
     when (this) {
-        ManagementInterface.ObfuscationType.UDP2TCP -> ObfuscationType.Udp2Tcp
-        ManagementInterface.ObfuscationType.UNRECOGNIZED ->
+        ManagementInterface.ObfuscationEndpoint.ObfuscationType.UDP2TCP -> ObfuscationType.Udp2Tcp
+        ManagementInterface.ObfuscationEndpoint.ObfuscationType.UNRECOGNIZED ->
             throw IllegalArgumentException("Unrecognized obfuscation type")
+        ManagementInterface.ObfuscationEndpoint.ObfuscationType.SHADOWSOCKS ->
+            throw IllegalArgumentException("Shadowsocks is unsupported")
     }
 
 internal fun ManagementInterface.TransportProtocol.toDomain(): TransportProtocol =
@@ -340,6 +342,8 @@ internal fun ManagementInterface.ObfuscationSettings.SelectedObfuscation.toDomai
         ManagementInterface.ObfuscationSettings.SelectedObfuscation.OFF -> SelectedObfuscation.Off
         ManagementInterface.ObfuscationSettings.SelectedObfuscation.UDP2TCP ->
             SelectedObfuscation.Udp2Tcp
+        ManagementInterface.ObfuscationSettings.SelectedObfuscation.SHADOWSOCKS ->
+            throw IllegalArgumentException("Shadowsocks is unsupported")
         ManagementInterface.ObfuscationSettings.SelectedObfuscation.UNRECOGNIZED ->
             throw IllegalArgumentException("Unrecognized selected obfuscation")
     }

android/lib/model/src/main/kotlin/net/mullvad/mullvadvpn/lib/model/ObfuscationType.kt

@@ -1,5 +1,6 @@
 package net.mullvad.mullvadvpn.lib.model
 
 enum class ObfuscationType {
-    Udp2Tcp
+    Udp2Tcp,
+    Shadowsocks
 }

gui/src/main/daemon-rpc.ts

@@ -29,7 +29,6 @@ import {
   DeviceEvent,
   DeviceState,
   DirectMethod,
-  EndpointObfuscationType,
   ErrorState,
   ErrorStateCause,
   FirewallPolicyError,
@@ -403,6 +402,8 @@ export class DaemonRpc {
       grpcObfuscationSettings.setUdp2tcp(grpcUdp2tcpSettings);
     }
 
+    grpcObfuscationSettings.setShadowsocks(new grpcTypes.ShadowsocksSettings());
+
     await this.call<grpcTypes.ObfuscationSettings, Empty>(
       this.client.setObfuscationSettings,
       grpcObfuscationSettings,
@@ -1136,9 +1137,9 @@ function convertFromTunnelType(tunnelType: grpcTypes.TunnelType): TunnelType {
 }
 
 function convertFromProxyEndpoint(proxyEndpoint: grpcTypes.ProxyEndpoint.AsObject): IProxyEndpoint {
-  const proxyTypeMap: Record<grpcTypes.ProxyType, ProxyType> = {
-    [grpcTypes.ProxyType.CUSTOM]: 'custom',
-    [grpcTypes.ProxyType.SHADOWSOCKS]: 'shadowsocks',
+  const proxyTypeMap: Record<grpcTypes.ProxyEndpoint.ProxyType, ProxyType> = {
+    [grpcTypes.ProxyEndpoint.ProxyType.CUSTOM]: 'custom',
+    [grpcTypes.ProxyEndpoint.ProxyType.SHADOWSOCKS]: 'shadowsocks',
   };
 
   return {
@@ -1151,14 +1152,17 @@ function convertFromProxyEndpoint(proxyEndpoint: grpcTypes.ProxyEndpoint.AsObjec
 function convertFromObfuscationEndpoint(
   obfuscationEndpoint: grpcTypes.ObfuscationEndpoint.AsObject,
 ): IObfuscationEndpoint {
-  const obfuscationTypes: Record<grpcTypes.ObfuscationType, EndpointObfuscationType> = {
-    [grpcTypes.ObfuscationType.UDP2TCP]: 'udp2tcp',
-  };
+  // TODO: Handle Shadowsocks (and other implemented protocols)
+  if (
+    obfuscationEndpoint.obfuscationType !== grpcTypes.ObfuscationEndpoint.ObfuscationType.UDP2TCP
+  ) {
+    throw new Error('unsupported obfuscation protocol');
+  }
 
   return {
     ...obfuscationEndpoint,
     protocol: convertFromTransportProtocol(obfuscationEndpoint.protocol),
-    obfuscationType: obfuscationTypes[obfuscationEndpoint.obfuscationType],
+    obfuscationType: 'udp2tcp',
   };
 }
 

mullvad-api/src/relay_list.rs

@@ -9,7 +9,8 @@ use talpid_types::net::wireguard;
 use std::{
     collections::BTreeMap,
     future::Future,
-    net::{Ipv4Addr, Ipv6Addr},
+    net::{IpAddr, Ipv4Addr, Ipv6Addr},
+    ops::RangeInclusive,
     time::Duration,
 };
 
@@ -244,20 +245,37 @@ struct Wireguard {
     port_ranges: Vec<(u16, u16)>,
     ipv4_gateway: Ipv4Addr,
     ipv6_gateway: Ipv6Addr,
+    /// Shadowsocks port ranges available on all WireGuard relays
+    #[serde(default)]
+    shadowsocks_port_ranges: Vec<(u16, u16)>,
     relays: Vec<WireGuardRelay>,
 }
 
 impl From<&Wireguard> for relay_list::WireguardEndpointData {
     fn from(wg: &Wireguard) -> Self {
         Self {
-            port_ranges: wg.port_ranges.clone(),
+            port_ranges: inclusive_range_from_pair_set(wg.port_ranges.clone()).collect(),
             ipv4_gateway: wg.ipv4_gateway,
             ipv6_gateway: wg.ipv6_gateway,
+            shadowsocks_port_ranges: inclusive_range_from_pair_set(
+                wg.shadowsocks_port_ranges.clone(),
+            )
+            .collect(),
             udp2tcp_ports: vec![],
         }
     }
 }
 
+fn inclusive_range_from_pair_set<T>(
+    set: impl IntoIterator<Item = (T, T)>,
+) -> impl Iterator<Item = RangeInclusive<T>> {
+    set.into_iter().map(inclusive_range_from_pair)
+}
+
+fn inclusive_range_from_pair<T>(pair: (T, T)) -> RangeInclusive<T> {
+    RangeInclusive::new(pair.0, pair.1)
+}
+
 impl Wireguard {
     /// Consumes `self` and appends all its relays to `countries`.
     fn extract_relays(
@@ -305,6 +323,8 @@ struct WireGuardRelay {
     public_key: wireguard::PublicKey,
     #[serde(default)]
     daita: bool,
+    #[serde(default)]
+    shadowsocks_extra_addr_in: Vec<IpAddr>,
 }
 
 impl WireGuardRelay {
@@ -315,6 +335,7 @@ impl WireGuardRelay {
             relay_list::RelayEndpointData::Wireguard(relay_list::WireguardRelayEndpointData {
                 public_key: self.public_key,
                 daita: self.daita,
+                shadowsocks_extra_addr_in: self.shadowsocks_extra_addr_in,
             }),
         )
     }

mullvad-cli/src/cmds/relay.rs

@@ -669,7 +669,7 @@ impl Relay {
                     let is_valid_port = wireguard
                         .port_ranges
                         .into_iter()
-                        .any(|(first, last)| first <= specific_port && specific_port <= last);
+                        .any(|range| range.contains(&specific_port));
                     if !is_valid_port {
                         return Err(anyhow!("The specified port is invalid"));
                     }

mullvad-daemon/src/lib.rs

@@ -2931,6 +2931,13 @@ impl Daemon {
                     .as_ref()
                     .filter(|obfuscation| obfuscation.obfuscation_type == ObfuscationType::Udp2Tcp)
                     .is_some();
+                let shadowsocks = endpoint
+                    .obfuscation
+                    .as_ref()
+                    .filter(|obfuscation| {
+                        obfuscation.obfuscation_type == ObfuscationType::Shadowsocks
+                    })
+                    .is_some();
 
                 let mtu = settings.tunnel_options.wireguard.mtu.is_some();
 
@@ -2941,6 +2948,7 @@ impl Daemon {
                     (quantum_resistant, FeatureIndicator::QuantumResistance),
                     (multihop, FeatureIndicator::Multihop),
                     (udp_tcp, FeatureIndicator::Udp2Tcp),
+                    (shadowsocks, FeatureIndicator::Shadowsocks),
                     (mtu, FeatureIndicator::CustomMtu),
                     #[cfg(daita)]
                     (daita, FeatureIndicator::Daita),

mullvad-daemon/src/logging.rs

@@ -47,6 +47,7 @@ pub const SILENCED_CRATES: &[&str] = &[
     "hickory_proto",
     "hickory_server",
     "hickory_resolver",
+    "shadowsocks::relay::udprelay",
 ];
 const SLIGHTLY_SILENCED_CRATES: &[&str] = &["mnl", "nftnl", "udp_over_tcp"];
 

mullvad-management-interface/proto/management_interface.proto

@@ -254,37 +254,39 @@ enum FeatureIndicator {
   SPLIT_TUNNELING = 3;
   LOCKDOWN_MODE = 4;
   UDP_2_TCP = 5;
-  LAN_SHARING = 6;
-  DNS_CONTENT_BLOCKERS = 7;
-  CUSTOM_DNS = 8;
-  SERVER_IP_OVERRIDE = 9;
-  CUSTOM_MTU = 10;
-  CUSTOM_MSS_FIX = 11;
-  DAITA = 12;
-}
-
-enum ObfuscationType {
-  UDP2TCP = 0;
+  SHADOWSOCKS = 6;
+  LAN_SHARING = 7;
+  DNS_CONTENT_BLOCKERS = 8;
+  CUSTOM_DNS = 9;
+  SERVER_IP_OVERRIDE = 10;
+  CUSTOM_MTU = 11;
+  CUSTOM_MSS_FIX = 12;
+  DAITA = 13;
 }
 
 message ObfuscationEndpoint {
+  enum ObfuscationType {
+    UDP2TCP = 0;
+    SHADOWSOCKS = 1;
+  }
+
   string address = 1;
   uint32 port = 2;
   TransportProtocol protocol = 3;
   ObfuscationType obfuscation_type = 4;
 }
 
-enum ProxyType {
-  SHADOWSOCKS = 0;
-  CUSTOM = 1;
-}
-
 message Endpoint {
   string address = 1;
   TransportProtocol protocol = 2;
 }
 
 message ProxyEndpoint {
+  enum ProxyType {
+    SHADOWSOCKS = 0;
+    CUSTOM = 1;
+  }
+
   string address = 1;
   TransportProtocol protocol = 2;
   ProxyType proxy_type = 3;
@@ -352,14 +354,18 @@ message BridgeState {
 
 message Udp2TcpObfuscationSettings { optional uint32 port = 1; }
 
+message ShadowsocksSettings { optional uint32 port = 1; }
+
 message ObfuscationSettings {
   enum SelectedObfuscation {
     AUTO = 0;
     OFF = 1;
     UDP2TCP = 2;
+    SHADOWSOCKS = 3;
   }
   SelectedObfuscation selected_obfuscation = 1;
   Udp2TcpObfuscationSettings udp2tcp = 2;
+  ShadowsocksSettings shadowsocks = 3;
 }
 
 message CustomList {
@@ -631,6 +637,7 @@ message Relay {
 message WireguardRelayEndpointData {
   bytes public_key = 1;
   bool daita = 2;
+  repeated string shadowsocks_extra_addr_in = 3;
 }
 
 message Location {
@@ -686,7 +693,8 @@ message WireguardEndpointData {
   repeated PortRange port_ranges = 1;
   string ipv4_gateway = 2;
   string ipv6_gateway = 3;
-  repeated uint32 udp2tcp_ports = 4;
+  repeated PortRange shadowsocks_port_ranges = 4;
+  repeated uint32 udp2tcp_ports = 5;
 }
 
 message PortRange {

mullvad-management-interface/src/types/conversions/features.rs

@@ -10,6 +10,7 @@ impl From<mullvad_types::features::FeatureIndicator> for proto::FeatureIndicator
             mullvad_types::features::FeatureIndicator::SplitTunneling => SplitTunneling,
             mullvad_types::features::FeatureIndicator::LockdownMode => LockdownMode,
             mullvad_types::features::FeatureIndicator::Udp2Tcp => Udp2Tcp,
+            mullvad_types::features::FeatureIndicator::Shadowsocks => Shadowsocks,
             mullvad_types::features::FeatureIndicator::LanSharing => LanSharing,
             mullvad_types::features::FeatureIndicator::DnsContentBlockers => DnsContentBlockers,
             mullvad_types::features::FeatureIndicator::CustomDns => CustomDns,
@@ -30,6 +31,7 @@ impl From<proto::FeatureIndicator> for mullvad_types::features::FeatureIndicator
             proto::FeatureIndicator::SplitTunneling => Self::SplitTunneling,
             proto::FeatureIndicator::LockdownMode => Self::LockdownMode,
             proto::FeatureIndicator::Udp2Tcp => Self::Udp2Tcp,
+            proto::FeatureIndicator::Shadowsocks => Self::Shadowsocks,
             proto::FeatureIndicator::LanSharing => Self::LanSharing,
             proto::FeatureIndicator::DnsContentBlockers => Self::DnsContentBlockers,
             proto::FeatureIndicator::CustomDns => Self::CustomDns,

mullvad-management-interface/src/types/conversions/net.rs

@@ -17,8 +17,12 @@ impl From<talpid_types::net::TunnelEndpoint> for proto::TunnelEndpoint {
                 address: proxy_ep.endpoint.address.to_string(),
                 protocol: i32::from(proto::TransportProtocol::from(proxy_ep.endpoint.protocol)),
                 proxy_type: match proxy_ep.proxy_type {
-                    net::proxy::ProxyType::Shadowsocks => i32::from(proto::ProxyType::Shadowsocks),
-                    net::proxy::ProxyType::Custom => i32::from(proto::ProxyType::Custom),
+                    net::proxy::ProxyType::Shadowsocks => {
+                        i32::from(proto::proxy_endpoint::ProxyType::Shadowsocks)
+                    }
+                    net::proxy::ProxyType::Custom => {
+                        i32::from(proto::proxy_endpoint::ProxyType::Custom)
+                    }
                 },
             }),
             obfuscation: endpoint.obfuscation.map(|obfuscation_endpoint| {
@@ -29,7 +33,12 @@ impl From<talpid_types::net::TunnelEndpoint> for proto::TunnelEndpoint {
                         obfuscation_endpoint.endpoint.protocol,
                     )),
                     obfuscation_type: match obfuscation_endpoint.obfuscation_type {
-                        net::ObfuscationType::Udp2Tcp => i32::from(proto::ObfuscationType::Udp2tcp),
+                        net::ObfuscationType::Udp2Tcp => {
+                            i32::from(proto::obfuscation_endpoint::ObfuscationType::Udp2tcp)
+                        }
+                        net::ObfuscationType::Shadowsocks => {
+                            i32::from(proto::obfuscation_endpoint::ObfuscationType::Shadowsocks)
+                        }
                     },
                 }
             }),
@@ -72,11 +81,15 @@ impl TryFrom<proto::TunnelEndpoint> for talpid_types::net::TunnelEndpoint {
                             )?,
                             protocol: try_transport_protocol_from_i32(proxy_ep.protocol)?,
                         },
-                        proxy_type: match proto::ProxyType::try_from(proxy_ep.proxy_type) {
-                            Ok(proto::ProxyType::Shadowsocks) => {
+                        proxy_type: match proto::proxy_endpoint::ProxyType::try_from(
+                            proxy_ep.proxy_type,
+                        ) {
+                            Ok(proto::proxy_endpoint::ProxyType::Shadowsocks) => {
                                 talpid_net::proxy::ProxyType::Shadowsocks
                             }
-                            Ok(proto::ProxyType::Custom) => talpid_net::proxy::ProxyType::Custom,
+                            Ok(proto::proxy_endpoint::ProxyType::Custom) => {
+                                talpid_net::proxy::ProxyType::Custom
+                            }
                             Err(_) => {
                                 return Err(FromProtobufTypeError::InvalidArgument(
                                     "unknown proxy type",
@@ -100,18 +113,22 @@ impl TryFrom<proto::TunnelEndpoint> for talpid_types::net::TunnelEndpoint {
                             ),
                             protocol: try_transport_protocol_from_i32(obfs_ep.protocol)?,
                         },
-                        obfuscation_type: match proto::ObfuscationType::try_from(
-                            obfs_ep.obfuscation_type,
-                        ) {
-                            Ok(proto::ObfuscationType::Udp2tcp) => {
-                                talpid_net::ObfuscationType::Udp2Tcp
-                            }
-                            Err(_) => {
-                                return Err(FromProtobufTypeError::InvalidArgument(
-                                    "unknown obfuscation type",
-                                ))
-                            }
-                        },
+                        obfuscation_type:
+                            match proto::obfuscation_endpoint::ObfuscationType::try_from(
+                                obfs_ep.obfuscation_type,
+                            ) {
+                                Ok(proto::obfuscation_endpoint::ObfuscationType::Udp2tcp) => {
+                                    talpid_net::ObfuscationType::Udp2Tcp
+                                }
+                                Ok(proto::obfuscation_endpoint::ObfuscationType::Shadowsocks) => {
+                                    talpid_net::ObfuscationType::Shadowsocks
+                                }
+                                Err(_) => {
+                                    return Err(FromProtobufTypeError::InvalidArgument(
+                                        "unknown obfuscation type",
+                                    ))
+                                }
+                            },
                     })
                 })
                 .transpose()?,