Skip to content

cfrs v0.3.0-beta.7

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 05:33
· 972 commits to main since this release
v0.3.0-beta.7
9fe4073

The seventh prerelease of cfrs, for tests.

Binaries

File System
cfrs-x86_64-unknown-linux-musl, pod-netns-x86_64-unknown-linux-musl Linux x86-64
cfrs-aarch64-unknown-linux-musl, pod-netns-aarch64-unknown-linux-musl Linux ARM64
cfrs-armv7-unknown-linux-musleabihf, pod-netns-armv7-unknown-linux-musleabihf Linux ARMv7 (32-bit, hard float)
cfrs-arm-unknown-linux-musleabihf, pod-netns-arm-unknown-linux-musleabihf Linux ARMv6 (32-bit, hard float)
cfrs-i686-unknown-linux-musl, pod-netns-i686-unknown-linux-musl Linux x86 (32-bit)
cfrs-riscv64gc-unknown-linux-musl, pod-netns-riscv64gc-unknown-linux-musl Linux RISC-V 64
cfrs-loongarch64-unknown-linux-musl, pod-netns-loongarch64-unknown-linux-musl Linux LoongArch64
cfrs-powerpc64le-unknown-linux-musl, pod-netns-powerpc64le-unknown-linux-musl Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.7 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

cfrs update from 0.3.0-beta.6 does these checks itself.

Breaking

Changes that a command written for beta.6 can need:

  • share with no --mode takes the mode of its flags: --file gives
    download, --port gives proxy. Flags of two modes, or a flag of another
    mode than --mode (--mode upload --file F), exit 64 (#118).
  • A verify of the public URL that fails exits 69 (before: 1). It waits up to
    180 s (before: 20 tries in about 40 s) (#119).
  • CFRS_WARP_TCP_BURST with a value that is not 1 to 430 or none exits 78
    (before: the default, with no message) (#111).
  • autostart add drops a leading cfrs, and a command that does not parse
    exits 64 (#117).
  • warp proxy does not take a unix socket that answers (a running proxy):
    the listener fails (#115).
  • The ready document of relay node has the pair in pair (before:
    name, which the name of the instance overwrote) (#119).
  • agent up --expose gives no tunnel to a port where nothing accepts a
    connection; each entry of exposed has a state (#119).
  • A new WARP session is up only when a DNS query through it got an answer
    (5 s). CFRS_WARP_NO_CHECK=1 turns the check off (#120).
  • The env file of warp up with no TCP listener sets CFRS_PROXY to the
    unix socket, so cfrs commands in that shell use WARP (#116).

Changes for a tester

The fixes of the reports on beta.6 (#109 to #130).

WARP

  • A UDP datagram to IPv6 no longer stops the userspace stack (a panic in
    smoltcp before); a stack whose driver ends is replaced (#112).
  • The stack frees the sockets of closed connections and of connects that a
    caller gave up; TCP has a time limit of 60 s and a keepalive; the end of
    the data of a client goes to the peer as a FIN; the operations of a dead
    session fail at once; a read that a caller gave up takes no data (#125).
  • The TCP window of the userspace stack stays 1 by default: on the direct
    path to the front door, larger windows still stall (#100, open). Through
    the WebSocket relay, no window stalled in the live runs.
  • A new WARP session tries the direct path first each time; the relay
    starts after 3 s (0.5 s when the relay worked last), and the first
    session that opens wins (#126, #76).
  • UDP ASSOCIATE replies 0x01 when it cannot open its socket; DNS through
    the tunnel is sent again after 1.2 s; a name in a datagram is resolved
    once for each association, A first. docs/protocol.md describes the UDP
    association in the stream (0x83) for a host that refuses UDP on
    127.0.0.1 (#114).
  • A capsule longer than 64 KiB ends the session (#123). ADDRESS_ASSIGN is
    parsed and logged (#121). The waiting packets go in one HTTP/2 DATA frame
    (#122).
  • The front door is the IPv4 address of the peer, then its IPv6 address;
    the one that worked goes first (#124). The leg that worked (direct or
    relay) is kept in warp-leg.json; a relay that worked in the last 6 h
    goes first after a restart (#126).
  • warp nc -u HOST PORT carries UDP; warp probe checks UDP too (#115).
  • warp proxy --dns ADDR and warp up --dns ADDR: a DNS forwarder through
    WARP (#117). warp proxy --max-connections N; the log has a health line
    each 10 min (#117, #116).
  • warp ssh-config --write --host H owns its block in ~/.ssh/config;
    --check and --remove (#130).
  • warp up --replace; --persist also for zsh and fish; warp status
    shows the instance; warp exec and warp shell set CFRS_WARP_SOCKET
    (#115, #116, #117).

Proxies and DNS

  • --proxy SCHEME+unix:/PATH and --proxy SCHEME+exec:COMMAND (a proxy at
    the stdin and stdout of a command, as the ProxyCommand of SSH) (#129).
  • An NXDOMAIN answer of one DoH operator does not stop the chain: the next
    operator is asked (#119).
  • A reset or a close during a TLS handshake is the hop network, with a
    hint about an egress policy, not about the CA or the clock (#127).

Pods

  • getaddrinfo with AF_UNSPEC works when the supervisor cannot write the
    memory of the program (RES_OPTIONS=single-request) (#113).
  • UDP to a fake IP of the pod goes to the proxy with its name (#113).
  • POD_NETNS_QUIET (and cfrs -q) silence the warnings of the pod (#115).

Tunnels, share, relay and the CLI

  • share --file shares the file (#118). A refused upload is read to its
    end before the 413, also past the body limit (#92).
  • serve of a directory with no index.html: the 404 of / is not a
    warning (#119).
  • ports --probe; origins on localhost with no /etc/hosts; relay stop
    stops the node instances of the pair (#119).
  • relay connect keeps the answer when the input ends at once (#109).
  • doctor: the relay road, the DNS answer of each name, the clock, and a
    summary of the roads direct, warp and relay (#128). doctor --agent
    names a synthetic resolver (#117).
  • cfrs raises the soft limit of open files at start; cfrs status shows
    it (#126).
  • cfrs bug-report: one text for a report, with no secret (#117).
  • agent up and doctor --agent give no eval line when warp up has no
    TCP listener (#110).

What to report

Open an issue with:

  • the output of cfrs --version, cfrs status and cfrs doctor --agent;
  • the command, and its output with RUST_LOG=cfrs=debug;
  • the network limits of the host (proxy, UDP, ports, DNS, TLS interception).

CFRS_ERROR_PROGRAM=/path/to/program gives each failure as one JSON
document to that program, with the credentials masked.

Limits of this prerelease

  • Linux only.
  • A proxy that terminates TLS cannot carry the edge connection or the WARP
    MASQUE connection.
  • The netns backend of cfrs pod carries TCP and DNS, not other UDP; use
    --backend seccomp or netns-raw for other UDP.
  • TCP through warp proxy and warp up has a small window by default
    (CFRS_WARP_TCP_BURST): about 0.5 MB/s on some paths (#100, open).
  • The relay limits each session to 64 MiB and 12 h.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

  • warp: a UDP datagram to IPv6 does not stop the userspace stack (issue 112) (96939b6)
  • resolve, verify: a new name that one DoH operator does not know yet (issue 119) (0775407)
  • warp stack: free the sockets, time limits, half-close; UDP association fixes (issues 125, 114) (1eff505)
  • capsule limit, CFRS_WARP_TCP_BURST check, agent advice, share mode, autostart args (issues 123, 111, 110, 118, 117) (25e242d)
  • pod AF_UNSPEC lookups and UDP to a name; relay connect answer; TLS reset hop (issues 113, 109, 127) (3c0c030)
  • live.yml: close the MASQUE connection with a TCP reset rule when ss -K fails; warp: log each close of the session (975bb84)
  • ports --probe, expose probe, localhost origins, relay node pair (issue 119) (1d0e06f)
  • Breaking heading of the release notes, the limit of open files, the WARP leg that worked (issue 126); live.yml: the new warp up line (b3a34ea)
  • warp ssh-config --write, --remove, --check: the block in the SSH config file (issue 130) (f1c2067)
  • proxy carriers: a unix socket and a command (issue 129); warp up env and exec (issue 116) (15bb151)
  • doctor: the relay road, DNS of each name, the clock, and the roads (issue 128) (31a689b)
  • warp: a new session is up when a packet crossed it; ADDRESS_ASSIGN; the IPv6 front door (issues 120, 121, 124) (e4bc032)
  • share: a refused upload is read to its end, also past the body limit (issue 92, live run 41556133042) (3ab5dd1)
  • QOL: warp nc note, a live socket is kept, warp up --replace, zsh and fish, POD_NETNS_QUIET, warp status instance, persist files, crontab check (issues 115, 116, 117) (194dc4b)
  • warp: the packets that wait go out in one DATA frame (issue 122) (e10b03e)
  • warp proxy --max-connections, client counters and a health line; doctor --agent: a synthetic resolver (issues 117, 116) (f2b3e62)
  • warp nc -u and the UDP line of warp probe (issue 115) (205bece)
  • fmt: the signatures of nc.rs (746a864)
  • warp proxy --dns and warp up --dns: a DNS forwarder through WARP (issue 117) (e50cff4)
  • warp: the default TCP window of the userspace stack is 8 (issue 100) (acc57e6)
  • cfrs bug-report: one text for a report, with no secret (issue 117) (40037ea)
  • Version 0.3.0-beta.7; release notes (7d576d8)
  • warp: the direct path first for each session, the relay after a delay; the leg in the live table (issues 126, 100) (fb8803f)
  • warp: the default TCP window is 1 again; live.yml: A/B with the binary of beta.6 (issue 100) (9fe4073)
Assets 23
Loading