cfrs v0.3.0-beta.8

The eighth prerelease of cfrs, for tests.

Binaries

File	System
cfrs-x86_64-unknown-linux-musl, pod-netns-x86_64-unknown-linux-musl	Linux x86-64
cfrs-aarch64-unknown-linux-musl, pod-netns-aarch64-unknown-linux-musl	Linux ARM64
cfrs-armv7-unknown-linux-musleabihf, pod-netns-armv7-unknown-linux-musleabihf	Linux ARMv7 (32-bit, hard float)
cfrs-arm-unknown-linux-musleabihf, pod-netns-arm-unknown-linux-musleabihf	Linux ARMv6 (32-bit, hard float)
cfrs-i686-unknown-linux-musl, pod-netns-i686-unknown-linux-musl	Linux x86 (32-bit)
cfrs-riscv64gc-unknown-linux-musl, pod-netns-riscv64gc-unknown-linux-musl	Linux RISC-V 64
cfrs-loongarch64-unknown-linux-musl, pod-netns-loongarch64-unknown-linux-musl	Linux LoongArch64
cfrs-powerpc64le-unknown-linux-musl, pod-netns-powerpc64le-unknown-linux-musl	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

New in this release:

• The image ghcr.io/azathothas/cfrs:v0.3.0-beta.8 (also :beta), for the
  8 architectures: FROM scratch, user 65534, the volume /var/lib/cfrs
  (#160).
• scripts/install.sh: a POSIX sh installer with downloader fallbacks and
  a SHA256SUMS check (#160).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.8 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS

cfrs update from 0.3.0-beta.7 does these checks itself.

Breaking

Changes that a command written for beta.7 can need:

• The SOCKS5 server of warp proxy answers 0xff (no acceptable method) to a
  client that offers no method the server takes. Before, a client that
  offered only user and password (0x02) to a proxy with no credentials got
  0x00. A client that offers 0x00 is served as before (#146).
• warp proxy refuses a loopback, a link-local or an unspecified address,
  and localhost, with SOCKS5 reply 0x02 or HTTP 403. Before, the
  connection went into the tunnel and failed after up to 15 s. A rule
  (-r cidr:127.0.0.0/8=direct) changes this (#132).
• pod-netns, library: RuleMatch::Cidr holds a list of IPv4 or IPv6
  prefixes (Arc<[Net]>), not one IPv4 address and a length. Use
  RuleMatch::parse("cidr:10.0.0.0/8") (#142).
• The stack of WARP sends no new packet while its outbound queue is full,
  in place of a drop (#134).

Changes for a tester

New commands and flags of cfrs warp

• warp exit [--json]: the colo, the country and the address of the exit
  of the session. warp probe prints one exit line (#147).
• warp forward -L LISTEN=HOST:PORT: as ssh -L, through WARP; HOST is
  resolved inside the tunnel (#143).
• warp scan [--candidate IP[:PORT]]: the TCP and TLS time of each front
  door, with the pinned key (#139).
• warp export [--format wg-quick|json] [--delete]: a WireGuard device with
  its own key, for other clients (#148).
• warp proxy -r KIND:VALUE=ACTION, --rules-file, --rule-default,
  --check: tunnel, direct or reject for each destination; the file is
  read again when it changes (#132, #136).
• warp proxy --listen-identity LISTEN=PATH: one device for each listener
  (#150).
• warp proxy --proxy-user USER --proxy-password-file FILE (also on
  warp up): SOCKS5 user and password, HTTP Basic (#146).
• warp --resolver SPEC (CFRS_WARP_RESOLVERS): the DNS resolvers inside
  the tunnel, UDP or DNS over TLS (#145, #144).
• warp --device-name, --device-model, --device-locale: what a new
  device declares (#141).
• warp --fragment-client-hello [record|sni], --fragment-size: the TLS
  ClientHello of the MASQUE connection in more than one record (#135).
• warp up --env-d: the proxy variables in
  ~/.config/environment.d/90-cfrs-warp.conf for the next login (#138).

Paths and counters

• The front door that carried data is kept for 7 days in
  warp-door.json; a door whose session carried no packet goes last (#133).
• cfrs_decisions_total{decision,outcome} in the metrics: DNS steps,
  egress, legs, MASQUE paths, proxy requests and rules (#137).
• The health line of warp proxy has the decisions, tx_dropped and
  tx_held (#134, #137).
• pod-netns: -r cidr: takes IPv6 prefixes and cidr:@FILE (#142).

An IPv6-only host (#163)

• DNS over HTTPS by the IPv6 addresses of 1.1.1.1 and 8.8.8.8, in the order
  of the routes of the host.
• warp tun --default-route routes the front door in use (IPv4 or IPv6),
  and skips a relay address that has no route.
• cfrs doctor measures the IPv6 front door.
• scripts/v6only/: an IPv6-only network namespace on a runner, with its
  live step.

Recipes

• Tor, Psiphon, and a nested session (a second device through the first):
  docs/target-environment.md (#156, #158, #159).

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

• share: the race test flushes each file before the read (21c1b33)
• IPv6-only host: IPv6 DoH servers, warp up --tun front door, doctor IPv6 front door, shutdown on a failed verify (issue 163) (4fc2a76)
• warp tun --default-route: the front door in use, IPv6 host routes, a relay address with no route is skipped (issue 163) (0c707d4)
• scripts/v6only: an IPv6-only host on a runner, and its live step (issue 163) (62fbb6c)
• warp: a front door that carries no packet goes last; the door that works is kept (issue 133) (74d8e07)
• warp proxy: credentials of the clients; 0xff for a SOCKS5 client with no acceptable method; a time limit for a request (issue 146) (bcb2fe0)
• warp: the name, the model and the locale of a new device (issue 141) (c6414f6)
• warp --resolver: the DNS resolvers inside the tunnel, on UDP or over TLS (issues 145, 144) (e699648)
• warp: print the exit colo and country of a session (#147) (92038e9)
• warp: add warp forward -L, a local forward through WARP (#143) (51a693b)
• warp proxy: add rules for the destinations; pod rules take IPv6 and prefix files (#132, #136, #142) (d04e3c0)
• metrics: count the path decisions by decision and outcome (#137) (46a0d16)
• warp: hold the stack when the outbound queue is full; log the drops (#134) (3ebee54)
• warp up: add --env-d, the proxy variables for the next login (#138) (5e88dc0)
• warp up: check the environment.d file before the start (#138) (d96ea1d)
• warp: add warp scan, a measure of front doors (#139) (a57cf75)
• warp: add warp export, a WireGuard device for other clients (#148) (5b99937)
• warp proxy: add --listen-identity, one WARP device for each listener (#150) (ebb9f85)
• docs, live: recipes for Tor, Psiphon and a nested session; live checks of batch 2 (#156, #157, #158, #159) (75f6cd0)
• release: a container image and a portable install script (#160) (c5b9834)
• docs: the notes of v0.3.0-beta.8 and the open work of the second batch (ccc936a)
• warp: split the ClientHello of the MASQUE connection into records (#135) (b811b8e)
• live: read the last line of a detached demo; wait for the test proxy (#163) (2a37832)
• Version 0.3.0-beta.8 (721fd17)
• warp exit: read the trace over HTTPS (#147); live-batch2: curl to the forward with no proxy (4ca3ab3)
• live-batch2: a marked local web server on its own port (df99e33)