green-tunnel 1.7.1 → 1.7.5

package/README.md

@@ -3,7 +3,7 @@
     <img src="assets/logo.png" alt="green tunnel logo" width="200">
 </p>
 <p align="center">
-    <img src="https://img.shields.io/github/license/SadeghHayeri/GreenTunnel.svg?color=Green&style=flat-square"> <img src="https://img.shields.io/github/repo-size/SadeghHayeri/GreenTunnel.svg?color=Green&style=flat-square">
+    <img src="https://img.shields.io/github/license/SadeghHayeri/GreenTunnel.svg?color=Green&style=for-the-badge"> <img src="https://img.shields.io/github/repo-size/SadeghHayeri/GreenTunnel.svg?color=Green&style=for-the-badge"> <img src="https://img.shields.io/discord/707464295021019197?color=Green&style=for-the-badge">
 </p>
 
 GreenTunnel bypasses DPI (Deep Packet Inspection) systems found in many ISPs (Internet Service Providers) which block access to certain websites.
@@ -21,6 +21,13 @@ You can install GreenTunnel using [npm](https://www.npmjs.org/ "npm"):
 ```
 $ npm i -g green-tunnel
 ```
+
+or using [snap](https://snapcraft.io) (edge version):
+```
+sudo snap install --edge green-tunnel --devmode
+```
+
+
 after installation you can run it using `gt` or `green-tunnel` commands.
 
 ```
@@ -32,16 +39,19 @@ Options:
   --help, -h      Show help                                            [boolean]
   --version, -V   Show version number                                  [boolean]
   --ip            ip address to bind proxy server[string] [default: "127.0.0.1"]
+  --https-only    Block insecure HTTP requests        [boolean] [default: false]
   --port          port address to bind proxy server     [number] [default: 8000]
   --dns-type               [string] [choices: "https", "tls"] [default: "https"]
   --dns-server        [string] [default: "https://cloudflare-dns.com/dns-query"]
+  --dns-ip        IP address for unencrypted DNS  [string][default: "127.0.0.1"]
+  --dns-port      Port for unencrypted DNS                [number] [default: 53]
   --silent, -s    run in silent mode                  [boolean] [default: false]
   --verbose, -v   debug mode                              [string] [default: ""]
   --system-proxy  automatic set system-proxy           [boolean] [default: true]
 
 Examples:
   gt
-  gt --ip 127.0.0.1 --port 8000
+  gt --ip 127.0.0.1 --port 8000 --https-only
   gt --dns-server https://doh.securedns.eu/dns-query
   gt --verbose 'green-tunnel:proxy*'
 
@@ -59,6 +69,7 @@ $ docker run -p 8000:8000 sadeghhayeri/green-tunnel
 ```
 > **envs**
 * PORT
+* HTTPS-ONLY
 * VERBOSE
 * SILENT
 * DNS_TYPE
@@ -69,6 +80,20 @@ usage:
 $ docker run -e 'PORT=1000' -p 8000:1000 sadeghhayeri/green-tunnel
 ```
 
+#### On Raspberry Pi
+```
+$ docker run -p 8000:8000 sadeghhayeri/green-tunnel:arm
+```
+
+If you want to make container keep running when reboot:
+```
+$ docker run -d --restart unless-stopped -p 8000:8000 sadeghhayeri/green-tunnel:arm
+```
+
+Please make sure port `8000` is not blocked on Raspberry Pi firewall. (`sudo ufw allow 8000 comment Green-Tunnel`)
+
+To use it on your other device, set http proxy to ```<Raspberry Pi IP Address>:<PORT>```. (PORT = `8000`)
+
 ### Tested on
 - MacOS Catalina with node 12
 - Ubuntu 18.04 with node 8
@@ -77,11 +102,6 @@ $ docker run -e 'PORT=1000' -p 8000:1000 sadeghhayeri/green-tunnel
 
 ## FAQ
 > **How does it work?**
-###### DNS
-When you enter a URL in a Web browser, the first thing the Web browser does is to ask a DNS (Domain Name System) server, at a known numeric address, to look up the domain name referenced in the URL and supply the corresponding IP address.
-If the DNS server is configured to block access, it consults a blacklist of banned domain names. When a browser requests the IP address for one of these domain names, the DNS server gives a wrong answer or no answer at all.
-GreenTunnel use [DNS over HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS "doh (DNS over HTTPS)") and [DNS over TLS](https://en.wikipedia.org/wiki/DNS_over_TLS "DNS over TLS") to get real IP address and bypass DNS Spoofing.
-
 ###### HTTP
 There are gaps in providers in DPI.  They happen from what the DPI rules write for ordinary user programs, omitting all possible cases that are permissible by standards.  This is done for simplicity and speed.
 Some DPIs cannot recognize the HTTP request if it is divided into TCP segments.  For example, a request of the form
@@ -96,6 +116,10 @@ we send it in 2 parts: first comes `GET / HTTP/1.0 \n Host: www.you` and second
 ###### HTTPS
 Server Name Indication (SNI) is an extension to TLS (Transport Layer Security) that indicates the actual destination hostname a client is attempting to access over HTTPS. For this Web Filter feature, SNI hostname information is used for blocking access to specific sites over HTTPS. For example, if the administrator chooses to block the hostname **youtube** using this feature, all Website access attempts over HTTPS that contain **youtube** like **www.youtube.com** in the SNI would be blocked. However, access to the same hostname over HTTP would not be blocked by this feature. GreenTunnel tries to split first **CLIENT-HELLO** packet into small chunks and ISPs can't parse packet and found SNI field so bypass traffic!
 
+###### DNS
+When you enter a URL in a Web browser, the first thing the Web browser does is to ask a DNS (Domain Name System) server, at a known numeric address, to look up the domain name referenced in the URL and supply the corresponding IP address.
+If the DNS server is configured to block access, it consults a blacklist of banned domain names. When a browser requests the IP address for one of these domain names, the DNS server gives a wrong answer or no answer at all.
+GreenTunnel use [DNS over HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS "doh (DNS over HTTPS)") and [DNS over TLS](https://en.wikipedia.org/wiki/DNS_over_TLS "DNS over TLS") to get real IP address and bypass DNS Spoofing.
 
 ## Development notes
 GreenTunnel is an open-source app and I really appreciate other developers adding new features and/or helping fix bugs. If you want to contribute to GreenTunnel, you can fork this repository, make the changes and create a pull request.
@@ -108,22 +132,29 @@ However, please make sure you follow a few rules listed below to ensure that you
 - Commits in your fork should be informative, as well. Make sure you don't combine too many changes into a single commit.
 
 ## TODO List
-- [ ] enable/disable proxy on windows
+- [X] enable/disable proxy on windows
 - [ ] HTTPHandler
 - [X] add CLI arguments
-- [ ] catch all exceptions
+- [X] catch all exceptions
 - [ ] add preferences menu
 - [ ] fix close button
 
 ## Donation
 > Love GreenTunnel? Please consider donating to sustain our activities.
 
-**Bitcoin:** 3C5sj5BJ3n5gYJR27uxowdsgGCq2vjdhn5
+**DOGECOIN!:** DTGjx8KKDCUkSEbtVHgQx1GYEnNaVVuXLa<br />
+**BITCOIN:** bc1qknjsmsa98lljwxjwl4pmjh48s8su8r8ajkqd8w<br />
+**ETHEREUM:** 0x018fbf3fAC7165b2c85f856cC90E2d9410415150<br />
+**LITECOIN:** ltc1q5tfprazpkzjvzf5shgprkpkhnnku3p72feutxt<br />
+**RIPPLE/XRP:** rt6ZTkKdBVYzBee9CpQsDTsewnTbAoV13<br />
 
 [![](https://img.shields.io/badge/Buy%20me%20a%20coffee-IRR%20|%20PayPing-Red.svg?style=for-the-badge&logo=ko-fi)](https://payping.ir/d/TXTS)
 <br />
 [![](https://img.shields.io/badge/Buy%20me%20a%20coffee-USD%20|%20PayPal-Red.svg?style=for-the-badge&logo=ko-fi)](https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=HJ5TBXVYTHS7N&currency_code=USD&source=url)
+<br />
+[![Donate with Bitcoin](https://en.cryptobadges.io/badge/big/3C5sj5BJ3n5gYJR27uxowdsgGCq2vjdhn5?showBalance=true)](https://en.cryptobadges.io/donate/bc1qknjsmsa98lljwxjwl4pmjh48s8su8r8ajkqd8w)
+[![Donate with Ethereum](https://en.cryptobadges.io/badge/big/0x018fbf3fAC7165b2c85f856cC90E2d9410415150?showBalance=true)](https://en.cryptobadges.io/donate/0x018fbf3fAC7165b2c85f856cC90E2d9410415150)
+[![Donate with Ripple](https://en.cryptobadges.io/badge/big/rt6ZTkKdBVYzBee9CpQsDTsewnTbAoV13?showBalance=true)](https://en.cryptobadges.io/donate/rt6ZTkKdBVYzBee9CpQsDTsewnTbAoV13)
 
 ## License
 Licensed under the MIT license. See [LICENSE](https://github.com/SadeghHayeri/GreenTunnel/blob/master/LICENSE "LICENSE").
-

package/bin/gt.js

@@ -7,11 +7,11 @@ const ora = require('ora');
 const debug = require('debug');
 const yargs = require('yargs');
 const pkg = require('../package.json');
-const {Proxy, config, getLogger} = require('../src/index.cjs');
+const { Proxy, config, getLogger } = require('../src/index.cjs');
 
 const logger = getLogger('cli');
 
-const {argv} = yargs
+const { argv } = yargs
 	.usage('Usage: green-tunnel [options]')
 	.usage('Usage: gt [options]')
 	.alias('help', 'h')
@@ -29,9 +29,15 @@ const {argv} = yargs
 		default: config.port,
 	})
 
+	.option('https-only', {
+		type: 'boolean',
+		describe: 'Block insecure HTTP requests',
+		default: config.httpsOnly,
+	})
+
 	.option('dns-type', {
 		type: 'string',
-		choices: ['https', 'tls'],
+		choices: ['https', 'tls', 'unencrypted'],
 		default: config.dns.type,
 	})
 
@@ -40,6 +46,16 @@ const {argv} = yargs
 		default: config.dns.server,
 	})
 
+	.option('dns-ip', {
+		type: 'string',
+		default: config.dns.ip,
+	})
+
+	.option('dns-port', {
+		type: 'number',
+		default: config.dns.port,
+	})
+
 	.option('silent', {
 		alias: 's',
 		type: 'boolean',
@@ -104,10 +120,14 @@ async function main() {
 	const proxy = new Proxy({
 		ip: argv['ip'],
 		port: parseInt(argv['port'], 10),
+		httpsOnly: argv['https-only'],
 		dns: {
 			type: argv['dns-type'],
-			server: argv['dns-server']
-		}
+			server: argv['dns-server'],
+			ip: argv['dns-ip'],
+			port: argv['dns-port']
+		},
+		source: 'CLI',
 	});
 
 	const exitTrap = async () => {
@@ -130,12 +150,12 @@ async function main() {
 	process.on('unhandledRejection', errorTrap);
 	process.on('uncaughtException', errorTrap);
 
-	await proxy.start({setProxy: argv['system-proxy']});
+	await proxy.start({ setProxy: argv['system-proxy'] });
 
 	if (!argv['silent'] && !argv['verbose']) {
 		clear();
 		printBanner();
-		updateNotifier({pkg}).notify();
+		updateNotifier({ pkg }).notify();
 		printAlert(proxy);
 		showSpinner();
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "green-tunnel",
-  "version": "1.7.1",
+  "version": "1.7.5",
   "description": "",
   "keywords": [
     "HTTPS",
@@ -31,17 +31,19 @@
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "dependencies": {
+    "app-data-folder": "^1.0.0",
     "chalk": "^2.4.2",
     "clear": "^0.1.0",
     "consola": "^2.11.0",
     "debug": "^4.1.1",
     "dns-over-http": "^0.1.2",
     "dns-over-tls": "0.0.6",
+    "dns-socket": "^4.2.2",
     "esm": "^3.2.22",
+    "is-docker": "^2.0.0",
     "lru-cache": "^5.1.1",
     "node-localstorage": "^2.1.5",
     "ora": "^3.2.0",
-    "platform-folders": "^0.4.1",
     "std-env": "^2.2.1",
     "universal-analytics": "^0.4.20",
     "update-notifier": "^2.5.0",

package/src/config.js

@@ -1,10 +1,13 @@
 const config = {
 	ip: '127.0.0.1',
 	port: 8000,
+	httpsOnly: false,
 	clientHelloMTU: 100,
 	dns: {
-		type: 'https', // 'tls' or 'https'
+		type: 'https', // 'tls' or 'https' or 'unencrypted'
 		server: 'https://cloudflare-dns.com/dns-query',
+		ip: '127.0.0.1',
+		port: 53,
 		cacheSize: 1000,
 	}
 };

package/src/dns/base.js

@@ -1,5 +1,5 @@
 import LRU from 'lru-cache';
-import {isIP} from 'validator';
+import { isIP } from 'validator';
 import getLogger from '../logger';
 import config from '../config';
 

package/src/dns/unencrypted.js

@@ -0,0 +1,25 @@
+import dnsSocket from 'dns-socket';
+import BaseDNS from './base';
+
+const socket = dnsSocket()
+
+export default class DNSUnencrypted extends BaseDNS {
+  constructor(dnsIp, dnsPort) {
+    super();
+    this.dnsIp = dnsIp;
+    this.dnsPort = dnsPort;
+  }
+
+  _lookup(hostname) {
+    return new Promise((resolve, reject) => {
+      socket.query({
+        questions: [{
+          type: 'A',
+          name: hostname
+        }]
+      }, this.dnsPort, this.dnsIp, (err, res, query) => {
+        resolve(res.answers[0].data);
+      });
+    });
+  }
+}

package/src/handlers/request.js

@@ -14,6 +14,8 @@ export default async function handleRequest(clientSocket, proxy) {
 				if (isStartOfHTTPRequest(strData)) {
 					if (isConnectMethod(strData)) {
 						await handleHTTPS(clientSocket, data, proxy);
+					} else if (proxy.config.httpsOnly) {
+						throw new Error('Insecure request blocked: ', strData);
 					} else {
 						await handleHTTP(clientSocket, data, proxy);
 					}

package/src/proxy.js

@@ -1,33 +1,38 @@
 import net from 'net';
-import {setProxy, unsetProxy} from './utils/system-proxy';
+import { setProxy, unsetProxy } from './utils/system-proxy';
 import handleRequest from './handlers/request';
 import DNSOverTLS from './dns/tls';
 import DNSOverHTTPS from './dns/https';
+import DNSUnencrypted from './dns/unencrypted';
 import config from './config';
 import getLogger from './logger';
-import {appInit} from './utils/analytics';
+import { appInit } from './utils/analytics';
 
 const logger = getLogger('proxy');
 
 export default class Proxy {
 	constructor(customConfig) {
-		this.config = {...config, ...customConfig};
+		this.config = { ...config, ...customConfig };
 		this.server = undefined;
 		this.isSystemProxySet = false;
 		this.initDNS();
+		appInit(customConfig.source);
 	}
 
 	initDNS() {
-		this.dns = this.config.dns.type === 'https' ?
-			new DNSOverHTTPS(this.config.dns.server) :
-			new DNSOverTLS(this.config.dns.server);
+		if (this.config.dns.type === 'https') {
+			this.dns = new DNSOverHTTPS(this.config.dns.server);
+		} else if (this.config.dns.type === 'tls') {
+			this.dns = new DNSOverTLS(this.config.dns.server);
+		} else {
+			this.dns = new DNSUnencrypted(this.config.dns.ip, this.config.dns.port);
+		}
 	}
 
 	async start(options = {}) {
-		appInit();
 		options.setProxy = options.setProxy === undefined ? false : options.setProxy;
 
-		this.server = net.createServer({pauseOnConnect: true}, clientSocket => {
+		this.server = net.createServer({ pauseOnConnect: true }, clientSocket => {
 			handleRequest(clientSocket, this).catch(err => {
 				logger.debug(String(err));
 			});
@@ -45,7 +50,7 @@ export default class Proxy {
 			this.server.listen(this.config.port, this.config.ip, () => resolve());
 		});
 
-		const {address, port} = this.server.address();
+		const { address, port } = this.server.address();
 		logger.debug(`server listen on ${address} port ${port}`);
 
 		if (options.setProxy) {

package/src/utils/analytics.js

@@ -1,18 +1,28 @@
 import ua from 'universal-analytics';
 import uuid from 'uuid/v4';
 import { JSONStorage } from 'node-localstorage';
-import path from 'path';
+import appData from 'app-data-folder';
+import os from 'os';
+import packageJson from '../../package.json'
+import isDocker from 'is-docker';
 
-import getPath from 'platform-folders';
-const configFolder = path.join(getPath('appData'), 'greentunnel');
-const nodeStorage = new JSONStorage(configFolder);
+const nodeStorage = new JSONStorage(appData('greentunnel'));
 const userId = nodeStorage.getItem('userid') || uuid();
 nodeStorage.setItem('userid', userId);
 
 var visitor = ua('UA-160385585-1', userId);
 
-function appInit() {
-  visitor.event("gt", "init").send()
+function appInit(source = 'OTHER') {
+  const osPlatform = os.platform() + (isDocker() ? '-docker' : '')
+
+  visitor.set('version', packageJson.version);
+  visitor.set('os', osPlatform);
+  visitor.set('source', source);
+
+  visitor.event('gt-total', 'init').send();
+  visitor.event(`gt-${source}`, 'init').send();
+  visitor.event(`gt-${osPlatform}`, 'init').send();
+  visitor.event(`gt-${packageJson.version}`, 'init').send();
 }
 
 export {appInit};

package/src/utils/system-proxy.js

@@ -24,6 +24,8 @@ class LinuxSystemProxy extends SystemProxy {
 		await exec('gsettings set org.gnome.system.proxy mode manual');
 		await exec(`gsettings set org.gnome.system.proxy.http host ${ip}`);
 		await exec(`gsettings set org.gnome.system.proxy.http port ${port}`);
+		await exec(`gsettings set org.gnome.system.proxy.https host ${ip}`);
+		await exec(`gsettings set org.gnome.system.proxy.https port ${port}`);
 	}
 
 	static async unsetProxy() {