search

guardianproject / orbot-apple

Orbot VPN app for iOS
MIT License
186 stars 34 forks source link

HTTP rendezvous response: 403 Forbidden #78

Closed golfvoyager1 closed 4 months ago

golfvoyager1 commented 9 months ago

iPhone 13 IOS 16.7. Orbot IOS version 1.6.4. Snowflake original is used.

Snowflake stopped working. And I have attached the log.txt. I noticed that snowflake client got HTTP 403 from the host: HTTP rendezvous response: 403 Forbidden.

I also noticed that result from curl -v https://cdn.sstatic.net contains server: cloudflare. But I remember that it was served by fastly. Maybe that is why domain fronting stopped working?

golfvoyager1 commented 9 months ago

I tried and found that the fastly IP is still working: curl -v --resolve cdn.sstatic.net:443:151.101.1.69 https://cdn.sstatic.net. This time the server did not return cloudflare in the HTTP header.

tladesignz commented 9 months ago

Thank you, @golfvoyager1 for that deep analysis.

Tor Project already knows about this and is actively working on the issue: https://forum.torproject.org/t/problems-with-snowflake-since-2023-09-20-broker-failure-unexpected-error-no-answer/9346

https://lists.torproject.org/pipermail/anti-censorship-team/2023-September/000314.html

I'll release an update, if they should be able to mitigate this problem through code.

In the meantime - use the AMP connection method, if possible!

golfvoyager1 commented 9 months ago

Thank you for your suggestion @tladesignz . Unfortunately, AMP does not work for me. Snowflake client still received 403. I've attached the log here.

But changing front to foursquare.com works on Tor Browser, as suggested in your first link.

tladesignz commented 9 months ago

Urgh. This is all so ugly. It was running pretty well for a while but now Tor Project is introducing more and more changes to the network which makes the client explode its RAM usage. And this stupid limit of 50 MB for Network Extensions which Apple enforces is suddenly the dealbreaker again.

On top of that come all sorts of issues with Snowflake.

I'm working with Tor Project to get this improved. I also have an update in the pipeline which is able to update the built-in bridge configuration when you select "Ask Tor" and which also brings back/in Meek Azure, which, to my surprise, is still not blocked.

Also, Apple finally added SOCKS5 proxy support to WKWebView in iOS 17, which hopefully will give Onion Browser back its built-in Tor again, which will be unburdened with that silly 50 MB constraint.

I can only say: Sorry. Please stay patient.