proxy sni experiments

2FA support

README.md

@@ -64,6 +64,7 @@ windscribe-proxy -list-proxies
 
 | Argument | Type | Description |
 | -------- | ---- | ----------- |
+| 2fa | String | 2FA code for login |
 | auth-secret | String | client auth secret (default `952b4412f002315aa50751032fcaab03`) |
 | bind-address | String | HTTP proxy listen address (default `127.0.0.1:28080`) |
 | cafile | String | use custom CA certificate bundle file |

main.go

@@ -60,6 +60,7 @@ type CLIArgs struct {
 	stateFile        string
 	username         string
 	password         string
+	tfacode          string
 }
 
 func parse_args() CLIArgs {
@@ -86,6 +87,7 @@ func parse_args() CLIArgs {
 		"Windscribe API client state")
 	flag.StringVar(&args.username, "username", "", "username for login")
 	flag.StringVar(&args.password, "password", "", "password for login")
+	flag.StringVar(&args.tfacode, "2fa", "", "2FA code for login")
 	flag.Parse()
 	if args.listLocations && args.listProxies {
 		arg_fail("list-locations and list-proxies flags are mutually exclusive")
@@ -191,7 +193,7 @@ func run() int {
 	state, err := loadState(args.stateFile)
 	if err != nil {
 		mainLogger.Warning("Failed to load client state: %v. Performing cold init...", err)
-		err = coldInit(wndc, args.username, args.password, args.timeout)
+		err = coldInit(wndc, args.username, args.password, args.tfacode, args.timeout)
 		if err != nil {
 			mainLogger.Critical("Cold init failed: %v", err)
 			return 9
@@ -249,7 +251,7 @@ func run() int {
 	}
 
 	proxyNetAddr := net.JoinHostPort(proxyHostname, strconv.FormatUint(uint64(ASSUMED_PROXY_PORT), 10))
-	handlerDialer := NewProxyDialer(proxyNetAddr, proxyHostname, auth, caPool, dialer)
+	handlerDialer := NewProxyDialer(proxyNetAddr, "a", auth, caPool, dialer)
 	mainLogger.Info("Endpoint: %s", proxyNetAddr)
 	mainLogger.Info("Starting proxy server...")
 	handler := NewProxyHandler(handlerDialer, proxyLogger)
@@ -371,9 +373,9 @@ func saveState(filename string, state *wndclient.WndClientState) error {
 	return err
 }
 
-func coldInit(wndc *wndclient.WndClient, username, password string, timeout time.Duration) error {
+func coldInit(wndc *wndclient.WndClient, username, password, tfacode string, timeout time.Duration) error {
 	ctx, cl := context.WithTimeout(context.Background(), timeout)
-	err := wndc.Session(ctx, username, password)
+	err := wndc.Session(ctx, username, password, tfacode)
 	cl()
 	if err != nil {
 		return fmt.Errorf("Session call failed: %w", err)

upstream.go

@@ -91,7 +91,7 @@ func (d *ProxyDialer) DialContext(ctx context.Context, network, address string)
 
 	conn, err := d.next.DialContext(ctx, "tcp", d.address)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("proxy dial failed: %w", err)
 	}
 
 	if d.tlsServerName != "" {
@@ -134,21 +134,21 @@ func (d *ProxyDialer) DialContext(ctx context.Context, network, address string)
 
 	rawreq, err := httputil.DumpRequest(req, false)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("unable to prepare request for proxy: %w", err)
 	}
 
 	_, err = conn.Write(rawreq)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("unable to send request to proxy: %w", err)
 	}
 
 	proxyResp, err := readResponse(conn, req)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("unable to read proxy response: %w", err)
 	}
 
 	if proxyResp.StatusCode != http.StatusOK {
-		return nil, errors.New(fmt.Sprintf("bad response from upstream proxy server: %s", proxyResp.Status))
+		return nil, fmt.Errorf("bad response from upstream proxy server: %s", proxyResp.Status)
 	}
 
 	return conn, nil

wndclient/wndclient.go

@@ -102,7 +102,7 @@ func NewWndClient(transport http.RoundTripper) (*WndClient, error) {
 	}, nil
 }
 
-func (c *WndClient) Session(ctx context.Context, username, password string) error {
+func (c *WndClient) Session(ctx context.Context, username, password, tfacode string) error {
 	c.Mux.Lock()
 	defer c.Mux.Unlock()
 
@@ -114,6 +114,9 @@ func (c *WndClient) Session(ctx context.Context, username, password string) erro
 		"username":         []string{username},
 		"password":         []string{password},
 	}
+	if tfacode != "" {
+		input["2fa_code"] = []string{tfacode}
+	}
 
 	var output SessionResponse