Tor integration #2
Description
The idea is to replace OkHttp3/HttpURLConnection builders with GuardianProject NetCipher's StrongBuilder. This has some benefits by itself and also allows to easily integrate with Orbot. A "Use Tor for server connections" advanced setting has to be added; when enabled the connections to the Cable server and to Giphy happen via Tor.
Notes:
- This requires forking at least
libsignal-service-javaandlibpastelog; - When using Tor the giphy proxy has to be disabled (easy);
- When "relying all calls" the connection to the TURN server has to happen via Tor. This is not trivial and probably the most delicate point as the webrtc library is not so friendly towards proxies. See [1];
- [If the user selected "Use Tor", but Orbot is not installed, use Thali (Orchid is very slow unfortunately, Tor in pure java on a mobile isn't really viable). This may not play well with NetCipher, some fallback logic will probably be necessary.]
- It would be nice to have a Cable server fully available as a hidden service.
This setup is better than just using Orbot's VPN mode for several reasons:
- High quality, low-latency p2p calls are still possible if we accept to leak our IP to our contacts, but:
- If "relay all calls" is enabled then the TURN server is accessed via Tor;
- Access to giphy is truly anonymous and independent from the Cable infrastructure.
The domain fronting (meek reflector) code can also be disabled/removed, encouraging the use of Tor in censoring countries, a strategy that also works for people just visiting such countries, but registered with a country code of a non-censoring country. Signal's strategy does not work in this case [2] [3].
Caveats:
The issue with Orbot as well is that the socks port is not static, it is sometimes dynamic, if the default ports are occupied, so you need to use the broadcastreceiver requests/callbacks we provide in NetCipher or that Orbot supports, to query what ports Orbot is on, if it is running, etc.
[1] https://groups.google.com/forum/#!searchin/discuss-webrtc/proxy|sort:relevance/discuss-webrtc/E3FX4bp363M/7FpT-SmAEAAJ
[2] signalapp/Signal-Android#5986
[3] signalapp/Signal-Android#6037