anton48/vk-turn-proxy-ios v1.0-build125

SRTP transport (opt-in) + WRAP UI removed

on GitHub

Adds DTLS-SRTP as an opt-in transport in addition to the existing
DTLS+WG path (off by default). SRTP-wrapped WireGuard payload bypasses
VK's per-allocation shape policy on TURN-relay traffic — empirical
30-40 Mbps speedtest sustained in soak testing vs ~2 Mbps on the
legacy DTLS+WG path.

• SRTP transport: DTLS-SRTP wrapper around WireGuard inner payload,
  wraps each WG packet as an RTP packet then SRTP-encrypts it. From
  VK's classifier perspective this looks like legitimate WebRTC media;
  per-allocation shape policy does not apply. Opt-in via Settings →
  "Use SRTP" toggle.

• Probe machinery on SRTP path: probe sender + active-probe-on-wake +
  freeze detection — ported from the DTLS path. Zombie kill + iOS
  freeze recovery behave the same way as on DTLS.

• Per-conn TX/RX counters + TURN RTT now populated on the SRTP path
  (UI tiles and conn-stats log lines work end-to-end).

• Per-conn buffer reuse in the SRTP wrap layer — cuts ~9k allocs/sec
  under active load.

• Go runtime panic capture: stderr from the extension's Go runtime
  now lands in vpn.log alongside log.Printf output, so any future
  runtime panic shows up with goroutine dump in the user-fetchable
  log.

• WRAP removed from the UI. We consider WRAP dead: VK's
  per-allocation filtering on the WRAP path is both aggressive and
  stochastic, leaving no reliable configuration. The toggle and key
  field are no longer surfaced in Settings.

• WRAP is NOT removed from the code path. Since we cannot be
  100% sure WRAP is dead for every user's network/cred combination,
  the use_wrap / wrap_key_hex settings are still readable from a
  stored configuration — you can flip them via Full Backup JSON
  (export → edit → import) or via Connection Link. If they're set,
  the extension still runs the WRAP XOR layer over DTLS+WG.

• "Use SRTP" toggle REQUIRES an SRTP-capable server. You can
  flip the toggle without a matching server, but the tunnel will
  hang at "Connecting…" because the server's DTLS-only listener
  doesn't speak SRTP framing. As of this release the only
  SRTP-capable server lives in our fork's feature branch:

  https://github.com/anton48/vk-turn-proxy/tree/add-server-srtp-layer

  The intended workflow: build that server for your VPS target
  architecture, run it on a separate port (e.g. :56004) in parallel
  with your existing legacy DTLS server, and point the client's
  "Proxy Server" port at the new one.

• The legacy DTLS+WG path keeps working unchanged. It remains
  VK-shaped at ~7-9 KB/s per allocation — on 30 conns this is
  roughly 2 Mbps tunnel bandwidth. Still usable as a fallback if
  SRTP becomes detected/shaped in the future.