File drop needs a local filesystem to deliver into and a receiver it can bind,
so wasm supports neither and never sets a manager. The code still linked in,
because the Engine reached filedrop through an untagged field, and with it the
net/http server and client. That put the wasm binary 0.97MiB over the 60MB
budget, on a main that had 0.34MiB of headroom left.
Split the feature on the js tag: the logic file and the OS dialer become !js,
a js no-op carries the start, stop and rebind entry points the engine calls on
its lifecycle paths, and a build-tagged alias types the manager so engine.go
and connect.go stay untagged and lose the import. iOS keeps the full feature:
the logic file is !js and the iOS dialer stays behind the ios tag.
Drops the wasm binary to 59.89MiB, with no filedrop symbol left in it.
gosec G101 matched the identifier fileDropWatchName: its default pattern
includes a bare "pw", which hits case-insensitively inside "fileDropWatch",
and the constant's value then cleared the entropy threshold. Nothing here is
credential-shaped, so rename rather than suppress. Any fileDropW... spelling
keeps the match, hence fileDropReceiverLabel.
overlayWait and the non-iOS overlayWaiter are read only by the iOS overlay
address wait, and the linter analyses the default build only. Suppress with a
reason; the field stays in engine.go as part of the lifecycle.
iOS applies the tunnel address out of band, after handing the engine the
tun fd, so the receiver bound to that address a moment too early and failed
with EADDRNOTAVAIL. Nothing retried it, leaving the peer able to send but
never to receive for the life of the connection.
Wait for the address to appear and bind then, and let a rebind start a
receiver that is down rather than skipping it. Only the subsystems that
asked to be bound are bound, so the SSH sessions and DNS queries that other
listeners are carrying are left alone.
The wait itself is iOS-only: every other platform assigns the address in the
call chain that creates the interface, or is handed one that already carries
it, so there it compiles down to nothing.
The receiver was bound on every engine start regardless of the profile's
receiving mode, and a failed bind also left the manager without a tunnel
dialer, which took sending down with it.
Set the tunnel dialer before the bind so sending no longer depends on it,
and gate the bind on the receiving mode. A mode change now notifies the
engine, which binds or unbinds accordingly: turning receiving off releases
the listeners and the offer store, empties the spool and settles unfinished
incoming transfers as cancelled.
Also log file drop send and receive failures with the peer and the step that
broke, so a failure can be read from the client log alone.
The receiver's host listener is a socket of the Network Extension, so the
SYN-ACK of an accepted connection followed the extension's own-traffic
bypass onto the physical interface and the sender never got an answer.
Bind the listeners to the tunnel interface index the same way the dial
already is; accepted sockets inherit the scope. Other platforms pass a
nil control and keep the current behavior.
The file drop server listened on 41421, which falls inside the ephemeral
port range on Linux (32768-60999) and Windows (49152-65535), so any
outbound connection could take it after boot. The receiver then bound a
dynamic port and advertised it over signaling, and the sender waited for
that advertisement before retrying.
That coupled a data plane feature to signaling traffic: once a peer
connection is established there is no reason for another offer or answer
to go out, so a sender could wait out the grace period for an
advertisement that never came.
Move the port to 22042, next to the SSH (22022) and DNS forwarder (22054)
ports and clear of both ephemeral ranges, and keep the tunnel side fixed
the way SSH does. A receiver that cannot bind it falls back to a dynamic
port and redirects 22042 to it with an inbound DNAT rule, so senders
always dial the well known port and never negotiate. NB_FILEDROP_PORT
overrides the local bind only.
The DNAT runs ahead of the filter on every backend (nftables prerouting
at NAT dest priority, iptables nat/PREROUTING, and the userspace filter's
translate-then-redecode path), so the netstack service registry keeps
taking the bound port.
This drops the port registry, the retry that waited on it, and the
signaling plumbing that fed it.
Android re-establishes the VpnService interface on every route change, which
replaces tun0 with a fresh device. The file drop listeners are bound to the
overlay address of the interface being swapped out: the IPv4 one dies with
accept4: invalid argument and never comes back, so a peer dialing the overlay
IPv4 address gets an RST. Restart the receiver once the new device is in place.
Files move directly between peers over the overlay, with no server in the
path. The receiver listens on the WireGuard address only, so the port is
unreachable from outside the tunnel, and every offer is matched to a known
peer before anything is read.
Consent is the default: an offer carries metadata alone, and no payload
moves until the receiver accepts. Policy is per profile and device-local —
off, ask, or auto-accept, with per-sender exceptions on top.
Policy and history live in the profile's preferences, so removing a profile
takes its file drop state with it. Transfers interrupted by a restart are
settled on load; nothing survives to finish them, and left alone they would
sit in the log as permanently pending.
The Android bindings pull payload bytes through a chunk-returning stream:
gomobile copies a []byte argument into a fresh Java array and never copies
it back, so a fill-my-buffer method would hand back the right length with
no data.
Zoltán Papp