Log more details with "invalid padding" error

Also:
- Tighten paddingSize check
- Allow for STUN server failures in test

psiphon/common/inproxy/inproxy_test.go

@@ -883,9 +883,10 @@ func runTestInproxy(doMustUpgrade bool) error {
 			if atomic.LoadInt32(&stunServerAddressSucceededCount) < 1 {
 				return errors.TraceNew("unexpected STUN server succeeded count")
 			}
-		}
-		if atomic.LoadInt32(&stunServerAddressFailedCount) > 0 {
-			return errors.TraceNew("unexpected STUN server failed count")
+			// Allow for some STUN server failures
+			if atomic.LoadInt32(&stunServerAddressFailedCount) >= int32(numProxies/2) {
+				return errors.TraceNew("unexpected STUN server failed count")
+			}
 		}
 
 		// Check if RoundTripper server replay callbacks were triggered

psiphon/common/inproxy/webrtc.go

@@ -1709,13 +1709,21 @@ func (conn *webRTCConn) readDataChannelMessage(p []byte) (int, error) {
 		conn.readLength = n
 		conn.readError = err
 
+		if conn.readLength == 0 && conn.readError != nil {
+			// No bytes were read, so return the error immediately.
+			return 0, errors.TraceReader(err)
+		}
+
 		// Skip over padding.
 
-		if n > 0 && !conn.peerPaddingDone {
+		if conn.readLength > 0 && !conn.peerPaddingDone {
 
 			paddingSize, n := binary.Varint(conn.readBuffer[0:conn.readLength])
-			if (paddingSize == 0 && n <= 0) || paddingSize >= int64(conn.readLength) {
-				return 0, errors.TraceNew("invalid padding")
+
+			if (paddingSize == 0 && n <= 0) || paddingSize > int64(conn.readLength-n) {
+				return 0, errors.Tracef(
+					"invalid padding: %d, %d, %d, %w",
+					n, paddingSize, conn.readLength, conn.readError)
 			}
 
 			if paddingSize < 0 {