This repository has been archived by the owner on May 6, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 95
refactor(intra): use outline-sdk as the network stack #125
Merged
Merged
Changes from all commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
f837468
refactor(intra): use outline-sdk as the network stack
jyyi1 e30b145
update gomobile to the latest version
jyyi1 2698578
Update intra/packet_proxy.go
jyyi1 cddafa6
replace queryconn with net.Pipe
jyyi1 5356b05
remove logs which might hurt performance
jyyi1 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
package tun2socks | ||
|
||
// Copyright 2019 The Outline Authors | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
import ( | ||
"runtime/debug" | ||
|
||
"github.com/eycorsican/go-tun2socks/common/log" | ||
) | ||
|
||
func init() { | ||
// Conserve memory by increasing garbage collection frequency. | ||
debug.SetGCPercent(10) | ||
log.SetLevel(log.WARN) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,38 @@ | ||
// Copyright 2023 Jigsaw Operations LLC | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
package tun2socks | ||
|
||
import ( | ||
"errors" | ||
"os" | ||
|
||
"golang.org/x/sys/unix" | ||
) | ||
|
||
func makeTunFile(fd int) (*os.File, error) { | ||
if fd < 0 { | ||
return nil, errors.New("must provide a valid TUN file descriptor") | ||
} | ||
// Make a copy of `fd` so that os.File's finalizer doesn't close `fd`. | ||
newfd, err := unix.Dup(fd) | ||
if err != nil { | ||
return nil, err | ||
} | ||
file := os.NewFile(uintptr(newfd), "") | ||
if file == nil { | ||
return nil, errors.New("failed to open TUN file descriptor") | ||
} | ||
return file, nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -15,67 +15,96 @@ | |
package tun2socks | ||
|
||
import ( | ||
"runtime/debug" | ||
"errors" | ||
"io" | ||
"io/fs" | ||
"log" | ||
"os" | ||
"strings" | ||
|
||
"github.com/Jigsaw-Code/outline-go-tun2socks/intra" | ||
"github.com/Jigsaw-Code/outline-go-tun2socks/intra/doh" | ||
"github.com/Jigsaw-Code/outline-go-tun2socks/intra/protect" | ||
"github.com/Jigsaw-Code/outline-go-tun2socks/tunnel" | ||
"github.com/eycorsican/go-tun2socks/common/log" | ||
"github.com/Jigsaw-Code/outline-sdk/network" | ||
) | ||
|
||
func init() { | ||
// Conserve memory by increasing garbage collection frequency. | ||
debug.SetGCPercent(10) | ||
log.SetLevel(log.WARN) | ||
} | ||
|
||
// ConnectIntraTunnel reads packets from a TUN device and applies the Intra routing | ||
// rules. Currently, this only consists of redirecting DNS packets to a specified | ||
// server; all other data flows directly to its destination. | ||
// | ||
// `fd` is the TUN device. The IntraTunnel acquires an additional reference to it, which | ||
// is released by IntraTunnel.Disconnect(), so the caller must close `fd` _and_ call | ||
// Disconnect() in order to close the TUN device. | ||
// | ||
// is released by IntraTunnel.Disconnect(), so the caller must close `fd` _and_ call | ||
// Disconnect() in order to close the TUN device. | ||
// | ||
// `fakedns` is the DNS server that the system believes it is using, in "host:port" style. | ||
// The port is normally 53. | ||
// | ||
// The port is normally 53. | ||
// | ||
// `udpdns` and `tcpdns` are the location of the actual DNS server being used. For DNS | ||
// tunneling in Intra, these are typically high-numbered ports on localhost. | ||
// | ||
// tunneling in Intra, these are typically high-numbered ports on localhost. | ||
// | ||
// `dohdns` is the initial DoH transport. It must not be `nil`. | ||
// `protector` is a wrapper for Android's VpnService.protect() method. | ||
// `listener` will be provided with a summary of each TCP and UDP socket when it is closed. | ||
// `eventListener` will be provided with a summary of each TCP and UDP socket when it is closed. | ||
// | ||
// Throws an exception if the TUN file descriptor cannot be opened, or if the tunnel fails to | ||
// connect. | ||
func ConnectIntraTunnel(fd int, fakedns string, dohdns doh.Transport, protector protect.Protector, listener intra.Listener) (intra.Tunnel, error) { | ||
tun, err := tunnel.MakeTunFile(fd) | ||
func ConnectIntraTunnel( | ||
fd int, fakedns string, dohdns doh.Transport, protector protect.Protector, eventListener intra.Listener, | ||
) (*intra.Tunnel, error) { | ||
tun, err := makeTunFile(fd) | ||
if err != nil { | ||
return nil, err | ||
} | ||
dialer := protect.MakeDialer(protector) | ||
config := protect.MakeListenConfig(protector) | ||
t, err := intra.NewTunnel(fakedns, dohdns, tun, dialer, config, listener) | ||
t, err := intra.NewTunnel(fakedns, dohdns, tun, protector, eventListener) | ||
if err != nil { | ||
return nil, err | ||
} | ||
go tunnel.ProcessInputPackets(t, tun) | ||
go copyUntilEOF(t, tun) | ||
go copyUntilEOF(tun, t) | ||
return t, nil | ||
} | ||
|
||
// NewDoHTransport returns a DNSTransport that connects to the specified DoH server. | ||
// `url` is the URL of a DoH server (no template, POST-only). If it is nonempty, it | ||
// overrides `udpdns` and `tcpdns`. | ||
// | ||
// overrides `udpdns` and `tcpdns`. | ||
// | ||
// `ips` is an optional comma-separated list of IP addresses for the server. (This | ||
// wrapper is required because gomobile can't make bindings for []string.) | ||
// | ||
// wrapper is required because gomobile can't make bindings for []string.) | ||
// | ||
// `protector` is the socket protector to use for all external network activity. | ||
// `auth` will provide a client certificate if required by the TLS server. | ||
// `listener` will be notified after each DNS query succeeds or fails. | ||
func NewDoHTransport(url string, ips string, protector protect.Protector, auth doh.ClientAuth, listener intra.Listener) (doh.Transport, error) { | ||
// `eventListener` will be notified after each DNS query succeeds or fails. | ||
func NewDoHTransport( | ||
url string, ips string, protector protect.Protector, auth doh.ClientAuth, eventListener intra.Listener, | ||
) (doh.Transport, error) { | ||
split := []string{} | ||
if len(ips) > 0 { | ||
split = strings.Split(ips, ",") | ||
} | ||
dialer := protect.MakeDialer(protector) | ||
return doh.NewTransport(url, split, dialer, auth, listener) | ||
return doh.NewTransport(url, split, dialer, auth, eventListener) | ||
} | ||
|
||
func copyUntilEOF(dst, src io.ReadWriteCloser) { | ||
log.Printf("[debug] start relaying traffic [%s] -> [%s]", src, dst) | ||
jyyi1 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
defer log.Printf("[debug] stop relaying traffic [%s] -> [%s]", src, dst) | ||
|
||
const commonMTU = 1500 | ||
buf := make([]byte, commonMTU) | ||
defer dst.Close() | ||
for { | ||
_, err := io.CopyBuffer(dst, src, buf) | ||
if err == nil || isErrClosed(err) { | ||
return | ||
} | ||
} | ||
} | ||
|
||
func isErrClosed(err error) bool { | ||
return errors.Is(err, os.ErrClosed) || errors.Is(err, fs.ErrClosed) || errors.Is(err, network.ErrClosed) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Do we return There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It's not us, it's the tun device (os.File) that doesn't conform with go's rules, it will return |
||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,23 @@ | ||
// Copyright 2023 Jigsaw Operations LLC | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
package intra | ||
|
||
import "net/netip" | ||
|
||
// isEquivalentAddrPort checks if addr1 and addr2 are equivalent. More specifically, it will treat | ||
// "ffff::127.0.0.1" (IPv4-in-6) and "127.0.0.1" (IPv4) as equivalent, even though they are "!=" in Go. | ||
func isEquivalentAddrPort(addr1, addr2 netip.AddrPort) bool { | ||
return addr1.Addr().Unmap() == addr2.Addr().Unmap() && addr1.Port() == addr2.Port() | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,76 @@ | ||
// Copyright 2023 Jigsaw Operations LLC | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
package intra | ||
|
||
import ( | ||
"net/netip" | ||
"testing" | ||
) | ||
|
||
func TestIsEquivalentAddrPort(t *testing.T) { | ||
cases := []struct { | ||
in1, in2 netip.AddrPort | ||
want bool | ||
msg string | ||
}{ | ||
{ | ||
in1: netip.MustParseAddrPort("12.34.56.78:80"), | ||
in2: netip.AddrPortFrom(netip.AddrFrom4([4]byte{12, 34, 56, 78}), 80), | ||
want: true, | ||
}, | ||
{ | ||
in1: netip.MustParseAddrPort("[fe80::1234:5678]:443"), | ||
in2: netip.AddrPortFrom(netip.AddrFrom16([16]byte{0xfe, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x12, 0x34, 0x56, 0x78}), 443), | ||
want: true, | ||
}, | ||
{ | ||
in1: netip.MustParseAddrPort("0.0.0.0:80"), | ||
in2: netip.MustParseAddrPort("127.0.0.1:80"), | ||
want: false, | ||
}, | ||
{ | ||
in1: netip.AddrPortFrom(netip.IPv6Unspecified(), 80), | ||
in2: netip.AddrPortFrom(netip.IPv6Loopback(), 80), | ||
want: false, | ||
}, | ||
{ | ||
in1: netip.MustParseAddrPort("127.0.0.1:38880"), | ||
in2: netip.MustParseAddrPort("127.0.0.1:38888"), | ||
want: false, | ||
}, | ||
{ | ||
in1: netip.MustParseAddrPort("[2001:db8:85a3:8d3:1319:8a2e:370:7348]:33443"), | ||
in2: netip.MustParseAddrPort("[2001:db8:85a3:8d3:1319:8a2e:370:7348]:33444"), | ||
want: false, | ||
}, | ||
{ | ||
in1: netip.MustParseAddrPort("127.0.0.1:8080"), | ||
in2: netip.MustParseAddrPort("[::ffff:127.0.0.1]:8080"), | ||
want: true, | ||
}, | ||
{ | ||
in1: netip.AddrPortFrom(netip.IPv6Loopback(), 80), | ||
in2: netip.MustParseAddrPort("127.0.0.1:80"), | ||
want: false, | ||
}, | ||
} | ||
|
||
for _, tc := range cases { | ||
actual := isEquivalentAddrPort(tc.in1, tc.in2) | ||
if actual != tc.want { | ||
t.Fatalf(`"%v" == "%v"? want %v, actual %v`, tc.in1, tc.in2, tc.want, actual) | ||
} | ||
} | ||
} |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Close the tun device once the IPDevice closes. The IPDevice shouldn't know about the tun device. See comments on tunnel.go
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's postpone this to next PR(s) in Intra repository, see the refactoring comment above.