add sni handler

This commit is contained in:
ginuerzh
2021-11-25 23:08:03 +08:00
parent 6daf0a4d0f
commit 5b97b878fb
12 changed files with 351 additions and 56 deletions

View File

@ -1,10 +1,21 @@
package tls
import (
"crypto/rand"
"crypto/rsa"
"crypto/tls"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"errors"
"io/ioutil"
"math/big"
"time"
)
var (
// DefaultConfig is a default TLS config for global use.
DefaultConfig *tls.Config
)
// LoadTLSConfig loads the certificate from cert & key files and optional client CA file.
@ -38,3 +49,48 @@ func loadCA(caFile string) (cp *x509.CertPool, err error) {
}
return
}
func GenCertificate() (cert tls.Certificate, err error) {
rawCert, rawKey, err := generateKeyPair()
if err != nil {
return
}
return tls.X509KeyPair(rawCert, rawKey)
}
func generateKeyPair() (rawCert, rawKey []byte, err error) {
// Create private key and self-signed certificate
// Adapted from https://golang.org/src/crypto/tls/generate_cert.go
priv, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
return
}
validFor := time.Hour * 24 * 365 * 10 // ten years
notBefore := time.Now()
notAfter := notBefore.Add(validFor)
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, _ := rand.Int(rand.Reader, serialNumberLimit)
template := x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{
Organization: []string{"gost"},
CommonName: "gost.run",
},
NotBefore: notBefore,
NotAfter: notAfter,
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
BasicConstraintsValid: true,
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
if err != nil {
return
}
rawCert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
rawKey = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
return
}

View File

@ -31,6 +31,12 @@ type ProfilingConfig struct {
Enabled bool
}
type TLSConfig struct {
Cert string
Key string
CA string
}
type SelectorConfig struct {
Strategy string
MaxFails int
@ -59,12 +65,12 @@ type ForwarderConfig struct {
type DialerConfig struct {
Type string
Metadata map[string]interface{}
Metadata map[string]interface{} `yaml:",omitempty"`
}
type ConnectorConfig struct {
Type string
Metadata map[string]interface{}
Metadata map[string]interface{} `yaml:",omitempty"`
}
type ServiceConfig struct {
@ -102,6 +108,7 @@ type NodeConfig struct {
type Config struct {
Log *LogConfig `yaml:",omitempty"`
Profiling *ProfilingConfig `yaml:",omitempty"`
TLS *TLSConfig `yaml:",omitempty"`
Services []*ServiceConfig
Chains []*ChainConfig `yaml:",omitempty"`
Bypasses []*BypassConfig `yaml:",omitempty"`

View File

@ -102,16 +102,16 @@ func (h *autoHandler) Handle(ctx context.Context, conn net.Conn) {
return
}
cc := handler.NewBufferReaderConn(conn, br)
conn = handler.NewBufferReaderConn(conn, br)
switch b[0] {
case gosocks4.Ver4: // socks4
h.socks4Handler.Handle(ctx, cc)
h.socks4Handler.Handle(ctx, conn)
case gosocks5.Ver5: // socks5
h.socks5Handler.Handle(ctx, cc)
h.socks5Handler.Handle(ctx, conn)
case relay.Version1: // relay
h.relayHandler.Handle(ctx, cc)
h.relayHandler.Handle(ctx, conn)
default: // http
h.httpHandler.Handle(ctx, cc)
h.httpHandler.Handle(ctx, conn)
}
}

183
pkg/handler/sni/handler.go Normal file
View File

@ -0,0 +1,183 @@
package sni
import (
"bufio"
"context"
"encoding/base64"
"encoding/binary"
"errors"
"hash/crc32"
"io"
"net"
"time"
"github.com/go-gost/gost/pkg/bypass"
"github.com/go-gost/gost/pkg/chain"
"github.com/go-gost/gost/pkg/handler"
http_handler "github.com/go-gost/gost/pkg/handler/http"
"github.com/go-gost/gost/pkg/logger"
md "github.com/go-gost/gost/pkg/metadata"
"github.com/go-gost/gost/pkg/registry"
dissector "github.com/go-gost/tls-dissector"
)
func init() {
registry.RegisterHandler("sni", NewHandler)
}
type sniHandler struct {
httpHandler handler.Handler
chain *chain.Chain
bypass bypass.Bypass
logger logger.Logger
md metadata
}
func NewHandler(opts ...handler.Option) handler.Handler {
options := &handler.Options{}
for _, opt := range opts {
opt(options)
}
log := options.Logger
if log == nil {
log = logger.Default()
}
h := &sniHandler{
bypass: options.Bypass,
logger: log,
}
v := append(opts,
handler.LoggerOption(log.WithFields(map[string]interface{}{"type": "http"})))
h.httpHandler = http_handler.NewHandler(v...)
return h
}
func (h *sniHandler) Init(md md.Metadata) (err error) {
if err = h.parseMetadata(md); err != nil {
return
}
if err = h.httpHandler.Init(md); err != nil {
return
}
return nil
}
// WithChain implements chain.Chainable interface
func (h *sniHandler) WithChain(chain *chain.Chain) {
h.chain = chain
}
func (h *sniHandler) Handle(ctx context.Context, conn net.Conn) {
defer conn.Close()
start := time.Now()
h.logger = h.logger.WithFields(map[string]interface{}{
"remote": conn.RemoteAddr().String(),
"local": conn.LocalAddr().String(),
})
h.logger.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
defer func() {
h.logger.WithFields(map[string]interface{}{
"duration": time.Since(start),
}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
}()
br := bufio.NewReader(conn)
hdr, err := br.Peek(dissector.RecordHeaderLen)
if err != nil {
h.logger.Error(err)
return
}
conn = handler.NewBufferReaderConn(conn, br)
if hdr[0] != dissector.Handshake {
// We assume it is an HTTP request
h.httpHandler.Handle(ctx, conn)
return
}
host, err := h.decodeHost(conn)
if err != nil {
h.logger.Error(err)
return
}
target := net.JoinHostPort(host, "443")
h.logger = h.logger.WithFields(map[string]interface{}{
"dst": target,
})
h.logger.Infof("%s >> %s", conn.RemoteAddr(), target)
if h.bypass != nil && h.bypass.Contains(target) {
h.logger.Info("bypass: ", target)
return
}
r := (&chain.Router{}).
WithChain(h.chain).
WithRetry(h.md.retryCount).
WithLogger(h.logger)
cc, err := r.Dial(ctx, "tcp", target)
if err != nil {
return
}
defer cc.Close()
t := time.Now()
h.logger.Infof("%s <-> %s", conn.RemoteAddr(), target)
handler.Transport(conn, cc)
h.logger.
WithFields(map[string]interface{}{
"duration": time.Since(t),
}).
Infof("%s >-< %s", conn.RemoteAddr(), target)
}
func (h *sniHandler) decodeHost(r io.Reader) (host string, err error) {
record, err := dissector.ReadRecord(r)
if err != nil {
return
}
clientHello := &dissector.ClientHelloMsg{}
if err = clientHello.Decode(record.Opaque); err != nil {
return
}
for _, ext := range clientHello.Extensions {
if ext.Type() == 0xFFFE {
b, _ := ext.Encode()
return h.decodeServerName(string(b))
}
if ext.Type() == dissector.ExtServerName {
snExtension := ext.(*dissector.ServerNameExtension)
host = snExtension.Name
}
}
return
}
func (h *sniHandler) decodeServerName(s string) (string, error) {
b, err := base64.RawURLEncoding.DecodeString(s)
if err != nil {
return "", err
}
if len(b) < 4 {
return "", errors.New("invalid name")
}
v, err := base64.RawURLEncoding.DecodeString(string(b[4:]))
if err != nil {
return "", err
}
if crc32.ChecksumIEEE(v) != binary.BigEndian.Uint32(b[:4]) {
return "", errors.New("invalid name")
}
return string(v), nil
}

View File

@ -0,0 +1,23 @@
package sni
import (
"time"
md "github.com/go-gost/gost/pkg/metadata"
)
type metadata struct {
readTimeout time.Duration
retryCount int
}
func (h *sniHandler) parseMetadata(md md.Metadata) (err error) {
const (
readTimeout = "readTimeout"
retryCount = "retry"
)
h.md.readTimeout = md.GetDuration(readTimeout)
h.md.retryCount = md.GetInt(retryCount)
return
}

View File

@ -5,7 +5,6 @@ import (
"net"
"github.com/go-gost/gost/pkg/common/util"
tls_util "github.com/go-gost/gost/pkg/common/util/tls"
"github.com/go-gost/gost/pkg/listener"
"github.com/go-gost/gost/pkg/logger"
md "github.com/go-gost/gost/pkg/metadata"
@ -55,17 +54,3 @@ func (l *tlsListener) Init(md md.Metadata) (err error) {
l.Listener = ln
return
}
func (l *tlsListener) parseMetadata(md md.Metadata) (err error) {
l.md.tlsConfig, err = tls_util.LoadTLSConfig(
md.GetString(certFile),
md.GetString(keyFile),
md.GetString(caFile),
)
if err != nil {
return
}
l.md.keepAlivePeriod = md.GetDuration(keepAlivePeriod)
return
}

View File

@ -3,16 +3,39 @@ package tls
import (
"crypto/tls"
"time"
)
const (
certFile = "certFile"
keyFile = "keyFile"
caFile = "caFile"
keepAlivePeriod = "keepAlivePeriod"
tls_util "github.com/go-gost/gost/pkg/common/util/tls"
md "github.com/go-gost/gost/pkg/metadata"
)
type metadata struct {
tlsConfig *tls.Config
keepAlivePeriod time.Duration
}
func (l *tlsListener) parseMetadata(md md.Metadata) (err error) {
const (
certFile = "certFile"
keyFile = "keyFile"
caFile = "caFile"
keepAlivePeriod = "keepAlivePeriod"
)
if md.GetString(certFile) != "" ||
md.GetString(keyFile) != "" ||
md.GetString(caFile) != "" {
l.md.tlsConfig, err = tls_util.LoadTLSConfig(
md.GetString(certFile),
md.GetString(keyFile),
md.GetString(caFile),
)
if err != nil {
return
}
} else {
l.md.tlsConfig = tls_util.DefaultConfig
}
l.md.keepAlivePeriod = md.GetDuration(keepAlivePeriod)
return
}