add sni handler
This commit is contained in:
@ -1,10 +1,21 @@
|
||||
package tls
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"io/ioutil"
|
||||
"math/big"
|
||||
"time"
|
||||
)
|
||||
|
||||
var (
|
||||
// DefaultConfig is a default TLS config for global use.
|
||||
DefaultConfig *tls.Config
|
||||
)
|
||||
|
||||
// LoadTLSConfig loads the certificate from cert & key files and optional client CA file.
|
||||
@ -38,3 +49,48 @@ func loadCA(caFile string) (cp *x509.CertPool, err error) {
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func GenCertificate() (cert tls.Certificate, err error) {
|
||||
rawCert, rawKey, err := generateKeyPair()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
return tls.X509KeyPair(rawCert, rawKey)
|
||||
}
|
||||
|
||||
func generateKeyPair() (rawCert, rawKey []byte, err error) {
|
||||
// Create private key and self-signed certificate
|
||||
// Adapted from https://golang.org/src/crypto/tls/generate_cert.go
|
||||
|
||||
priv, err := rsa.GenerateKey(rand.Reader, 2048)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
validFor := time.Hour * 24 * 365 * 10 // ten years
|
||||
notBefore := time.Now()
|
||||
notAfter := notBefore.Add(validFor)
|
||||
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
|
||||
serialNumber, _ := rand.Int(rand.Reader, serialNumberLimit)
|
||||
template := x509.Certificate{
|
||||
SerialNumber: serialNumber,
|
||||
Subject: pkix.Name{
|
||||
Organization: []string{"gost"},
|
||||
CommonName: "gost.run",
|
||||
},
|
||||
NotBefore: notBefore,
|
||||
NotAfter: notAfter,
|
||||
|
||||
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
rawCert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
|
||||
rawKey = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
|
||||
|
||||
return
|
||||
}
|
||||
|
@ -31,6 +31,12 @@ type ProfilingConfig struct {
|
||||
Enabled bool
|
||||
}
|
||||
|
||||
type TLSConfig struct {
|
||||
Cert string
|
||||
Key string
|
||||
CA string
|
||||
}
|
||||
|
||||
type SelectorConfig struct {
|
||||
Strategy string
|
||||
MaxFails int
|
||||
@ -59,12 +65,12 @@ type ForwarderConfig struct {
|
||||
|
||||
type DialerConfig struct {
|
||||
Type string
|
||||
Metadata map[string]interface{}
|
||||
Metadata map[string]interface{} `yaml:",omitempty"`
|
||||
}
|
||||
|
||||
type ConnectorConfig struct {
|
||||
Type string
|
||||
Metadata map[string]interface{}
|
||||
Metadata map[string]interface{} `yaml:",omitempty"`
|
||||
}
|
||||
|
||||
type ServiceConfig struct {
|
||||
@ -102,6 +108,7 @@ type NodeConfig struct {
|
||||
type Config struct {
|
||||
Log *LogConfig `yaml:",omitempty"`
|
||||
Profiling *ProfilingConfig `yaml:",omitempty"`
|
||||
TLS *TLSConfig `yaml:",omitempty"`
|
||||
Services []*ServiceConfig
|
||||
Chains []*ChainConfig `yaml:",omitempty"`
|
||||
Bypasses []*BypassConfig `yaml:",omitempty"`
|
||||
|
@ -102,16 +102,16 @@ func (h *autoHandler) Handle(ctx context.Context, conn net.Conn) {
|
||||
return
|
||||
}
|
||||
|
||||
cc := handler.NewBufferReaderConn(conn, br)
|
||||
conn = handler.NewBufferReaderConn(conn, br)
|
||||
switch b[0] {
|
||||
case gosocks4.Ver4: // socks4
|
||||
h.socks4Handler.Handle(ctx, cc)
|
||||
h.socks4Handler.Handle(ctx, conn)
|
||||
case gosocks5.Ver5: // socks5
|
||||
h.socks5Handler.Handle(ctx, cc)
|
||||
h.socks5Handler.Handle(ctx, conn)
|
||||
case relay.Version1: // relay
|
||||
h.relayHandler.Handle(ctx, cc)
|
||||
h.relayHandler.Handle(ctx, conn)
|
||||
default: // http
|
||||
h.httpHandler.Handle(ctx, cc)
|
||||
h.httpHandler.Handle(ctx, conn)
|
||||
}
|
||||
|
||||
}
|
||||
|
183
pkg/handler/sni/handler.go
Normal file
183
pkg/handler/sni/handler.go
Normal file
@ -0,0 +1,183 @@
|
||||
package sni
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"encoding/binary"
|
||||
"errors"
|
||||
"hash/crc32"
|
||||
"io"
|
||||
"net"
|
||||
"time"
|
||||
|
||||
"github.com/go-gost/gost/pkg/bypass"
|
||||
"github.com/go-gost/gost/pkg/chain"
|
||||
"github.com/go-gost/gost/pkg/handler"
|
||||
http_handler "github.com/go-gost/gost/pkg/handler/http"
|
||||
"github.com/go-gost/gost/pkg/logger"
|
||||
md "github.com/go-gost/gost/pkg/metadata"
|
||||
"github.com/go-gost/gost/pkg/registry"
|
||||
dissector "github.com/go-gost/tls-dissector"
|
||||
)
|
||||
|
||||
func init() {
|
||||
registry.RegisterHandler("sni", NewHandler)
|
||||
}
|
||||
|
||||
type sniHandler struct {
|
||||
httpHandler handler.Handler
|
||||
chain *chain.Chain
|
||||
bypass bypass.Bypass
|
||||
logger logger.Logger
|
||||
md metadata
|
||||
}
|
||||
|
||||
func NewHandler(opts ...handler.Option) handler.Handler {
|
||||
options := &handler.Options{}
|
||||
for _, opt := range opts {
|
||||
opt(options)
|
||||
}
|
||||
|
||||
log := options.Logger
|
||||
if log == nil {
|
||||
log = logger.Default()
|
||||
}
|
||||
|
||||
h := &sniHandler{
|
||||
bypass: options.Bypass,
|
||||
logger: log,
|
||||
}
|
||||
|
||||
v := append(opts,
|
||||
handler.LoggerOption(log.WithFields(map[string]interface{}{"type": "http"})))
|
||||
h.httpHandler = http_handler.NewHandler(v...)
|
||||
|
||||
return h
|
||||
}
|
||||
|
||||
func (h *sniHandler) Init(md md.Metadata) (err error) {
|
||||
if err = h.parseMetadata(md); err != nil {
|
||||
return
|
||||
}
|
||||
if err = h.httpHandler.Init(md); err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// WithChain implements chain.Chainable interface
|
||||
func (h *sniHandler) WithChain(chain *chain.Chain) {
|
||||
h.chain = chain
|
||||
}
|
||||
|
||||
func (h *sniHandler) Handle(ctx context.Context, conn net.Conn) {
|
||||
defer conn.Close()
|
||||
|
||||
start := time.Now()
|
||||
h.logger = h.logger.WithFields(map[string]interface{}{
|
||||
"remote": conn.RemoteAddr().String(),
|
||||
"local": conn.LocalAddr().String(),
|
||||
})
|
||||
|
||||
h.logger.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
|
||||
defer func() {
|
||||
h.logger.WithFields(map[string]interface{}{
|
||||
"duration": time.Since(start),
|
||||
}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
|
||||
}()
|
||||
|
||||
br := bufio.NewReader(conn)
|
||||
hdr, err := br.Peek(dissector.RecordHeaderLen)
|
||||
if err != nil {
|
||||
h.logger.Error(err)
|
||||
return
|
||||
}
|
||||
|
||||
conn = handler.NewBufferReaderConn(conn, br)
|
||||
|
||||
if hdr[0] != dissector.Handshake {
|
||||
// We assume it is an HTTP request
|
||||
h.httpHandler.Handle(ctx, conn)
|
||||
return
|
||||
}
|
||||
|
||||
host, err := h.decodeHost(conn)
|
||||
if err != nil {
|
||||
h.logger.Error(err)
|
||||
return
|
||||
}
|
||||
target := net.JoinHostPort(host, "443")
|
||||
|
||||
h.logger = h.logger.WithFields(map[string]interface{}{
|
||||
"dst": target,
|
||||
})
|
||||
h.logger.Infof("%s >> %s", conn.RemoteAddr(), target)
|
||||
|
||||
if h.bypass != nil && h.bypass.Contains(target) {
|
||||
h.logger.Info("bypass: ", target)
|
||||
return
|
||||
}
|
||||
|
||||
r := (&chain.Router{}).
|
||||
WithChain(h.chain).
|
||||
WithRetry(h.md.retryCount).
|
||||
WithLogger(h.logger)
|
||||
cc, err := r.Dial(ctx, "tcp", target)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
defer cc.Close()
|
||||
|
||||
t := time.Now()
|
||||
h.logger.Infof("%s <-> %s", conn.RemoteAddr(), target)
|
||||
handler.Transport(conn, cc)
|
||||
h.logger.
|
||||
WithFields(map[string]interface{}{
|
||||
"duration": time.Since(t),
|
||||
}).
|
||||
Infof("%s >-< %s", conn.RemoteAddr(), target)
|
||||
}
|
||||
|
||||
func (h *sniHandler) decodeHost(r io.Reader) (host string, err error) {
|
||||
record, err := dissector.ReadRecord(r)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
clientHello := &dissector.ClientHelloMsg{}
|
||||
if err = clientHello.Decode(record.Opaque); err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
for _, ext := range clientHello.Extensions {
|
||||
if ext.Type() == 0xFFFE {
|
||||
b, _ := ext.Encode()
|
||||
return h.decodeServerName(string(b))
|
||||
}
|
||||
|
||||
if ext.Type() == dissector.ExtServerName {
|
||||
snExtension := ext.(*dissector.ServerNameExtension)
|
||||
host = snExtension.Name
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func (h *sniHandler) decodeServerName(s string) (string, error) {
|
||||
b, err := base64.RawURLEncoding.DecodeString(s)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if len(b) < 4 {
|
||||
return "", errors.New("invalid name")
|
||||
}
|
||||
v, err := base64.RawURLEncoding.DecodeString(string(b[4:]))
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if crc32.ChecksumIEEE(v) != binary.BigEndian.Uint32(b[:4]) {
|
||||
return "", errors.New("invalid name")
|
||||
}
|
||||
return string(v), nil
|
||||
}
|
23
pkg/handler/sni/metadata.go
Normal file
23
pkg/handler/sni/metadata.go
Normal file
@ -0,0 +1,23 @@
|
||||
package sni
|
||||
|
||||
import (
|
||||
"time"
|
||||
|
||||
md "github.com/go-gost/gost/pkg/metadata"
|
||||
)
|
||||
|
||||
type metadata struct {
|
||||
readTimeout time.Duration
|
||||
retryCount int
|
||||
}
|
||||
|
||||
func (h *sniHandler) parseMetadata(md md.Metadata) (err error) {
|
||||
const (
|
||||
readTimeout = "readTimeout"
|
||||
retryCount = "retry"
|
||||
)
|
||||
|
||||
h.md.readTimeout = md.GetDuration(readTimeout)
|
||||
h.md.retryCount = md.GetInt(retryCount)
|
||||
return
|
||||
}
|
@ -5,7 +5,6 @@ import (
|
||||
"net"
|
||||
|
||||
"github.com/go-gost/gost/pkg/common/util"
|
||||
tls_util "github.com/go-gost/gost/pkg/common/util/tls"
|
||||
"github.com/go-gost/gost/pkg/listener"
|
||||
"github.com/go-gost/gost/pkg/logger"
|
||||
md "github.com/go-gost/gost/pkg/metadata"
|
||||
@ -55,17 +54,3 @@ func (l *tlsListener) Init(md md.Metadata) (err error) {
|
||||
l.Listener = ln
|
||||
return
|
||||
}
|
||||
|
||||
func (l *tlsListener) parseMetadata(md md.Metadata) (err error) {
|
||||
l.md.tlsConfig, err = tls_util.LoadTLSConfig(
|
||||
md.GetString(certFile),
|
||||
md.GetString(keyFile),
|
||||
md.GetString(caFile),
|
||||
)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
l.md.keepAlivePeriod = md.GetDuration(keepAlivePeriod)
|
||||
return
|
||||
}
|
||||
|
@ -3,16 +3,39 @@ package tls
|
||||
import (
|
||||
"crypto/tls"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
certFile = "certFile"
|
||||
keyFile = "keyFile"
|
||||
caFile = "caFile"
|
||||
keepAlivePeriod = "keepAlivePeriod"
|
||||
tls_util "github.com/go-gost/gost/pkg/common/util/tls"
|
||||
md "github.com/go-gost/gost/pkg/metadata"
|
||||
)
|
||||
|
||||
type metadata struct {
|
||||
tlsConfig *tls.Config
|
||||
keepAlivePeriod time.Duration
|
||||
}
|
||||
|
||||
func (l *tlsListener) parseMetadata(md md.Metadata) (err error) {
|
||||
const (
|
||||
certFile = "certFile"
|
||||
keyFile = "keyFile"
|
||||
caFile = "caFile"
|
||||
keepAlivePeriod = "keepAlivePeriod"
|
||||
)
|
||||
|
||||
if md.GetString(certFile) != "" ||
|
||||
md.GetString(keyFile) != "" ||
|
||||
md.GetString(caFile) != "" {
|
||||
l.md.tlsConfig, err = tls_util.LoadTLSConfig(
|
||||
md.GetString(certFile),
|
||||
md.GetString(keyFile),
|
||||
md.GetString(caFile),
|
||||
)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
} else {
|
||||
l.md.tlsConfig = tls_util.DefaultConfig
|
||||
}
|
||||
|
||||
l.md.keepAlivePeriod = md.GetDuration(keepAlivePeriod)
|
||||
return
|
||||
}
|
||||
|
Reference in New Issue
Block a user