update forward handler

handler/tunnel/connect.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"net"
-	"strconv"
 	"time"
 
 	"github.com/go-gost/core/logger"
@@ -12,37 +11,54 @@ import (
 	xnet "github.com/go-gost/x/internal/net"
 )
 
-func (h *tunnelHandler) handleConnect(ctx context.Context, conn net.Conn, network, address string, tunnelID relay.TunnelID, log logger.Logger) error {
+func (h *tunnelHandler) handleConnect(ctx context.Context, conn net.Conn, network, srcAddr string, dstAddr string, tunnelID relay.TunnelID, log logger.Logger) error {
 	log = log.WithFields(map[string]any{
-		"dst":    fmt.Sprintf("%s/%s", address, network),
+		"dst":    fmt.Sprintf("%s/%s", dstAddr, network),
 		"cmd":    "connect",
 		"tunnel": tunnelID.String(),
 	})
 
-	log.Debugf("%s >> %s/%s", conn.RemoteAddr(), address, network)
-
 	resp := relay.Response{
 		Version: relay.Version1,
 		Status:  relay.StatusOK,
 	}
 
-	host, sp, _ := net.SplitHostPort(address)
-
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, network, address) {
-		log.Debug("bypass: ", address)
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, network, dstAddr) {
+		log.Debug("bypass: ", dstAddr)
 		resp.Status = relay.StatusForbidden
 		_, err := resp.WriteTo(conn)
 		return err
 	}
 
+	host, _, _ := net.SplitHostPort(dstAddr)
+
 	var tid relay.TunnelID
-	if ingress := h.md.ingress; ingress != nil {
+	if ingress := h.md.ingress; ingress != nil && host != "" {
 		tid = parseTunnelID(ingress.Get(ctx, host))
 	}
 
-	// client is not an public entrypoint.
-	if h.md.entryPointID.IsZero() || !tunnelID.Equal(h.md.entryPointID) {
-		if !tid.Equal(tunnelID) && !h.md.directTunnel {
+	// client is a public entrypoint.
+	if tunnelID.Equal(h.md.entryPointID) && !h.md.entryPointID.IsZero() {
+		if tid.IsZero() {
+			resp.Status = relay.StatusNetworkUnreachable
+			resp.WriteTo(conn)
+			err := fmt.Errorf("no route to host %s", host)
+			log.Error(err)
+			return err
+		}
+
+		if tid.IsPrivate() {
+			resp.Status = relay.StatusHostUnreachable
+			resp.WriteTo(conn)
+			err := fmt.Errorf("access denied: tunnel %s is private for host %s", tunnelID, host)
+			log.Error(err)
+			return err
+		}
+	} else {
+		// direct routing
+		if h.md.directTunnel {
+			tid = tunnelID
+		} else if !tid.Equal(tunnelID) {
 			resp.Status = relay.StatusHostUnreachable
 			resp.WriteTo(conn)
 			err := fmt.Errorf("no route to host %s", host)
@@ -62,36 +78,35 @@ func (h *tunnelHandler) handleConnect(ctx context.Context, conn net.Conn, networ
 
 	log.Debugf("%s >> %s", conn.RemoteAddr(), cc.RemoteAddr())
 
-	rc := &tcpConn{
-		Conn: conn,
-	}
-	// cache the header
-	if _, err := resp.WriteTo(&rc.wbuf); err != nil {
-		return err
-	}
-	conn = rc
-
-	var features []relay.Feature
-	af := &relay.AddrFeature{} // source/visitor address
-	af.ParseFrom(conn.RemoteAddr().String())
-	features = append(features, af)
-
-	if host != "" {
-		port, _ := strconv.Atoi(sp)
-		// target host
-		af = &relay.AddrFeature{
-			AType: relay.AddrDomain,
-			Host:  host,
-			Port:  uint16(port),
+	if h.md.noDelay {
+		if _, err := resp.WriteTo(conn); err != nil {
+			log.Error(err)
+			return err
 		}
-		features = append(features, af)
+	} else {
+		rc := &tcpConn{
+			Conn: conn,
+		}
+		// cache the header
+		if _, err := resp.WriteTo(&rc.wbuf); err != nil {
+			return err
+		}
+		conn = rc
 	}
 
 	resp = relay.Response{
-		Version:  relay.Version1,
-		Status:   relay.StatusOK,
-		Features: features,
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
 	}
+
+	af := &relay.AddrFeature{}
+	af.ParseFrom(srcAddr)
+	resp.Features = append(resp.Features, af) // src address
+
+	af = &relay.AddrFeature{}
+	af.ParseFrom(dstAddr)
+	resp.Features = append(resp.Features, af) // dst address
+
 	resp.WriteTo(cc)
 
 	t := time.Now()

handler/tunnel/handler.go

@@ -118,7 +118,7 @@ func (h *tunnelHandler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 	}
 
 	var user, pass string
-	var address string
+	var srcAddr, dstAddr string
 	var networkID relay.NetworkID
 	var tunnelID relay.TunnelID
 	for _, f := range req.Features {
@@ -129,7 +129,12 @@ func (h *tunnelHandler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 			}
 		case relay.FeatureAddr:
 			if feature, _ := f.(*relay.AddrFeature); feature != nil {
-				address = net.JoinHostPort(feature.Host, strconv.Itoa(int(feature.Port)))
+				v := net.JoinHostPort(feature.Host, strconv.Itoa(int(feature.Port)))
+				if srcAddr != "" {
+					dstAddr = v
+				} else {
+					srcAddr = v
+				}
 			}
 		case relay.FeatureTunnel:
 			if feature, _ := f.(*relay.TunnelFeature); feature != nil {
@@ -170,9 +175,12 @@ func (h *tunnelHandler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 	switch req.Cmd & relay.CmdMask {
 	case relay.CmdConnect:
 		defer conn.Close()
-		return h.handleConnect(ctx, conn, network, address, tunnelID, log)
+
+		log.Debugf("connect: %s >> %s/%s", srcAddr, dstAddr, network)
+		return h.handleConnect(ctx, conn, network, srcAddr, dstAddr, tunnelID, log)
 	case relay.CmdBind:
-		return h.handleBind(ctx, conn, network, address, tunnelID, log)
+		log.Debugf("bind: %s >> %s/%s", srcAddr, dstAddr, network)
+		return h.handleBind(ctx, conn, network, dstAddr, tunnelID, log)
 	default:
 		resp.Status = relay.StatusBadRequest
 		resp.WriteTo(conn)

handler/tunnel/metadata.go

@@ -15,6 +15,7 @@ import (
 
 type metadata struct {
 	readTimeout  time.Duration
+	noDelay      bool
 	hash         string
 	directTunnel bool
 	entryPointID relay.TunnelID
@@ -22,18 +23,13 @@ type metadata struct {
 }
 
 func (h *tunnelHandler) parseMetadata(md mdata.Metadata) (err error) {
-	const (
-		readTimeout  = "readTimeout"
-		entryPointID = "entrypoint.id"
-		hash         = "hash"
-	)
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	h.md.noDelay = mdutil.GetBool(md, "nodelay")
 
-	h.md.readTimeout = mdutil.GetDuration(md, readTimeout)
-
-	h.md.hash = mdutil.GetString(md, hash)
+	h.md.hash = mdutil.GetString(md, "hash")
 
 	h.md.directTunnel = mdutil.GetBool(md, "tunnel.direct")
-	h.md.entryPointID = parseTunnelID(mdutil.GetString(md, entryPointID))
+	h.md.entryPointID = parseTunnelID(mdutil.GetString(md, "entrypoint.id"))
 
 	h.md.ingress = registry.IngressRegistry().Get(mdutil.GetString(md, "ingress"))
 	if h.md.ingress == nil {

handler/tunnel/tunnel.go

@@ -177,6 +177,11 @@ func parseTunnelID(s string) (tid relay.TunnelID) {
 }
 
 func getTunnelConn(network string, pool *ConnectorPool, tid relay.TunnelID, retry int, log logger.Logger) (conn net.Conn, cid relay.ConnectorID, err error) {
+	if tid.IsZero() {
+		err = ErrTunnelID
+		return
+	}
+
 	if retry <= 0 {
 		retry = 1
 	}