add handle options for sniffer

config/cmd/cmd.go

@@ -10,12 +10,12 @@ import (
 	"strings"
 	"time"
 
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/x/config"
 	xnet "github.com/go-gost/x/internal/net"
 	"github.com/go-gost/x/limiter/conn"
 	"github.com/go-gost/x/limiter/traffic"
 	mdx "github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

config/parsing/hop/parse.go

@@ -8,7 +8,6 @@ import (
 	"github.com/go-gost/core/chain"
 	"github.com/go-gost/core/hop"
 	"github.com/go-gost/core/logger"
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/x/config"
 	"github.com/go-gost/x/config/parsing"
 	bypass_parser "github.com/go-gost/x/config/parsing/bypass"
@@ -19,6 +18,7 @@ import (
 	"github.com/go-gost/x/internal/loader"
 	"github.com/go-gost/x/internal/plugin"
 	"github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 func ParseHop(cfg *config.HopConfig, log logger.Logger) (hop.Hop, error) {

config/parsing/node/parse.go

@@ -12,7 +12,7 @@ import (
 	"github.com/go-gost/core/dialer"
 	"github.com/go-gost/core/logger"
 	"github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	xauth "github.com/go-gost/x/auth"
 	xchain "github.com/go-gost/x/chain"
 	"github.com/go-gost/x/config"

config/parsing/service/parse.go

@@ -14,7 +14,7 @@ import (
 	"github.com/go-gost/core/hop"
 	"github.com/go-gost/core/listener"
 	"github.com/go-gost/core/logger"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
 	"github.com/go-gost/core/selector"

connector/http/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/http2/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/relay/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

connector/sni/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/socks/v4/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/socks/v5/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

connector/ss/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/ss/udp/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/tunnel/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/relay"
 	"github.com/go-gost/x/internal/util/mux"
 	"github.com/google/uuid"

dialer/dtls/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/grpc/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/http2/h2/metadata.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/http3/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/http3/wt/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/icmp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/kcp/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	kcp_util "github.com/go-gost/x/internal/util/kcp"
 )
 

dialer/mtcp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

dialer/mtls/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

dialer/mws/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

dialer/obfs/http/metadata.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/obfs/tls/metadata.go

@@ -2,7 +2,7 @@ package tls
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/pht/metadata.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/quic/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/ssh/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/mitchellh/go-homedir"
 	"github.com/zalando/go-keyring"
 	"golang.org/x/crypto/ssh"

dialer/sshd/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/mitchellh/go-homedir"
 	"github.com/zalando/go-keyring"
 	"golang.org/x/crypto/ssh"

dialer/tls/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/ws/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/gin-contrib/cors v1.6.0
 	github.com/gin-gonic/gin v1.9.1
-	github.com/go-gost/core v0.1.5
+	github.com/go-gost/core v0.1.6
 	github.com/go-gost/gosocks4 v0.0.1
 	github.com/go-gost/gosocks5 v0.4.2
 	github.com/go-gost/plugin v0.1.1

go.sum

@@ -53,8 +53,8 @@ github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
 github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU=
-github.com/go-gost/core v0.1.5 h1:Rbj+xq+q2RkxviUErjwyT8wbqCa5WeV+UelyIs99dFI=
-github.com/go-gost/core v0.1.5/go.mod h1:WGI43jOka7FAsSAwi/fSMaqxdR+E339ycb4NBGlFr6A=
+github.com/go-gost/core v0.1.6 h1:0Vdck2qrcfi1jz5f7fhfj+Uu0qvZhCdTdIisa5NDa98=
+github.com/go-gost/core v0.1.6/go.mod h1:WGI43jOka7FAsSAwi/fSMaqxdR+E339ycb4NBGlFr6A=
 github.com/go-gost/gosocks4 v0.0.1 h1:+k1sec8HlELuQV7rWftIkmy8UijzUt2I6t+iMPlGB2s=
 github.com/go-gost/gosocks4 v0.0.1/go.mod h1:3B6L47HbU/qugDg4JnoFPHgJXE43Inz8Bah1QaN9qCc=
 github.com/go-gost/gosocks5 v0.4.2 h1:IianxHTkACPqCwiOAT3MHoMdSUl+SEPSRu1ikawC1Pc=

handler/dns/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/file/metadata.go

@@ -2,7 +2,7 @@ package file
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

handler/forward/local/metadata.go

@@ -1,16 +1,27 @@
 package local
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
-	readTimeout     time.Duration
+	readTimeout time.Duration
+
 	sniffing        bool
 	sniffingTimeout time.Duration
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *forwardHandler) parseMetadata(md mdata.Metadata) (err error) {
@@ -18,7 +29,25 @@ func (h *forwardHandler) parseMetadata(md mdata.Metadata) (err error) {
 	if h.md.readTimeout <= 0 {
 		h.md.readTimeout = 15 * time.Second
 	}
+
 	h.md.sniffing = mdutil.GetBool(md, "sniffing")
 	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return
 }

handler/forward/remote/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

handler/http2/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/http3/metadata.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

handler/metrics/metadata.go

@@ -2,7 +2,7 @@ package file
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/redirect/tcp/handler.go

@@ -162,6 +162,9 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 			}
 
 			if cc == nil {
+				if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", dstAddr.String()) {
+					return nil, xbypass.ErrBypass
+				}
 				var buf bytes.Buffer
 				cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", dstAddr.String())
 				ro.Route = buf.String()
@@ -170,30 +173,39 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 
 			return cc, err
 		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return dial(ctx, network, address)
+		}
 
 		sniffer := &sniffing.Sniffer{
 			Recorder:           h.recorder.Recorder,
 			RecorderOptions:    h.recorder.Options,
-			RecorderObject:     ro,
 			Certificate:        h.md.certificate,
 			PrivateKey:         h.md.privateKey,
 			NegotiatedProtocol: h.md.alpn,
 			CertPool:           h.certPool,
 			MitmBypass:         h.md.mitmBypass,
 			ReadTimeout:        h.md.readTimeout,
-			Log:                log,
-			Dial:               dial,
-			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-				return dial(ctx, network, address)
-			},
 		}
 
 		conn = xnet.NewReadWriteConn(br, conn, conn)
 		switch proto {
 		case sniffing.ProtoHTTP:
-			return sniffer.HandleHTTP(ctx, conn)
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithBypass(h.options.Bypass),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		case sniffing.ProtoTLS:
-			return sniffer.HandleTLS(ctx, conn)
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithBypass(h.options.Bypass),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 

handler/redirect/tcp/metadata.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

handler/relay/connect.go

@@ -154,31 +154,39 @@ func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network
 			conn.SetReadDeadline(time.Time{})
 		}
 
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
 		sniffer := &sniffing.Sniffer{
 			Recorder:           h.recorder.Recorder,
 			RecorderOptions:    h.recorder.Options,
-			RecorderObject:     ro,
 			Certificate:        h.md.certificate,
 			PrivateKey:         h.md.privateKey,
 			NegotiatedProtocol: h.md.alpn,
 			CertPool:           h.certPool,
 			MitmBypass:         h.md.mitmBypass,
 			ReadTimeout:        h.md.readTimeout,
-			Log:                log,
-			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-				return cc, nil
-			},
-			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-				return cc, nil
-			},
 		}
 
 		conn = xnet.NewReadWriteConn(br, rw, conn)
 		switch proto {
 		case sniffing.ProtoHTTP:
-			return sniffer.HandleHTTP(ctx, conn)
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		case sniffing.ProtoTLS:
-			return sniffer.HandleTLS(ctx, conn)
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 

handler/relay/metadata.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 	"github.com/go-gost/x/registry"
 )

handler/serial/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/sni/handler.go

@@ -112,40 +112,51 @@ func (h *sniHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 	proto, _ := sniffing.Sniff(ctx, br)
 	ro.Proto = proto
 
+	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+		var buf bytes.Buffer
+		cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+		ro.Route = buf.String()
+		return cc, err
+	}
+	dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+		var buf bytes.Buffer
+		cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+		ro.Route = buf.String()
+		if err != nil {
+			return nil, err
+		}
+		cc = tls.Client(cc, cfg)
+		return cc, nil
+	}
+
 	sniffer := &sniffing.Sniffer{
 		Recorder:           h.recorder.Recorder,
 		RecorderOptions:    h.recorder.Options,
-		RecorderObject:     ro,
 		Certificate:        h.md.certificate,
 		PrivateKey:         h.md.privateKey,
 		NegotiatedProtocol: h.md.alpn,
 		CertPool:           h.certPool,
 		MitmBypass:         h.md.mitmBypass,
 		ReadTimeout:        h.md.readTimeout,
-		Log:                log,
-		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-			var buf bytes.Buffer
-			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
-			ro.Route = buf.String()
-			return cc, err
-		},
-		DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-			var buf bytes.Buffer
-			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
-			ro.Route = buf.String()
-			if err != nil {
-				return nil, err
-			}
-			cc = tls.Client(cc, cfg)
-			return cc, nil
-		},
 	}
 	conn = xnet.NewReadWriteConn(br, conn, conn)
 	switch proto {
 	case sniffing.ProtoHTTP:
-		return sniffer.HandleHTTP(ctx, conn)
+		return sniffer.HandleHTTP(ctx, conn,
+			sniffing.WithDial(dial),
+			sniffing.WithDialTLS(dialTLS),
+			sniffing.WithBypass(h.options.Bypass),
+			sniffing.WithRecorderObject(ro),
+			sniffing.WithLog(log),
+		)
 	case sniffing.ProtoTLS:
-		return sniffer.HandleTLS(ctx, conn)
+		return sniffer.HandleTLS(ctx, conn,
+			sniffing.WithDial(dial),
+			sniffing.WithDialTLS(dialTLS),
+			sniffing.WithBypass(h.options.Bypass),
+			sniffing.WithRecorderObject(ro),
+			sniffing.WithLog(log),
+		)
 	default:
 		return errors.New("unknown traffic")
 	}

handler/sni/metadata.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

handler/socks/v4/handler.go

@@ -246,31 +246,39 @@ func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *g
 			conn.SetReadDeadline(time.Time{})
 		}
 
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
 		sniffer := &sniffing.Sniffer{
 			Recorder:           h.recorder.Recorder,
 			RecorderOptions:    h.recorder.Options,
-			RecorderObject:     ro,
 			Certificate:        h.md.certificate,
 			PrivateKey:         h.md.privateKey,
 			NegotiatedProtocol: h.md.alpn,
 			CertPool:           h.certPool,
 			MitmBypass:         h.md.mitmBypass,
 			ReadTimeout:        h.md.readTimeout,
-			Log:                log,
-			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-				return cc, nil
-			},
-			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-				return cc, nil
-			},
 		}
 
 		conn = xnet.NewReadWriteConn(br, rw, conn)
 		switch proto {
 		case sniffing.ProtoHTTP:
-			return sniffer.HandleHTTP(ctx, conn)
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		case sniffing.ProtoTLS:
-			return sniffer.HandleTLS(ctx, conn)
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 

handler/socks/v4/metadata.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

handler/socks/v5/connect.go

@@ -91,31 +91,39 @@ func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, networ
 			conn.SetReadDeadline(time.Time{})
 		}
 
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
 		sniffer := &sniffing.Sniffer{
 			Recorder:           h.recorder.Recorder,
 			RecorderOptions:    h.recorder.Options,
-			RecorderObject:     ro,
 			Certificate:        h.md.certificate,
 			PrivateKey:         h.md.privateKey,
 			NegotiatedProtocol: h.md.alpn,
 			CertPool:           h.certPool,
 			MitmBypass:         h.md.mitmBypass,
 			ReadTimeout:        h.md.readTimeout,
-			Log:                log,
-			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-				return cc, nil
-			},
-			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-				return cc, nil
-			},
 		}
 
 		conn = xnet.NewReadWriteConn(br, rw, conn)
 		switch proto {
 		case sniffing.ProtoHTTP:
-			return sniffer.HandleHTTP(ctx, conn)
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		case sniffing.ProtoTLS:
-			return sniffer.HandleTLS(ctx, conn)
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 

handler/socks/v5/metadata.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 	"github.com/go-gost/x/registry"
 )

handler/ss/handler.go

@@ -165,31 +165,39 @@ func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.H
 			conn.SetReadDeadline(time.Time{})
 		}
 
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
 		sniffer := &sniffing.Sniffer{
 			Recorder:           h.recorder.Recorder,
 			RecorderOptions:    h.recorder.Options,
-			RecorderObject:     ro,
 			Certificate:        h.md.certificate,
 			PrivateKey:         h.md.privateKey,
 			NegotiatedProtocol: h.md.alpn,
 			CertPool:           h.certPool,
 			MitmBypass:         h.md.mitmBypass,
 			ReadTimeout:        h.md.readTimeout,
-			Log:                log,
-			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-				return cc, nil
-			},
-			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-				return cc, nil
-			},
 		}
 
 		conn = xnet.NewReadWriteConn(br, conn, conn)
 		switch proto {
 		case sniffing.ProtoHTTP:
-			return sniffer.HandleHTTP(ctx, conn)
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		case sniffing.ProtoTLS:
-			return sniffer.HandleTLS(ctx, conn)
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 

handler/ss/metadata.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

handler/ss/udp/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

handler/sshd/handler.go

@@ -161,30 +161,38 @@ func (h *forwardHandler) handleDirectForward(ctx context.Context, conn *sshd_uti
 			conn.SetReadDeadline(time.Time{})
 		}
 
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
 		sniffer := &sniffing.Sniffer{
 			Recorder:           h.recorder.Recorder,
 			RecorderOptions:    h.recorder.Options,
-			RecorderObject:     ro,
 			Certificate:        h.md.certificate,
 			PrivateKey:         h.md.privateKey,
 			NegotiatedProtocol: h.md.alpn,
 			CertPool:           h.certPool,
 			MitmBypass:         h.md.mitmBypass,
 			ReadTimeout:        h.md.readTimeout,
-			Log:                log,
-			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-				return cc, nil
-			},
-			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-				return cc, nil
-			},
 		}
 
 		switch proto {
 		case sniffing.ProtoHTTP:
-			return sniffer.HandleHTTP(ctx, xnet.NewReadWriteConn(br, conn, conn))
+			return sniffer.HandleHTTP(ctx, xnet.NewReadWriteConn(br, conn, conn),
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		case sniffing.ProtoTLS:
-			return sniffer.HandleTLS(ctx, xnet.NewReadWriteConn(br, conn, conn))
+			return sniffer.HandleTLS(ctx, xnet.NewReadWriteConn(br, conn, conn),
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 

handler/sshd/metadata.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

handler/tap/metadata.go

@@ -2,7 +2,7 @@ package tap
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

handler/tun/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/tunnel/metadata.go

@@ -7,7 +7,7 @@ import (
 	"github.com/go-gost/core/ingress"
 	"github.com/go-gost/core/logger"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/core/sd"
 	"github.com/go-gost/relay"
 	xingress "github.com/go-gost/x/ingress"

handler/unix/handler.go

@@ -141,31 +141,39 @@ func (h *unixHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler
 			conn.SetReadDeadline(time.Time{})
 		}
 
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
 		sniffer := &sniffing.Sniffer{
 			Recorder:           h.recorder.Recorder,
 			RecorderOptions:    h.recorder.Options,
-			RecorderObject:     ro,
 			Certificate:        h.md.certificate,
 			PrivateKey:         h.md.privateKey,
 			NegotiatedProtocol: h.md.alpn,
 			CertPool:           h.certPool,
 			MitmBypass:         h.md.mitmBypass,
 			ReadTimeout:        h.md.readTimeout,
-			Log:                log,
-			Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
-				return cc, nil
-			},
-			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-				return cc, nil
-			},
 		}
 
 		conn = xnet.NewReadWriteConn(br, conn, conn)
 		switch proto {
 		case sniffing.ProtoHTTP:
-			return sniffer.HandleHTTP(ctx, conn)
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		case sniffing.ProtoTLS:
-			return sniffer.HandleTLS(ctx, conn)
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 

handler/unix/metadata.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

internal/util/sniffing/sniffer.go

@@ -21,6 +21,7 @@ import (
 	"github.com/go-gost/core/logger"
 	"github.com/go-gost/core/recorder"
 	dissector "github.com/go-gost/tls-dissector"
+	xbypass "github.com/go-gost/x/bypass"
 	xio "github.com/go-gost/x/internal/io"
 	xnet "github.com/go-gost/x/internal/net"
 	xhttp "github.com/go-gost/x/internal/net/http"
@@ -38,13 +39,50 @@ var (
 	DefaultCertPool = tls_util.NewMemoryCertPool()
 )
 
-type Sniffer struct {
+type HandleOptions struct {
 	Dial    func(ctx context.Context, network, address string) (net.Conn, error)
 	DialTLS func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error)
 
+	Bypass         bypass.Bypass
+	RecorderObject *xrecorder.HandlerRecorderObject
+	Log            logger.Logger
+}
+
+type HandleOption func(opts *HandleOptions)
+
+func WithDial(dial func(ctx context.Context, network, address string) (net.Conn, error)) HandleOption {
+	return func(opts *HandleOptions) {
+		opts.Dial = dial
+	}
+}
+
+func WithDialTLS(dialTLS func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error)) HandleOption {
+	return func(opts *HandleOptions) {
+		opts.DialTLS = dialTLS
+	}
+}
+
+func WithBypass(bypass bypass.Bypass) HandleOption {
+	return func(opts *HandleOptions) {
+		opts.Bypass = bypass
+	}
+}
+
+func WithRecorderObject(ro *xrecorder.HandlerRecorderObject) HandleOption {
+	return func(opts *HandleOptions) {
+		opts.RecorderObject = ro
+	}
+}
+
+func WithLog(log logger.Logger) HandleOption {
+	return func(opts *HandleOptions) {
+		opts.Log = log
+	}
+}
+
+type Sniffer struct {
 	Recorder        recorder.Recorder
 	RecorderOptions *recorder.Options
-	RecorderObject  *xrecorder.HandlerRecorderObject
 
 	// MITM TLS termination
 	Certificate        *x509.Certificate
@@ -54,21 +92,25 @@ type Sniffer struct {
 	MitmBypass         bypass.Bypass
 
 	ReadTimeout time.Duration
-	Log         logger.Logger
 }
 
-func (h *Sniffer) HandleHTTP(ctx context.Context, conn net.Conn) error {
+func (h *Sniffer) HandleHTTP(ctx context.Context, conn net.Conn, opts ...HandleOption) error {
+	var o HandleOptions
+	for _, opt := range opts {
+		opt(&o)
+	}
+
 	br := bufio.NewReader(conn)
 	req, err := http.ReadRequest(br)
 	if err != nil {
 		return err
 	}
-	if h.Log.IsLevelEnabled(logger.TraceLevel) {
+	if o.Log.IsLevelEnabled(logger.TraceLevel) {
 		dump, _ := httputil.DumpRequest(req, false)
-		h.Log.Trace(string(dump))
+		o.Log.Trace(string(dump))
 	}
 
-	ro := h.RecorderObject
+	ro := o.RecorderObject
 	host := req.Host
 	if host != "" {
 		if _, _, err := net.SplitHostPort(host); err != nil {
@@ -76,9 +118,13 @@ func (h *Sniffer) HandleHTTP(ctx context.Context, conn net.Conn) error {
 		}
 		ro.Host = host
 
-		h.Log = h.Log.WithFields(map[string]any{
+		o.Log = o.Log.WithFields(map[string]any{
 			"host": host,
 		})
+
+		if o.Bypass != nil && o.Bypass.Contains(ctx, "tcp", host) {
+			return xbypass.ErrBypass
+		}
 	}
 
 	// http/2
@@ -96,35 +142,39 @@ func (h *Sniffer) HandleHTTP(ctx context.Context, conn net.Conn) error {
 
 		ro.Time = time.Time{}
 
+		tr := &http2.Transport{
+			DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
+				if dial := o.DialTLS; dial != nil {
+					return dial(ctx, network, addr, cfg)
+				}
+
+				cc, err := (&net.Dialer{}).DialContext(ctx, network, addr)
+				if err != nil {
+					return nil, err
+				}
+
+				cc = tls.Client(cc, cfg)
+				return cc, nil
+			},
+		}
+		defer tr.CloseIdleConnections()
+
 		h2s := &http2.Server{}
 		h2s.ServeConn(xnet.NewReadWriteConn(br, conn, conn), &http2.ServeConnOpts{
 			Context:          ctx,
 			SawClientPreface: true,
 			Handler: &h2Handler{
-				Client: &http.Client{
-					Transport: &http2.Transport{
-						DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
-							if dial := h.DialTLS; dial != nil {
-								return dial(ctx, network, addr, cfg)
-							}
-
-							cc, err := (&net.Dialer{}).DialContext(ctx, network, addr)
-							if err != nil {
-								return nil, err
-							}
-
-							cc = tls.Client(cc, cfg)
-							return cc, nil
-						},
-					},
-				},
-				Sniffer: h,
+				transport:       tr,
+				recorder:        h.Recorder,
+				recorderOptions: h.RecorderOptions,
+				recorderObject:  ro,
+				log:             o.Log,
 			},
 		})
 		return nil
 	}
 
-	dial := h.Dial
+	dial := o.Dial
 	if dial == nil {
 		dial = (&net.Dialer{}).DialContext
 	}
@@ -136,7 +186,7 @@ func (h *Sniffer) HandleHTTP(ctx context.Context, conn net.Conn) error {
 
 	ro.Time = time.Time{}
 
-	shouldClose, err := h.httpRoundTrip(ctx, conn, cc, req)
+	shouldClose, err := h.httpRoundTrip(ctx, conn, cc, req, &o)
 	if err != nil || shouldClose {
 		return err
 	}
@@ -150,35 +200,35 @@ func (h *Sniffer) HandleHTTP(ctx context.Context, conn net.Conn) error {
 			return err
 		}
 
-		if h.Log.IsLevelEnabled(logger.TraceLevel) {
+		if o.Log.IsLevelEnabled(logger.TraceLevel) {
 			dump, _ := httputil.DumpRequest(req, false)
-			h.Log.Trace(string(dump))
+			o.Log.Trace(string(dump))
 		}
 
-		if shouldClose, err := h.httpRoundTrip(ctx, conn, cc, req); err != nil || shouldClose {
+		if shouldClose, err := h.httpRoundTrip(ctx, conn, cc, req, &o); err != nil || shouldClose {
 			return err
 		}
 	}
 }
 
-func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *http.Request) (close bool, err error) {
+func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *http.Request, o *HandleOptions) (close bool, err error) {
 	close = true
 
 	ro := &xrecorder.HandlerRecorderObject{}
-	*ro = *h.RecorderObject
+	*ro = *o.RecorderObject
 
 	ro.Time = time.Now()
-	h.Log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
+	o.Log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
 	defer func() {
 		ro.Duration = time.Since(ro.Time)
 		if err != nil {
 			ro.Err = err.Error()
 		}
 		if err := ro.Record(ctx, h.Recorder); err != nil {
-			h.Log.Errorf("record: %v", err)
+			o.Log.Errorf("record: %v", err)
 		}
 
-		h.Log.WithFields(map[string]any{
+		o.Log.WithFields(map[string]any{
 			"duration": time.Since(ro.Time),
 		}).Infof("%s >-< %s", ro.RemoteAddr, req.Host)
 	}()
@@ -231,7 +281,7 @@ func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *
 	xio.SetReadDeadline(cc, time.Now().Add(h.ReadTimeout))
 	resp, err := http.ReadResponse(bufio.NewReader(cc), req)
 	if err != nil {
-		h.Log.Errorf("read response: %v", err)
+		o.Log.Errorf("read response: %v", err)
 		return
 	}
 	defer resp.Body.Close()
@@ -241,9 +291,9 @@ func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *
 	ro.HTTP.Response.Header = resp.Header
 	ro.HTTP.Response.ContentLength = resp.ContentLength
 
-	if h.Log.IsLevelEnabled(logger.TraceLevel) {
+	if o.Log.IsLevelEnabled(logger.TraceLevel) {
 		dump, _ := httputil.DumpResponse(resp, false)
-		h.Log.Trace(string(dump))
+		o.Log.Trace(string(dump))
 	}
 
 	// HTTP/1.0
@@ -266,7 +316,7 @@ func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *
 	}
 
 	if err = resp.Write(rw); err != nil {
-		h.Log.Errorf("write response: %v", err)
+		o.Log.Errorf("write response: %v", err)
 		return
 	}
 
@@ -282,14 +332,19 @@ func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *
 	return resp.Close, nil
 }
 
-func (h *Sniffer) HandleTLS(ctx context.Context, conn net.Conn) error {
+func (h *Sniffer) HandleTLS(ctx context.Context, conn net.Conn, opts ...HandleOption) error {
+	var o HandleOptions
+	for _, opt := range opts {
+		opt(&o)
+	}
+
 	buf := new(bytes.Buffer)
 	clientHello, err := dissector.ParseClientHello(io.TeeReader(conn, buf))
 	if err != nil {
 		return err
 	}
 
-	ro := h.RecorderObject
+	ro := o.RecorderObject
 	ro.TLS = &xrecorder.TLSRecorderObject{
 		ServerName:  clientHello.ServerName,
 		ClientHello: hex.EncodeToString(buf.Bytes()),
@@ -304,9 +359,13 @@ func (h *Sniffer) HandleTLS(ctx context.Context, conn net.Conn) error {
 			host = net.JoinHostPort(strings.Trim(host, "[]"), "443")
 		}
 		ro.Host = host
+
+		if o.Bypass != nil && o.Bypass.Contains(ctx, "tcp", host) {
+			return xbypass.ErrBypass
+		}
 	}
 
-	dial := h.Dial
+	dial := o.Dial
 	if dial == nil {
 		dial = (&net.Dialer{}).DialContext
 	}
@@ -322,7 +381,7 @@ func (h *Sniffer) HandleTLS(ctx context.Context, conn net.Conn) error {
 			host = ro.Host
 		}
 		if h.MitmBypass == nil || !h.MitmBypass.Contains(ctx, "tcp", host) {
-			return h.terminateTLS(ctx, xnet.NewReadWriteConn(io.MultiReader(buf, conn), conn, conn), cc, clientHello)
+			return h.terminateTLS(ctx, xnet.NewReadWriteConn(io.MultiReader(buf, conn), conn, conn), cc, clientHello, &o)
 		}
 	}
 
@@ -353,17 +412,18 @@ func (h *Sniffer) HandleTLS(ctx context.Context, conn net.Conn) error {
 		return err
 	}
 
-	h.Log.Infof("%s <-> %s", ro.RemoteAddr, ro.Host)
+	o.Log.Infof("%s <-> %s", ro.RemoteAddr, ro.Host)
 	xnet.Transport(conn, cc)
-	h.Log.WithFields(map[string]any{
+	o.Log.WithFields(map[string]any{
 		"duration": time.Since(ro.Time),
 	}).Infof("%s >-< %s", ro.RemoteAddr, ro.Host)
 
 	return err
 }
 
-func (h *Sniffer) terminateTLS(ctx context.Context, conn, cc net.Conn, clientHello *dissector.ClientHelloInfo) error {
-	ro := h.RecorderObject
+func (h *Sniffer) terminateTLS(ctx context.Context, conn, cc net.Conn, clientHello *dissector.ClientHelloInfo, o *HandleOptions) error {
+	ro := o.RecorderObject
+	log := o.Log
 
 	nextProtos := clientHello.SupportedProtos
 	if h.NegotiatedProtocol != "" {
@@ -419,8 +479,20 @@ func (h *Sniffer) terminateTLS(ctx context.Context, conn, cc net.Conn, clientHel
 				serverName = host
 			}
 			cert, err := certPool.Get(serverName)
+			if cert != nil {
+				pool := x509.NewCertPool()
+				pool.AddCert(h.Certificate)
+				if _, err = cert.Verify(x509.VerifyOptions{
+					DNSName: serverName,
+					Roots:   pool,
+				}); err != nil {
+					log.Warnf("verify cached certificate for %s: %v", serverName, err)
+					cert = nil
+				}
+			}
 			if cert == nil {
 				cert, err = tls_util.GenerateCertificate(serverName, 7*24*time.Hour, h.Certificate, h.PrivateKey)
+				certPool.Put(serverName, cert)
 			}
 			if err != nil {
 				return nil, err
@@ -436,28 +508,32 @@ func (h *Sniffer) terminateTLS(ctx context.Context, conn, cc net.Conn, clientHel
 		return err
 	}
 
-	sniffer := &Sniffer{}
-	*sniffer = *h
-
-	sniffer.Dial = func(ctx context.Context, network, address string) (net.Conn, error) {
-		return clientConn, nil
+	opts := []HandleOption{
+		WithDial(func(ctx context.Context, network, address string) (net.Conn, error) {
+			return clientConn, nil
+		}),
+		WithDialTLS(func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return clientConn, nil
+		}),
+		WithRecorderObject(ro),
+		WithLog(log),
 	}
-	sniffer.DialTLS = func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
-		return clientConn, nil
-	}
-	return sniffer.HandleHTTP(ctx, serverConn)
+	return h.HandleHTTP(ctx, serverConn, opts...)
 }
 
 type h2Handler struct {
-	Client  *http.Client
-	Sniffer *Sniffer
+	transport       http.RoundTripper
+	recorder        recorder.Recorder
+	recorderOptions *recorder.Options
+	recorderObject  *xrecorder.HandlerRecorderObject
+	log             logger.Logger
 }
 
 func (h *h2Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	log := h.Sniffer.Log
+	log := h.log
 
 	ro := &xrecorder.HandlerRecorderObject{}
-	*ro = *h.Sniffer.RecorderObject
+	*ro = *h.recorderObject
 	ro.Time = time.Now()
 
 	var err error
@@ -467,7 +543,7 @@ func (h *h2Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			ro.Err = err.Error()
 		}
-		if err := ro.Record(r.Context(), h.Sniffer.Recorder); err != nil {
+		if err := ro.Record(r.Context(), h.recorder); err != nil {
 			log.Errorf("record: %v", err)
 		}
 
@@ -510,7 +586,7 @@ func (h *h2Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var reqBody *xhttp.Body
-	if opts := h.Sniffer.RecorderOptions; opts != nil && opts.HTTPBody {
+	if opts := h.recorderOptions; opts != nil && opts.HTTPBody {
 		if req.Body != nil {
 			maxSize := opts.MaxBodySize
 			if maxSize <= 0 {
@@ -521,7 +597,7 @@ func (h *h2Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	resp, err := h.Client.Do(req.WithContext(r.Context()))
+	resp, err := h.transport.RoundTrip(req.WithContext(r.Context()))
 	if reqBody != nil {
 		ro.HTTP.Request.Body = reqBody.Content()
 		ro.HTTP.Request.ContentLength = reqBody.Length()
@@ -546,7 +622,7 @@ func (h *h2Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.WriteHeader(resp.StatusCode)
 
 	var respBody *xhttp.Body
-	if opts := h.Sniffer.RecorderOptions; opts != nil && opts.HTTPBody {
+	if opts := h.recorderOptions; opts != nil && opts.HTTPBody {
 		maxSize := opts.MaxBodySize
 		if maxSize <= 0 {
 			maxSize = DefaultBodySize

listener/dns/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/dtls/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/ftcp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/grpc/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/http2/h2/metadata.go

@@ -2,7 +2,7 @@ package h2
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/http2/metadata.go

@@ -2,7 +2,7 @@ package http2
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/http3/h3/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/http3/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/http3/wt/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/icmp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/kcp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	kcp_util "github.com/go-gost/x/internal/util/kcp"
 )
 

listener/mtcp/metadata.go

@@ -2,7 +2,7 @@ package mtcp
 
 import (
 	md "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

listener/mtls/metadata.go

@@ -2,7 +2,7 @@ package mtls
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

listener/mws/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

listener/obfs/http/metadata.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

listener/obfs/tls/metadata.go

@@ -2,7 +2,7 @@ package tls
 
 import (
 	md "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

listener/pht/metadata.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/quic/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/redirect/tcp/metadata.go

@@ -2,7 +2,7 @@ package tcp
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

listener/redirect/udp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/rudp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/serial/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	md "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

listener/ssh/metadata.go

@@ -4,7 +4,7 @@ import (
 	"os"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	ssh_util "github.com/go-gost/x/internal/util/ssh"
 	"github.com/mitchellh/go-homedir"
 	"golang.org/x/crypto/ssh"

listener/sshd/metadata.go

@@ -5,7 +5,7 @@ import (
 	"os"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	ssh_util "github.com/go-gost/x/internal/util/ssh"
 	"github.com/mitchellh/go-homedir"
 	"github.com/zalando/go-keyring"

listener/tap/metadata.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	tap_util "github.com/go-gost/x/internal/util/tap"
 )
 

listener/tcp/metadata.go

@@ -2,7 +2,7 @@ package tcp
 
 import (
 	md "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

listener/tls/metadata.go

@@ -2,7 +2,7 @@ package tls
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

listener/tun/metadata.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/go-gost/core/logger"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/core/router"
 	tun_util "github.com/go-gost/x/internal/util/tun"
 	"github.com/go-gost/x/registry"

listener/udp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

listener/ws/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

selector/filter.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	"github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/core/selector"
 )
 

selector/strategy.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/go-gost/core/logger"
 	"github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/core/selector"
 	ctxvalue "github.com/go-gost/x/ctx"
 )