From a32ffd56083c56196fbcae74fa3cc84ccfa04a06 Mon Sep 17 00:00:00 2001 From: ginuerzh Date: Tue, 23 Jun 2026 20:54:26 +0800 Subject: [PATCH] fix(sniffing): pass bypass option to sniffer HandleHTTP/HandleTLS calls When sniffing is enabled, the sniffer extracts the real domain from HTTP Host header or TLS SNI and checks bypass rules against it. However, most handlers were not passing WithBypass(...) to the sniffer, so the sniffer internal bypass check was always skipped. Additionally, the TLS-to-HTTP fallback paths in internal util sniffer and forwarder also omitted bypass when constructing options for the recursive HandleHTTP call after decrypting TLS. Add WithBypass to all sniffer call sites that were missing it across handlers (http, relay, socks4, socks5, ss, sshd, unix) and internal TLS fallback paths. Also fix import ordering in handler/http/connect.go. Fixes go-gost/gost#874 --- handler/http/connect.go | 8 +++++--- handler/relay/connect.go | 4 +++- handler/socks/v4/handler.go | 2 ++ handler/socks/v5/connect.go | 2 ++ handler/ss/handler.go | 2 ++ handler/sshd/handler.go | 2 ++ handler/unix/handler.go | 2 ++ internal/util/forwarder/sniffer_tls.go | 1 + internal/util/sniffing/sniffer_tls.go | 1 + 9 files changed, 20 insertions(+), 4 deletions(-) diff --git a/handler/http/connect.go b/handler/http/connect.go index 8f9942aa..2a57ad1c 100644 --- a/handler/http/connect.go +++ b/handler/http/connect.go @@ -15,9 +15,9 @@ import ( "github.com/go-gost/core/bypass" "github.com/go-gost/core/limiter" - "github.com/go-gost/core/recorder" - stats "github.com/go-gost/core/observer/stats" "github.com/go-gost/core/logger" + stats "github.com/go-gost/core/observer/stats" + "github.com/go-gost/core/recorder" xctx "github.com/go-gost/x/ctx" ictx "github.com/go-gost/x/internal/ctx" xnet "github.com/go-gost/x/internal/net" @@ -132,6 +132,7 @@ func (h *httpHandler) sniffAndHandle(ctx context.Context, conn net.Conn, cc net. sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -140,6 +141,7 @@ func (h *httpHandler) sniffAndHandle(ctx context.Context, conn net.Conn, cc net. sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -233,7 +235,7 @@ type SnifferBuilder struct { // ReadTimeout is the timeout for reading upstream HTTP response headers // and TLS ServerHello during sniffing. Passed through to sniffing.Sniffer. // See sniffing.Sniffer.ReadTimeout for details. - ReadTimeout time.Duration + ReadTimeout time.Duration } // Build creates a new sniffing.Sniffer from the builder's configuration. diff --git a/handler/relay/connect.go b/handler/relay/connect.go index 5aec0eb1..004e2a6d 100644 --- a/handler/relay/connect.go +++ b/handler/relay/connect.go @@ -237,6 +237,7 @@ func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -245,6 +246,7 @@ func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -306,4 +308,4 @@ func (a *serialAddr) Network() string { func (a *serialAddr) String() string { return a.port -} \ No newline at end of file +} diff --git a/handler/socks/v4/handler.go b/handler/socks/v4/handler.go index 8fb9efdf..6beed7bf 100644 --- a/handler/socks/v4/handler.go +++ b/handler/socks/v4/handler.go @@ -310,6 +310,7 @@ func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *g sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -318,6 +319,7 @@ func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *g sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) diff --git a/handler/socks/v5/connect.go b/handler/socks/v5/connect.go index 2b233dcc..2037a2dc 100644 --- a/handler/socks/v5/connect.go +++ b/handler/socks/v5/connect.go @@ -128,6 +128,7 @@ func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, networ sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -136,6 +137,7 @@ func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, networ sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) diff --git a/handler/ss/handler.go b/handler/ss/handler.go index ca7f7f0c..0c19bc64 100644 --- a/handler/ss/handler.go +++ b/handler/ss/handler.go @@ -237,6 +237,7 @@ func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.H sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -245,6 +246,7 @@ func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.H sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) diff --git a/handler/sshd/handler.go b/handler/sshd/handler.go index e36469c3..382b714a 100644 --- a/handler/sshd/handler.go +++ b/handler/sshd/handler.go @@ -209,6 +209,7 @@ func (h *forwardHandler) handleDirectForward(ctx context.Context, targetAddr str sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -217,6 +218,7 @@ func (h *forwardHandler) handleDirectForward(ctx context.Context, targetAddr str sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) diff --git a/handler/unix/handler.go b/handler/unix/handler.go index 70b7f1fe..f5241993 100644 --- a/handler/unix/handler.go +++ b/handler/unix/handler.go @@ -180,6 +180,7 @@ func (h *unixHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) @@ -188,6 +189,7 @@ func (h *unixHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler sniffing.WithService(h.options.Service), sniffing.WithDial(dial), sniffing.WithDialTLS(dialTLS), + sniffing.WithBypass(h.options.Bypass), sniffing.WithRecorderObject(ro), sniffing.WithLog(log), ) diff --git a/internal/util/forwarder/sniffer_tls.go b/internal/util/forwarder/sniffer_tls.go index af966184..86e9cb92 100644 --- a/internal/util/forwarder/sniffer_tls.go +++ b/internal/util/forwarder/sniffer_tls.go @@ -321,6 +321,7 @@ func (h *Sniffer) terminateTLS(ctx context.Context, conn, cc net.Conn, clientHel }), WithHTTPKeepalive(true), WithNode(ho.node), + WithBypass(ho.bypass), WithRecorderObject(ro), WithLog(log), } diff --git a/internal/util/sniffing/sniffer_tls.go b/internal/util/sniffing/sniffer_tls.go index 2209f2b0..27b4384a 100644 --- a/internal/util/sniffing/sniffer_tls.go +++ b/internal/util/sniffing/sniffer_tls.go @@ -235,6 +235,7 @@ func (h *Sniffer) terminateTLS(ctx context.Context, network string, conn, cc net WithDialTLS(func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) { return clientConn, nil }), + WithBypass(ho.bypass), WithRecorderObject(ro), WithLog(log), }