add sniffer utility

handler/redirect/tcp/handler.go

@@ -4,9 +4,10 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"crypto/tls"
 	"fmt"
-	"io"
 	"net"
+	"strings"
 	"time"
 
 	"github.com/go-gost/core/handler"
@@ -14,9 +15,9 @@ import (
 	"github.com/go-gost/core/recorder"
 	xbypass "github.com/go-gost/x/bypass"
 	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
@@ -36,6 +37,7 @@ type redirectHandler struct {
 	md       metadata
 	options  handler.Options
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -61,6 +63,10 @@ func (h *redirectHandler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return
 }
 
@@ -122,7 +128,6 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 		"dst": fmt.Sprintf("%s/%s", dstAddr, dstAddr.Network()),
 	})
 
-	var rw io.ReadWriter = conn
 	if h.md.sniffing {
 		if h.md.sniffingTimeout > 0 {
 			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
@@ -136,15 +141,59 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 			conn.SetReadDeadline(time.Time{})
 		}
 
-		rw = xio.NewReadWriter(br, conn)
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			var cc net.Conn
+			var err error
+			if address != "" {
+				host, _, _ := net.SplitHostPort(address)
+				if host == "" {
+					host = address
+				}
+				_, port, _ := net.SplitHostPort(dstAddr.String())
+				address = net.JoinHostPort(strings.Trim(host, "[]"), port)
+				ro.Host = address
+
+				var buf bytes.Buffer
+				cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+				ro.Route = buf.String()
+				if err != nil && !h.md.sniffingFallback {
+					return nil, err
+				}
+			}
+
+			if cc == nil {
+				var buf bytes.Buffer
+				cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", dstAddr.String())
+				ro.Route = buf.String()
+				ro.Host = dstAddr.String()
+			}
+
+			return cc, err
+		}
+
+		sniffer := &sniffing.Sniffer{
+			Recorder:           h.recorder.Recorder,
+			RecorderOptions:    h.recorder.Options,
+			RecorderObject:     ro,
+			Certificate:        h.md.certificate,
+			PrivateKey:         h.md.privateKey,
+			NegotiatedProtocol: h.md.alpn,
+			CertPool:           h.certPool,
+			MitmBypass:         h.md.mitmBypass,
+			ReadTimeout:        h.md.readTimeout,
+			Log:                log,
+			Dial:               dial,
+			DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+				return dial(ctx, network, address)
+			},
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
 		switch proto {
 		case sniffing.ProtoHTTP:
-			ro2 := &xrecorder.HandlerRecorderObject{}
-			*ro2 = *ro
-			ro.Time = time.Time{}
-			return h.handleHTTP(ctx, rw, dstAddr, ro2, log)
+			return sniffer.HandleHTTP(ctx, conn)
 		case sniffing.ProtoTLS:
-			return h.handleTLS(ctx, rw, dstAddr, ro, log)
+			return sniffer.HandleTLS(ctx, conn)
 		}
 	}
 
@@ -167,7 +216,7 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), dstAddr)
-	netpkg.Transport(rw, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), dstAddr)

handler/redirect/tcp/metadata.go

@@ -1,18 +1,29 @@
 package redirect
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
 	mdutil "github.com/go-gost/core/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
-	readTimeout      time.Duration
-	tproxy           bool
+	readTimeout time.Duration
+	tproxy      bool
+
 	sniffing         bool
 	sniffingTimeout  time.Duration
 	sniffingFallback bool
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *redirectHandler) parseMetadata(md mdata.Metadata) (err error) {
@@ -21,8 +32,26 @@ func (h *redirectHandler) parseMetadata(md mdata.Metadata) (err error) {
 		h.md.readTimeout = 15 * time.Second
 	}
 	h.md.tproxy = mdutil.GetBool(md, "tproxy")
+
 	h.md.sniffing = mdutil.GetBool(md, "sniffing")
 	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
 	h.md.sniffingFallback = mdutil.GetBool(md, "sniffing.fallback")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return
 }

handler/redirect/tcp/sniffing.go

@@ -1,318 +0,0 @@
-package redirect
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/hex"
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"strings"
-	"time"
-
-	"github.com/go-gost/core/bypass"
-	"github.com/go-gost/core/logger"
-	dissector "github.com/go-gost/tls-dissector"
-	xbypass "github.com/go-gost/x/bypass"
-	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
-	netpkg "github.com/go-gost/x/internal/net"
-	xhttp "github.com/go-gost/x/internal/net/http"
-	tls_util "github.com/go-gost/x/internal/util/tls"
-	xrecorder "github.com/go-gost/x/recorder"
-)
-
-func (h *redirectHandler) handleHTTP(ctx context.Context, rw io.ReadWriter, dstAddr net.Addr, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
-	br := bufio.NewReader(rw)
-	req, err := http.ReadRequest(br)
-	if err != nil {
-		return err
-	}
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpRequest(req, false)
-		log.Trace(string(dump))
-	}
-
-	host := req.Host
-	if _, _, err := net.SplitHostPort(host); err != nil {
-		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
-	}
-	ro.Host = host
-
-	log = log.WithFields(map[string]any{
-		"host": host,
-	})
-
-	if h.options.Bypass != nil &&
-		h.options.Bypass.Contains(ctx, "tcp", host, bypass.WithPathOption(req.RequestURI)) {
-		log.Debugf("bypass: %s %s", host, req.RequestURI)
-		return xbypass.ErrBypass
-	}
-
-	var buf bytes.Buffer
-	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", host)
-	ro.Route = buf.String()
-	if err != nil {
-		log.Error(err)
-		if !h.md.sniffingFallback {
-			return err
-		}
-	}
-
-	if cc == nil {
-		var buf bytes.Buffer
-		cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", dstAddr.String())
-		ro.Route = buf.String()
-		if err != nil {
-			log.Error(err)
-			return err
-		}
-	}
-	defer cc.Close()
-
-	if shoudlClose, err := h.httpRoundTrip(ctx, rw, cc, req, ro, log); err != nil || shoudlClose {
-		return err
-	}
-
-	for {
-		req, err := http.ReadRequest(br)
-		if err != nil {
-			if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
-				return nil
-			}
-			return err
-		}
-
-		if log.IsLevelEnabled(logger.TraceLevel) {
-			dump, _ := httputil.DumpRequest(req, false)
-			log.Trace(string(dump))
-		}
-
-		if shouldClose, err := h.httpRoundTrip(ctx, rw, cc, req, ro, log); err != nil || shouldClose {
-			return err
-		}
-	}
-}
-
-func (h *redirectHandler) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (close bool, err error) {
-	close = true
-
-	if req == nil {
-		return
-	}
-
-	start := time.Now()
-	ro.Time = start
-
-	log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
-	defer func() {
-		ro.Duration = time.Since(start)
-		if err != nil {
-			ro.Err = err.Error()
-		}
-		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
-			log.Errorf("record: %v", err)
-		}
-
-		log.WithFields(map[string]any{
-			"duration": time.Since(start),
-		}).Infof("%s >-< %s", ro.RemoteAddr, req.Host)
-	}()
-
-	ro.HTTP = &xrecorder.HTTPRecorderObject{
-		Host:   req.Host,
-		Proto:  req.Proto,
-		Scheme: req.URL.Scheme,
-		Method: req.Method,
-		URI:    req.RequestURI,
-		Request: xrecorder.HTTPRequestRecorderObject{
-			ContentLength: req.ContentLength,
-			Header:        req.Header.Clone(),
-		},
-	}
-
-	// HTTP/1.0
-	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
-		if strings.ToLower(req.Header.Get("Connection")) == "keep-alive" {
-			req.Header.Del("Connection")
-		} else {
-			req.Header.Set("Connection", "close")
-		}
-	}
-
-	var reqBody *xhttp.Body
-	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
-		if req.Body != nil {
-			maxSize := opts.MaxBodySize
-			if maxSize <= 0 {
-				maxSize = defaultBodySize
-			}
-			reqBody = xhttp.NewBody(req.Body, maxSize)
-			req.Body = reqBody
-		}
-	}
-
-	if err = req.Write(cc); err != nil {
-		return
-	}
-
-	if reqBody != nil {
-		ro.HTTP.Request.Body = reqBody.Content()
-		ro.HTTP.Request.ContentLength = reqBody.Length()
-	}
-
-	xio.SetReadDeadline(cc, time.Now().Add(h.md.readTimeout))
-	resp, err := http.ReadResponse(bufio.NewReader(cc), req)
-	if err != nil {
-		log.Errorf("read response: %v", err)
-		return
-	}
-	defer resp.Body.Close()
-	xio.SetReadDeadline(cc, time.Time{})
-
-	ro.HTTP.StatusCode = resp.StatusCode
-	ro.HTTP.Response.Header = resp.Header
-	ro.HTTP.Response.ContentLength = resp.ContentLength
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpResponse(resp, false)
-		log.Trace(string(dump))
-	}
-
-	// HTTP/1.0
-	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
-		if !resp.Close {
-			resp.Header.Set("Connection", "keep-alive")
-		}
-		resp.ProtoMajor = req.ProtoMajor
-		resp.ProtoMinor = req.ProtoMinor
-	}
-
-	var respBody *xhttp.Body
-	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
-		maxSize := opts.MaxBodySize
-		if maxSize <= 0 {
-			maxSize = defaultBodySize
-		}
-		respBody = xhttp.NewBody(resp.Body, maxSize)
-		resp.Body = respBody
-	}
-
-	if err = resp.Write(rw); err != nil {
-		log.Errorf("write response: %v", err)
-		return
-	}
-
-	if respBody != nil {
-		ro.HTTP.Response.Body = respBody.Content()
-		ro.HTTP.Response.ContentLength = respBody.Length()
-	}
-
-	if req.Header.Get("Upgrade") == "websocket" {
-		netpkg.Transport(rw, cc)
-	}
-
-	return resp.Close, nil
-}
-
-func (h *redirectHandler) handleTLS(ctx context.Context, rw io.ReadWriter, dstAddr net.Addr, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
-	buf := new(bytes.Buffer)
-
-	clientHello, err := dissector.ParseClientHello(io.TeeReader(rw, buf))
-	if err != nil {
-		return err
-	}
-
-	ro.TLS = &xrecorder.TLSRecorderObject{
-		ServerName:  clientHello.ServerName,
-		ClientHello: hex.EncodeToString(buf.Bytes()),
-	}
-	if len(clientHello.SupportedProtos) > 0 {
-		ro.TLS.Proto = clientHello.SupportedProtos[0]
-	}
-
-	var cc net.Conn
-
-	host := clientHello.ServerName
-	if host != "" {
-		if _, _, err := net.SplitHostPort(host); err != nil {
-			_, port, _ := net.SplitHostPort(dstAddr.String())
-			if port == "" {
-				port = "443"
-			}
-			host = net.JoinHostPort(strings.Trim(host, "[]"), port)
-		}
-		log = log.WithFields(map[string]any{
-			"host": host,
-		})
-		ro.Host = host
-
-		if h.options.Bypass != nil &&
-			h.options.Bypass.Contains(ctx, "tcp", host) {
-			log.Debug("bypass: ", host)
-			return xbypass.ErrBypass
-		}
-
-		var routeBuf bytes.Buffer
-		cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &routeBuf), "tcp", host)
-		ro.Route = routeBuf.String()
-		if err != nil {
-			log.Error(err)
-
-			if !h.md.sniffingFallback {
-				return err
-			}
-		}
-	}
-
-	if cc == nil {
-		var routeBuf bytes.Buffer
-		cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &routeBuf), "tcp", dstAddr.String())
-		ro.Route = routeBuf.String()
-		if err != nil {
-			log.Error(err)
-			return err
-		}
-	}
-	defer cc.Close()
-
-	if _, err := buf.WriteTo(cc); err != nil {
-		return err
-	}
-
-	cc.SetReadDeadline(time.Now().Add(h.md.readTimeout))
-	serverHello, err := dissector.ParseServerHello(io.TeeReader(cc, buf))
-	cc.SetReadDeadline(time.Time{})
-
-	if serverHello != nil {
-		ro.TLS.CipherSuite = tls_util.CipherSuite(serverHello.CipherSuite).String()
-		ro.TLS.CompressionMethod = serverHello.CompressionMethod
-		if serverHello.Proto != "" {
-			ro.TLS.Proto = serverHello.Proto
-		}
-		if serverHello.Version > 0 {
-			ro.TLS.Version = tls_util.Version(serverHello.Version).String()
-		}
-	}
-
-	if buf.Len() > 0 {
-		ro.TLS.ServerHello = hex.EncodeToString(buf.Bytes())
-	}
-
-	if _, err := buf.WriteTo(rw); err != nil {
-		return err
-	}
-
-	t := time.Now()
-	log.Infof("%s <-> %s", ro.RemoteAddr, host)
-	netpkg.Transport(rw, cc)
-	log.WithFields(map[string]any{
-		"duration": time.Since(t),
-	}).Infof("%s >-< %s", ro.RemoteAddr, host)
-
-	return err
-}

handler/redirect/udp/handler.go

@@ -12,7 +12,7 @@ import (
 	"github.com/go-gost/core/recorder"
 	xbypass "github.com/go-gost/x/bypass"
 	ctxvalue "github.com/go-gost/x/ctx"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
@@ -118,7 +118,7 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), dstAddr)
-	netpkg.Transport(conn, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), dstAddr)