add sniffer utility

handler/sni/handler.go

@@ -2,7 +2,9 @@ package sni
 
 import (
 	"bufio"
+	"bytes"
 	"context"
+	"crypto/tls"
 	"errors"
 	"net"
 	"time"
@@ -11,8 +13,9 @@ import (
 	md "github.com/go-gost/core/metadata"
 	"github.com/go-gost/core/recorder"
 	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
+	xnet "github.com/go-gost/x/internal/net"
 	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
@@ -30,6 +33,7 @@ type sniHandler struct {
 	md       metadata
 	options  handler.Options
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -57,6 +61,10 @@ func (h *sniHandler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return nil
 }
 
@@ -83,14 +91,12 @@ func (h *sniHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
 	defer func() {
-		if !ro.Time.IsZero() {
-			if err != nil {
-				ro.Err = err.Error()
-			}
-			ro.Duration = time.Since(start)
-			if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
-				log.Errorf("record: %v", err)
-			}
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
 		}
 
 		log.WithFields(map[string]any{
@@ -106,15 +112,40 @@ func (h *sniHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 	proto, _ := sniffing.Sniff(ctx, br)
 	ro.Proto = proto
 
-	rw := xio.NewReadWriter(br, conn)
+	sniffer := &sniffing.Sniffer{
+		Recorder:           h.recorder.Recorder,
+		RecorderOptions:    h.recorder.Options,
+		RecorderObject:     ro,
+		Certificate:        h.md.certificate,
+		PrivateKey:         h.md.privateKey,
+		NegotiatedProtocol: h.md.alpn,
+		CertPool:           h.certPool,
+		MitmBypass:         h.md.mitmBypass,
+		ReadTimeout:        h.md.readTimeout,
+		Log:                log,
+		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+			var buf bytes.Buffer
+			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+			ro.Route = buf.String()
+			return cc, err
+		},
+		DialTLS: func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			var buf bytes.Buffer
+			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+			ro.Route = buf.String()
+			if err != nil {
+				return nil, err
+			}
+			cc = tls.Client(cc, cfg)
+			return cc, nil
+		},
+	}
+	conn = xnet.NewReadWriteConn(br, conn, conn)
 	switch proto {
 	case sniffing.ProtoHTTP:
-		ro2 := &xrecorder.HandlerRecorderObject{}
-		*ro2 = *ro
-		ro.Time = time.Time{}
-		return h.handleHTTP(ctx, rw, ro2, log)
+		return sniffer.HandleHTTP(ctx, conn)
 	case sniffing.ProtoTLS:
-		return h.handleTLS(ctx, rw, ro, log)
+		return sniffer.HandleTLS(ctx, conn)
 	default:
 		return errors.New("unknown traffic")
 	}

handler/sni/metadata.go

@@ -1,15 +1,25 @@
 package sni
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
 	mdutil "github.com/go-gost/core/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
 	readTimeout time.Duration
 	hash        string
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *sniHandler) parseMetadata(md mdata.Metadata) (err error) {
@@ -18,5 +28,22 @@ func (h *sniHandler) parseMetadata(md mdata.Metadata) (err error) {
 		h.md.readTimeout = 15 * time.Second
 	}
 	h.md.hash = mdutil.GetString(md, "hash")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return
 }

handler/sni/sniffing.go

@@ -1,355 +0,0 @@
-package sni
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"encoding/base64"
-	"encoding/binary"
-	"encoding/hex"
-	"errors"
-	"hash/crc32"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httputil"
-	"strings"
-	"time"
-
-	"github.com/go-gost/core/bypass"
-	"github.com/go-gost/core/logger"
-	dissector "github.com/go-gost/tls-dissector"
-	xbypass "github.com/go-gost/x/bypass"
-	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
-	netpkg "github.com/go-gost/x/internal/net"
-	xhttp "github.com/go-gost/x/internal/net/http"
-	tls_util "github.com/go-gost/x/internal/util/tls"
-	xrecorder "github.com/go-gost/x/recorder"
-)
-
-func (h *sniHandler) handleHTTP(ctx context.Context, rw io.ReadWriter, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
-	br := bufio.NewReader(rw)
-	req, err := http.ReadRequest(br)
-	if err != nil {
-		return err
-	}
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpRequest(req, false)
-		log.Trace(string(dump))
-	}
-
-	host := req.Host
-	if _, _, err := net.SplitHostPort(host); err != nil {
-		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
-	}
-	ro.Host = host
-
-	log = log.WithFields(map[string]any{
-		"host": host,
-	})
-
-	if h.options.Bypass != nil &&
-		h.options.Bypass.Contains(ctx, "tcp", host, bypass.WithPathOption(req.RequestURI)) {
-		log.Debugf("bypass: %s %s", host, req.RequestURI)
-		return xbypass.ErrBypass
-	}
-
-	var buf bytes.Buffer
-	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", host)
-	ro.Route = buf.String()
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-	defer cc.Close()
-
-	if shouldClose, err := h.httpRoundTrip(ctx, rw, cc, req, ro, log); err != nil || shouldClose {
-		return err
-	}
-
-	for {
-		req, err := http.ReadRequest(br)
-		if err != nil {
-			if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
-				return nil
-			}
-			return err
-		}
-
-		if log.IsLevelEnabled(logger.TraceLevel) {
-			dump, _ := httputil.DumpRequest(req, false)
-			log.Trace(string(dump))
-		}
-
-		if shouldClose, err := h.httpRoundTrip(ctx, rw, cc, req, ro, log); err != nil || shouldClose {
-			return err
-		}
-	}
-}
-
-func (h *sniHandler) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (close bool, err error) {
-	close = true
-
-	if req == nil {
-		return
-	}
-
-	start := time.Now()
-	ro.Time = start
-
-	log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
-	defer func() {
-		ro.Duration = time.Since(start)
-		if err != nil {
-			ro.Err = err.Error()
-		}
-		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
-			log.Errorf("record: %v", err)
-		}
-
-		log.WithFields(map[string]any{
-			"duration": time.Since(start),
-		}).Infof("%s >-< %s", ro.RemoteAddr, req.Host)
-	}()
-
-	ro.HTTP = &xrecorder.HTTPRecorderObject{
-		Host:   req.Host,
-		Proto:  req.Proto,
-		Scheme: req.URL.Scheme,
-		Method: req.Method,
-		URI:    req.RequestURI,
-		Request: xrecorder.HTTPRequestRecorderObject{
-			ContentLength: req.ContentLength,
-			Header:        req.Header.Clone(),
-		},
-	}
-
-	// HTTP/1.0
-	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
-		if strings.ToLower(req.Header.Get("Connection")) == "keep-alive" {
-			req.Header.Del("Connection")
-		} else {
-			req.Header.Set("Connection", "close")
-		}
-	}
-
-	var reqBody *xhttp.Body
-	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
-		if req.Body != nil {
-			maxSize := opts.MaxBodySize
-			if maxSize <= 0 {
-				maxSize = defaultBodySize
-			}
-			reqBody = xhttp.NewBody(req.Body, maxSize)
-			req.Body = reqBody
-		}
-	}
-
-	if err = req.Write(cc); err != nil {
-		return
-	}
-
-	if reqBody != nil {
-		ro.HTTP.Request.Body = reqBody.Content()
-		ro.HTTP.Request.ContentLength = reqBody.Length()
-	}
-
-	xio.SetReadDeadline(cc, time.Now().Add(h.md.readTimeout))
-	resp, err := http.ReadResponse(bufio.NewReader(cc), req)
-	if err != nil {
-		log.Errorf("read response: %v", err)
-		return
-	}
-	defer resp.Body.Close()
-	xio.SetReadDeadline(cc, time.Time{})
-
-	ro.HTTP.StatusCode = resp.StatusCode
-	ro.HTTP.Response.Header = resp.Header
-	ro.HTTP.Response.ContentLength = resp.ContentLength
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpResponse(resp, false)
-		log.Trace(string(dump))
-	}
-
-	// HTTP/1.0
-	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
-		if !resp.Close {
-			resp.Header.Set("Connection", "keep-alive")
-		}
-		resp.ProtoMajor = req.ProtoMajor
-		resp.ProtoMinor = req.ProtoMinor
-	}
-
-	var respBody *xhttp.Body
-	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
-		maxSize := opts.MaxBodySize
-		if maxSize <= 0 {
-			maxSize = defaultBodySize
-		}
-		respBody = xhttp.NewBody(resp.Body, maxSize)
-		resp.Body = respBody
-	}
-
-	if err = resp.Write(rw); err != nil {
-		log.Errorf("write response: %v", err)
-		return
-	}
-
-	if respBody != nil {
-		ro.HTTP.Response.Body = respBody.Content()
-		ro.HTTP.Response.ContentLength = respBody.Length()
-	}
-
-	if req.Header.Get("Upgrade") == "websocket" {
-		netpkg.Transport(rw, cc)
-	}
-
-	return resp.Close, nil
-}
-
-func (h *sniHandler) handleTLS(ctx context.Context, rw io.ReadWriter, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
-	buf := new(bytes.Buffer)
-	host, err := h.decodeHost(io.TeeReader(rw, buf))
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-
-	clientHello, err := dissector.ParseClientHello(bytes.NewReader(buf.Bytes()))
-	if err != nil {
-		return err
-	}
-
-	ro.TLS = &xrecorder.TLSRecorderObject{
-		ServerName:  clientHello.ServerName,
-		ClientHello: hex.EncodeToString(buf.Bytes()),
-	}
-	if len(clientHello.SupportedProtos) > 0 {
-		ro.TLS.Proto = clientHello.SupportedProtos[0]
-	}
-
-	if _, _, err := net.SplitHostPort(host); err != nil {
-		host = net.JoinHostPort(strings.Trim(host, "[]"), "443")
-	}
-
-	ro.Host = host
-
-	log = log.WithFields(map[string]any{
-		"dst": host,
-	})
-	log.Debugf("%s >> %s", ro.RemoteAddr, host)
-
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", host) {
-		log.Debug("bypass: ", host)
-		return xbypass.ErrBypass
-	}
-
-	switch h.md.hash {
-	case "host":
-		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: host})
-	}
-
-	var routeBuf bytes.Buffer
-	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &routeBuf), "tcp", host)
-	ro.Route = routeBuf.String()
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-	defer cc.Close()
-
-	if _, err := buf.WriteTo(cc); err != nil {
-		return err
-	}
-
-	cc.SetReadDeadline(time.Now().Add(h.md.readTimeout))
-	serverHello, err := dissector.ParseServerHello(io.TeeReader(cc, buf))
-	cc.SetReadDeadline(time.Time{})
-
-	if serverHello != nil {
-		ro.TLS.CipherSuite = tls_util.CipherSuite(serverHello.CipherSuite).String()
-		ro.TLS.CompressionMethod = serverHello.CompressionMethod
-		if serverHello.Proto != "" {
-			ro.TLS.Proto = serverHello.Proto
-		}
-		if serverHello.Version > 0 {
-			ro.TLS.Version = tls_util.Version(serverHello.Version).String()
-		}
-	}
-
-	if buf.Len() > 0 {
-		ro.TLS.ServerHello = hex.EncodeToString(buf.Bytes())
-	}
-
-	if _, err := buf.WriteTo(rw); err != nil {
-		return err
-	}
-
-	t := time.Now()
-	log.Infof("%s <-> %s", ro.RemoteAddr, host)
-	netpkg.Transport(rw, cc)
-	log.WithFields(map[string]any{
-		"duration": time.Since(t),
-	}).Infof("%s >-< %s", ro.RemoteAddr, host)
-
-	return err
-}
-
-func (h *sniHandler) decodeHost(r io.Reader) (host string, err error) {
-	record, err := dissector.ReadRecord(r)
-	if err != nil {
-		return
-	}
-	clientHello := dissector.ClientHelloMsg{}
-	if err = clientHello.Decode(record.Opaque); err != nil {
-		return
-	}
-
-	var extensions []dissector.Extension
-	for _, ext := range clientHello.Extensions {
-		if ext.Type() == 0xFFFE {
-			b, _ := ext.Encode()
-			if v, err := h.decodeServerName(string(b)); err == nil {
-				host = v
-			}
-			continue
-		}
-		extensions = append(extensions, ext)
-	}
-	clientHello.Extensions = extensions
-
-	for _, ext := range clientHello.Extensions {
-		if ext.Type() == dissector.ExtServerName {
-			snExtension := ext.(*dissector.ServerNameExtension)
-			if host == "" {
-				host = snExtension.Name
-			} else {
-				snExtension.Name = host
-			}
-			break
-		}
-	}
-
-	return
-}
-
-func (h *sniHandler) decodeServerName(s string) (string, error) {
-	b, err := base64.RawURLEncoding.DecodeString(s)
-	if err != nil {
-		return "", err
-	}
-	if len(b) < 4 {
-		return "", errors.New("invalid name")
-	}
-	v, err := base64.RawURLEncoding.DecodeString(string(b[4:]))
-	if err != nil {
-		return "", err
-	}
-	if crc32.ChecksumIEEE(v) != binary.BigEndian.Uint32(b[:4]) {
-		return "", errors.New("invalid name")
-	}
-	return string(v), nil
-}