Chore: use renamed buffer pkg

Signed-off-by: yusheng <yusheng@tencent.com>

.dockerignore

@@ -0,0 +1,6 @@
+.github
+.gitignore
+
+# Other
+build/*
+docs/*

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+xjasonlyu@gmail.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,55 @@
+name: Bug report
+description: Create a report to help us improve
+title: "[Bug] "
+body:
+  - type: checkboxes
+    id: ensure
+    attributes:
+      label: Verify steps
+      description: Please verify that you've followed these steps
+      options:
+        - label: Is this something you can **debug and fix**? Send a pull request! Bug fixes and documentation fixes are welcome.
+          required: true
+
+        - label: I have searched on the [issue tracker](……/) for a related issue.
+          required: true
+
+  - type: input
+    attributes:
+      label: Version
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: What OS are you seeing the problem on?
+      multiple: true
+      options:
+        - Windows
+        - Linux
+        - macOS
+        - OpenBSD/FreeBSD
+        - Other
+
+  - type: textarea
+    attributes:
+      label: Description
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: CLI or Config
+      description: Paste the command line parameters or configuration below.
+
+  - type: textarea
+    attributes:
+      render: shell
+      label: Logs
+      description: Paste the logs below with the log level set to `DEBUG`.
+
+  - type: textarea
+    attributes:
+      label: How to Reproduce
+      description: Steps to reproduce the behavior, if any.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+blank_issues_enabled: false
+
+contact_links:
+  - name: tun2socks GitHub Wiki
+    url: https://github.com/xjasonlyu/tun2socks/wiki
+    about: Please see the wiki for common configurations
+  - name: tun2socks GitHub Discussions
+    url: https://github.com/xjasonlyu/tun2socks/discussions
+    about: Ask questions and get help on GitHub Discussions

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Suggest an idea or improvement
+title: "[Feature] "
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      placeholder: A clear description of the feature or enhancement.
+    validations:
+      required: true
+
+  - type: textarea
+    id: related
+    attributes:
+      label: Is this feature related to a specific bug?
+      description: Please include a bug references if yes.
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Do you have a specific solution in mind?
+      description: >
+        Please include any details about a solution that you have in mind,
+        including any alternatives considered.

.github/SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| :-----: | :----------------: |
+|   2.x   | :white_check_mark: |
+|   1.x   | :x: |
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in this repository, please report it to me through coordinated disclosure.
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Instead, please send an email to xjasonlyu[@]gmail.com.
+
+Please include as much of the information listed below as you can to help me better understand and resolve the issue:
+
+  * The type of issue (e.g., buffer overflow, payload attack)
+  * Full paths of source file(s) related to the manifestation of the issue
+  * The location of the affected source code (tag/branch/commit or direct URL)
+  * Any special configuration required to reproduce the issue
+  * Step-by-step instructions to reproduce the issue
+  * Proof-of-concept or exploit code (if possible)
+  * Impact of the issue, including how an attacker might exploit the issue
+
+This information will help me triage your report more quickly.

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,30 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/docker.yml

@@ -3,12 +3,9 @@ name: Publish Docker Image
 on:
   push:
     branches:
-      - master
-    paths-ignore:
-      - '.github/**'
-      - 'assets/**'
-      - '.gitignore'
-      - 'README.md'
+      - 'main'
+    tags:
+      - '*'
 
 jobs:
 
@@ -18,31 +15,62 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
+        with:
+          platforms: all
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
+        with:
+          version: latest
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Get Version
-        id: version
-        uses: oprypin/find-latest-tag@v1
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
         with:
-          repository: xjasonlyu/tun2socks
+          registry: ghcr.io
+          username: xjasonlyu
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and Push
-        uses: docker/build-push-action@v2
+      - name: Get Version
+        id: shell
+        run: |
+          echo "version=$(git describe --tags --abbrev=0)" >> $GITHUB_OUTPUT
+
+      - name: Build and Push (dev)
+        if: github.ref == 'refs/heads/main'
+        uses: docker/build-push-action@v3
         with:
+          context: .
           push: true
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
+          tags: |
+            xjasonlyu/tun2socks:dev
+            ghcr.io/xjasonlyu/tun2socks:dev
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and Push (latest)
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
           tags: |
             xjasonlyu/tun2socks:latest
-            xjasonlyu/tun2socks:${{ steps.version.outputs.tag }}
+            xjasonlyu/tun2socks:${{ steps.shell.outputs.version }}
+            ghcr.io/xjasonlyu/tun2socks:latest
+            ghcr.io/xjasonlyu/tun2socks:${{ steps.shell.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/linter.yml

@@ -0,0 +1,18 @@
+name: Linter
+on: [ push, pull_request ]
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup Go
+        uses: actions/setup-go@v4
+        with:
+          check-latest: true
+          go-version: '1.20'
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: latest

.github/workflows/release.yml

@@ -1,59 +1,46 @@
-name: Go
+name: Publish Go Releases
 
 on:
   push:
-    branches:
-      - master
     tags:
       - '*'
-    paths-ignore:
-      - '.github/**'
-      - 'assets/**'
-      - '.gitignore'
-      - 'README.md'
 
 jobs:
-
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - name: Setup Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.15.x
-
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          check-latest: true
+          go-version: '1.20'
 
       - name: Cache go module
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go-
 
-      - name: Get dependencies, run test and static check
+      - name: Run test
         run: |
           go test ./...
-          go vet ./...
-          go get -u honnef.co/go/tools/cmd/staticcheck
-          staticcheck -- $(go list ./...)
 
       - name: Build
         if: startsWith(github.ref, 'refs/tags/')
-        env:
-          DIR: bin
-          NAME: tun2socks
         run: make -j releases
 
-      - name: Upload Release
+      - name: Upload Releases
         uses: softprops/action-gh-release@v1
         if: startsWith(github.ref, 'refs/tags/')
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          files: bin/*
+          files: build/*
           draft: true
-          prerelease: true
+          prerelease: false

.github/workflows/stale.yml

@@ -0,0 +1,16 @@
+name: Mark stale issues and pull requests
+
+on:
+  schedule:
+    - cron: "0 10 * * *"
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v7
+        with:
+          stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days'
+          exempt-issue-labels: 'question,bug,enhancement'
+          days-before-stale: 60
+          days-before-close: 7

.gitignore

@@ -1,6 +1,14 @@
+# Binaries
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+build/
 
+# IDE
 .idea/
 .vscode/
-bin/
 
+# Misc
 .DS_Store

.golangci.yaml

@@ -0,0 +1,23 @@
+linters:
+  disable-all: true
+  enable:
+    - gci
+    - gofumpt
+    - gosimple
+    - govet
+    - ineffassign
+    - misspell
+    - staticcheck
+    - unconvert
+    - unused
+    - usestdlibvars
+
+linters-settings:
+  gci:
+    custom-order: true
+    sections:
+      - standard
+      - default
+      - prefix(github.com/xjasonlyu/tun2socks)
+  staticcheck:
+    go: '1.20'

Dockerfile

@@ -1,32 +1,32 @@
 FROM golang:alpine AS builder
 
-WORKDIR /app
-COPY . /app
+WORKDIR /src
+COPY . /src
 
-RUN apk add --no-cache make git \
-    && go mod download \
-    && make docker \
-    && /app/bin/tun2socks-docker -v
+RUN apk add --update --no-cache make git \
+    && make tun2socks
 
 FROM alpine:latest
+LABEL org.opencontainers.image.source="https://github.com/xjasonlyu/tun2socks"
 
-COPY ./scripts/entrypoint.sh /entrypoint.sh
-COPY --from=builder /app/bin/tun2socks-docker /usr/bin/tun2socks
+COPY docker/entrypoint.sh /entrypoint.sh
+COPY --from=builder /src/build/tun2socks /usr/bin/tun2socks
 
-RUN apk add --update --no-cache iptables iproute2 \
+RUN apk add --update --no-cache iptables iproute2 tzdata \
     && chmod +x /entrypoint.sh
 
-ENV TUN tun0
-ENV ETH eth0
-ENV TUN_ADDR=
-ENV TUN_MASK=
-ENV LOGLEVEL=
-ENV EXCLUDED=
-ENV EXTRACMD=
-
-ENV API=
-ENV DNS=
-ENV HOSTS=
-ENV PROXY=
+ENV TUN=tun0
+ENV ADDR=198.18.0.1/15
+ENV LOGLEVEL=info
+ENV PROXY=direct://
+ENV MTU=9000
+ENV RESTAPI=
+ENV UDP_TIMEOUT=
+ENV TCP_SNDBUF=
+ENV TCP_RCVBUF=
+ENV TCP_AUTO_TUNING=
+ENV EXTRA_COMMANDS=
+ENV TUN_INCLUDED_ROUTES=
+ENV TUN_EXCLUDED_ROUTES=
 
 ENTRYPOINT ["/entrypoint.sh"]

LICENSE

@@ -1,21 +1,674 @@
-MIT License
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
 
-Copyright (c) 2020 Jason Lyu
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+                            Preamble
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

Makefile

@@ -1,44 +1,177 @@
-DIR = "bin"
-NAME = "tun2socks"
+BINARY := tun2socks
+MODULE := github.com/xjasonlyu/tun2socks/v2
 
-TAGS = ""
-BUILD_FLAGS = "-v"
+BUILD_DIR     := build
+BUILD_TAGS    :=
+BUILD_FLAGS   := -v
+BUILD_COMMIT  := $(shell git rev-parse --short HEAD)
+BUILD_VERSION := $(shell git describe --abbrev=0 --tags HEAD)
 
-VERSION = $(shell git describe --tags --abbrev=0)
-BUILD_TIME = $(shell date -u '+%FT%TZ')
+CGO_ENABLED := 0
+GO111MODULE := on
 
 LDFLAGS += -w -s -buildid=
-LDFLAGS += -X "main.Version=$(VERSION)"
-LDFLAGS += -X "main.BuildTime=$(BUILD_TIME)"  # RFC3339
-GO_BUILD = CGO_ENABLED=0 go build $(BUILD_FLAGS) -ldflags '$(LDFLAGS)' -tags '$(TAGS)' -trimpath
+LDFLAGS += -X "$(MODULE)/internal/version.Version=$(BUILD_VERSION)"
+LDFLAGS += -X "$(MODULE)/internal/version.GitCommit=$(BUILD_COMMIT)"
 
-PLATFORM_LIST = \
+GO_BUILD = GO111MODULE=$(GO111MODULE) CGO_ENABLED=$(CGO_ENABLED) \
+	go build $(BUILD_FLAGS) -ldflags '$(LDFLAGS)' -tags '$(BUILD_TAGS)' -trimpath
+
+UNIX_ARCH_LIST = \
 	darwin-amd64 \
+	darwin-amd64-v3 \
+	darwin-arm64 \
+	freebsd-386 \
+	freebsd-amd64 \
+	freebsd-amd64-v3 \
+	freebsd-arm64 \
+	linux-386 \
 	linux-amd64 \
+	linux-amd64-v3 \
 	linux-arm64 \
+	linux-armv5 \
+	linux-armv6 \
+	linux-armv7 \
+	linux-mips-softfloat \
+	linux-mips-hardfloat \
+	linux-mipsle-softfloat \
+	linux-mipsle-hardfloat \
+	linux-mips64 \
+	linux-mips64le \
+	linux-ppc64 \
+	linux-ppc64le \
+	linux-s390x \
+	openbsd-amd64 \
+	openbsd-amd64-v3 \
+	openbsd-arm64
 
-.PHONY: all docker $(PLATFORM_LIST)
+WINDOWS_ARCH_LIST = \
+	windows-386 \
+	windows-amd64 \
+	windows-amd64-v3 \
+	windows-arm64 \
+	windows-arm32v7
 
-all: $(PLATFORM_LIST)
+all: linux-amd64 linux-arm64 darwin-amd64 darwin-arm64 windows-amd64
 
-docker:
-	$(GO_BUILD) -o $(DIR)/$(NAME)-$@
+debug: BUILD_TAGS += debug
+debug: all
+
+tun2socks:
+	$(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)
 
 darwin-amd64:
-	GOARCH=amd64 GOOS=darwin $(GO_BUILD) -o $(DIR)/$(NAME)-$@
+	GOARCH=amd64 GOOS=darwin $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+darwin-amd64-v3:
+	GOARCH=amd64 GOOS=darwin GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+darwin-arm64:
+	GOARCH=arm64 GOOS=darwin $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+freebsd-386:
+	GOARCH=386 GOOS=freebsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+freebsd-amd64:
+	GOARCH=amd64 GOOS=freebsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+freebsd-amd64-v3:
+	GOARCH=amd64 GOOS=freebsd GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+freebsd-arm64:
+	GOARCH=arm64 GOOS=freebsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-386:
+	GOARCH=386 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
 linux-amd64:
-	GOARCH=amd64 GOOS=linux $(GO_BUILD) -o $(DIR)/$(NAME)-$@
+	GOARCH=amd64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-amd64-v3:
+	GOARCH=amd64 GOOS=linux GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
 linux-arm64:
-	GOARCH=arm64 GOOS=linux $(GO_BUILD) -o $(DIR)/$(NAME)-$@
+	GOARCH=arm64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
-zip_releases=$(addsuffix .zip, $(PLATFORM_LIST))
+linux-armv5:
+	GOARCH=arm GOARM=5 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
-$(zip_releases): %.zip : %
-	zip -m -j $(DIR)/$(NAME)-$(basename $@).zip $(DIR)/$(NAME)-$(basename $@)
+linux-armv6:
+	GOARCH=arm GOARM=6 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
-releases: $(zip_releases)
+linux-armv7:
+	GOARCH=arm GOARM=7 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-mips-softfloat:
+	GOARCH=mips GOMIPS=softfloat GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-mips-hardfloat:
+	GOARCH=mips GOMIPS=hardfloat GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-mipsle-softfloat:
+	GOARCH=mipsle GOMIPS=softfloat GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-mipsle-hardfloat:
+	GOARCH=mipsle GOMIPS=hardfloat GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-mips64:
+	GOARCH=mips64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-mips64le:
+	GOARCH=mips64le GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-ppc64:
+	GOARCH=ppc64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-ppc64le:
+	GOARCH=ppc64le GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+linux-s390x:
+	GOARCH=s390x GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+openbsd-amd64:
+	GOARCH=amd64 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+openbsd-amd64-v3:
+	GOARCH=amd64 GOOS=openbsd GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+openbsd-arm64:
+	GOARCH=arm64 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
+windows-386:
+	GOARCH=386 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
+windows-amd64:
+	GOARCH=amd64 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
+windows-amd64-v3:
+	GOARCH=amd64 GOOS=windows GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
+windows-arm64:
+	GOARCH=arm64 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
+windows-arm32v7:
+	GOARCH=arm GOARM=7 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
+unix_releases := $(addsuffix .zip, $(UNIX_ARCH_LIST))
+windows_releases := $(addsuffix .zip, $(WINDOWS_ARCH_LIST))
+
+$(unix_releases): %.zip: %
+	@zip -qmj $(BUILD_DIR)/$(BINARY)-$(basename $@).zip $(BUILD_DIR)/$(BINARY)-$(basename $@)
+
+$(windows_releases): %.zip: %
+	@zip -qmj $(BUILD_DIR)/$(BINARY)-$(basename $@).zip $(BUILD_DIR)/$(BINARY)-$(basename $@).exe
+
+all-arch: $(UNIX_ARCH_LIST) $(WINDOWS_ARCH_LIST)
+
+releases: $(unix_releases) $(windows_releases)
+
+lint:
+	GOOS=darwin golangci-lint run ./...
+	GOOS=windows golangci-lint run ./...
+	GOOS=linux golangci-lint run ./...
+	GOOS=freebsd golangci-lint run ./...
+	GOOS=openbsd golangci-lint run ./...
 
 clean:
-	rm $(DIR)/*
+	rm -rf $(BUILD_DIR)

README.md

@@ -1,268 +1,62 @@
-<h1 align="center">tun2socks</h1>
-<h3 align="center">A tun2socks powered by gVisor TCP/IP stack.</h3>
+![tun2socks](docs/wordmark.png)
 
-<p align="center">
-  <a href="https://github.com/xjasonlyu/tun2socks/actions">
-    <img src="https://img.shields.io/github/workflow/status/xjasonlyu/tun2socks/Go/master?style=flat-square" alt="GitHub Workflow">
-  </a>
-  <a href="https://hub.docker.com/r/xjasonlyu/tun2socks">
-    <img src="https://img.shields.io/docker/pulls/xjasonlyu/tun2socks?style=flat-square" alt="Docker Pulls">
-  </a>
-  <a href="https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks">
-    <img src="https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks?style=flat-square" alt="Go Version">
-  </a>
-  <a href="https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks">
-    <img src="https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks?style=flat-square" alt="Go Report">
-  </a>
-  <a href="https://github.com/xjasonlyu/tun2socks/blob/master/LICENSE">
-    <img src="https://img.shields.io/github/license/xjasonlyu/tun2socks?style=flat-square" alt="GitHub License">
-  </a>
-  <a href="https://img.shields.io/tokei/lines/github/xjasonlyu/tun2socks">
-    <img src="https://img.shields.io/tokei/lines/github/xjasonlyu/tun2socks?style=flat-square" alt="Total Lines">
-  </a>
-  <a href="https://github.com/xjasonlyu/tun2socks/releases">
-    <img src="https://img.shields.io/github/v/release/xjasonlyu/tun2socks?include_prereleases&style=flat-square" alt="Release">
-  </a>
-</p>
+[![GitHub Workflow][1]](https://github.com/xjasonlyu/tun2socks/actions)
+[![Go Version][2]](https://github.com/xjasonlyu/tun2socks/blob/main/go.mod)
+[![Go Report][3]](https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks)
+[![Maintainability][4]](https://codeclimate.com/github/xjasonlyu/tun2socks/maintainability)
+[![GitHub License][5]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
+[![Docker Pulls][6]](https://hub.docker.com/r/xjasonlyu/tun2socks)
+[![Releases][7]](https://github.com/xjasonlyu/tun2socks/releases)
+
+[1]: https://img.shields.io/github/actions/workflow/status/xjasonlyu/tun2socks/release.yml?branch=main&logo=github
+[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks?logo=go
+[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks
+[4]: https://api.codeclimate.com/v1/badges/b5b30239174fc6603aca/maintainability
+[5]: https://img.shields.io/github/license/xjasonlyu/tun2socks
+[6]: https://img.shields.io/docker/pulls/xjasonlyu/tun2socks?logo=docker
+[7]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?logo=smartthings
+
+English | [简体中文](README_ZH.md)
 
 ## Features
 
-- ICMP echoing
-- IPv6 support
-- Optimized UDP transmission for game acceleration
-- Pure Go implementation, no more CGO required
-- Router mode, routing all the traffic in LAN
-- Socks5, Shadowsocks protocol support for remote connections
-- TCP/IP stack powered by [gVisor](https://github.com/google/gvisor)
-- Up to 2.5Gbps throughput (10x faster than [v1](https://github.com/xjasonlyu/tun2socks/tree/v1))
+- Proxy Everything: Handle all network traffic of any internet programs sent by the device through a proxy.
+- Proxy Protocols: HTTP/Socks4/Socks5/Shadowsocks with authentication support for remote connections.
+- Run Everywhere: Linux/macOS/Windows/FreeBSD/OpenBSD multi-platform support with specific optimization.
+- Gateway Mode: Act as a layer three gateway to handle network traffic from other devices in the same network.
+- Full IPv6 Support: All functions work in IPv6, tunnel IPv4 connections through IPv6 proxy and vice versa.
+- Network Stack: Powered by user-space TCP/IP stack from Google container application kernel **[gVisor](https://github.com/google/gvisor)**.
 
-## Requirements
+## Benchmarks
 
-| Target | Minimum | Recommended |
-| :----- | :-----: | :---------: |
-| System | linux darwin | linux |
-| Memory | >20MB | >128MB |
-| CPU | amd64 arm64 | amd64 |
+For all scenarios of usage, tun2socks performs best. See [here](https://github.com/xjasonlyu/tun2socks/wiki/Benchmarks) for more details.
 
-## Performance
+![benchmark](docs/benchmark.png)
 
-> iPerf3 tested on Debian 10 with i5-10500, 8G RAM
+## Documentation
 
-![iPerf3 Test](assets/iperf3.png)
+- [Install from Source](https://github.com/xjasonlyu/tun2socks/wiki/Install-from-Source)
+- [Quickstart Examples](https://github.com/xjasonlyu/tun2socks/wiki/Examples)
+- [Memory Optimization](https://github.com/xjasonlyu/tun2socks/wiki/Memory-Optimization)
 
-## How to Build
+Full documentation and technical guides can be found at [Wiki](https://github.com/xjasonlyu/tun2socks/wiki).
 
-### build from source code
+## Community
 
-Go compiler version >= 1.15 is required
-
-```text
-$ git clone https://github.com/xjasonlyu/tun2socks.git
-$ cd tun2socks
-$ make
-```
-
-### build docker image
-
-```text
-$ docker build -t tun2socks .
-```
-
-or
-
-```text
-$ docker build -t tun2socks -f ./docker/Dockerfile.aarch64 .
-```
-
-## QuickStart
-
-Download from precompiled [Releases](https://github.com/xjasonlyu/tun2socks/releases).
-
-<details>
-  <summary><b>With Docker</b></summary>
-
-> Since Go 1.12, the runtime now uses MADV_FREE to release unused memory on **linux**. This is more efficient but may result in higher reported RSS. The kernel will reclaim the unused data when it is needed. To revert to the Go 1.11 behavior (MADV_DONTNEED), set the environment variable GODEBUG=madvdontneed=1.
-
-### create docker network (macvlan mode)
-
-```shell script
-docker network create -d macvlan \
-  --subnet=172.20.1.0/25 \
-  --gateway=172.20.1.1 \
-  -o parent=eth0 \
-  switch
-```
-
-### pull `tun2socks` docker image
-
-```shell script
-docker pull xjasonlyu/tun2socks:latest
-```
-
-### run as gateway
-
-> DNS configuration is required.
-
-```shell script
-docker run -d \
-  --network switch \
-  --name tun2socks \
-  --ip 172.20.1.2 \
-  --privileged \
-  --restart always \
-  --sysctl net.ipv4.ip_forward=1 \
-  -e PROXY=socks5://server:port \
-  -e KEY=VALUE... \
-  xjasonlyu/tun2socks:latest
-```
-
-### use docker-compose (recommended)
-
-```yaml
-version: '2.4'
-
-services:
-  tun2socks:
-    image: xjasonlyu/tun2socks:latest
-    cap_add:
-      - NET_ADMIN
-    devices:
-        - '/dev/net/tun:/dev/net/tun'
-    environment:
-      # - GODEBUG=madvdontneed=1
-      - PROXY=socks5://server:port
-      - LOGLEVEL=INFO
-      - API=api://:8080
-      - DNS=dns://:53
-      - HOSTS=localhost=127.0.0.1,router.local=172.20.1.1
-      - EXCLUDED=1.1.1.1,1.0.0.1
-      - EXTRACMD=
-    networks:
-      switch:
-        ipv4_address: 172.20.1.2
-    restart: always
-    container_name: tun2socks
-
-networks:
-  switch:
-    name: switch
-    ipam:
-      driver: default
-      config:
-        - subnet: '172.20.1.0/25'
-          gateway: 172.20.1.1
-    driver: macvlan
-    driver_opts:
-      parent: eth0
-```
-</details>
-
-<details>
-  <summary><b>With Linux</b></summary>
-
-### create tun
-
-```shell script
-ip tuntap add mode tun dev tun0
-ip addr add 198.18.0.1/15 dev tun0
-ip link set dev tun0 up
-```
-
-### config policy routing
-
-```shell script
-echo "100 tun2socks" >> /etc/iproute2/rt_tables
-
-ip route add default via 198.18.0.1 dev tun0 table tun2socks
-ip route add 172.17.0.0/16 dev eth0 src 172.17.0.3 table tun2socks
-ip route add 198.18.0.0/15 dev tun0 src 198.18.0.1 table tun2socks
-
-ip rule add from 172.20.0.3 to 198.18.0.0/15 priority 1000 prohibit
-ip rule add from 172.20.0.3 priority 2000 table main
-ip rule add from all priority 3000 table tun2socks
-```
-
-### run
-
-> bind to a specific interface to prevent traffic looping.
-
-```shell script
-./tun2socks --loglevel info --device tun://tun0 --proxy socks5://server:port --interface eth0
-```
-</details>
-
-<details>
-  <summary><b>With Script</b></summary>
-
-> entrypoint.sh would take care of tun & routes.
-
-```shell script
-PROXY=socks5://server:port LOGLEVEL=INFO sh ./scripts/entrypoint.sh
-```
-</details>
-
-## Details
-
-<details>
-  <summary><b>API Reference</b></summary>
-
-| Path | Methods | Parameters | Description |
-| :--- | :------ | :--------: | :---------- |
-| `/logs` | GET | `level` | Get real-time logs |
-| `/traffic` | GET | / | Get real-time traffic data |
-| `/version` | GET | / | Get current version |
-| `/connections` | GET | `interval` | Get all connections |
-| `/connections` | DELETE | / | Close all connections |
-| `/connections/{id}` | DELETE | / | Close connection by `id` |
-
-</details>
-
-<details>
-  <summary><b>Help Text</b></summary>
-
-```text
-NAME:
-   tun2socks - A tun2socks powered by gVisor TCP/IP stack.
-
-USAGE:
-   tun2socks [global options] [arguments...]
-
-GLOBAL OPTIONS:
-   --api value                  URL of external API to listen
-   --device value, -d value     URL of device to open
-   --dns value                  URL of fake DNS to listen
-   --hosts value                Extra hosts mapping
-   --interface value, -i value  Bind interface to dial
-   --loglevel value, -l value   Set logging level (default: "INFO")
-   --proxy value, -p value      URL of proxy to dial
-   --version, -v                Print current version (default: false)
-   --help, -h                   show help (default: false)
-```
-
-</details>
-
-<details>
-  <summary><b>Proxy URL</b></summary>
-
-| Protocol | Scheme | Examples |
-| :------- | :----- | :------- |
-| direct | `direct` | `direct://` |
-| socks5 | `socks5` | `socks5://username:password@server:port` |
-| shadowsocks | `ss`, `shadowsocks` | `ss://method:password@server:port` |
-
-</details>
+Welcome and feel free to ask any questions at [Discussions](https://github.com/xjasonlyu/tun2socks/discussions).
 
 ## Credits
 
-- [Dreamacro/clash](https://github.com/Dreamacro/clash)
-- [google/gvisor](https://github.com/google/gvisor)
-- [majek/slirpnetstack](https://github.com/majek/slirpnetstack)
+- [Dreamacro/clash](https://github.com/Dreamacro/clash) - A rule-based tunnel in Go
+- [google/gvisor](https://github.com/google/gvisor) - Application Kernel for Containers
+- [wireguard-go](https://git.zx2c4.com/wireguard-go) - Go Implementation of WireGuard
 
-## Known Issues
+## License
 
-Due to the implementation of pure Go, the memory usage is higher than the previous version.
-If you are sensitive to memory, please go back to [v1](https://github.com/xjasonlyu/tun2socks/tree/v1).
+[GPL-3.0](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
 
-## TODO
+[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks?ref=badge_large)
 
-- [ ] Windows support
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=xjasonlyu/tun2socks&type=Date)](https://star-history.com/#xjasonlyu/tun2socks&Date)

README_ZH.md

@@ -0,0 +1,62 @@
+![tun2socks](docs/wordmark.png)
+
+[![GitHub Workflow][1]](https://github.com/xjasonlyu/tun2socks/actions)
+[![Go Version][2]](https://github.com/xjasonlyu/tun2socks/blob/main/go.mod)
+[![Go Report][3]](https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks)
+[![Maintainability][4]](https://codeclimate.com/github/xjasonlyu/tun2socks/maintainability)
+[![GitHub License][5]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
+[![Docker Pulls][6]](https://hub.docker.com/r/xjasonlyu/tun2socks)
+[![Releases][7]](https://github.com/xjasonlyu/tun2socks/releases)
+
+[1]: https://img.shields.io/github/actions/workflow/status/xjasonlyu/tun2socks/release.yml?branch=main&logo=github
+[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks?logo=go
+[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks
+[4]: https://api.codeclimate.com/v1/badges/b5b30239174fc6603aca/maintainability
+[5]: https://img.shields.io/github/license/xjasonlyu/tun2socks
+[6]: https://img.shields.io/docker/pulls/xjasonlyu/tun2socks?logo=docker
+[7]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?logo=smartthings
+
+[English](README.md) | 简体中文
+
+## 特性介绍
+
+- 全局代理: 处理来自本设备的任意网络应用的所有网络流量并通过代理转发。
+- 代理协议: 通过 HTTP/Socks4/Socks5/Shadowsocks 远程连接且支持鉴权。
+- 跨平台性: 具有 Linux/macOS/Windows/FreeBSD/OpenBSD 特定优化的多平台支持。
+- 网关模式: 作为第三层网关处理来自同一网络中其他设备的所有网络流量。
+- IPv6 支持: 所有功能都可以在 IPv6 中工作，允许通过 IPv6 代理转发 IPv4 连接，反之亦然。
+- TCP/IP 栈: 由来自 Google 容器应用程序内核 **[gVisor](https://github.com/google/gvisor)** 的用户空间 TCP/IP 网络栈强力驱动。
+
+## 性能测试
+
+对于任意的使用场景，tun2socks 表现最佳。更多细节看[这里](https://github.com/xjasonlyu/tun2socks/wiki/Benchmarks)。
+
+![benchmark](docs/benchmark.png)
+
+## 使用文档
+
+- [源码安装](https://github.com/xjasonlyu/tun2socks/wiki/Install-from-Source)
+- [使用例子](https://github.com/xjasonlyu/tun2socks/wiki/Examples)
+- [内存优化](https://github.com/xjasonlyu/tun2socks/wiki/Memory-Optimization)
+
+文档以及使用方式可以在 [Wiki](https://github.com/xjasonlyu/tun2socks/wiki) 里找到。
+
+## 交流讨论
+
+欢迎来讨论区 [Discussions](https://github.com/xjasonlyu/tun2socks/discussions) 交流提问。
+
+## 特别感谢
+
+- [Dreamacro/clash](https://github.com/Dreamacro/clash) - A rule-based tunnel in Go
+- [google/gvisor](https://github.com/google/gvisor) - Application Kernel for Containers
+- [wireguard-go](https://git.zx2c4.com/wireguard-go) - Go Implementation of WireGuard
+
+## 许可协议
+
+[GPL-3.0](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
+
+[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks?ref=badge_large)
+
+## 星星历史
+
+[![Star History Chart](https://api.star-history.com/svg?repos=xjasonlyu/tun2socks&type=Date)](https://star-history.com/#xjasonlyu/tun2socks&Date)

common/observable/iterable.go

@@ -0,0 +1,3 @@
+package observable
+
+type Iterable <-chan any

common/observable/observable.go

@@ -0,0 +1,65 @@
+package observable
+
+import (
+	"errors"
+	"sync"
+)
+
+type Observable struct {
+	iterable Iterable
+	listener map[Subscription]*Subscriber
+	mux      sync.Mutex
+	done     bool
+}
+
+func (o *Observable) process() {
+	for item := range o.iterable {
+		o.mux.Lock()
+		for _, sub := range o.listener {
+			sub.Emit(item)
+		}
+		o.mux.Unlock()
+	}
+	o.close()
+}
+
+func (o *Observable) close() {
+	o.mux.Lock()
+	defer o.mux.Unlock()
+
+	o.done = true
+	for _, sub := range o.listener {
+		sub.Close()
+	}
+}
+
+func (o *Observable) Subscribe() (Subscription, error) {
+	o.mux.Lock()
+	defer o.mux.Unlock()
+	if o.done {
+		return nil, errors.New("observable is closed")
+	}
+	subscriber := newSubscriber()
+	o.listener[subscriber.Out()] = subscriber
+	return subscriber.Out(), nil
+}
+
+func (o *Observable) UnSubscribe(sub Subscription) {
+	o.mux.Lock()
+	defer o.mux.Unlock()
+	subscriber, exist := o.listener[sub]
+	if !exist {
+		return
+	}
+	delete(o.listener, sub)
+	subscriber.Close()
+}
+
+func NewObservable(any Iterable) *Observable {
+	observable := &Observable{
+		iterable: any,
+		listener: map[Subscription]*Subscriber{},
+	}
+	go observable.process()
+	return observable
+}

common/observable/observable_test.go

@@ -0,0 +1,148 @@
+package observable
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/atomic"
+)
+
+func iterator(item []any) chan any {
+	ch := make(chan any)
+	go func() {
+		time.Sleep(100 * time.Millisecond)
+		for _, elm := range item {
+			ch <- elm
+		}
+		close(ch)
+	}()
+	return ch
+}
+
+func TestObservable(t *testing.T) {
+	iter := iterator([]any{1, 2, 3, 4, 5})
+	src := NewObservable(iter)
+	data, err := src.Subscribe()
+	assert.Nil(t, err)
+	count := 0
+	for range data {
+		count++
+	}
+	assert.Equal(t, count, 5)
+}
+
+func TestObservable_MultiSubscribe(t *testing.T) {
+	iter := iterator([]any{1, 2, 3, 4, 5})
+	src := NewObservable(iter)
+	ch1, _ := src.Subscribe()
+	ch2, _ := src.Subscribe()
+	count := atomic.NewInt32(0)
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	waitCh := func(ch <-chan any) {
+		for range ch {
+			count.Inc()
+		}
+		wg.Done()
+	}
+	go waitCh(ch1)
+	go waitCh(ch2)
+	wg.Wait()
+	assert.Equal(t, int32(10), count.Load())
+}
+
+func TestObservable_UnSubscribe(t *testing.T) {
+	iter := iterator([]any{1, 2, 3, 4, 5})
+	src := NewObservable(iter)
+	data, err := src.Subscribe()
+	assert.Nil(t, err)
+	src.UnSubscribe(data)
+	_, open := <-data
+	assert.False(t, open)
+}
+
+func TestObservable_SubscribeClosedSource(t *testing.T) {
+	iter := iterator([]any{1})
+	src := NewObservable(iter)
+	data, _ := src.Subscribe()
+	<-data
+
+	_, closed := src.Subscribe()
+	assert.NotNil(t, closed)
+}
+
+func TestObservable_UnSubscribeWithNotExistSubscription(t *testing.T) {
+	sub := Subscription(make(chan any))
+	iter := iterator([]any{1})
+	src := NewObservable(iter)
+	src.UnSubscribe(sub)
+}
+
+func TestObservable_SubscribeGoroutineLeak(t *testing.T) {
+	iter := iterator([]any{1, 2, 3, 4, 5})
+	src := NewObservable(iter)
+	max := 100
+
+	var list []Subscription
+	for i := 0; i < max; i++ {
+		ch, _ := src.Subscribe()
+		list = append(list, ch)
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(max)
+	waitCh := func(ch <-chan any) {
+		for range ch {
+		}
+		wg.Done()
+	}
+
+	for _, ch := range list {
+		go waitCh(ch)
+	}
+	wg.Wait()
+
+	for _, sub := range list {
+		_, more := <-sub
+		assert.False(t, more)
+	}
+
+	if len(list) > 0 {
+		_, more := <-list[0]
+		assert.False(t, more)
+	}
+}
+
+func Benchmark_Observable_1000(b *testing.B) {
+	ch := make(chan any)
+	o := NewObservable(ch)
+	num := 1000
+
+	var subs []Subscription
+	for i := 0; i < num; i++ {
+		sub, _ := o.Subscribe()
+		subs = append(subs, sub)
+	}
+
+	wg := sync.WaitGroup{}
+	wg.Add(num)
+
+	b.ResetTimer()
+	for _, sub := range subs {
+		go func(s Subscription) {
+			for range s {
+			}
+			wg.Done()
+		}(sub)
+	}
+
+	for i := 0; i < b.N; i++ {
+		ch <- i
+	}
+
+	close(ch)
+	wg.Wait()
+}

common/observable/subscriber.go

@@ -0,0 +1,33 @@
+package observable
+
+import (
+	"sync"
+)
+
+type Subscription <-chan any
+
+type Subscriber struct {
+	buffer chan any
+	once   sync.Once
+}
+
+func (s *Subscriber) Emit(item any) {
+	s.buffer <- item
+}
+
+func (s *Subscriber) Out() Subscription {
+	return s.buffer
+}
+
+func (s *Subscriber) Close() {
+	s.once.Do(func() {
+		close(s.buffer)
+	})
+}
+
+func newSubscriber() *Subscriber {
+	sub := &Subscriber{
+		buffer: make(chan any, 200),
+	}
+	return sub
+}

common/pool/alloc.go

@@ -0,0 +1,63 @@
+package pool
+
+import (
+	"errors"
+	"math/bits"
+	"sync"
+)
+
+var _allocator = NewAllocator()
+
+// Allocator for incoming frames, optimized to prevent overwriting
+// after zeroing.
+type Allocator struct {
+	buffers []sync.Pool
+}
+
+// NewAllocator initiates a []byte allocator for frames less than
+// 65536 bytes, the waste(memory fragmentation) of space allocation
+// is guaranteed to be no more than 50%.
+func NewAllocator() *Allocator {
+	alloc := &Allocator{}
+	alloc.buffers = make([]sync.Pool, 17) // 1B -> 64K
+	for k := range alloc.buffers {
+		i := k
+		alloc.buffers[k].New = func() any {
+			return make([]byte, 1<<uint32(i))
+		}
+	}
+	return alloc
+}
+
+// Get gets a []byte from pool with most appropriate cap.
+func (alloc *Allocator) Get(size int) []byte {
+	if size <= 0 || size > 65536 {
+		return nil
+	}
+
+	b := msb(size)
+	if size == 1<<b {
+		return alloc.buffers[b].Get().([]byte)[:size]
+	}
+
+	return alloc.buffers[b+1].Get().([]byte)[:size]
+}
+
+// Put returns a []byte to pool for future use,
+// which the cap must be exactly 2^n.
+func (alloc *Allocator) Put(buf []byte) error {
+	b := msb(cap(buf))
+	if cap(buf) == 0 || cap(buf) > 65536 || cap(buf) != 1<<b {
+		return errors.New("allocator Put() incorrect buffer size")
+	}
+
+	//lint:ignore SA6002 ignore temporarily
+	//nolint
+	alloc.buffers[b].Put(buf)
+	return nil
+}
+
+// msb returns the pos of most significant bit.
+func msb(size int) uint16 {
+	return uint16(bits.Len32(uint32(size)) - 1)
+}

common/pool/alloc_test.go

@@ -0,0 +1,48 @@
+package pool
+
+import (
+	"math/rand"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAllocGet(t *testing.T) {
+	alloc := NewAllocator()
+	assert.Nil(t, alloc.Get(0))
+	assert.Equal(t, 1, len(alloc.Get(1)))
+	assert.Equal(t, 2, len(alloc.Get(2)))
+	assert.Equal(t, 3, len(alloc.Get(3)))
+	assert.Equal(t, 4, cap(alloc.Get(3)))
+	assert.Equal(t, 4, cap(alloc.Get(4)))
+	assert.Equal(t, 1023, len(alloc.Get(1023)))
+	assert.Equal(t, 1024, cap(alloc.Get(1023)))
+	assert.Equal(t, 1024, len(alloc.Get(1024)))
+	assert.Equal(t, 65536, len(alloc.Get(65536)))
+	assert.Nil(t, alloc.Get(65537))
+}
+
+func TestAllocPut(t *testing.T) {
+	alloc := NewAllocator()
+	assert.NotNil(t, alloc.Put(nil), "put nil misbehavior")
+	assert.NotNil(t, alloc.Put(make([]byte, 3)), "put elem:3 []bytes misbehavior")
+	assert.Nil(t, alloc.Put(make([]byte, 4)), "put elem:4 []bytes misbehavior")
+	assert.Nil(t, alloc.Put(make([]byte, 1023, 1024)), "put elem:1024 []bytes misbehavior")
+	assert.Nil(t, alloc.Put(make([]byte, 65536)), "put elem:65536 []bytes misbehavior")
+	assert.NotNil(t, alloc.Put(make([]byte, 65537)), "put elem:65537 []bytes misbehavior")
+}
+
+func TestAllocPutThenGet(t *testing.T) {
+	alloc := NewAllocator()
+	data := alloc.Get(4)
+	_ = alloc.Put(data)
+	newData := alloc.Get(4)
+
+	assert.Equal(t, cap(data), cap(newData), "different cap while alloc.Get()")
+}
+
+func BenchmarkMSB(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		msb(rand.Int())
+	}
+}

common/pool/buffer.go

@@ -0,0 +1,17 @@
+package pool
+
+import (
+	"bytes"
+	"sync"
+)
+
+var bufferPool = sync.Pool{New: func() any { return &bytes.Buffer{} }}
+
+func GetBuffer() *bytes.Buffer {
+	return bufferPool.Get().(*bytes.Buffer)
+}
+
+func PutBuffer(buf *bytes.Buffer) {
+	buf.Reset()
+	bufferPool.Put(buf)
+}

common/pool/pool.go

@@ -0,0 +1,23 @@
+// Package pool provides a pool of []byte.
+package pool
+
+const (
+	// MaxSegmentSize is the largest possible UDP datagram size.
+	MaxSegmentSize = (1 << 16) - 1
+
+	// RelayBufferSize is a buffer of 20 KiB to reduce the memory
+	// of each TCP relay as io.Copy default buffer size is 32 KiB,
+	// but the maximum packet size of vmess/shadowsocks is about
+	// 16 KiB, so define .
+	RelayBufferSize = 20 << 10
+)
+
+// Get gets a []byte from default allocator with most appropriate cap.
+func Get(size int) []byte {
+	return _allocator.Get(size)
+}
+
+// Put returns a []byte to default allocator for future use.
+func Put(buf []byte) error {
+	return _allocator.Put(buf)
+}

core/adapter/adapter.go

@@ -0,0 +1,24 @@
+package adapter
+
+import (
+	"net"
+
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+// TCPConn implements the net.Conn interface.
+type TCPConn interface {
+	net.Conn
+
+	// ID returns the transport endpoint id of TCPConn.
+	ID() *stack.TransportEndpointID
+}
+
+// UDPConn implements net.Conn and net.PacketConn.
+type UDPConn interface {
+	net.Conn
+	net.PacketConn
+
+	// ID returns the transport endpoint id of UDPConn.
+	ID() *stack.TransportEndpointID
+}

core/adapter/handler.go

@@ -0,0 +1,8 @@
+package adapter
+
+// TransportHandler is a TCP/UDP connection handler that implements
+// HandleTCP and HandleUDP methods.
+type TransportHandler interface {
+	HandleTCP(TCPConn)
+	HandleUDP(UDPConn)
+}

core/device/device.go

@@ -0,0 +1,20 @@
+package device
+
+import (
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+// Device is the interface that implemented by network layer devices (e.g. tun),
+// and easy to use as stack.LinkEndpoint.
+type Device interface {
+	stack.LinkEndpoint
+
+	// Close stops and closes the device.
+	Close() error
+
+	// Name returns the current name of the device.
+	Name() string
+
+	// Type returns the driver type of the device.
+	Type() string
+}

core/device/fdbased/fd.go

@@ -0,0 +1,3 @@
+package fdbased
+
+const Driver = "fd"

core/device/fdbased/fd_unix.go

@@ -0,0 +1,47 @@
+//go:build !windows
+
+package fdbased
+
+import (
+	"fmt"
+	"strconv"
+
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+const defaultMTU = 1500
+
+type FD struct {
+	stack.LinkEndpoint
+
+	fd  int
+	mtu uint32
+}
+
+func Open(name string, mtu uint32) (device.Device, error) {
+	fd, err := strconv.Atoi(name)
+	if err != nil {
+		return nil, fmt.Errorf("cannot open fd: %s", name)
+	}
+	if mtu == 0 {
+		mtu = defaultMTU
+	}
+	return open(fd, mtu)
+}
+
+func (f *FD) Type() string {
+	return Driver
+}
+
+func (f *FD) Name() string {
+	return strconv.Itoa(f.fd)
+}
+
+func (f *FD) Close() error {
+	return unix.Close(f.fd)
+}
+
+var _ device.Device = (*FD)(nil)

core/device/fdbased/fd_windows.go

@@ -0,0 +1,11 @@
+package fdbased
+
+import (
+	"errors"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+func Open(name string, mtu uint32) (device.Device, error) {
+	return nil, errors.New("not supported")
+}

core/device/fdbased/open_linux.go

@@ -0,0 +1,28 @@
+//go:build (linux && amd64) || (linux && arm64)
+
+package fdbased
+
+import (
+	"fmt"
+
+	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+func open(fd int, mtu uint32) (device.Device, error) {
+	f := &FD{fd: fd, mtu: mtu}
+
+	ep, err := fdbased.New(&fdbased.Options{
+		FDs: []int{fd},
+		MTU: mtu,
+		// TUN only, ignore ethernet header.
+		EthernetHeader: false,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	f.LinkEndpoint = ep
+
+	return f, nil
+}

core/device/fdbased/open_others.go

@@ -0,0 +1,23 @@
+//go:build !(linux && amd64) && !(linux && arm64) && !windows
+
+package fdbased
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/iobased"
+)
+
+func open(fd int, mtu uint32) (device.Device, error) {
+	f := &FD{fd: fd, mtu: mtu}
+
+	ep, err := iobased.New(os.NewFile(uintptr(fd), f.Name()), mtu, 0)
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	f.LinkEndpoint = ep
+
+	return f, nil
+}

core/device/iobased/endpoint.go

@@ -0,0 +1,153 @@
+// Package iobased provides the implementation of io.ReadWriter
+// based data-link layer endpoints.
+package iobased
+
+import (
+	"context"
+	"errors"
+	"io"
+	"sync"
+
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/link/channel"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+const (
+	// Queue length for outbound packet, arriving for read. Overflow
+	// causes packet drops.
+	defaultOutQueueLen = 1 << 10
+)
+
+// Endpoint implements the interface of stack.LinkEndpoint from io.ReadWriter.
+type Endpoint struct {
+	*channel.Endpoint
+
+	// rw is the io.ReadWriter for reading and writing packets.
+	rw io.ReadWriter
+
+	// mtu (maximum transmission unit) is the maximum size of a packet.
+	mtu uint32
+
+	// offset can be useful when perform TUN device I/O with TUN_PI enabled.
+	offset int
+
+	// once is used to perform the init action once when attaching.
+	once sync.Once
+
+	// wg keeps track of running goroutines.
+	wg sync.WaitGroup
+}
+
+// New returns stack.LinkEndpoint(.*Endpoint) and error.
+func New(rw io.ReadWriter, mtu uint32, offset int) (*Endpoint, error) {
+	if mtu == 0 {
+		return nil, errors.New("MTU size is zero")
+	}
+
+	if rw == nil {
+		return nil, errors.New("RW interface is nil")
+	}
+
+	if offset < 0 {
+		return nil, errors.New("offset must be non-negative")
+	}
+
+	return &Endpoint{
+		Endpoint: channel.New(defaultOutQueueLen, mtu, ""),
+		rw:       rw,
+		mtu:      mtu,
+		offset:   offset,
+	}, nil
+}
+
+// Attach launches the goroutine that reads packets from io.Reader and
+// dispatches them via the provided dispatcher.
+func (e *Endpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	e.Endpoint.Attach(dispatcher)
+	e.once.Do(func() {
+		ctx, cancel := context.WithCancel(context.Background())
+		e.wg.Add(2)
+		go func() {
+			e.outboundLoop(ctx)
+			e.wg.Done()
+		}()
+		go func() {
+			e.dispatchLoop(cancel)
+			e.wg.Done()
+		}()
+	})
+}
+
+func (e *Endpoint) Wait() {
+	e.wg.Wait()
+}
+
+// dispatchLoop dispatches packets to upper layer.
+func (e *Endpoint) dispatchLoop(cancel context.CancelFunc) {
+	// Call cancel() to ensure (*Endpoint).outboundLoop(context.Context) exits
+	// gracefully after (*Endpoint).dispatchLoop(context.CancelFunc) returns.
+	defer cancel()
+
+	offset, mtu := e.offset, int(e.mtu)
+
+	for {
+		data := make([]byte, offset+mtu)
+
+		n, err := e.rw.Read(data)
+		if err != nil {
+			break
+		}
+
+		if n == 0 || n > mtu {
+			continue
+		}
+
+		if !e.IsAttached() {
+			continue /* unattached, drop packet */
+		}
+
+		pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
+			Payload: buffer.MakeWithData(data[offset : offset+n]),
+		})
+
+		switch header.IPVersion(data[offset:]) {
+		case header.IPv4Version:
+			e.InjectInbound(header.IPv4ProtocolNumber, pkt)
+		case header.IPv6Version:
+			e.InjectInbound(header.IPv6ProtocolNumber, pkt)
+		}
+		pkt.DecRef()
+	}
+}
+
+// outboundLoop reads outbound packets from channel, and then it calls
+// writePacket to send those packets back to lower layer.
+func (e *Endpoint) outboundLoop(ctx context.Context) {
+	for {
+		pkt := e.ReadContext(ctx)
+		if pkt.IsNil() {
+			break
+		}
+		e.writePacket(pkt)
+	}
+}
+
+// writePacket writes outbound packets to the io.Writer.
+func (e *Endpoint) writePacket(pkt stack.PacketBufferPtr) tcpip.Error {
+	defer pkt.DecRef()
+
+	buf := pkt.ToBuffer()
+	defer buf.Release()
+	if e.offset != 0 {
+		v := buffer.NewViewWithData(make([]byte, e.offset))
+		_ = buf.Prepend(v)
+	}
+
+	if _, err := e.rw.Write(buf.Flatten()); err != nil {
+		return &tcpip.ErrInvalidEndpointState{}
+	}
+	return nil
+}

core/device/tun/tun.go

@@ -0,0 +1,14 @@
+// Package tun provides TUN which implemented device.Device interface.
+package tun
+
+import (
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+const Driver = "tun"
+
+func (t *TUN) Type() string {
+	return Driver
+}
+
+var _ device.Device = (*TUN)(nil)

core/device/tun/tun_netstack.go

@@ -0,0 +1,102 @@
+//go:build (linux && amd64) || (linux && arm64)
+
+package tun
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
+	"gvisor.dev/gvisor/pkg/tcpip/link/rawfile"
+	"gvisor.dev/gvisor/pkg/tcpip/link/tun"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+type TUN struct {
+	stack.LinkEndpoint
+
+	fd   int
+	mtu  uint32
+	name string
+}
+
+func Open(name string, mtu uint32) (device.Device, error) {
+	t := &TUN{name: name, mtu: mtu}
+
+	if len(t.name) >= unix.IFNAMSIZ {
+		return nil, fmt.Errorf("interface name too long: %s", t.name)
+	}
+
+	fd, err := tun.Open(t.name)
+	if err != nil {
+		return nil, fmt.Errorf("create tun: %w", err)
+	}
+	t.fd = fd
+
+	if t.mtu > 0 {
+		if err := setMTU(t.name, t.mtu); err != nil {
+			return nil, fmt.Errorf("set mtu: %w", err)
+		}
+	}
+
+	_mtu, err := rawfile.GetMTU(t.name)
+	if err != nil {
+		return nil, fmt.Errorf("get mtu: %w", err)
+	}
+	t.mtu = _mtu
+
+	ep, err := fdbased.New(&fdbased.Options{
+		FDs: []int{fd},
+		MTU: t.mtu,
+		// TUN only, ignore ethernet header.
+		EthernetHeader: false,
+		// SYS_READV support only for TUN fd.
+		PacketDispatchMode: fdbased.Readv,
+		// TAP/TUN fd's are not sockets and using the WritePackets calls results
+		// in errors as it always defaults to using SendMMsg which is not supported
+		// for tap/tun device fds.
+		//
+		// This CL changes WritePackets to gracefully degrade to using writev instead
+		// of sendmmsg if the underlying fd is not a socket.
+		//
+		// Fixed: https://github.com/google/gvisor/commit/f33d034fecd7723a1e560ccc62aeeba328454fd0
+		MaxSyscallHeaderBytes: 0x00,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	t.LinkEndpoint = ep
+
+	return t, nil
+}
+
+func (t *TUN) Name() string {
+	return t.name
+}
+
+func (t *TUN) Close() error {
+	return unix.Close(t.fd)
+}
+
+func setMTU(name string, n uint32) error {
+	// open datagram socket
+	fd, err := unix.Socket(
+		unix.AF_INET,
+		unix.SOCK_DGRAM,
+		0,
+	)
+	if err != nil {
+		return err
+	}
+
+	defer unix.Close(fd)
+
+	ifr, err := unix.NewIfreq(name)
+	if err != nil {
+		return err
+	}
+	ifr.SetUint32(n)
+	return unix.IoctlIfreq(fd, unix.SIOCSIFMTU, ifr)
+}

core/device/tun/tun_wireguard.go

@@ -0,0 +1,95 @@
+//go:build !(linux && amd64) && !(linux && arm64)
+
+package tun
+
+import (
+	"fmt"
+	"sync"
+
+	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/iobased"
+)
+
+type TUN struct {
+	*iobased.Endpoint
+
+	nt     *tun.NativeTun
+	mtu    uint32
+	name   string
+	offset int
+
+	rSizes []int
+	rBuffs [][]byte
+	wBuffs [][]byte
+	rMutex sync.Mutex
+	wMutex sync.Mutex
+}
+
+func Open(name string, mtu uint32) (_ device.Device, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("open tun: %v", r)
+		}
+	}()
+
+	t := &TUN{
+		name:   name,
+		mtu:    mtu,
+		offset: offset,
+		rSizes: make([]int, 1),
+		rBuffs: make([][]byte, 1),
+		wBuffs: make([][]byte, 1),
+	}
+
+	forcedMTU := defaultMTU
+	if t.mtu > 0 {
+		forcedMTU = int(t.mtu)
+	}
+
+	nt, err := createTUN(t.name, forcedMTU)
+	if err != nil {
+		return nil, fmt.Errorf("create tun: %w", err)
+	}
+	t.nt = nt.(*tun.NativeTun)
+
+	tunMTU, err := nt.MTU()
+	if err != nil {
+		return nil, fmt.Errorf("get mtu: %w", err)
+	}
+	t.mtu = uint32(tunMTU)
+
+	ep, err := iobased.New(t, t.mtu, offset)
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	t.Endpoint = ep
+
+	return t, nil
+}
+
+func (t *TUN) Read(packet []byte) (int, error) {
+	t.rMutex.Lock()
+	defer t.rMutex.Unlock()
+	t.rBuffs[0] = packet
+	_, err := t.nt.Read(t.rBuffs, t.rSizes, t.offset)
+	return t.rSizes[0], err
+}
+
+func (t *TUN) Write(packet []byte) (int, error) {
+	t.wMutex.Lock()
+	defer t.wMutex.Unlock()
+	t.wBuffs[0] = packet
+	return t.nt.Write(t.wBuffs, t.offset)
+}
+
+func (t *TUN) Name() string {
+	name, _ := t.nt.Name()
+	return name
+}
+
+func (t *TUN) Close() error {
+	defer t.Endpoint.Close()
+	return t.nt.Close()
+}

core/device/tun/tun_wireguard_linux.go

@@ -0,0 +1,26 @@
+//go:build linux && !(amd64 || arm64)
+
+package tun
+
+import (
+	"fmt"
+	"os"
+
+	"golang.zx2c4.com/wireguard/tun"
+	gun "gvisor.dev/gvisor/pkg/tcpip/link/tun"
+)
+
+const (
+	offset     = 0 /* IFF_NO_PI */
+	defaultMTU = 1500
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	nfd, err := gun.Open(name)
+	if err != nil {
+		return nil, fmt.Errorf("create tun: %w", err)
+	}
+
+	fd := os.NewFile(uintptr(nfd), "/dev/net/tun")
+	return tun.CreateTUNFromFile(fd, mtu)
+}

core/device/tun/tun_wireguard_unix.go

@@ -0,0 +1,16 @@
+//go:build unix && !linux
+
+package tun
+
+import (
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+const (
+	offset     = 4 /* 4 bytes TUN_PI */
+	defaultMTU = 1500
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	return tun.CreateTUN(name, mtu)
+}

core/device/tun/tun_wireguard_windows.go

@@ -0,0 +1,14 @@
+package tun
+
+import (
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+const (
+	offset     = 0
+	defaultMTU = 0 /* auto */
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	return tun.CreateTUN(name, mtu)
+}

core/nic.go

@@ -5,12 +5,11 @@ import (
 
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
 )
 
 const (
-	// defaultNICID is the ID of default NIC used by DefaultStack.
-	defaultNICID tcpip.NICID = 1
-
 	// nicPromiscuousModeEnabled is the value used by stack to enable
 	// or disable NIC's promiscuous mode.
 	nicPromiscuousModeEnabled = true
@@ -20,18 +19,25 @@ const (
 	nicSpoofingEnabled = true
 )
 
-// WithCreatingNIC creates NIC for stack.
-func WithCreatingNIC(nicID tcpip.NICID, ep stack.LinkEndpoint) Option {
+// withCreatingNIC creates NIC for stack.
+func withCreatingNIC(nicID tcpip.NICID, ep stack.LinkEndpoint) option.Option {
 	return func(s *stack.Stack) error {
-		if err := s.CreateNIC(nicID, ep); err != nil {
+		if err := s.CreateNICWithOptions(nicID, ep,
+			stack.NICOptions{
+				Disabled: false,
+				// If no queueing discipline was specified
+				// provide a stub implementation that just
+				// delegates to the lower link endpoint.
+				QDisc: nil,
+			}); err != nil {
 			return fmt.Errorf("create NIC: %s", err)
 		}
 		return nil
 	}
 }
 
-// WithPromiscuousMode sets promiscuous mode in the given NIC.
-func WithPromiscuousMode(nicID tcpip.NICID, v bool) Option {
+// withPromiscuousMode sets promiscuous mode in the given NICs.
+func withPromiscuousMode(nicID tcpip.NICID, v bool) option.Option {
 	return func(s *stack.Stack) error {
 		if err := s.SetPromiscuousMode(nicID, v); err != nil {
 			return fmt.Errorf("set promiscuous mode: %s", err)
@@ -40,9 +46,9 @@ func WithPromiscuousMode(nicID tcpip.NICID, v bool) Option {
 	}
 }
 
-// WithSpoofing sets address spoofing in the given NIC, allowing
+// withSpoofing sets address spoofing in the given NICs, allowing
 // endpoints to bind to any address in the NIC.
-func WithSpoofing(nicID tcpip.NICID, v bool) Option {
+func withSpoofing(nicID tcpip.NICID, v bool) option.Option {
 	return func(s *stack.Stack) error {
 		if err := s.SetSpoofing(nicID, v); err != nil {
 			return fmt.Errorf("set spoofing: %s", err)

core/option/option.go

@@ -1,4 +1,4 @@
-package core
+package option
 
 import (
 	"fmt"
@@ -12,19 +12,13 @@ import (
 )
 
 const (
-	// maxBufferSize is the maximum permitted size of a send/receive buffer.
-	maxBufferSize = 4 << 20 // 4 MiB
-
-	// minBufferSize is the smallest size of a receive or send buffer.
-	minBufferSize = 4 << 10 // 4 KiB
-
-	// defaultBufferSize is the default size of the send/recv buffer for
-	// a transport endpoint.
-	defaultBufferSize = 212 << 10 // 212 KiB
-
 	// defaultTimeToLive specifies the default TTL used by stack.
 	defaultTimeToLive uint8 = 64
 
+	// ipForwardingEnabled is the value used by stack to enable packet
+	// forwarding between NICs.
+	ipForwardingEnabled = true
+
 	// icmpBurst is the default number of ICMP messages that can be sent in
 	// a single burst.
 	icmpBurst = 50
@@ -33,10 +27,6 @@ const (
 	// by this rate limiter.
 	icmpLimit rate.Limit = 1000
 
-	// ipForwardingEnabled is the value used by stack to enable packet
-	// forwarding between NICs.
-	ipForwardingEnabled = true
-
 	// tcpCongestionControl is the congestion control algorithm used by
 	// stack. ccReno is the default option in gVisor stack.
 	tcpCongestionControlAlgorithm = "reno" // "reno" or "cubic"
@@ -47,15 +37,83 @@ const (
 
 	// tcpModerateReceiveBufferEnabled is the value used by stack to
 	// enable or disable tcp receive buffer auto-tuning option.
-	tcpModerateReceiveBufferEnabled = true
+	tcpModerateReceiveBufferEnabled = false
 
 	// tcpSACKEnabled is the value used by stack to enable or disable
 	// tcp selective ACK.
 	tcpSACKEnabled = true
+
+	// tcpRecovery is the loss detection algorithm used by TCP.
+	tcpRecovery = tcpip.TCPRACKLossDetection
+
+	// tcpMinBufferSize is the smallest size of a send/recv buffer.
+	tcpMinBufferSize = tcp.MinBufferSize
+
+	// tcpMaxBufferSize is the maximum permitted size of a send/recv buffer.
+	tcpMaxBufferSize = tcp.MaxBufferSize
+
+	// tcpDefaultBufferSize is the default size of the send buffer for
+	// a transport endpoint.
+	tcpDefaultSendBufferSize = tcp.DefaultSendBufferSize
+
+	// tcpDefaultReceiveBufferSize is the default size of the receive buffer
+	// for a transport endpoint.
+	tcpDefaultReceiveBufferSize = tcp.DefaultReceiveBufferSize
 )
 
 type Option func(*stack.Stack) error
 
+// WithDefault sets all default values for stack.
+func WithDefault() Option {
+	return func(s *stack.Stack) error {
+		opts := []Option{
+			WithDefaultTTL(defaultTimeToLive),
+			WithForwarding(ipForwardingEnabled),
+
+			// Config default stack ICMP settings.
+			WithICMPBurst(icmpBurst), WithICMPLimit(icmpLimit),
+
+			// We expect no packet loss, therefore we can bump buffers.
+			// Too large buffers thrash cache, so there is little point
+			// in too large buffers.
+			//
+			// Ref: https://github.com/cloudflare/slirpnetstack/blob/master/stack.go
+			WithTCPSendBufferSizeRange(tcpMinBufferSize, tcpDefaultSendBufferSize, tcpMaxBufferSize),
+			WithTCPReceiveBufferSizeRange(tcpMinBufferSize, tcpDefaultReceiveBufferSize, tcpMaxBufferSize),
+
+			WithTCPCongestionControl(tcpCongestionControlAlgorithm),
+			WithTCPDelay(tcpDelayEnabled),
+
+			// Receive Buffer Auto-Tuning Option, see:
+			// https://github.com/google/gvisor/issues/1666
+			WithTCPModerateReceiveBuffer(tcpModerateReceiveBufferEnabled),
+
+			// TCP selective ACK Option, see:
+			// https://tools.ietf.org/html/rfc2018
+			WithTCPSACKEnabled(tcpSACKEnabled),
+
+			// TCPRACKLossDetection: indicates RACK is used for loss detection and
+			// recovery.
+			//
+			// TCPRACKStaticReoWnd: indicates the reordering window should not be
+			// adjusted when DSACK is received.
+			//
+			// TCPRACKNoDupTh: indicates RACK should not consider the classic three
+			// duplicate acknowledgements rule to mark the segments as lost. This
+			// is used when reordering is not detected.
+			WithTCPRecovery(tcpRecovery),
+		}
+
+		for _, opt := range opts {
+			if err := opt(s); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}
+}
+
 // WithDefaultTTL sets the default TTL used by stack.
 func WithDefaultTTL(ttl uint8) Option {
 	return func(s *stack.Stack) error {
@@ -73,10 +131,10 @@ func WithDefaultTTL(ttl uint8) Option {
 // WithForwarding sets packet forwarding between NICs for IPv4 & IPv6.
 func WithForwarding(v bool) Option {
 	return func(s *stack.Stack) error {
-		if err := s.SetForwarding(ipv4.ProtocolNumber, v); err != nil {
+		if err := s.SetForwardingDefaultAndAllNICs(ipv4.ProtocolNumber, v); err != nil {
 			return fmt.Errorf("set ipv4 forwarding: %s", err)
 		}
-		if err := s.SetForwarding(ipv6.ProtocolNumber, v); err != nil {
+		if err := s.SetForwardingDefaultAndAllNICs(ipv6.ProtocolNumber, v); err != nil {
 			return fmt.Errorf("set ipv6 forwarding: %s", err)
 		}
 		return nil
@@ -101,17 +159,46 @@ func WithICMPLimit(limit rate.Limit) Option {
 	}
 }
 
-// WithTCPBufferSizeRange sets the receive and send buffer size range for TCP.
-func WithTCPBufferSizeRange(a, b, c int) Option {
+// WithTCPSendBufferSize sets default the send buffer size for TCP.
+func WithTCPSendBufferSize(size int) Option {
+	return func(s *stack.Stack) error {
+		sndOpt := tcpip.TCPSendBufferSizeRangeOption{Min: tcpMinBufferSize, Default: size, Max: tcpMaxBufferSize}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &sndOpt); err != nil {
+			return fmt.Errorf("set TCP send buffer size range: %s", err)
+		}
+		return nil
+	}
+}
+
+// WithTCPSendBufferSizeRange sets the send buffer size range for TCP.
+func WithTCPSendBufferSizeRange(a, b, c int) Option {
+	return func(s *stack.Stack) error {
+		sndOpt := tcpip.TCPSendBufferSizeRangeOption{Min: a, Default: b, Max: c}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &sndOpt); err != nil {
+			return fmt.Errorf("set TCP send buffer size range: %s", err)
+		}
+		return nil
+	}
+}
+
+// WithTCPReceiveBufferSize sets the default receive buffer size for TCP.
+func WithTCPReceiveBufferSize(size int) Option {
+	return func(s *stack.Stack) error {
+		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: tcpMinBufferSize, Default: size, Max: tcpMaxBufferSize}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
+			return fmt.Errorf("set TCP receive buffer size range: %s", err)
+		}
+		return nil
+	}
+}
+
+// WithTCPReceiveBufferSizeRange sets the receive buffer size range for TCP.
+func WithTCPReceiveBufferSizeRange(a, b, c int) Option {
 	return func(s *stack.Stack) error {
 		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: a, Default: b, Max: c}
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
 			return fmt.Errorf("set TCP receive buffer size range: %s", err)
 		}
-		sndOpt := tcpip.TCPSendBufferSizeRangeOption{Min: a, Default: b, Max: c}
-		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &sndOpt); err != nil {
-			return fmt.Errorf("set TCP send buffer size range: %s", err)
-		}
 		return nil
 	}
 }
@@ -159,3 +246,13 @@ func WithTCPSACKEnabled(v bool) Option {
 		return nil
 	}
 }
+
+// WithTCPRecovery sets the recovery option for TCP.
+func WithTCPRecovery(v tcpip.TCPRecovery) Option {
+	return func(s *stack.Stack) error {
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &v); err != nil {
+			return fmt.Errorf("set TCP Recovery: %s", err)
+		}
+		return nil
+	}
+}

core/route.go

@@ -0,0 +1,25 @@
+package core
+
+import (
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+func withRouteTable(nicID tcpip.NICID) option.Option {
+	return func(s *stack.Stack) error {
+		s.SetRouteTable([]tcpip.Route{
+			{
+				Destination: header.IPv4EmptySubnet,
+				NIC:         nicID,
+			},
+			{
+				Destination: header.IPv6EmptySubnet,
+				NIC:         nicID,
+			},
+		})
+		return nil
+	}
+}

core/stack.go

@@ -0,0 +1,99 @@
+package core
+
+import (
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+// Config is the configuration to create *stack.Stack.
+type Config struct {
+	// LinkEndpoints is the interface implemented by
+	// data link layer protocols.
+	LinkEndpoint stack.LinkEndpoint
+
+	// TransportHandler is the handler used by internal
+	// stack to set transport handlers.
+	TransportHandler adapter.TransportHandler
+
+	// Options are supplement options to apply settings
+	// for the internal stack.
+	Options []option.Option
+}
+
+// CreateStack creates *stack.Stack with given config.
+func CreateStack(cfg *Config) (*stack.Stack, error) {
+	opts := []option.Option{option.WithDefault()}
+	if len(opts) > 0 {
+		opts = append(opts, cfg.Options...)
+	}
+
+	s := stack.New(stack.Options{
+		NetworkProtocols: []stack.NetworkProtocolFactory{
+			ipv4.NewProtocol,
+			ipv6.NewProtocol,
+		},
+		TransportProtocols: []stack.TransportProtocolFactory{
+			tcp.NewProtocol,
+			udp.NewProtocol,
+			icmp.NewProtocol4,
+			icmp.NewProtocol6,
+		},
+	})
+
+	// Generate unique NIC id.
+	nicID := tcpip.NICID(s.UniqueID())
+
+	opts = append(opts,
+		// Important: We must initiate transport protocol handlers
+		// before creating NIC, otherwise NIC would dispatch packets
+		// to stack and cause race condition.
+		// Initiate transport protocol (TCP/UDP) with given handler.
+		withTCPHandler(cfg.TransportHandler.HandleTCP),
+		withUDPHandler(cfg.TransportHandler.HandleUDP),
+
+		// Create stack NIC and then bind link endpoint to it.
+		withCreatingNIC(nicID, cfg.LinkEndpoint),
+
+		// In the past we did s.AddAddressRange to assign 0.0.0.0/0
+		// onto the interface. We need that to be able to terminate
+		// all the incoming connections - to any ip. AddressRange API
+		// has been removed and the suggested workaround is to use
+		// Promiscuous mode. https://github.com/google/gvisor/issues/3876
+		//
+		// Ref: https://github.com/cloudflare/slirpnetstack/blob/master/stack.go
+		withPromiscuousMode(nicID, nicPromiscuousModeEnabled),
+
+		// Enable spoofing if a stack may send packets from unowned
+		// addresses. This change required changes to some netgophers
+		// since previously, promiscuous mode was enough to let the
+		// netstack respond to all incoming packets regardless of the
+		// packet's destination address. Now that a stack.Route is not
+		// held for each incoming packet, finding a route may fail with
+		// local addresses we don't own but accepted packets for while
+		// in promiscuous mode. Since we also want to be able to send
+		// from any address (in response the received promiscuous mode
+		// packets), we need to enable spoofing.
+		//
+		// Ref: https://github.com/google/gvisor/commit/8c0701462a84ff77e602f1626aec49479c308127
+		withSpoofing(nicID, nicSpoofingEnabled),
+
+		// Add default route table for IPv4 and IPv6. This will handle
+		// all incoming ICMP packets.
+		withRouteTable(nicID),
+	)
+
+	for _, opt := range opts {
+		if err := opt(s); err != nil {
+			return nil, err
+		}
+	}
+	return s, nil
+}

core/tcp.go

@@ -0,0 +1,122 @@
+package core
+
+import (
+	"time"
+
+	glog "gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+const (
+	// defaultWndSize if set to zero, the default
+	// receive window buffer size is used instead.
+	defaultWndSize = 0
+
+	// maxConnAttempts specifies the maximum number
+	// of in-flight tcp connection attempts.
+	maxConnAttempts = 2 << 10
+
+	// tcpKeepaliveCount is the maximum number of
+	// TCP keep-alive probes to send before giving up
+	// and killing the connection if no response is
+	// obtained from the other end.
+	tcpKeepaliveCount = 9
+
+	// tcpKeepaliveIdle specifies the time a connection
+	// must remain idle before the first TCP keepalive
+	// packet is sent. Once this time is reached,
+	// tcpKeepaliveInterval option is used instead.
+	tcpKeepaliveIdle = 60 * time.Second
+
+	// tcpKeepaliveInterval specifies the interval
+	// time between sending TCP keepalive packets.
+	tcpKeepaliveInterval = 30 * time.Second
+)
+
+func withTCPHandler(handle func(adapter.TCPConn)) option.Option {
+	return func(s *stack.Stack) error {
+		tcpForwarder := tcp.NewForwarder(s, defaultWndSize, maxConnAttempts, func(r *tcp.ForwarderRequest) {
+			var (
+				wq  waiter.Queue
+				ep  tcpip.Endpoint
+				err tcpip.Error
+				id  = r.ID()
+			)
+
+			defer func() {
+				if err != nil {
+					glog.Debugf("forward tcp request: %s:%d->%s:%d: %s",
+						id.RemoteAddress, id.RemotePort, id.LocalAddress, id.LocalPort, err)
+				}
+			}()
+
+			// Perform a TCP three-way handshake.
+			ep, err = r.CreateEndpoint(&wq)
+			if err != nil {
+				// RST: prevent potential half-open TCP connection leak.
+				r.Complete(true)
+				return
+			}
+			defer r.Complete(false)
+
+			err = setSocketOptions(s, ep)
+
+			conn := &tcpConn{
+				TCPConn: gonet.NewTCPConn(&wq, ep),
+				id:      id,
+			}
+			handle(conn)
+		})
+		s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
+		return nil
+	}
+}
+
+func setSocketOptions(s *stack.Stack, ep tcpip.Endpoint) tcpip.Error {
+	{ /* TCP keepalive options */
+		ep.SocketOptions().SetKeepAlive(true)
+
+		idle := tcpip.KeepaliveIdleOption(tcpKeepaliveIdle)
+		if err := ep.SetSockOpt(&idle); err != nil {
+			return err
+		}
+
+		interval := tcpip.KeepaliveIntervalOption(tcpKeepaliveInterval)
+		if err := ep.SetSockOpt(&interval); err != nil {
+			return err
+		}
+
+		if err := ep.SetSockOptInt(tcpip.KeepaliveCountOption, tcpKeepaliveCount); err != nil {
+			return err
+		}
+	}
+	{ /* TCP recv/send buffer size */
+		var ss tcpip.TCPSendBufferSizeRangeOption
+		if err := s.TransportProtocolOption(header.TCPProtocolNumber, &ss); err == nil {
+			ep.SocketOptions().SetReceiveBufferSize(int64(ss.Default), false)
+		}
+
+		var rs tcpip.TCPReceiveBufferSizeRangeOption
+		if err := s.TransportProtocolOption(header.TCPProtocolNumber, &rs); err == nil {
+			ep.SocketOptions().SetReceiveBufferSize(int64(rs.Default), false)
+		}
+	}
+	return nil
+}
+
+type tcpConn struct {
+	*gonet.TCPConn
+	id stack.TransportEndpointID
+}
+
+func (c *tcpConn) ID() *stack.TransportEndpointID {
+	return &c.id
+}

core/udp.go

@@ -0,0 +1,46 @@
+package core
+
+import (
+	glog "gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+func withUDPHandler(handle func(adapter.UDPConn)) option.Option {
+	return func(s *stack.Stack) error {
+		udpForwarder := udp.NewForwarder(s, func(r *udp.ForwarderRequest) {
+			var (
+				wq waiter.Queue
+				id = r.ID()
+			)
+			ep, err := r.CreateEndpoint(&wq)
+			if err != nil {
+				glog.Debugf("forward udp request: %s:%d->%s:%d: %s",
+					id.RemoteAddress, id.RemotePort, id.LocalAddress, id.LocalPort, err)
+				return
+			}
+
+			conn := &udpConn{
+				UDPConn: gonet.NewUDPConn(s, &wq, ep),
+				id:      id,
+			}
+			handle(conn)
+		})
+		s.SetTransportProtocolHandler(udp.ProtocolNumber, udpForwarder.HandlePacket)
+		return nil
+	}
+}
+
+type udpConn struct {
+	*gonet.UDPConn
+	id stack.TransportEndpointID
+}
+
+func (c *udpConn) ID() *stack.TransportEndpointID {
+	return &c.id
+}

dialer/dialer.go

@@ -0,0 +1,66 @@
+package dialer
+
+import (
+	"context"
+	"net"
+	"syscall"
+
+	"go.uber.org/atomic"
+)
+
+var (
+	DefaultInterfaceName  = atomic.NewString("")
+	DefaultInterfaceIndex = atomic.NewInt32(0)
+	DefaultRoutingMark    = atomic.NewInt32(0)
+)
+
+type Options struct {
+	// InterfaceName is the name of interface/device to bind.
+	// If a socket is bound to an interface, only packets received
+	// from that particular interface are processed by the socket.
+	InterfaceName string
+
+	// InterfaceIndex is the index of interface/device to bind.
+	// It is almost the same as InterfaceName except it uses the
+	// index of the interface instead of the name.
+	InterfaceIndex int
+
+	// RoutingMark is the mark for each packet sent through this
+	// socket. Changing the mark can be used for mark-based routing
+	// without netfilter or for packet filtering.
+	RoutingMark int
+}
+
+func DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return DialContextWithOptions(ctx, network, address, &Options{
+		InterfaceName:  DefaultInterfaceName.Load(),
+		InterfaceIndex: int(DefaultInterfaceIndex.Load()),
+		RoutingMark:    int(DefaultRoutingMark.Load()),
+	})
+}
+
+func DialContextWithOptions(ctx context.Context, network, address string, opts *Options) (net.Conn, error) {
+	d := &net.Dialer{
+		Control: func(network, address string, c syscall.RawConn) error {
+			return setSocketOptions(network, address, c, opts)
+		},
+	}
+	return d.DialContext(ctx, network, address)
+}
+
+func ListenPacket(network, address string) (net.PacketConn, error) {
+	return ListenPacketWithOptions(network, address, &Options{
+		InterfaceName:  DefaultInterfaceName.Load(),
+		InterfaceIndex: int(DefaultInterfaceIndex.Load()),
+		RoutingMark:    int(DefaultRoutingMark.Load()),
+	})
+}
+
+func ListenPacketWithOptions(network, address string, opts *Options) (net.PacketConn, error) {
+	lc := &net.ListenConfig{
+		Control: func(network, address string, c syscall.RawConn) error {
+			return setSocketOptions(network, address, c, opts)
+		},
+	}
+	return lc.ListenPacket(context.Background(), network, address)
+}

dialer/sockopt.go

@@ -0,0 +1,19 @@
+package dialer
+
+func isTCPSocket(network string) bool {
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		return true
+	default:
+		return false
+	}
+}
+
+func isUDPSocket(network string) bool {
+	switch network {
+	case "udp", "udp4", "udp6":
+		return true
+	default:
+		return false
+	}
+}

dialer/sockopt_darwin.go

@@ -0,0 +1,45 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceIndex == 0 && opts.InterfaceName != "" {
+			if iface, err := net.InterfaceByName(opts.InterfaceName); err == nil {
+				opts.InterfaceIndex = iface.Index
+			}
+		}
+
+		if opts.InterfaceIndex != 0 {
+			switch network {
+			case "tcp4", "udp4":
+				innerErr = unix.SetsockoptInt(int(fd), syscall.IPPROTO_IP, syscall.IP_BOUND_IF, opts.InterfaceIndex)
+			case "tcp6", "udp6":
+				innerErr = unix.SetsockoptInt(int(fd), syscall.IPPROTO_IPV6, syscall.IPV6_BOUND_IF, opts.InterfaceIndex)
+			}
+			if innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_freebsd.go

@@ -0,0 +1,33 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_USER_COOKIE, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_linux.go

@@ -0,0 +1,44 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceName == "" && opts.InterfaceIndex != 0 {
+			if iface, err := net.InterfaceByIndex(opts.InterfaceIndex); err == nil {
+				opts.InterfaceName = iface.Name
+			}
+		}
+
+		if opts.InterfaceName != "" {
+			if innerErr = unix.BindToDevice(int(fd), opts.InterfaceName); innerErr != nil {
+				return
+			}
+		}
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_openbsd.go

@@ -0,0 +1,33 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_RTABLE, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_others.go

@@ -0,0 +1,9 @@
+//go:build !unix && !windows
+
+package dialer
+
+import "syscall"
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) error {
+	return nil
+}

dialer/sockopt_windows.go

@@ -0,0 +1,68 @@
+package dialer
+
+import (
+	"encoding/binary"
+	"net"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	IP_UNICAST_IF   = 31
+	IPV6_UNICAST_IF = 31
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		ip := net.ParseIP(host)
+		if ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceIndex == 0 && opts.InterfaceName != "" {
+			if iface, err := net.InterfaceByName(opts.InterfaceName); err == nil {
+				opts.InterfaceIndex = iface.Index
+			}
+		}
+
+		if opts.InterfaceIndex != 0 {
+			switch network {
+			case "tcp4", "udp4":
+				innerErr = bindSocketToInterface4(windows.Handle(fd), uint32(opts.InterfaceIndex))
+			case "tcp6", "udp6":
+				innerErr = bindSocketToInterface6(windows.Handle(fd), uint32(opts.InterfaceIndex))
+				if network == "udp6" && ip == nil {
+					// The underlying IP net maybe IPv4 even if the `network` param is `udp6`,
+					// so we should bind socket to interface4 at the same time.
+					innerErr = bindSocketToInterface4(windows.Handle(fd), uint32(opts.InterfaceIndex))
+				}
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}
+
+func bindSocketToInterface4(handle windows.Handle, index uint32) error {
+	// For IPv4, this parameter must be an interface index in network byte order.
+	// Ref: https://learn.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
+	var bytes [4]byte
+	binary.BigEndian.PutUint32(bytes[:], index)
+	index = *(*uint32)(unsafe.Pointer(&bytes[0]))
+	return windows.SetsockoptInt(handle, windows.IPPROTO_IP, IP_UNICAST_IF, int(index))
+}
+
+func bindSocketToInterface6(handle windows.Handle, index uint32) error {
+	return windows.SetsockoptInt(handle, windows.IPPROTO_IPV6, IPV6_UNICAST_IF, int(index))
+}

dns/resolver.go

@@ -0,0 +1,14 @@
+package dns
+
+import (
+	"net"
+
+	"github.com/xjasonlyu/tun2socks/v2/dialer"
+)
+
+func init() {
+	// We must use this DialContext to query DNS
+	// when using net default resolver.
+	net.DefaultResolver.PreferGo = true
+	net.DefaultResolver.Dial = dialer.DialContext
+}

docker/Dockerfile.aarch64

@@ -1,32 +0,0 @@
-FROM arm64v8/golang:alpine AS builder
-
-WORKDIR /app
-COPY . /app
-
-RUN apk add --no-cache make git \
-    && go mod download \
-    && make docker \
-    && /app/bin/tun2socks-docker -v
-
-FROM arm64v8/alpine:latest
-
-COPY ./scripts/entrypoint.sh /entrypoint.sh
-COPY --from=builder /app/bin/tun2socks-docker /usr/bin/tun2socks
-
-RUN apk add --update --no-cache iptables iproute2 \
-    && chmod +x /entrypoint.sh
-
-ENV TUN tun0
-ENV ETH eth0
-ENV TUN_ADDR=
-ENV TUN_MASK=
-ENV LOGLEVEL=
-ENV EXCLUDED=
-ENV EXTRACMD=
-
-ENV API=
-ENV DNS=
-ENV HOSTS=
-ENV PROXY=
-
-ENTRYPOINT ["/entrypoint.sh"]

docker/docker-compose.yml

@@ -1,35 +0,0 @@
-version: '2.4'
-
-services:
-  tun2socks:
-    image: xjasonlyu/tun2socks:latest
-    cap_add:
-      - NET_ADMIN
-    devices:
-        - '/dev/net/tun:/dev/net/tun'
-    environment:
-      - GODEBUG=madvdontneed=1
-      - PROXY=
-      - LOGLEVEL=
-      - API=
-      - DNS=
-      - HOSTS=
-      - EXCLUDED=
-      - EXTRACMD=
-    networks:
-      switch:
-        ipv4_address: 172.20.1.2
-    restart: always
-    container_name: tun2socks
-
-networks:
-  switch:
-    name: switch
-    ipam:
-      driver: default
-      config:
-        - subnet: '172.20.1.0/25'
-          gateway: 172.20.1.1
-    driver: macvlan
-    driver_opts:
-      parent: eth0

docker/entrypoint.sh

@@ -0,0 +1,92 @@
+#!/bin/sh
+
+TUN="${TUN:-tun0}"
+ADDR="${ADDR:-198.18.0.1/15}"
+LOGLEVEL="${LOGLEVEL:-info}"
+
+# default values
+TABLE="${TABLE:-0x22b}"
+FWMARK="${FWMARK:-0x22b}"
+CLONE_MAIN="${CLONE_MAIN:-1}"
+
+create_tun() {
+  # create tun device
+  ip tuntap add mode tun dev "$TUN"
+  ip addr add "$ADDR" dev "$TUN"
+  ip link set dev "$TUN" up
+}
+
+create_table() {
+  if [ "$CLONE_MAIN" -ne 0 ]; then
+    # clone main route table
+    ip route show table main |
+      while read -r route; do
+        ip route add ${route%linkdown*} table "$TABLE"
+      done
+    # replace default route
+    ip route replace default dev "$TUN" table "$TABLE"
+  else
+    # just add default route
+    ip route add default dev "$TUN" table "$TABLE"
+  fi
+}
+
+config_route() {
+  # policy routing
+  ip rule add not fwmark "$FWMARK" table "$TABLE"
+  ip rule add fwmark "$FWMARK" to "$ADDR" prohibit
+
+  # add tun included routes
+  for addr in $(echo "$TUN_INCLUDED_ROUTES" | tr ',' '\n'); do
+    ip rule add to "$addr" table "$TABLE"
+  done
+
+  # add tun excluded routes
+  for addr in $(echo "$TUN_EXCLUDED_ROUTES" | tr ',' '\n'); do
+    ip rule add to "$addr" table main
+  done
+}
+
+run() {
+  create_tun
+  create_table
+  config_route
+
+  # execute extra commands
+  if [ -n "$EXTRA_COMMANDS" ]; then
+    sh -c "$EXTRA_COMMANDS"
+  fi
+
+  if [ -n "$MTU" ]; then
+    ARGS="--mtu $MTU"
+  fi
+
+  if [ -n "$RESTAPI" ]; then
+    ARGS="$ARGS --restapi $RESTAPI"
+  fi
+
+  if [ -n "$UDP_TIMEOUT" ]; then
+    ARGS="$ARGS --udp-timeout $UDP_TIMEOUT"
+  fi
+
+  if [ -n "$TCP_SNDBUF" ]; then
+    ARGS="$ARGS --tcp-sndbuf $TCP_SNDBUF"
+  fi
+
+  if [ -n "$TCP_RCVBUF" ]; then
+    ARGS="$ARGS --tcp-rcvbuf $TCP_RCVBUF"
+  fi
+
+  if [ "$TCP_AUTO_TUNING" = 1 ]; then
+    ARGS="$ARGS --tcp-auto-tuning"
+  fi
+
+  exec tun2socks \
+    --loglevel "$LOGLEVEL" \
+    --fwmark "$FWMARK" \
+    --device "$TUN" \
+    --proxy "$PROXY" \
+    $ARGS
+}
+
+run || exit 1

engine/engine.go

@@ -0,0 +1,231 @@
+package engine
+
+import (
+	"errors"
+	"net"
+	"os/exec"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/docker/go-units"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core"
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+	"github.com/xjasonlyu/tun2socks/v2/dialer"
+	"github.com/xjasonlyu/tun2socks/v2/engine/mirror"
+	"github.com/xjasonlyu/tun2socks/v2/log"
+	"github.com/xjasonlyu/tun2socks/v2/proxy"
+	"github.com/xjasonlyu/tun2socks/v2/restapi"
+	"github.com/xjasonlyu/tun2socks/v2/tunnel"
+)
+
+var (
+	_engineMu sync.Mutex
+
+	// _defaultKey holds the default key for the engine.
+	_defaultKey *Key
+
+	// _defaultProxy holds the default proxy for the engine.
+	_defaultProxy proxy.Proxy
+
+	// _defaultDevice holds the default device for the engine.
+	_defaultDevice device.Device
+
+	// _defaultStack holds the default stack for the engine.
+	_defaultStack *stack.Stack
+)
+
+// Start starts the default engine up.
+func Start() {
+	if err := start(); err != nil {
+		log.Fatalf("[ENGINE] failed to start: %v", err)
+	}
+}
+
+// Stop shuts the default engine down.
+func Stop() {
+	if err := stop(); err != nil {
+		log.Fatalf("[ENGINE] failed to stop: %v", err)
+	}
+}
+
+// Insert loads *Key to the default engine.
+func Insert(k *Key) {
+	_engineMu.Lock()
+	_defaultKey = k
+	_engineMu.Unlock()
+}
+
+func start() error {
+	_engineMu.Lock()
+	if _defaultKey == nil {
+		return errors.New("empty key")
+	}
+
+	for _, f := range []func(*Key) error{
+		general,
+		restAPI,
+		netstack,
+	} {
+		if err := f(_defaultKey); err != nil {
+			return err
+		}
+	}
+	_engineMu.Unlock()
+	return nil
+}
+
+func stop() (err error) {
+	_engineMu.Lock()
+	if _defaultDevice != nil {
+		err = _defaultDevice.Close()
+	}
+	if _defaultStack != nil {
+		_defaultStack.Close()
+		_defaultStack.Wait()
+	}
+	_engineMu.Unlock()
+	return err
+}
+
+func execCommand(cmd string) error {
+	parts := strings.Fields(cmd)
+	if len(parts) == 0 {
+		return errors.New("empty command")
+	}
+	_, err := exec.Command(parts[0], parts[1:]...).Output()
+	return err
+}
+
+func general(k *Key) error {
+	level, err := log.ParseLevel(k.LogLevel)
+	if err != nil {
+		return err
+	}
+	log.SetLevel(level)
+
+	if k.Interface != "" {
+		iface, err := net.InterfaceByName(k.Interface)
+		if err != nil {
+			return err
+		}
+		dialer.DefaultInterfaceName.Store(iface.Name)
+		dialer.DefaultInterfaceIndex.Store(int32(iface.Index))
+		log.Infof("[DIALER] bind to interface: %s", k.Interface)
+	}
+
+	if k.Mark != 0 {
+		dialer.DefaultRoutingMark.Store(int32(k.Mark))
+		log.Infof("[DIALER] set fwmark: %#x", k.Mark)
+	}
+
+	if k.UDPTimeout > 0 {
+		if k.UDPTimeout < time.Second {
+			return errors.New("invalid udp timeout value")
+		}
+		tunnel.SetUDPTimeout(k.UDPTimeout)
+	}
+	return nil
+}
+
+func restAPI(k *Key) error {
+	if k.RestAPI != "" {
+		u, err := parseRestAPI(k.RestAPI)
+		if err != nil {
+			return err
+		}
+		host, token := u.Host, u.User.String()
+
+		restapi.SetStatsFunc(func() tcpip.Stats {
+			_engineMu.Lock()
+			defer _engineMu.Unlock()
+
+			// default stack is not initialized.
+			if _defaultStack == nil {
+				return tcpip.Stats{}
+			}
+			return _defaultStack.Stats()
+		})
+
+		go func() {
+			if err := restapi.Start(host, token); err != nil {
+				log.Warnf("[RESTAPI] failed to start: %v", err)
+			}
+		}()
+		log.Infof("[RESTAPI] serve at: %s", u)
+	}
+	return nil
+}
+
+func netstack(k *Key) (err error) {
+	if k.Proxy == "" {
+		return errors.New("empty proxy")
+	}
+	if k.Device == "" {
+		return errors.New("empty device")
+	}
+
+	if k.TUNPreUp != "" {
+		if preUpErr := execCommand(k.TUNPreUp); preUpErr != nil {
+			log.Warnf("[TUN] failed to pre-execute: %s: %v", k.TUNPreUp, preUpErr)
+		}
+	}
+
+	defer func() {
+		if k.TUNPostUp == "" || err != nil {
+			return
+		}
+		if postUpErr := execCommand(k.TUNPostUp); postUpErr != nil {
+			log.Warnf("[TUN] failed to post-execute: %s: %v", k.TUNPostUp, postUpErr)
+		}
+	}()
+
+	if _defaultProxy, err = parseProxy(k.Proxy); err != nil {
+		return
+	}
+	proxy.SetDialer(_defaultProxy)
+
+	if _defaultDevice, err = parseDevice(k.Device, uint32(k.MTU)); err != nil {
+		return
+	}
+
+	var opts []option.Option
+	if k.TCPModerateReceiveBuffer {
+		opts = append(opts, option.WithTCPModerateReceiveBuffer(true))
+	}
+
+	if k.TCPSendBufferSize != "" {
+		size, err := units.RAMInBytes(k.TCPSendBufferSize)
+		if err != nil {
+			return err
+		}
+		opts = append(opts, option.WithTCPSendBufferSize(int(size)))
+	}
+
+	if k.TCPReceiveBufferSize != "" {
+		size, err := units.RAMInBytes(k.TCPReceiveBufferSize)
+		if err != nil {
+			return err
+		}
+		opts = append(opts, option.WithTCPReceiveBufferSize(int(size)))
+	}
+
+	if _defaultStack, err = core.CreateStack(&core.Config{
+		LinkEndpoint:     _defaultDevice,
+		TransportHandler: &mirror.Tunnel{},
+		Options:          opts,
+	}); err != nil {
+		return
+	}
+
+	log.Infof(
+		"[STACK] %s://%s <-> %s://%s",
+		_defaultDevice.Type(), _defaultDevice.Name(),
+		_defaultProxy.Proto(), _defaultProxy.Addr(),
+	)
+	return nil
+}

engine/key.go

@@ -0,0 +1,19 @@
+package engine
+
+import "time"
+
+type Key struct {
+	MTU                      int           `yaml:"mtu"`
+	Mark                     int           `yaml:"fwmark"`
+	Proxy                    string        `yaml:"proxy"`
+	RestAPI                  string        `yaml:"restapi"`
+	Device                   string        `yaml:"device"`
+	LogLevel                 string        `yaml:"loglevel"`
+	Interface                string        `yaml:"interface"`
+	TCPModerateReceiveBuffer bool          `yaml:"tcp-moderate-receive-buffer"`
+	TCPSendBufferSize        string        `yaml:"tcp-send-buffer-size"`
+	TCPReceiveBufferSize     string        `yaml:"tcp-receive-buffer-size"`
+	TUNPreUp                 string        `yaml:"tun-pre-up"`
+	TUNPostUp                string        `yaml:"tun-post-up"`
+	UDPTimeout               time.Duration `yaml:"udp-timeout"`
+}

engine/mirror/tunnel.go

@@ -0,0 +1,18 @@
+package mirror
+
+import (
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/tunnel"
+)
+
+var _ adapter.TransportHandler = (*Tunnel)(nil)
+
+type Tunnel struct{}
+
+func (*Tunnel) HandleTCP(conn adapter.TCPConn) {
+	tunnel.TCPIn() <- conn
+}
+
+func (*Tunnel) HandleUDP(conn adapter.UDPConn) {
+	tunnel.UDPIn() <- conn
+}

engine/parse.go

@@ -0,0 +1,152 @@
+package engine
+
+import (
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/fdbased"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/tun"
+	"github.com/xjasonlyu/tun2socks/v2/proxy"
+	"github.com/xjasonlyu/tun2socks/v2/proxy/proto"
+)
+
+func parseRestAPI(s string) (*url.URL, error) {
+	if !strings.Contains(s, "://") {
+		s = fmt.Sprintf("%s://%s", "http", s)
+	}
+
+	u, err := url.Parse(s)
+	if err != nil {
+		return nil, err
+	}
+
+	addr, err := net.ResolveTCPAddr("tcp", u.Host)
+	if err != nil {
+		return nil, err
+	}
+	if addr.IP == nil {
+		addr.IP = net.IPv4zero /* default: 0.0.0.0 */
+	}
+	u.Host = addr.String()
+
+	switch u.Scheme {
+	case "http":
+		return u, nil
+	default:
+		return nil, fmt.Errorf("unsupported scheme: %s", u.Scheme)
+	}
+}
+
+func parseDevice(s string, mtu uint32) (device.Device, error) {
+	if !strings.Contains(s, "://") {
+		s = fmt.Sprintf("%s://%s", tun.Driver /* default driver */, s)
+	}
+
+	u, err := url.Parse(s)
+	if err != nil {
+		return nil, err
+	}
+
+	name := u.Host
+	driver := strings.ToLower(u.Scheme)
+
+	switch driver {
+	case fdbased.Driver:
+		return fdbased.Open(name, mtu)
+	case tun.Driver:
+		return tun.Open(name, mtu)
+	default:
+		return nil, fmt.Errorf("unsupported driver: %s", driver)
+	}
+}
+
+func parseProxy(s string) (proxy.Proxy, error) {
+	if !strings.Contains(s, "://") {
+		s = fmt.Sprintf("%s://%s", proto.Socks5 /* default protocol */, s)
+	}
+
+	u, err := url.Parse(s)
+	if err != nil {
+		return nil, err
+	}
+
+	protocol := strings.ToLower(u.Scheme)
+
+	switch protocol {
+	case proto.Direct.String():
+		return proxy.NewDirect(), nil
+	case proto.Reject.String():
+		return proxy.NewReject(), nil
+	case proto.HTTP.String():
+		return proxy.NewHTTP(parseHTTP(u))
+	case proto.Socks4.String():
+		return proxy.NewSocks4(parseSocks4(u))
+	case proto.Socks5.String():
+		return proxy.NewSocks5(parseSocks5(u))
+	case proto.Shadowsocks.String():
+		return proxy.NewShadowsocks(parseShadowsocks(u))
+	default:
+		return nil, fmt.Errorf("unsupported protocol: %s", protocol)
+	}
+}
+
+func parseHTTP(u *url.URL) (address, username, password string) {
+	address, username = u.Host, u.User.Username()
+	password, _ = u.User.Password()
+	return
+}
+
+func parseSocks4(u *url.URL) (address, username string) {
+	address, username = u.Host, u.User.Username()
+	return
+}
+
+func parseSocks5(u *url.URL) (address, username, password string) {
+	address, username = u.Host, u.User.Username()
+	password, _ = u.User.Password()
+
+	// Socks5 over UDS
+	if address == "" {
+		address = u.Path
+	}
+	return
+}
+
+func parseShadowsocks(u *url.URL) (address, method, password, obfsMode, obfsHost string) {
+	address = u.Host
+
+	if pass, set := u.User.Password(); set {
+		method = u.User.Username()
+		password = pass
+	} else {
+		data, _ := base64.RawURLEncoding.DecodeString(u.User.String())
+		userInfo := strings.SplitN(string(data), ":", 2)
+		if len(userInfo) == 2 {
+			method = userInfo[0]
+			password = userInfo[1]
+		}
+	}
+
+	rawQuery, _ := url.QueryUnescape(u.RawQuery)
+	for _, s := range strings.Split(rawQuery, ";") {
+		data := strings.SplitN(s, "=", 2)
+		if len(data) != 2 {
+			continue
+		}
+		key := data[0]
+		value := data[1]
+
+		switch key {
+		case "obfs":
+			obfsMode = value
+		case "obfs-host":
+			obfsHost = value
+		}
+	}
+
+	return
+}

go.mod

@@ -1,22 +1,33 @@
-module github.com/xjasonlyu/tun2socks
+module github.com/xjasonlyu/tun2socks/v2
 
-go 1.15
+go 1.20
 
 require (
-	github.com/Dreamacro/go-shadowsocks2 v0.1.6
-	github.com/go-chi/chi v4.1.2+incompatible
-	github.com/go-chi/cors v1.1.1
-	github.com/go-chi/render v1.0.1
-	github.com/gofrs/uuid v3.3.0+incompatible
-	github.com/gorilla/websocket v1.4.2
-	github.com/sirupsen/logrus v1.7.0
-	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
-	github.com/urfave/cli/v2 v2.3.0
-	github.com/xjasonlyu/clash v0.15.1-0.20201105074459-aa45c8b56cf6
-	go.uber.org/atomic v1.7.0
-	golang.org/x/net v0.0.0-20201031054903-ff519b6c9102 // indirect
-	golang.org/x/sys v0.0.0-20201106081118-db71ae66460a // indirect
-	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e
-	gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 // indirect
-	gvisor.dev/gvisor v0.0.0-20201107070040-22fc22ad6ef7
+	github.com/Dreamacro/go-shadowsocks2 v0.1.8
+	github.com/docker/go-units v0.5.0
+	github.com/go-chi/chi/v5 v5.0.8
+	github.com/go-chi/cors v1.2.1
+	github.com/go-chi/render v1.0.2
+	github.com/google/uuid v1.3.0
+	github.com/gorilla/websocket v1.5.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/stretchr/testify v1.7.1
+	go.uber.org/atomic v1.11.0
+	go.uber.org/automaxprocs v1.5.2
+	golang.org/x/sys v0.8.0
+	golang.org/x/time v0.3.0
+	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
+	gopkg.in/yaml.v3 v3.0.1
+	gvisor.dev/gvisor v0.0.0-20230603040744-5c9219dedd33
+)
+
+require (
+	github.com/ajg/form v1.5.1 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/btree v1.1.2 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	golang.org/x/crypto v0.9.0 // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 )

go.sum

@@ -1,454 +1,58 @@
-bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.52.1-0.20200122224058-0482b626c726/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
-github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
-github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
-github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
-github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
-github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
-github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/Dreamacro/go-shadowsocks2 v0.1.6 h1:PysSf9sLT3Qn8jhlin5v7Rk68gOQG4K5BZFY1nxLGxI=
-github.com/Dreamacro/go-shadowsocks2 v0.1.6/go.mod h1:LSXCjyHesPY3pLjhwff1mQX72ItcBT/N2xNC685cYeU=
-github.com/Microsoft/go-winio v0.4.15-0.20200908182639-5b44b70ab3ab/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
-github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
-github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
-github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/cenkalti/backoff v1.1.1-0.20190506075156-2146c9339422/go.mod h1:b6Nc7NRH5C4aCISLry0tLnTjcuTEvoiqcWDdsU0sOGM=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmEg9bt0VpxxWqJlO4iwu3FBdHUzV7wQVg=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/containerd/cgroups v0.0.0-20181219155423-39b18af02c41/go.mod h1:X9rLEHIqSf/wfK8NsPqxJmeZgW4pcfzdXITDrUSJ6uI=
-github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
-github.com/containerd/containerd v1.3.4/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/continuity v0.0.0-20200928162600-f2cc35102c2a/go.mod h1:W0qIOTD7mp2He++YVq+kgfXezRYqzP1uDuMVH1bITDY=
-github.com/containerd/fifo v0.0.0-20191213151349-ff969a566b00/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
-github.com/containerd/go-runc v0.0.0-20200220073739-7016d3ce2328/go.mod h1:PpyHrqVs8FTi9vpyHwPwiNEGaACDxT/N/pLcvMSRA9g=
-github.com/containerd/ttrpc v0.0.0-20200121165050-0be804eadb15/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/typeurl v0.0.0-20200205145503-b45ef1f1f737/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
-github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.0 h1:EoUDS0afbrsXAZ9YQ9jdu/mZ2sXgT1/2yyNng4PGlyM=
-github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/Dreamacro/go-shadowsocks2 v0.1.8 h1:Ixejp5JscEc866gAvm/l6TFd7BOBvDviKgwb1quWw3g=
+github.com/Dreamacro/go-shadowsocks2 v0.1.8/go.mod h1:51y4Q6tJoCE7e8TmYXcQRqfoxPfE9Cvn79V6pB6Df7Y=
+github.com/ajg/form v1.5.1 h1:t9c7v8JUKu/XxOGBU0yjNpaMloxGEJhUkqFRq0ibGeU=
+github.com/ajg/form v1.5.1/go.mod h1:uL1WgH+h2mgNtvBq0339dVnzXdBETtL2LeUXaIv25UY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v1.4.2-0.20191028175130-9e7d5ac5ea55/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.3.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
-github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
-github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
-github.com/dpjacques/clockwork v0.1.1-0.20200827220843-c1f524b839be/go.mod h1:D8mP2A8vVT2GkXqPorSBmhnshhkFBYgzhA90KmJt25Y=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
-github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
-github.com/go-chi/cors v1.1.1 h1:eHuqxsIw89iXcWnWUN8R72JMibABJTN/4IOYI5WERvw=
-github.com/go-chi/cors v1.1.1/go.mod h1:K2Yje0VW/SJzxiyMYu6iPQYa7hMjQX2i/F491VChg1I=
-github.com/go-chi/render v1.0.1 h1:4/5tis2cKaNdnv9zFLfXzcquC9HbeZgCnxGnKrltBS8=
-github.com/go-chi/render v1.0.1/go.mod h1:pq4Rr7HbnsdaeHagklXub+p6Wd16Af5l9koip1OvJns=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
-github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
-github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
-github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
-github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
-github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofrs/flock v0.6.1-0.20180915234121-886344bea079/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
-github.com/gofrs/uuid v3.3.0+incompatible h1:8K4tyRfvU1CYPgJsveYFQMhpFd/wXNM7iK6rR7UHz84=
-github.com/gofrs/uuid v3.3.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
-github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3-0.20201020212313-ab46b8bd0abd/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-github/v28 v28.1.2-0.20191108005307-e555eab49ce8/go.mod h1:g82e6OHbJ0WYrYeOrid1MMfHAtqjxBz+N74tfAt9KrQ=
-github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/gofuzz v0.0.0-20161122191042-44d81051d367/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/subcommands v1.0.2-0.20190508160503-636abe8753b8/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
-github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
-github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
-github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/json-iterator/go v0.0.0-20180612202835-f2b4162afba3/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/go-chi/chi/v5 v5.0.8 h1:lD+NLqFcAi1ovnVZpsnObHGW4xb4J8lNmoYVfECH1Y0=
+github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
+github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
+github.com/go-chi/render v1.0.2 h1:4ER/udB0+fMWB2Jlf15RV3F4A2FDuYi/9f+lFttR/Lg=
+github.com/go-chi/render v1.0.2/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
+github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.4-0.20190131011033-7dc38fb350b1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mattbaird/jsonpatch v0.0.0-20171005235357-81af80346b1a/go.mod h1:M1qoD/MqPgTZIk0EWKB38wE28ACRfVcn+cU08jyArI0=
-github.com/miekg/dns v1.1.35 h1:oTfOaDH+mZkdcgdIjH6yBajRGtIwcwcaR+rt23ZSrJs=
-github.com/miekg/dns v1.1.35/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180320133207-05fbef0ca5da/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/mohae/deepcopy v0.0.0-20170308212314-bb9b5e7adda9/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
-github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
-github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.2-0.20181111125026-1722abf79c2f/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/oschwald/geoip2-golang v1.4.0 h1:5RlrjCgRyIGDz/mBmPfnAF4h8k0IAcRv9PvrpOfz+Ug=
-github.com/oschwald/geoip2-golang v1.4.0/go.mod h1:8QwxJvRImBH+Zl6Aa6MaIcs5YdlZSTKtzmPGzQqi9ng=
-github.com/oschwald/maxminddb-golang v1.6.0 h1:KAJSjdHQ8Kv45nFIbtoLGrGWqHFajOIm7skTyz/+Dls=
-github.com/oschwald/maxminddb-golang v1.6.0/go.mod h1:DUJFucBg2cvqx42YmDa/+xHvb0elJtOm3o4aFQ/nb/w=
-github.com/oschwald/maxminddb-golang v1.7.0 h1:JmU4Q1WBv5Q+2KZy5xJI+98aUwTIrPPxZUkd5Cwr8Zc=
-github.com/oschwald/maxminddb-golang v1.7.0/go.mod h1:RXZtst0N6+FY/3qCNmZMBApR19cdQj43/NM9VkrNAis=
-github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
-github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.7.0 h1:ShrD1U9pZB12TX0cVy0DtePoCH97K8EtX+mg7ZARUtM=
-github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
-github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
-github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/urfave/cli v1.22.2 h1:gsqYFH8bb9ekPA12kRo0hfjngWQjkJPlN9R0N78BoUo=
-github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli/v2 v2.3.0 h1:qph92Y649prgesehzOrQjdWyxFOp/QVM+6imKHad91M=
-github.com/urfave/cli/v2 v2.3.0/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
-github.com/vishvananda/netlink v1.0.1-0.20190930145447-2ec5bdc52b86/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
-github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/xjasonlyu/clash v0.15.1-0.20201105074459-aa45c8b56cf6 h1:iQsLkjayjJs29VOeXaeznpy1jddiuRjstj6MfFbKVoM=
-github.com/xjasonlyu/clash v0.15.1-0.20201105074459-aa45c8b56cf6/go.mod h1:eQ5eRTAjXlzRV4rB9pOujCwDl1mBF8htrMvKMqavqvo=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897 h1:pLI5jrR7OSLijeIDcmRxNmw2api+jEfxLoykJVice/E=
-golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200822124328-c89045814202 h1:VvcQYSHwXgi7W+TpUR6A9g6Up98WAHf3f/ulnJ62IyA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201029221708-28c70e62bb1d h1:dOiJ2n2cMwGLce/74I/QHMbnpk5GfY7InR8rczoMqRM=
-golang.org/x/net v0.0.0-20201029221708-28c70e62bb1d/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102 h1:42cLlJJdEh+ySyeUUbEQ5bsTiq8voBeTuweGVkY6Puw=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 h1:qwRHBd0NqMbJxfbotnDhm2ByMI1Shq4Y6oRJo21SGJA=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9 h1:SQFwaSi55rU7vdNs9Yr0Z324VNlrF+0wMqRXT4St8ck=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037 h1:YyJpGZS1sBuBCzLAR1VEpK193GlqGZbnPFnPV/5Rsb4=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191224085550-c709ea063b76/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201029080932-201ba4db2418 h1:HlFl4V6pEMziuLXyRkm5BIYq1y1GAbb02pRlWvI54OM=
-golang.org/x/sys v0.0.0-20201029080932-201ba4db2418/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201106081118-db71ae66460a h1:ALUFBKlIyeY7y5ZgPJmblk/vKz+zBQSnNiPkt41sgeg=
-golang.org/x/sys v0.0.0-20201106081118-db71ae66460a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4 h1:0YWbFKbhXG/wIiuHDSKpS0Iy7FSA+u45VtBMfQcFTTc=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e h1:EHBhcS0mlXEAVwNyO2dLfjToGsyY4j24pTs2ScHnX7s=
-golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216052735-49a3e744a425/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20201021000207-d49c4edd7d96/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200117163144-32f20d992d24/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.29.0/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.1-0.20201020201750-d3470999428b/go.mod h1:hFxJC2f0epmp1elRCiEGJTKAWbwxZ2nvqZdHl3FQXCY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/automaxprocs v1.5.2 h1:2LxUOGiR3O6tw8ui5sZa2LAaHnsviZdVOUZw4fvbnME=
+go.uber.org/automaxprocs v1.5.2/go.mod h1:eRbA25aqJrxAbsLO0xy5jVwPt7FQnRgjW+efnwa1WM0=
+golang.org/x/crypto v0.9.0 h1:LF6fAI+IutBocDJ2OT0Q1g8plpYljMZ4+lty+dsqw3g=
+golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
+golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776 h1:tQIYjPdBoyREyB9XMu+nnTclpTYkz2zFM+lzLJFO4gQ=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
-gvisor.dev/gvisor v0.0.0-20201107070040-22fc22ad6ef7 h1:JKZNg4wnh94dWyhXSNOQ4jkliNbcRJt1Vs5NPyMOo48=
-gvisor.dev/gvisor v0.0.0-20201107070040-22fc22ad6ef7/go.mod h1:t4GUXJhnQEPtYSvrvRNW5CNdBQ2oWZBy7P+FbCVKBFY=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-k8s.io/api v0.16.13/go.mod h1:QWu8UWSTiuQZMMeYjwLs6ILu5O74qKSJ0c+4vrchDxs=
-k8s.io/apimachinery v0.16.13/go.mod h1:4HMHS3mDHtVttspuuhrJ1GGr/0S9B6iWYWZ57KnnZqQ=
-k8s.io/apimachinery v0.16.14-rc.0/go.mod h1:4HMHS3mDHtVttspuuhrJ1GGr/0S9B6iWYWZ57KnnZqQ=
-k8s.io/client-go v0.16.13/go.mod h1:UKvVT4cajC2iN7DCjLgT0KVY/cbY6DGdUCyRiIfws5M=
-k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
-k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
-k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
-k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
-k8s.io/kube-openapi v0.0.0-20200410163147-594e756bea31/go.mod h1:1TqjTSzOxsLGIKfj0lK8EeCP7K1iUG65v09OM0/WG5E=
-k8s.io/utils v0.0.0-20190801114015-581e00157fb1/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-sigs.k8s.io/structured-merge-diff v0.0.0-20190525122527-15d366b2352e/go.mod h1:wWxsB5ozmmv/SG7nM11ayaAW51xMvak/t1r0CSlcokI=
-sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gvisor.dev/gvisor v0.0.0-20230603040744-5c9219dedd33 h1:64QentohifmKGeTgJCHilDgfmQVuYE45fsaS9psJ3zY=
+gvisor.dev/gvisor v0.0.0-20230603040744-5c9219dedd33/go.mod h1:sQuqOkxbfJq/GS2uSnqHphtXclHyk/ZrAGhZBxxsq6g=

internal/adapter/adapter.go

@@ -1,31 +0,0 @@
-package adapter
-
-import "net"
-
-type TCPConn interface {
-	net.Conn
-	Metadata() *Metadata
-}
-
-type UDPPacket interface {
-	// Data get the payload of UDP Packet.
-	Data() []byte
-
-	// Drop call after packet is used, could release resources in this function.
-	Drop()
-
-	// LocalAddr returns the source IP/Port of packet.
-	LocalAddr() net.Addr
-
-	// Metadata returns the metadata of packet.
-	Metadata() *Metadata
-
-	// RemoteAddr returns the destination IP/Port of packet.
-	RemoteAddr() net.Addr
-
-	// WriteBack writes the payload with source IP/Port equals addr
-	// - variable source IP/Port is important to STUN
-	// - if addr is not provided, WriteBack will write out UDP packet with SourceIP/Port equals to original Target,
-	//   this is important when using Fake-IP.
-	WriteBack([]byte, net.Addr) (int, error)
-}

internal/adapter/metadata.go

@@ -1,96 +0,0 @@
-package adapter
-
-import (
-	"bytes"
-	"encoding/json"
-	"net"
-	"strconv"
-
-	"github.com/xjasonlyu/clash/component/socks5"
-)
-
-const (
-	TCP Network = iota
-	UDP
-)
-
-type Network int
-
-func (n Network) String() string {
-	if n == TCP {
-		return "tcp"
-	}
-	return "udp"
-}
-
-func (n Network) MarshalJSON() ([]byte, error) {
-	return json.Marshal(n.String())
-}
-
-// Metadata implements the net.Addr interface.
-type Metadata struct {
-	Net     Network `json:"network"`
-	SrcIP   net.IP  `json:"sourceIP"`
-	MidIP   net.IP  `json:"dialerIP"`
-	DstIP   net.IP  `json:"destinationIP"`
-	SrcPort uint16  `json:"sourcePort"`
-	MidPort uint16  `json:"dialerPort"`
-	DstPort uint16  `json:"destinationPort"`
-	Host    string  `json:"host"`
-}
-
-func (m *Metadata) DestinationAddress() string {
-	if m.Host != "" {
-		return net.JoinHostPort(m.Host, strconv.FormatUint(uint64(m.DstPort), 10))
-	} else if m.DstIP != nil {
-		return net.JoinHostPort(m.DstIP.String(), strconv.FormatUint(uint64(m.DstPort), 10))
-	}
-	return ""
-}
-
-func (m *Metadata) SourceAddress() string {
-	return net.JoinHostPort(m.SrcIP.String(), strconv.FormatUint(uint64(m.SrcPort), 10))
-}
-
-func (m *Metadata) UDPAddr() *net.UDPAddr {
-	if m.Net != UDP || m.DstIP == nil {
-		return nil
-	}
-	return &net.UDPAddr{
-		IP:   m.DstIP,
-		Port: int(m.DstPort),
-	}
-}
-
-func (m *Metadata) SerializesSocksAddr() socks5.Addr {
-	var buf [][]byte
-	port := []byte{uint8(m.DstPort >> 8), uint8(m.DstPort & 0xff)}
-	switch {
-	case m.Host != "": /* Domain */
-		aType := socks5.AtypDomainName
-		length := uint8(len(m.Host))
-		host := []byte(m.Host)
-		buf = [][]byte{{uint8(aType), length}, host, port}
-	case m.DstIP.To4() != nil: /* IPv4 */
-		aType := socks5.AtypIPv4
-		host := m.DstIP.To4()
-		buf = [][]byte{{uint8(aType)}, host, port}
-	default: /* IPv6 */
-		aType := socks5.AtypIPv6
-		host := m.DstIP.To16()
-		buf = [][]byte{{uint8(aType)}, host, port}
-	}
-	return bytes.Join(buf, nil)
-}
-
-func (m *Metadata) Network() string {
-	return m.Net.String()
-}
-
-func (m *Metadata) String() string {
-	return m.DestinationAddress()
-}
-
-func (m *Metadata) Valid() bool {
-	return m.Host != "" || m.DstIP != nil
-}

internal/api/errors.go

@@ -1,24 +0,0 @@
-// Clash: https://github.com/Dreamacro/clash/blob/master/hub/route/errors.go
-
-package api
-
-var (
-	ErrUnauthorized   = newError("Unauthorized")
-	ErrBadRequest     = newError("Body invalid")
-	ErrForbidden      = newError("Forbidden")
-	ErrNotFound       = newError("Resource not found")
-	ErrRequestTimeout = newError("Timeout")
-)
-
-// HTTPError is custom HTTP error for API
-type HTTPError struct {
-	Message string `json:"message"`
-}
-
-func (e *HTTPError) Error() string {
-	return e.Message
-}
-
-func newError(msg string) *HTTPError {
-	return &HTTPError{Message: msg}
-}

internal/cmd/cmd.go

@@ -1,100 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"os"
-	"os/signal"
-	"runtime"
-	"syscall"
-	"time"
-
-	"github.com/urfave/cli/v2"
-
-	"github.com/xjasonlyu/clash/component/dialer"
-	"github.com/xjasonlyu/tun2socks/internal/api"
-	"github.com/xjasonlyu/tun2socks/internal/core"
-	"github.com/xjasonlyu/tun2socks/internal/dev"
-	"github.com/xjasonlyu/tun2socks/internal/dns"
-	"github.com/xjasonlyu/tun2socks/internal/proxy"
-	"github.com/xjasonlyu/tun2socks/internal/tunnel"
-	"github.com/xjasonlyu/tun2socks/pkg/log"
-)
-
-func bindToInterface(name string) {
-	dialer.DialHook = dialer.DialerWithInterface(name)
-	dialer.ListenPacketHook = dialer.ListenPacketWithInterface(name)
-}
-
-func printVersion(app *cli.App) {
-	fmt.Printf("%s %s\n%s/%s, %s, %s\n",
-		app.Name,
-		app.Version,
-		runtime.GOOS,
-		runtime.GOARCH,
-		runtime.Version(),
-		app.Compiled.Format(time.RFC3339),
-	)
-}
-
-func Main(c *cli.Context) error {
-	if c.Bool("version") {
-		printVersion(c.App)
-		return nil
-	}
-
-	level, err := log.ParseLevel(c.String("loglevel"))
-	if err != nil {
-		return err
-	}
-	log.SetLevel(level)
-
-	if c.IsSet("interface") {
-		name := c.String("interface")
-		bindToInterface(name)
-		log.Infof("[IFCE] bind to interface: %s", name)
-	}
-
-	if c.IsSet("api") { /* initiate API */
-		raw := c.String("api")
-		if err := api.Start(raw, c.App); err != nil {
-			return fmt.Errorf("start API server %s: %w", raw, err)
-		}
-		log.Infof("[API] listen and serve at: %s", raw)
-	}
-
-	if c.IsSet("dns") { /* initiate DNS */
-		raw := c.String("dns")
-		if err := dns.Start(raw, c.StringSlice("hosts")); err != nil {
-			return fmt.Errorf("start DNS server %s: %w", raw, err)
-		}
-		log.Infof("[DNS] listen and serve at: %s", raw)
-	}
-
-	deviceURL := c.String("device")
-	device, err := dev.Open(deviceURL)
-	if err != nil {
-		return fmt.Errorf("open device %s: %w", deviceURL, err)
-	}
-	defer func() {
-		err := device.Close()
-		if err != nil {
-			log.Errorf("close device %s error: %v", deviceURL, err)
-		}
-	}()
-
-	proxyURL := c.String("proxy")
-	if err := proxy.Register(proxyURL); err != nil {
-		return fmt.Errorf("register proxy %s: %w", proxyURL, err)
-	}
-
-	if _, err := core.NewDefaultStack(device, tunnel.Add, tunnel.AddPacket); err != nil {
-		return fmt.Errorf("initiate stack: %w", err)
-	}
-	log.Infof("[STACK] %s --> %s", device.String(), proxy.String())
-
-	sigCh := make(chan os.Signal, 1)
-	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
-	<-sigCh
-
-	return nil
-}

internal/cmd/flags.go

@@ -1,51 +0,0 @@
-package cmd
-
-import "github.com/urfave/cli/v2"
-
-var (
-	API = cli.StringFlag{
-		Name:  "api",
-		Usage: "URL of external API to listen",
-	}
-
-	Device = cli.StringFlag{
-		Name:    "device",
-		Aliases: []string{"d"},
-		Usage:   "URL of device to open",
-	}
-
-	DNS = cli.StringFlag{
-		Name:  "dns",
-		Usage: "URL of fake DNS to listen",
-	}
-
-	Hosts = cli.StringSliceFlag{
-		Name:  "hosts",
-		Usage: "Extra hosts mapping",
-	}
-
-	Interface = cli.StringFlag{
-		Name:    "interface",
-		Aliases: []string{"i"},
-		Usage:   "Bind interface to dial",
-	}
-
-	LogLevel = cli.StringFlag{
-		Name:    "loglevel",
-		Aliases: []string{"l"},
-		Usage:   "Set logging level",
-		Value:   "INFO",
-	}
-
-	Proxy = cli.StringFlag{
-		Name:    "proxy",
-		Aliases: []string{"p"},
-		Usage:   "URL of proxy to dial",
-	}
-
-	Version = cli.BoolFlag{
-		Name:    "version",
-		Aliases: []string{"v"},
-		Usage:   "Print current version",
-	}
-)

internal/core/icmp.go

@@ -1,43 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"net"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-type icmpHandleFunc func()
-
-func WithICMPHandler(_ icmpHandleFunc) Option {
-	return func(s *stack.Stack) error {
-		// Add default route table for IPv4 and IPv6
-		// This will handle all incoming ICMP packets.
-		s.SetRouteTable([]tcpip.Route{
-			{
-				Destination: mustSubnet("0.0.0.0/0"),
-				NIC:         defaultNICID,
-			},
-			{
-				Destination: mustSubnet("::/0"),
-				NIC:         defaultNICID,
-			},
-		})
-		return nil
-	}
-}
-
-// mustSubnet returns tcpip.Subnet from CIDR string.
-func mustSubnet(s string) tcpip.Subnet {
-	_, ipNet, err := net.ParseCIDR(s)
-	if err != nil {
-		panic(fmt.Errorf("unable to ParseCIDR(%s): %w", s, err))
-	}
-
-	subnet, err := tcpip.NewSubnet(tcpip.Address(ipNet.IP), tcpip.AddressMask(ipNet.Mask))
-	if err != nil {
-		panic(fmt.Errorf("unable to NewSubnet(%s): %w", ipNet, err))
-	}
-	return subnet
-}

internal/core/stack.go

@@ -1,93 +0,0 @@
-package core
-
-import (
-	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
-	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
-)
-
-// NewStack returns *stack.Stack with provided options.
-func NewStack(opts ...Option) (*stack.Stack, error) {
-	ipstack := stack.New(stack.Options{
-		NetworkProtocols: []stack.NetworkProtocolFactory{
-			ipv4.NewProtocol,
-			ipv6.NewProtocol,
-		},
-		TransportProtocols: []stack.TransportProtocolFactory{
-			tcp.NewProtocol,
-			udp.NewProtocol,
-			icmp.NewProtocol4,
-			icmp.NewProtocol6,
-		},
-	})
-
-	for _, opt := range opts {
-		if err := opt(ipstack); err != nil {
-			return nil, err
-		}
-	}
-
-	return ipstack, nil
-}
-
-// NewDefaultStack calls NewStack with default options.
-func NewDefaultStack(linkEp stack.LinkEndpoint, th tcpHandleFunc, uh udpHandleFunc) (*stack.Stack, error) {
-	return NewStack(
-		WithDefaultTTL(defaultTimeToLive),
-		WithForwarding(ipForwardingEnabled),
-
-		// Config default stack ICMP settings.
-		WithICMPBurst(icmpBurst), WithICMPLimit(icmpLimit),
-
-		// We expect no packet loss, therefore we can bump buffers.
-		// Too large buffers thrash cache, so there is little point
-		// in too large buffers.
-		//
-		// Ref: https://github.com/majek/slirpnetstack/blob/master/stack.go
-		WithTCPBufferSizeRange(minBufferSize, defaultBufferSize, maxBufferSize),
-
-		WithTCPCongestionControl(tcpCongestionControlAlgorithm),
-		WithTCPDelay(tcpDelayEnabled),
-
-		// Receive Buffer Auto-Tuning Option, see:
-		// https://github.com/google/gvisor/issues/1666
-		WithTCPModerateReceiveBuffer(tcpModerateReceiveBufferEnabled),
-
-		// TCP selective ACK Option, see:
-		// https://tools.ietf.org/html/rfc2018
-		WithTCPSACKEnabled(tcpSACKEnabled),
-
-		// Important: We must initiate transport protocol handlers
-		// before creating NIC, otherwise NIC would dispatch packets
-		// to stack and cause race condition.
-		WithICMPHandler(nil), WithTCPHandler(th), WithUDPHandler(uh),
-
-		// Create stack NIC and then bind link endpoint.
-		WithCreatingNIC(defaultNICID, linkEp),
-
-		// In past we did s.AddAddressRange to assign 0.0.0.0/0 onto
-		// the interface. We need that to be able to terminate all the
-		// incoming connections - to any ip. AddressRange API has been
-		// removed and the suggested workaround is to use Promiscuous
-		// mode. https://github.com/google/gvisor/issues/3876
-		//
-		// Ref: https://github.com/majek/slirpnetstack/blob/master/stack.go
-		WithPromiscuousMode(defaultNICID, nicPromiscuousModeEnabled),
-
-		// Enable spoofing if a stack may send packets from unowned addresses.
-		// This change required changes to some netgophers since previously,
-		// promiscuous mode was enough to let the netstack respond to all
-		// incoming packets regardless of the packet's destination address. Now
-		// that a stack.Route is not held for each incoming packet, finding a route
-		// may fail with local addresses we don't own but accepted packets for
-		// while in promiscuous mode. Since we also want to be able to send from
-		// any address (in response the received promiscuous mode packets), we need
-		// to enable spoofing.
-		//
-		// Ref: https://github.com/google/gvisor/commit/8c0701462a84ff77e602f1626aec49479c308127
-		WithSpoofing(defaultNICID, nicSpoofingEnabled),
-	)
-}

internal/core/tcp.go

@@ -1,108 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"net"
-	"time"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
-	"gvisor.dev/gvisor/pkg/waiter"
-
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-	"github.com/xjasonlyu/tun2socks/pkg/log"
-)
-
-const (
-	// defaultWndSize if set to zero, the default
-	// receive window buffer size is used instead.
-	defaultWndSize = 0
-
-	// maxConnAttempts specifies the maximum number
-	// of in-flight tcp connection attempts.
-	maxConnAttempts = 2 << 10
-
-	// tcpKeepaliveIdle specifies the time a connection
-	// must remain idle before the first TCP keepalive
-	// packet is sent. Once this time is reached,
-	// tcpKeepaliveInterval option is used instead.
-	tcpKeepaliveIdle = 60 * time.Second
-
-	// tcpKeepaliveInterval specifies the interval
-	// time between sending TCP keepalive packets.
-	tcpKeepaliveInterval = 30 * time.Second
-)
-
-type tcpHandleFunc func(adapter.TCPConn)
-
-func WithTCPHandler(handle tcpHandleFunc) Option {
-	return func(s *stack.Stack) error {
-		tcpForwarder := tcp.NewForwarder(s, defaultWndSize, maxConnAttempts, func(r *tcp.ForwarderRequest) {
-			var wq waiter.Queue
-			id := r.ID()
-			ep, err := r.CreateEndpoint(&wq)
-			if err != nil {
-				log.Warnf("[STACK] %s create endpoint error: %v", formatID(&id), err)
-				// prevent potential half-open TCP connection leak.
-				r.Complete(true)
-				return
-			}
-			r.Complete(false)
-
-			if err := setKeepalive(ep); err != nil {
-				log.Warnf("[STACK] %s %v", formatID(&id), err)
-			}
-
-			conn := &tcpConn{
-				Conn: gonet.NewTCPConn(&wq, ep),
-				metadata: &adapter.Metadata{
-					Net:     adapter.TCP,
-					SrcIP:   net.IP(id.RemoteAddress),
-					SrcPort: id.RemotePort,
-					DstIP:   net.IP(id.LocalAddress),
-					DstPort: id.LocalPort,
-				},
-			}
-
-			handle(conn)
-		})
-		s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
-		return nil
-	}
-}
-
-func formatID(id *stack.TransportEndpointID) string {
-	return fmt.Sprintf(
-		"%s:%d --> %s:%d",
-		id.RemoteAddress,
-		id.RemotePort,
-		id.LocalAddress,
-		id.LocalPort,
-	)
-}
-
-func setKeepalive(ep tcpip.Endpoint) error {
-	if err := ep.SetSockOptBool(tcpip.KeepaliveEnabledOption, true); err != nil {
-		return fmt.Errorf("set keepalive: %s", err)
-	}
-	idleOpt := tcpip.KeepaliveIdleOption(tcpKeepaliveIdle)
-	if err := ep.SetSockOpt(&idleOpt); err != nil {
-		return fmt.Errorf("set keepalive idle: %s", err)
-	}
-	intervalOpt := tcpip.KeepaliveIntervalOption(tcpKeepaliveInterval)
-	if err := ep.SetSockOpt(&intervalOpt); err != nil {
-		return fmt.Errorf("set keepalive interval: %s", err)
-	}
-	return nil
-}
-
-type tcpConn struct {
-	net.Conn
-	metadata *adapter.Metadata
-}
-
-func (c *tcpConn) Metadata() *adapter.Metadata {
-	return c.metadata
-}

internal/core/udp.go

@@ -1,187 +0,0 @@
-package core
-
-import (
-	"fmt"
-	"net"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/buffer"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
-
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-	"github.com/xjasonlyu/tun2socks/pkg/log"
-)
-
-const udpNoChecksum = true
-
-type udpHandleFunc func(adapter.UDPPacket)
-
-func WithUDPHandler(handle udpHandleFunc) Option {
-	return func(s *stack.Stack) error {
-		udpHandlePacket := func(id stack.TransportEndpointID, pkt *stack.PacketBuffer) bool {
-			// Ref: gVisor pkg/tcpip/transport/udp/endpoint.go HandlePacket
-			udpHdr := header.UDP(pkt.TransportHeader().View())
-			if int(udpHdr.Length()) > pkt.Data.Size()+header.UDPMinimumSize {
-				// Malformed packet.
-				s.Stats().UDP.MalformedPacketsReceived.Increment()
-				return true
-			}
-
-			if !verifyChecksum(udpHdr, pkt) {
-				// Checksum error.
-				s.Stats().UDP.ChecksumErrors.Increment()
-				return true
-			}
-
-			s.Stats().UDP.PacketsReceived.Increment()
-
-			netHdr := pkt.Network()
-			route, err := s.FindRoute(pkt.NICID, netHdr.DestinationAddress(), netHdr.SourceAddress(), pkt.NetworkProtocolNumber, false /* multicastLoop */)
-			if err != nil {
-				log.Warnf("[STACK] find route error: %v", err)
-				return true
-			}
-			route.ResolveWith(pkt.SourceLinkAddress())
-
-			packet := &udpPacket{
-				id: id,
-				r:  &route,
-				metadata: &adapter.Metadata{
-					Net:     adapter.UDP,
-					SrcIP:   net.IP(id.RemoteAddress),
-					SrcPort: id.RemotePort,
-					DstIP:   net.IP(id.LocalAddress),
-					DstPort: id.LocalPort,
-				},
-				payload: pkt.Data.ToView(),
-			}
-
-			handle(packet)
-			return true
-		}
-		s.SetTransportProtocolHandler(udp.ProtocolNumber, udpHandlePacket)
-		return nil
-	}
-}
-
-type udpPacket struct {
-	id       stack.TransportEndpointID
-	r        *stack.Route
-	metadata *adapter.Metadata
-	payload  []byte
-}
-
-func (p *udpPacket) Data() []byte {
-	return p.payload
-}
-
-func (p *udpPacket) Drop() {
-	p.r.Release()
-}
-
-func (p *udpPacket) LocalAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP(p.id.LocalAddress), Port: int(p.id.LocalPort)}
-}
-
-func (p *udpPacket) Metadata() *adapter.Metadata {
-	return p.metadata
-}
-
-func (p *udpPacket) RemoteAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP(p.id.RemoteAddress), Port: int(p.id.RemotePort)}
-}
-
-func (p *udpPacket) WriteBack(b []byte, addr net.Addr) (int, error) {
-	v := buffer.View(b)
-	if len(v) > header.UDPMaximumPacketSize {
-		// Payload can't possibly fit in a packet.
-		return 0, fmt.Errorf("%s", tcpip.ErrMessageTooLong)
-	}
-
-	data := v.ToVectorisedView()
-	// if addr is not provided, write back use original dst Addr as src Addr.
-	if addr == nil {
-		return sendUDP(p.r, data, p.id.LocalPort, p.id.RemotePort, udpNoChecksum)
-	}
-
-	udpAddr, ok := addr.(*net.UDPAddr)
-	if !ok {
-		return 0, fmt.Errorf("type %T is not a valid udp address", addr)
-	}
-
-	r := p.r.Clone()
-	defer r.Release()
-	if ipv4 := udpAddr.IP.To4(); ipv4 != nil {
-		r.LocalAddress = tcpip.Address(ipv4)
-	} else {
-		r.LocalAddress = tcpip.Address(udpAddr.IP)
-	}
-	return sendUDP(&r, data, uint16(udpAddr.Port), p.id.RemotePort, udpNoChecksum)
-}
-
-// sendUDP sends a UDP segment via the provided network endpoint and under the
-// provided identity.
-func sendUDP(r *stack.Route, data buffer.VectorisedView, localPort, remotePort uint16, noChecksum bool) (int, error) {
-	// Allocate a buffer for the UDP header.
-	pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
-		ReserveHeaderBytes: header.UDPMinimumSize + int(r.MaxHeaderLength()),
-		Data:               data,
-	})
-
-	// Initialize the UDP header.
-	udpHdr := header.UDP(pkt.TransportHeader().Push(header.UDPMinimumSize))
-	pkt.TransportProtocolNumber = udp.ProtocolNumber
-
-	length := uint16(pkt.Size())
-	udpHdr.Encode(&header.UDPFields{
-		SrcPort: localPort,
-		DstPort: remotePort,
-		Length:  length,
-	})
-
-	// Set the checksum field unless TX checksum offload is enabled.
-	// On IPv4, UDP checksum is optional, and a zero value indicates the
-	// transmitter skipped the checksum generation (RFC768).
-	// On IPv6, UDP checksum is not optional (RFC2460 Section 8.1).
-	if r.RequiresTXTransportChecksum() &&
-		(!noChecksum || r.NetProto == header.IPv6ProtocolNumber) {
-		xsum := r.PseudoHeaderChecksum(udp.ProtocolNumber, length)
-		for _, v := range data.Views() {
-			xsum = header.Checksum(v, xsum)
-		}
-		udpHdr.SetChecksum(^udpHdr.CalculateChecksum(xsum))
-	}
-
-	ttl := r.DefaultTTL()
-	if err := r.WritePacket(nil /* gso */, stack.NetworkHeaderParams{
-		Protocol: udp.ProtocolNumber,
-		TTL:      ttl,
-		TOS:      0, /* default */
-	}, pkt); err != nil {
-		r.Stats().UDP.PacketSendErrors.Increment()
-		return 0, fmt.Errorf("%s", err)
-	}
-
-	// Track count of packets sent.
-	r.Stats().UDP.PacketsSent.Increment()
-	return data.Size(), nil
-}
-
-// verifyChecksum verifies the checksum unless RX checksum offload is enabled.
-// On IPv4, UDP checksum is optional, and a zero value means the transmitter
-// omitted the checksum generation (RFC768).
-// On IPv6, UDP checksum is not optional (RFC2460 Section 8.1).
-func verifyChecksum(hdr header.UDP, pkt *stack.PacketBuffer) bool {
-	if !pkt.RXTransportChecksumValidated &&
-		(hdr.Checksum() != 0 || pkt.NetworkProtocolNumber == header.IPv6ProtocolNumber) {
-		netHdr := pkt.Network()
-		xsum := header.PseudoHeaderChecksum(udp.ProtocolNumber, netHdr.DestinationAddress(), netHdr.SourceAddress(), hdr.Length())
-		for _, v := range pkt.Data.Views() {
-			xsum = header.Checksum(v, xsum)
-		}
-		return hdr.CalculateChecksum(xsum) == 0xffff
-	}
-	return true
-}

internal/dev/dev.go

@@ -1,74 +0,0 @@
-package dev
-
-import (
-	"errors"
-	"io"
-	"net/url"
-	"strings"
-
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-
-	"github.com/xjasonlyu/tun2socks/internal/dev/tun"
-)
-
-const defaultScheme = "tun"
-
-type Device struct {
-	url *url.URL
-	io.Closer
-	stack.LinkEndpoint
-}
-
-func Open(deviceURL string) (device *Device, err error) {
-	if !strings.Contains(deviceURL, "://") {
-		deviceURL = defaultScheme + "://" + deviceURL
-	}
-
-	var u *url.URL
-	if u, err = url.Parse(deviceURL); err != nil {
-		return
-	}
-
-	var (
-		ep stack.LinkEndpoint
-		c  io.Closer
-	)
-	switch strings.ToLower(u.Scheme) {
-	case "tun":
-		name := u.Host
-		ep, c, err = tun.Open(name)
-	default:
-		err = errors.New("unsupported device type")
-	}
-
-	if err != nil {
-		return
-	}
-
-	device = &Device{
-		url:          u,
-		Closer:       c,
-		LinkEndpoint: ep,
-	}
-	return
-}
-
-// Close closes device.
-func (d *Device) Close() error {
-	return d.Closer.Close()
-}
-
-// Name returns name of device.
-func (d *Device) Name() string {
-	return d.url.Host
-}
-
-// Type returns type of device.
-func (d *Device) Type() string {
-	return strings.ToLower(d.url.Scheme)
-}
-
-// String returns full URL string.
-func (d *Device) String() string {
-	return d.url.String()
-}

internal/dev/tun/tun.go

@@ -1,15 +0,0 @@
-// +build !darwin,!linux
-
-package tun
-
-import (
-	"fmt"
-	"io"
-	"runtime"
-
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-func Open(_ string) (stack.LinkEndpoint, io.Closer, error) {
-	return nil, nil, fmt.Errorf("operation was not supported on %s", runtime.GOOS)
-}

internal/dev/tun/tun_darwin.go

@@ -1,70 +0,0 @@
-package tun
-
-import (
-	"fmt"
-	"io"
-	"syscall"
-	"unsafe"
-
-	"github.com/songgao/water"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-
-	"github.com/xjasonlyu/tun2socks/pkg/link/rwc"
-)
-
-func Open(name string) (ep stack.LinkEndpoint, c io.Closer, err error) {
-	config := water.Config{
-		DeviceType: water.TUN,
-	}
-	config.Name = name
-
-	var ifce *water.Interface
-	ifce, err = water.New(config)
-	if err != nil {
-		return
-	}
-
-	var mtu uint32
-	mtu, err = getMTU(name)
-	if err != nil {
-		return
-	}
-
-	ep, err = rwc.New(ifce, mtu)
-	c = ifce
-
-	return
-}
-
-func getMTU(name string) (uint32, error) {
-	// open datagram socket
-	fd, err := syscall.Socket(
-		syscall.AF_INET,
-		syscall.SOCK_DGRAM,
-		0,
-	)
-	if err != nil {
-		return 0, err
-	}
-
-	defer syscall.Close(fd)
-
-	// do ioctl call
-	var ifr struct {
-		name [16]byte
-		mtu  uint32
-	}
-	copy(ifr.name[:], name)
-
-	_, _, errno := syscall.Syscall(
-		syscall.SYS_IOCTL,
-		uintptr(fd),
-		uintptr(syscall.SIOCGIFMTU),
-		uintptr(unsafe.Pointer(&ifr)),
-	)
-	if errno != 0 {
-		return 0, fmt.Errorf("get MTU on %s: %s", name, errno.Error())
-	}
-
-	return ifr.mtu, nil
-}

internal/dev/tun/tun_linux.go

@@ -1,43 +0,0 @@
-package tun
-
-import (
-	"io"
-	"syscall"
-
-	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
-	"gvisor.dev/gvisor/pkg/tcpip/link/rawfile"
-	"gvisor.dev/gvisor/pkg/tcpip/link/tun"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-type closeFunc func() error
-
-func (f closeFunc) Close() error {
-	return f()
-}
-
-func Open(name string) (ep stack.LinkEndpoint, c io.Closer, err error) {
-	var fd int
-	fd, err = tun.Open(name)
-	if err != nil {
-		return
-	}
-
-	var mtu uint32
-	mtu, err = rawfile.GetMTU(name)
-	if err != nil {
-		return
-	}
-
-	ep, err = fdbased.New(&fdbased.Options{
-		FDs:            []int{fd},
-		MTU:            mtu,
-		EthernetHeader: false,
-	})
-
-	c = closeFunc(func() error {
-		return syscall.Close(fd)
-	})
-
-	return
-}

internal/dns/resolver.go

@@ -1,12 +0,0 @@
-package dns
-
-import (
-	"net"
-
-	"github.com/xjasonlyu/clash/component/dialer"
-)
-
-func init() { /* use bound dialer to resolve DNS */
-	net.DefaultResolver.PreferGo = true
-	net.DefaultResolver.Dial = dialer.DialContext
-}

internal/dns/server.go

@@ -1,107 +0,0 @@
-package dns
-
-import (
-	"errors"
-	"net/url"
-	"strings"
-
-	"github.com/xjasonlyu/clash/component/resolver"
-	"github.com/xjasonlyu/clash/dns"
-)
-
-const (
-	defaultScheme      = "dns"
-	defaultCacheSize   = 1000
-	defaultFakeIPRange = "198.18.0.0/15"
-)
-
-var _defaultNameServer = []string{"223.5.5.5", "8.8.8.8"}
-
-func Start(dnsURL string, rawHosts []string) error {
-	if !strings.Contains(dnsURL, "://") {
-		dnsURL = defaultScheme + "://" + dnsURL
-	}
-
-	u, err := url.Parse(dnsURL)
-	if err != nil {
-		return err
-	}
-
-	if strings.ToLower(u.Scheme) != defaultScheme {
-		return errors.New("unsupported scheme")
-	}
-
-	var serverAddr = u.Host
-
-	fakeIPRange := u.Query().Get("fake-ip-range")
-	if fakeIPRange == "" {
-		fakeIPRange = defaultFakeIPRange
-	}
-
-	var fakeIPFilter []string
-	if raw := strings.TrimSpace(u.Query().Get("fake-ip-filter")); raw != "" {
-		fakeIPFilter = append(fakeIPFilter, strings.Split(raw, ",")...)
-	}
-
-	pool, err := parseFakeIP(fakeIPRange, fakeIPFilter)
-	if err != nil {
-		return err
-	}
-
-	var mainNS, defaultNS []dns.NameServer
-	{
-		var ns []string
-		if raw := strings.TrimSpace(u.Query().Get("default-nameserver")); raw != "" {
-			ns = append(ns, strings.Split(raw, ",")...)
-		}
-
-		if len(ns) == 0 {
-			ns = append(ns, _defaultNameServer...)
-		}
-
-		if defaultNS, err = parseNameServer(ns); err != nil {
-			return err
-		}
-	}
-	{
-		var ns []string
-		if raw := strings.TrimSpace(u.Query().Get("nameserver")); raw != "" {
-			ns = append(ns, strings.Split(raw, ",")...)
-		}
-
-		if len(ns) == 0 {
-			ns = append(ns, _defaultNameServer...)
-		}
-
-		if mainNS, err = parseNameServer(ns); err != nil {
-			return err
-		}
-	}
-
-	hosts, err := parseHosts(parseHostsSlice(rawHosts))
-	if err != nil {
-		return err
-	}
-
-	cfg := dns.Config{
-		IPv6:         true,
-		Pool:         pool,
-		Hosts:        hosts,
-		Main:         mainNS,
-		Default:      defaultNS,
-		EnhancedMode: dns.FAKEIP,
-	}
-
-	r := dns.NewResolver(cfg)
-	m := dns.NewEnhancer(cfg)
-
-	// reuse cache of old host mapper
-	if old := resolver.DefaultHostMapper; old != nil {
-		m.PatchFrom(old.(*dns.ResolverEnhancer))
-	}
-
-	resolver.DefaultResolver = r
-	resolver.DefaultHostMapper = m
-
-	return dns.ReCreateServer(serverAddr, r, m)
-}

internal/dns/utils.go

@@ -1,141 +0,0 @@
-package dns
-
-import (
-	"fmt"
-	"net"
-	"net/url"
-	"strings"
-
-	"github.com/xjasonlyu/clash/component/fakeip"
-	"github.com/xjasonlyu/clash/component/trie"
-	"github.com/xjasonlyu/clash/dns"
-	"github.com/xjasonlyu/tun2socks/pkg/log"
-)
-
-func parseFakeIP(fakeIPRange string, fakeIPFilter []string) (*fakeip.Pool, error) {
-	_, ipnet, err := net.ParseCIDR(fakeIPRange)
-	if err != nil {
-		return nil, err
-	}
-
-	var host *trie.DomainTrie
-	// fake ip skip host filter
-	if len(fakeIPFilter) != 0 {
-		host = trie.New()
-		for _, domain := range fakeIPFilter {
-			_ = host.Insert(domain, true)
-		}
-	}
-
-	return fakeip.New(ipnet, defaultCacheSize, host)
-}
-
-func parseHosts(hosts map[string]string) (*trie.DomainTrie, error) {
-	tree := trie.New()
-
-	// add default hosts
-	if err := tree.Insert("localhost", net.IP{127, 0, 0, 1}); err != nil {
-		log.Errorf("[DNS] insert localhost to host error: %v", err)
-	}
-
-	if len(hosts) != 0 {
-		for domain, ipStr := range hosts {
-			ip := net.ParseIP(ipStr)
-			if ip == nil {
-				return nil, fmt.Errorf("%s is not a valid IP", ipStr)
-			}
-			_ = tree.Insert(domain, ip)
-		}
-	}
-
-	return tree, nil
-}
-
-func parseHostsSlice(s []string) map[string]string {
-	m := make(map[string]string)
-
-	for _, i := range s {
-		if strings.Contains(i, "=") {
-			v := strings.SplitN(i, "=", 2)
-			m[v[0]] = v[1]
-			continue
-		}
-		if strings.Contains(i, ":") {
-			v := strings.SplitN(i, ":", 2)
-			m[v[0]] = v[1]
-			continue
-		}
-		log.Debugf("invalid hosts item: %s", i)
-	}
-
-	return m
-}
-
-func hostWithDefaultPort(host string, defPort string) (string, error) {
-	if !strings.Contains(host, ":") {
-		host += ":"
-	}
-
-	hostname, port, err := net.SplitHostPort(host)
-	if err != nil {
-		return "", err
-	}
-
-	if port == "" {
-		port = defPort
-	}
-
-	return net.JoinHostPort(hostname, port), nil
-}
-
-func parseNameServer(servers []string) ([]dns.NameServer, error) {
-	var nameservers []dns.NameServer
-
-	for idx, server := range servers {
-		server := strings.TrimSpace(server)
-		if server == "" {
-			return nil, fmt.Errorf("empty server field")
-		}
-
-		// parse without scheme .e.g 8.8.8.8:53
-		if !strings.Contains(server, "://") {
-			server = "udp://" + server
-		}
-		u, err := url.Parse(server)
-		if err != nil {
-			return nil, fmt.Errorf("DNS NameServer[%d] format: %s", idx, err.Error())
-		}
-
-		var addr, dnsNetType string
-		switch u.Scheme {
-		case "udp":
-			addr, err = hostWithDefaultPort(u.Host, "53")
-			dnsNetType = "" // UDP
-		case "tcp":
-			addr, err = hostWithDefaultPort(u.Host, "53")
-			dnsNetType = "tcp" // TCP
-		case "tls":
-			addr, err = hostWithDefaultPort(u.Host, "853")
-			dnsNetType = "tcp-tls" // DNS over TLS
-		case "https":
-			clearURL := url.URL{Scheme: "https", Host: u.Host, Path: u.Path}
-			addr = clearURL.String()
-			dnsNetType = "https" // DNS over HTTPS
-		default:
-			return nil, fmt.Errorf("DNS NameServer[%d] unsupport scheme: %s", idx, u.Scheme)
-		}
-
-		if err != nil {
-			return nil, fmt.Errorf("DNS NameServer[%d] format: %s", idx, err.Error())
-		}
-
-		nameservers = append(
-			nameservers,
-			dns.NameServer{
-				Net:  dnsNetType,
-				Addr: addr,
-			},
-		)
-	}
-	return nameservers, nil
-}

internal/proxy/base.go

@@ -1,50 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"errors"
-	"net"
-	"net/url"
-	"strings"
-
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-)
-
-type Base struct {
-	url *url.URL
-}
-
-func NewBase(url *url.URL) (*Base, error) {
-	return &Base{
-		url: url,
-	}, nil
-}
-
-func (b *Base) Type() string {
-	if b.url == nil {
-		return ""
-	}
-	return strings.ToLower(b.url.Scheme)
-}
-
-func (b *Base) Addr() string {
-	if b.url == nil {
-		return ""
-	}
-	return b.url.Host
-}
-
-func (b *Base) String() string {
-	if b.url == nil {
-		return ""
-	}
-	return b.url.String()
-}
-
-func (b *Base) DialContext(context.Context, *adapter.Metadata) (net.Conn, error) {
-	return nil, errors.New("no support")
-}
-
-func (b *Base) DialUDP(*adapter.Metadata) (net.PacketConn, error) {
-	return nil, errors.New("no support")
-}

internal/proxy/direct.go

@@ -1,57 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"net"
-	"net/url"
-
-	"github.com/xjasonlyu/clash/component/dialer"
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-)
-
-type Direct struct {
-	*Base
-}
-
-func NewDirect(url *url.URL) (*Direct, error) {
-	return &Direct{
-		Base: &Base{
-			url: url,
-		},
-	}, nil
-}
-
-func (d *Direct) DialContext(ctx context.Context, metadata *adapter.Metadata) (net.Conn, error) {
-	c, err := dialer.DialContext(ctx, "tcp", metadata.DestinationAddress())
-	if err != nil {
-		return nil, err
-	}
-	tcpKeepAlive(c)
-	return c, nil
-}
-
-func (d *Direct) DialUDP(_ *adapter.Metadata) (net.PacketConn, error) {
-	pc, err := dialer.ListenPacket("udp", "")
-	if err != nil {
-		return nil, err
-	}
-	return &directPacketConn{PacketConn: pc}, nil
-}
-
-type directPacketConn struct {
-	net.PacketConn
-}
-
-func (pc *directPacketConn) WriteTo(b []byte, addr net.Addr) (_ int, err error) {
-	var udpAddr *net.UDPAddr
-	if m, ok := addr.(*adapter.Metadata); ok && m.Host == "" {
-		udpAddr = m.UDPAddr()
-	} else {
-		udpAddr, err = resolveUDPAddr("udp", addr.String())
-	}
-
-	if err != nil {
-		return 0, err
-	}
-	return pc.PacketConn.WriteTo(b, udpAddr)
-}

internal/proxy/proxy.go

@@ -1,84 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/url"
-	"strings"
-
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-)
-
-type Dialer interface {
-	Addr() string
-	Type() string
-	String() string
-
-	DialContext(context.Context, *adapter.Metadata) (net.Conn, error)
-	DialUDP(*adapter.Metadata) (net.PacketConn, error)
-}
-
-var _defaultDialer Dialer = &Base{}
-
-// New returns proxy dialer.
-func New(proxyURL string) (Dialer, error) {
-	u, err := url.Parse(proxyURL)
-	if err != nil {
-		return nil, err
-	}
-
-	proto := strings.ToLower(u.Scheme)
-	user := u.User.Username()
-	pass, _ := u.User.Password()
-
-	switch proto {
-	case "direct":
-		return NewDirect(u)
-	case "socks5":
-		return NewSocks5(u, user, pass)
-	case "ss", "shadowsocks":
-		method, password := user, pass
-		return NewShadowSocks(u, method, password)
-	}
-
-	return nil, fmt.Errorf("unsupported protocol: %s", proto)
-}
-
-// Register updates the _defaultDialer.
-func Register(proxyURL string) error {
-	dialer, err := New(proxyURL)
-	if err != nil {
-		return err
-	}
-
-	_defaultDialer = dialer
-	return nil
-}
-
-// Dial uses _defaultDialer to dial TCP.
-func Dial(metadata *adapter.Metadata) (net.Conn, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), tcpConnectTimeout)
-	defer cancel()
-	return _defaultDialer.DialContext(ctx, metadata)
-}
-
-// DialUDP uses _defaultDialer to dial UDP.
-func DialUDP(metadata *adapter.Metadata) (net.PacketConn, error) {
-	return _defaultDialer.DialUDP(metadata)
-}
-
-// Addr returns _defaultDialer addr.
-func Addr() string {
-	return _defaultDialer.Addr()
-}
-
-// Type returns _defaultDialer type.
-func Type() string {
-	return _defaultDialer.Type()
-}
-
-// String returns _defaultDialer URL.
-func String() string {
-	return _defaultDialer.String()
-}

internal/proxy/shadowsocks.go

@@ -1,108 +0,0 @@
-package proxy
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/url"
-
-	"github.com/Dreamacro/go-shadowsocks2/core"
-
-	"github.com/xjasonlyu/clash/component/dialer"
-	"github.com/xjasonlyu/clash/component/socks5"
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-)
-
-type ShadowSocks struct {
-	*Base
-
-	cipher core.Cipher
-}
-
-func NewShadowSocks(url *url.URL, method, password string) (*ShadowSocks, error) {
-	cipher, err := core.PickCipher(method, nil, password)
-	if err != nil {
-		return nil, fmt.Errorf("ss initialize: %w", err)
-	}
-
-	return &ShadowSocks{
-		Base: &Base{
-			url: url,
-		},
-		cipher: cipher,
-	}, nil
-}
-
-func (ss *ShadowSocks) DialContext(ctx context.Context, metadata *adapter.Metadata) (c net.Conn, err error) {
-	c, err = dialer.DialContext(ctx, "tcp", ss.Addr())
-	if err != nil {
-		return nil, fmt.Errorf("connect to %s: %w", ss.Addr(), err)
-	}
-	tcpKeepAlive(c)
-
-	defer func() {
-		if err != nil {
-			c.Close()
-		}
-	}()
-
-	c = ss.cipher.StreamConn(c)
-	_, err = c.Write(metadata.SerializesSocksAddr())
-	return
-}
-
-func (ss *ShadowSocks) DialUDP(_ *adapter.Metadata) (net.PacketConn, error) {
-	pc, err := dialer.ListenPacket("udp", "")
-	if err != nil {
-		return nil, err
-	}
-
-	udpAddr, err := resolveUDPAddr("udp", ss.Addr())
-	if err != nil {
-		return nil, fmt.Errorf("resolve UDPAddr %s failed", ss.Addr())
-	}
-
-	pc = ss.cipher.PacketConn(pc)
-	return &ssPacketConn{PacketConn: pc, rAddr: udpAddr}, nil
-}
-
-type ssPacketConn struct {
-	net.PacketConn
-
-	rAddr net.Addr
-}
-
-func (pc *ssPacketConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
-	var packet []byte
-	if m, ok := addr.(*adapter.Metadata); ok {
-		packet, err = socks5.EncodeUDPPacket(m.SerializesSocksAddr(), b)
-	} else {
-		packet, err = socks5.EncodeUDPPacket(socks5.ParseAddrToSocksAddr(addr), b)
-	}
-
-	if err != nil {
-		return
-	}
-	return pc.PacketConn.WriteTo(packet[3:], pc.rAddr)
-}
-
-func (pc *ssPacketConn) ReadFrom(b []byte) (int, net.Addr, error) {
-	n, _, e := pc.PacketConn.ReadFrom(b)
-	if e != nil {
-		return 0, nil, e
-	}
-
-	addr := socks5.SplitAddr(b[:n])
-	if addr == nil {
-		return 0, nil, errors.New("parse addr error")
-	}
-
-	udpAddr := addr.UDPAddr()
-	if udpAddr == nil {
-		return 0, nil, errors.New("parse addr error")
-	}
-
-	copy(b, b[len(addr):])
-	return n - len(addr), udpAddr, e
-}

internal/proxy/utils.go

@@ -1,33 +0,0 @@
-package proxy
-
-import (
-	"net"
-	"time"
-
-	"github.com/xjasonlyu/clash/component/resolver"
-)
-
-const (
-	tcpConnectTimeout  = 5 * time.Second
-	tcpKeepAlivePeriod = 30 * time.Second
-)
-
-func tcpKeepAlive(c net.Conn) {
-	if tcp, ok := c.(*net.TCPConn); ok {
-		tcp.SetKeepAlive(true)
-		tcp.SetKeepAlivePeriod(tcpKeepAlivePeriod)
-	}
-}
-
-func resolveUDPAddr(network, address string) (*net.UDPAddr, error) {
-	host, port, err := net.SplitHostPort(address)
-	if err != nil {
-		return nil, err
-	}
-
-	ip, err := resolver.ResolveIP(host)
-	if err != nil {
-		return nil, err
-	}
-	return net.ResolveUDPAddr(network, net.JoinHostPort(ip.String(), port))
-}

internal/tunnel/tcp.go

@@ -1,86 +0,0 @@
-package tunnel
-
-import (
-	"io"
-	"net"
-	"strconv"
-	"sync"
-	"time"
-
-	"github.com/xjasonlyu/clash/common/pool"
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-	"github.com/xjasonlyu/tun2socks/internal/manager"
-	"github.com/xjasonlyu/tun2socks/internal/proxy"
-	"github.com/xjasonlyu/tun2socks/pkg/log"
-)
-
-const (
-	tcpWaitTimeout  = 5 * time.Second
-	relayBufferSize = pool.RelayBufferSize
-)
-
-func handleTCP(localConn adapter.TCPConn) {
-	defer localConn.Close()
-
-	metadata := localConn.Metadata()
-	if !metadata.Valid() {
-		log.Warnf("[Metadata] not valid: %#v", metadata)
-		return
-	}
-
-	err := resolveMetadata(metadata)
-	if err != nil {
-		log.Warnf("[Metadata] resolve metadata error: %v", err)
-		return
-	}
-
-	targetConn, err := proxy.Dial(metadata)
-	if err != nil {
-		log.Warnf("[TCP] dial %s error: %v", metadata.DestinationAddress(), err)
-		return
-	}
-
-	if dialerAddr, ok := targetConn.LocalAddr().(*net.TCPAddr); ok {
-		metadata.MidIP = dialerAddr.IP
-		metadata.MidPort = uint16(dialerAddr.Port)
-	} else {
-		ip, p, _ := net.SplitHostPort(targetConn.LocalAddr().String())
-		port, _ := strconv.ParseUint(p, 10, 16)
-		metadata.MidIP = net.ParseIP(ip)
-		metadata.MidPort = uint16(port)
-	}
-
-	targetConn = manager.NewTCPTracker(targetConn, metadata)
-	defer targetConn.Close()
-
-	log.Infof("[TCP] %s <--> %s", metadata.SourceAddress(), metadata.DestinationAddress())
-	relay(localConn, targetConn) /* relay connections */
-}
-
-// relay copies between left and right bidirectionally.
-func relay(left, right net.Conn) {
-	var wg sync.WaitGroup
-	wg.Add(2)
-
-	go func() {
-		defer wg.Done()
-		_ = copyBuffer(right, left) /* ignore error */
-		right.SetReadDeadline(time.Now().Add(tcpWaitTimeout))
-	}()
-
-	go func() {
-		defer wg.Done()
-		_ = copyBuffer(left, right) /* ignore error */
-		left.SetReadDeadline(time.Now().Add(tcpWaitTimeout))
-	}()
-
-	wg.Wait()
-}
-
-func copyBuffer(dst io.Writer, src io.Reader) error {
-	buf := pool.Get(relayBufferSize)
-	defer pool.Put(buf)
-
-	_, err := io.CopyBuffer(dst, src, buf)
-	return err
-}

internal/tunnel/tunnel.go

@@ -1,67 +0,0 @@
-package tunnel
-
-import (
-	"runtime"
-
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-	"github.com/xjasonlyu/tun2socks/pkg/log"
-)
-
-const (
-	// maxUDPQueueSize is the max number of UDP packets
-	// could be buffered. if queue is full, upcoming packets
-	// would be dropped util queue is ready again.
-	maxUDPQueueSize = 2 << 10
-)
-
-var (
-	numUDPWorkers = max(runtime.NumCPU(), 4 /* at least 4 workers */)
-
-	tcpQueue      = make(chan adapter.TCPConn) /* unbuffered */
-	udpMultiQueue = make([]chan adapter.UDPPacket, 0, numUDPWorkers)
-)
-
-func init() {
-	for i := 0; i < numUDPWorkers; i++ {
-		udpMultiQueue = append(udpMultiQueue, make(chan adapter.UDPPacket, maxUDPQueueSize))
-	}
-
-	go process()
-}
-
-// Add adds tcpConn to tcpQueue.
-func Add(conn adapter.TCPConn) {
-	tcpQueue <- conn
-}
-
-// AddPacket adds udpPacket to udpQueue.
-func AddPacket(packet adapter.UDPPacket) {
-	m := packet.Metadata()
-	// In order to keep each packet sent in order, we
-	// calculate which queue each packet should be sent
-	// by src/dst info, and make sure the rest of them
-	// would only be sent to the same queue.
-	i := int(m.SrcPort+m.DstPort) % numUDPWorkers
-
-	select {
-	case udpMultiQueue[i] <- packet:
-	default:
-		log.Warnf("queue is currently full, packet will be dropped")
-		packet.Drop()
-	}
-}
-
-func process() {
-	for _, udpQueue := range udpMultiQueue {
-		queue := udpQueue
-		go func() {
-			for packet := range queue {
-				handleUDP(packet)
-			}
-		}()
-	}
-
-	for conn := range tcpQueue {
-		go handleTCP(conn)
-	}
-}

internal/tunnel/udp.go

@@ -1,150 +0,0 @@
-package tunnel
-
-import (
-	"errors"
-	"net"
-	"os"
-	"strconv"
-	"time"
-
-	"github.com/xjasonlyu/clash/common/pool"
-	"github.com/xjasonlyu/clash/component/resolver"
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-	"github.com/xjasonlyu/tun2socks/internal/manager"
-	"github.com/xjasonlyu/tun2socks/internal/proxy"
-	"github.com/xjasonlyu/tun2socks/pkg/log"
-	"github.com/xjasonlyu/tun2socks/pkg/nat"
-)
-
-const (
-	udpTimeout    = 30 * time.Second
-	udpBufferSize = 64 << 10 // KiB
-)
-
-var (
-	// natTable uses source udp packet information
-	// as key to store destination udp packetConn.
-	natTable = nat.NewTable()
-)
-
-func handleUDP(packet adapter.UDPPacket) {
-	metadata := packet.Metadata()
-	if !metadata.Valid() {
-		log.Warnf("[Metadata] not valid: %#v", metadata)
-		return
-	}
-
-	// make a fAddr if request ip is fake ip.
-	var fAddr net.Addr
-	if resolver.IsExistFakeIP(metadata.DstIP) {
-		fAddr = metadata.UDPAddr()
-	}
-
-	err := resolveMetadata(metadata)
-	if err != nil {
-		log.Warnf("[Metadata] resolve metadata error: %v", err)
-		return
-	}
-
-	key := generateNATKey(metadata)
-
-	handle := func(drop bool) bool {
-		pc := natTable.Get(key)
-		if pc != nil {
-			handleUDPToRemote(packet, pc, metadata /* as net.Addr */, drop)
-			return true
-		}
-		return false
-	}
-
-	if handle(true /* drop */) {
-		return
-	}
-
-	lockKey := key + "-lock"
-	cond, loaded := natTable.GetOrCreateLock(lockKey)
-	go func() {
-		if loaded {
-			cond.L.Lock()
-			cond.Wait()
-			handle(true) /* drop after sending data to remote */
-			cond.L.Unlock()
-			return
-		}
-
-		defer func() {
-			natTable.Delete(lockKey)
-			cond.Broadcast()
-		}()
-
-		pc, err := proxy.DialUDP(metadata)
-		if err != nil {
-			log.Warnf("[UDP] dial %s error: %v", metadata.DestinationAddress(), err)
-			return
-		}
-
-		if dialerAddr, ok := pc.LocalAddr().(*net.UDPAddr); ok {
-			metadata.MidIP = dialerAddr.IP
-			metadata.MidPort = uint16(dialerAddr.Port)
-		} else {
-			ip, p, _ := net.SplitHostPort(pc.LocalAddr().String())
-			port, _ := strconv.ParseUint(p, 10, 16)
-			metadata.MidIP = net.ParseIP(ip)
-			metadata.MidPort = uint16(port)
-		}
-
-		pc = manager.NewUDPTracker(pc, metadata)
-
-		go func() {
-			defer pc.Close()
-			defer packet.Drop()
-			defer natTable.Delete(key)
-
-			handleUDPToLocal(packet, pc, fAddr, udpTimeout)
-		}()
-
-		natTable.Set(key, pc)
-		handle(false /* drop */)
-	}()
-}
-
-func handleUDPToRemote(packet adapter.UDPPacket, pc net.PacketConn, remote net.Addr, drop bool) {
-	defer func() {
-		if drop {
-			packet.Drop()
-		}
-	}()
-
-	if _, err := pc.WriteTo(packet.Data() /* data */, remote); err != nil {
-		log.Warnf("[UDP] write to %s error: %v", remote, err)
-	}
-
-	log.Infof("[UDP] %s --> %s", packet.RemoteAddr(), remote)
-}
-
-func handleUDPToLocal(packet adapter.UDPPacket, pc net.PacketConn, fAddr net.Addr, timeout time.Duration) {
-	buf := pool.Get(udpBufferSize)
-	defer pool.Put(buf)
-
-	for /* just loop */ {
-		pc.SetReadDeadline(time.Now().Add(timeout))
-		n, from, err := pc.ReadFrom(buf)
-		if err != nil {
-			if !errors.Is(err, os.ErrDeadlineExceeded) /* ignore i/o timeout */ {
-				log.Warnf("[UDP] ReadFrom error: %v", err)
-			}
-			return
-		}
-
-		if fAddr != nil {
-			from = fAddr
-		}
-
-		if _, err := packet.WriteBack(buf[:n], from); err != nil {
-			log.Warnf("[UDP] write back from %s error: %v", from, err)
-			return
-		}
-
-		log.Infof("[UDP] %s <-- %s", packet.RemoteAddr(), from)
-	}
-}

internal/tunnel/utils.go

@@ -1,35 +0,0 @@
-package tunnel
-
-import (
-	"fmt"
-
-	"github.com/xjasonlyu/clash/component/resolver"
-	"github.com/xjasonlyu/tun2socks/internal/adapter"
-)
-
-func generateNATKey(m *adapter.Metadata) string {
-	return m.SourceAddress() /* Full Cone NAT Key */
-}
-
-func max(a, b int) int {
-	if a > b {
-		return a
-	}
-	return b
-}
-
-func resolveMetadata(metadata *adapter.Metadata) error {
-	if metadata.DstIP == nil {
-		return fmt.Errorf("destination IP is nil")
-	}
-
-	if resolver.IsFakeIP(metadata.DstIP) {
-		var exist bool
-		metadata.Host, exist = resolver.FindHostByIP(metadata.DstIP)
-		if !exist {
-			return fmt.Errorf("fake DNS record %s missing", metadata.DstIP)
-		}
-	}
-
-	return nil
-}

internal/version/debug.go

@@ -0,0 +1,7 @@
+//go:build debug
+
+package version
+
+func init() {
+	_debug = true
+}

internal/version/module.go

@@ -0,0 +1,11 @@
+package version
+
+import (
+	"runtime/debug"
+)
+
+// Info returns project dependencies as []*debug.Module.
+func Info() []*debug.Module {
+	bi, _ := debug.ReadBuildInfo()
+	return bi.Deps
+}

internal/version/version.go

@@ -0,0 +1,40 @@
+package version
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+)
+
+const Name = "tun2socks"
+
+var (
+	_debug = false
+
+	// Version can be set at link time by executing
+	// the command: `git describe --abbrev=0 --tags HEAD`
+	Version string
+
+	// GitCommit can be set at link time by executing
+	// the command: `git rev-parse --short HEAD`
+	GitCommit string
+)
+
+func versionize(s string) string {
+	return strings.TrimPrefix(s, "v")
+}
+
+func Debug() bool {
+	return _debug
+}
+
+func String() string {
+	if !Debug() {
+		return fmt.Sprintf("%s-%s", Name, versionize(Version))
+	}
+	return fmt.Sprintf("%s-%s (debug)", Name, versionize(Version))
+}
+
+func BuildString() string {
+	return fmt.Sprintf("%s/%s, %s, %s", runtime.GOOS, runtime.GOARCH, runtime.Version(), GitCommit)
+}

log/emitter.go

@@ -0,0 +1,34 @@
+package log
+
+import (
+	"io"
+	"runtime"
+	"strings"
+	"time"
+
+	glog "gvisor.dev/gvisor/pkg/log"
+)
+
+func init() {
+	EnableStackLog(true)
+}
+
+func EnableStackLog(v bool) {
+	if v {
+		glog.SetTarget(&emitter{}) // built-in logger
+	} else {
+		glog.SetTarget(&glog.Writer{Next: io.Discard})
+	}
+}
+
+type emitter struct{}
+
+func (emitter) Emit(depth int, level glog.Level, _ time.Time, format string, args ...any) {
+	if _, file, line, ok := runtime.Caller(depth + 1); ok {
+		// Ignore (*gonet.TCPConn).RemoteAddr() warning: `ep.GetRemoteAddress() failed`.
+		if line == 457 && strings.HasSuffix(file, "/pkg/tcpip/adapters/gonet/gonet.go") {
+			return
+		}
+	}
+	logf(Level(level)+2, "[STACK] "+format, args...)
+}

log/event.go

@@ -4,12 +4,12 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/xjasonlyu/clash/common/observable"
+	"github.com/xjasonlyu/tun2socks/v2/common/observable"
 )
 
 var (
-	logCh  = make(chan interface{})
-	source = observable.NewObservable(logCh)
+	_logCh  = make(chan any)
+	_source = observable.NewObservable(_logCh)
 )
 
 type Event struct {
@@ -18,22 +18,22 @@ type Event struct {
 	Time    time.Time `json:"time"`
 }
 
-func newEvent(level Level, format string, args ...interface{}) *Event {
+func newEvent(level Level, format string, args ...any) *Event {
 	event := &Event{
 		Level:   level,
 		Time:    time.Now(),
 		Message: fmt.Sprintf(format, args...),
 	}
-	logCh <- event /* send all events to logCh */
+	_logCh <- event /* send all events to logCh */
 
 	return event
 }
 
 func Subscribe() observable.Subscription {
-	sub, _ := source.Subscribe()
+	sub, _ := _source.Subscribe()
 	return sub
 }
 
 func UnSubscribe(sub observable.Subscription) {
-	source.UnSubscribe(sub)
+	_source.UnSubscribe(sub)
 }

log/level.go

@@ -10,7 +10,6 @@ type Level uint32
 
 const (
 	SilentLevel Level = iota
-	FatalLevel
 	ErrorLevel
 	WarnLevel
 	InfoLevel
@@ -48,8 +47,6 @@ func (level Level) String() string {
 		return "warning"
 	case ErrorLevel:
 		return "error"
-	case FatalLevel:
-		return "fatal"
 	case SilentLevel:
 		return "silent"
 	default:
@@ -59,13 +56,11 @@ func (level Level) String() string {
 
 func ParseLevel(lvl string) (Level, error) {
 	switch strings.ToLower(lvl) {
-	case "silent", "none":
+	case "silent":
 		return SilentLevel, nil
-	case "fatal":
-		return FatalLevel, nil
 	case "error":
 		return ErrorLevel, nil
-	case "warn", "warning":
+	case "warning":
 		return WarnLevel, nil
 	case "info":
 		return InfoLevel, nil