Chore(stale): add exempt-pr-labels (#438)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.29.0 to 0.31.0.
- [Commits](https://github.com/golang/crypto/compare/v0.29.0...v0.31.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.dockerignore

@@ -1,6 +1,8 @@
-.github
+.github/
 .gitignore
+.golangci.yaml
 
 # Other
-build/*
-docs/*
+docs/
+build/
+tests/

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+xjasonlyu@gmail.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

.github/FUNDING.yml

@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: [ xjasonlyu ] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,33 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Environment**
- - OS: [e.g. `Ubuntu-20.04`]
- - Version: [e.g. `v2.1.0`]
- - Network: [e.g. route tables, iptables rules]
-
-**Log**
-Paste the tun2socks log below with the log level set to `DEBUG`.
-```
-```
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. [First Step]
-2. [Second Step]
-3. ……
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,55 @@
+name: Bug report
+description: Create a report to help us improve
+title: "[Bug] "
+body:
+  - type: checkboxes
+    id: ensure
+    attributes:
+      label: Verify steps
+      description: Please verify that you've followed these steps
+      options:
+        - label: Is this something you can **debug and fix**? Send a pull request! Bug fixes and documentation fixes are welcome.
+          required: true
+
+        - label: I have searched on the [issue tracker](……/) for a related issue.
+          required: true
+
+  - type: input
+    attributes:
+      label: Version
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: What OS are you seeing the problem on?
+      multiple: true
+      options:
+        - Windows
+        - Linux
+        - macOS
+        - OpenBSD/FreeBSD
+        - Other
+
+  - type: textarea
+    attributes:
+      label: Description
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: CLI or Config
+      description: Paste the command line parameters or configuration below.
+
+  - type: textarea
+    attributes:
+      render: shell
+      label: Logs
+      description: Paste the logs below with the log level set to `DEBUG`.
+
+  - type: textarea
+    attributes:
+      label: How to Reproduce
+      description: Steps to reproduce the behavior, if any.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+blank_issues_enabled: false
+
+contact_links:
+  - name: tun2socks GitHub Wiki
+    url: https://github.com/xjasonlyu/tun2socks/wiki
+    about: Please see the wiki for common configurations
+  - name: tun2socks GitHub Discussions
+    url: https://github.com/xjasonlyu/tun2socks/discussions
+    about: Ask questions and get help on GitHub Discussions

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,20 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Is your feature request related to a problem?**
-A clear and concise description of what the problem is.
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Suggest an idea or improvement
+title: "[Feature] "
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      placeholder: A clear description of the feature or enhancement.
+    validations:
+      required: true
+
+  - type: textarea
+    id: related
+    attributes:
+      label: Is this feature related to a specific bug?
+      description: Please include a bug references if yes.
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Do you have a specific solution in mind?
+      description: >
+        Please include any details about a solution that you have in mind,
+        including any alternatives considered.

.github/SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+| Version |     Supported      |
+|:-------:|:------------------:|
+|   2.x   | :white_check_mark: |
+|   1.x   |        :x:         |
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in this repository, please report it to me through coordinated
+disclosure.
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Instead, please email to xjasonlyu[@]gmail.com.
+
+Please include as much of the information listed below as you can to help me better understand and resolve the issue:
+
+* The type of issue (e.g., buffer overflow, payload attack)
+* Full paths of source file(s) related to the manifestation of the issue
+* The location of the affected source code (tag/branch/commit or direct URL)
+* Any special configuration required to reproduce the issue
+* Step-by-step instructions to reproduce the issue
+* Proof-of-concept or exploit code (if possible)
+* Impact of the issue, including how an attacker might exploit the issue
+
+This information will help me triage your report more quickly.

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,41 @@
+name: "CodeQL"
+
+concurrency:
+  group: codeql-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          check-latest: true
+          go-version-file: 'go.mod'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/docker.yml

@@ -1,75 +1,78 @@
 name: Publish Docker Image
 
+concurrency:
+  group: docker-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches:
       - 'main'
     tags:
       - '*'
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
 
 jobs:
-
-  build:
-    name: Build
+  docker:
+    name: Docker
     runs-on: ubuntu-latest
     steps:
-
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+      - name: Checkout code
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v3
         with:
           platforms: all
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v3
         with:
           version: latest
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: xjasonlyu
-          password: ${{ secrets.CR_PAT }}
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Get Version
         id: shell
         run: |
-          echo ::set-output name=version::$(git describe --tags --abbrev=0)
+          echo "version=$(git describe --tags --abbrev=0)" >> $GITHUB_OUTPUT
 
-      - name: Build and Push (nightly)
+      - name: Build and Push (dev)
         if: github.ref == 'refs/heads/main'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
           tags: |
-            xjasonlyu/tun2socks:nightly
-            ghcr.io/xjasonlyu/tun2socks:nightly
+            xjasonlyu/tun2socks:dev
+            ghcr.io/xjasonlyu/tun2socks:dev
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Build and Push (latest)
         if: startsWith(github.ref, 'refs/tags/')
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
           tags: |
             xjasonlyu/tun2socks:latest
             xjasonlyu/tun2socks:${{ steps.shell.outputs.version }}
             ghcr.io/xjasonlyu/tun2socks:latest
             ghcr.io/xjasonlyu/tun2socks:${{ steps.shell.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/go.yml

@@ -1,35 +0,0 @@
-name: Go Static Check
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-
-      - name: Setup Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.16.x
-
-      - name: Cache go module
-        uses: actions/cache@v2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
-
-      - name: Get dependencies, run test and static check
-        run: |
-          go test ./...
-          go vet ./...
-          go install honnef.co/go/tools/cmd/staticcheck@latest
-          staticcheck -- $(go list ./...)

.github/workflows/linter.yml

@@ -0,0 +1,30 @@
+name: Linter
+
+concurrency:
+  group: linter-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+
+jobs:
+  linter:
+    name: Linter
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          check-latest: true
+          go-version-file: 'go.mod'
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest

.github/workflows/release.yml

@@ -1,37 +1,47 @@
 name: Publish Go Releases
 
+concurrency:
+  group: release-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     tags:
       - '*'
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - 'docker/**'
 
 jobs:
-  build:
-    name: Build
+  release:
+    name: Release
     runs-on: ubuntu-latest
     steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+      - name: Checkout code
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.16.x
+          check-latest: true
+          go-version-file: 'go.mod'
+
+      - name: Cache go module
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
 
       - name: Build
+        if: startsWith(github.ref, 'refs/tags/')
         run: make -j releases
 
       - name: Upload Releases
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         if: startsWith(github.ref, 'refs/tags/')
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           files: build/*
           draft: true

.github/workflows/stale.yml

@@ -1,5 +1,10 @@
 name: Mark stale issues and pull requests
 
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
 on:
   schedule:
     - cron: "0 10 * * *"
@@ -8,9 +13,10 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v3
+      - uses: actions/stale@v9
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days'
+          exempt-issue-labels: 'question,bug,enhancement,help wanted'
+          exempt-pr-labels: 'pending,WIP,help wanted'
           days-before-stale: 60
           days-before-close: 7

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Test
+
+concurrency:
+  group: test-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+
+jobs:
+  build-test:
+    name: Build Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          check-latest: true
+          go-version-file: 'go.mod'
+
+      - name: Run test
+        run: |
+          go test ./...

.gitignore

@@ -1,9 +1,27 @@
-# Binaries
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
 *.exe
 *.exe~
 *.dll
 *.so
 *.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# Build directory
 build/
 
 # IDE

.golangci.yaml

@@ -0,0 +1,21 @@
+linters:
+  disable-all: true
+  enable:
+    - gci
+    - gofumpt
+    - gosimple
+    - govet
+    - ineffassign
+    - misspell
+    - staticcheck
+    - unconvert
+    - unused
+    - usestdlibvars
+
+linters-settings:
+  gci:
+    custom-order: true
+    sections:
+      - standard
+      - default
+      - prefix(github.com/xjasonlyu/tun2socks)

Dockerfile

@@ -1,19 +1,18 @@
 FROM golang:alpine AS builder
 
-WORKDIR /tun2socks-src
-COPY . /tun2socks-src
+WORKDIR /src
+COPY . /src
 
-RUN apk add --no-cache make git \
-    && make tun2socks \
-    && mv ./build/tun2socks /tun2socks
+RUN apk add --update --no-cache make git \
+    && make tun2socks
 
 FROM alpine:latest
 LABEL org.opencontainers.image.source="https://github.com/xjasonlyu/tun2socks"
 
 COPY docker/entrypoint.sh /entrypoint.sh
-COPY --from=builder /tun2socks /usr/bin/tun2socks
+COPY --from=builder /src/build/tun2socks /usr/bin/tun2socks
 
-RUN apk add --update --no-cache iptables iproute2 \
+RUN apk add --update --no-cache iptables iproute2 tzdata \
     && chmod +x /entrypoint.sh
 
 ENV TUN=tun0
@@ -21,9 +20,12 @@ ENV ADDR=198.18.0.1/15
 ENV LOGLEVEL=info
 ENV PROXY=direct://
 ENV MTU=9000
-ENV STATS=
-ENV TOKEN=
+ENV RESTAPI=
 ENV UDP_TIMEOUT=
+ENV TCP_SNDBUF=
+ENV TCP_RCVBUF=
+ENV TCP_AUTO_TUNING=
+ENV MULTICAST_GROUPS=
 ENV EXTRA_COMMANDS=
 ENV TUN_INCLUDED_ROUTES=
 ENV TUN_EXCLUDED_ROUTES=

Makefile

@@ -1,5 +1,5 @@
 BINARY := tun2socks
-MODULE := github.com/xjasonlyu/tun2socks
+MODULE := github.com/xjasonlyu/tun2socks/v2
 
 BUILD_DIR     := build
 BUILD_TAGS    :=
@@ -11,20 +11,23 @@ CGO_ENABLED := 0
 GO111MODULE := on
 
 LDFLAGS += -w -s -buildid=
-LDFLAGS += -X "$(MODULE)/constant.Version=$(BUILD_VERSION)"
-LDFLAGS += -X "$(MODULE)/constant.GitCommit=$(BUILD_COMMIT)"
+LDFLAGS += -X "$(MODULE)/internal/version.Version=$(BUILD_VERSION)"
+LDFLAGS += -X "$(MODULE)/internal/version.GitCommit=$(BUILD_COMMIT)"
 
 GO_BUILD = GO111MODULE=$(GO111MODULE) CGO_ENABLED=$(CGO_ENABLED) \
 	go build $(BUILD_FLAGS) -ldflags '$(LDFLAGS)' -tags '$(BUILD_TAGS)' -trimpath
 
 UNIX_ARCH_LIST = \
 	darwin-amd64 \
+	darwin-amd64-v3 \
 	darwin-arm64 \
 	freebsd-386 \
 	freebsd-amd64 \
+	freebsd-amd64-v3 \
 	freebsd-arm64 \
 	linux-386 \
 	linux-amd64 \
+	linux-amd64-v3 \
 	linux-arm64 \
 	linux-armv5 \
 	linux-armv6 \
@@ -38,16 +41,22 @@ UNIX_ARCH_LIST = \
 	linux-ppc64 \
 	linux-ppc64le \
 	linux-s390x \
-	openbsd-386 \
+	linux-loong64 \
 	openbsd-amd64 \
+	openbsd-amd64-v3 \
 	openbsd-arm64
 
 WINDOWS_ARCH_LIST = \
 	windows-386 \
 	windows-amd64 \
+	windows-amd64-v3 \
+	windows-arm64 \
 	windows-arm32v7
 
-all: linux-amd64 darwin-amd64 windows-amd64
+all: linux-amd64 linux-arm64 darwin-amd64 darwin-arm64 windows-amd64
+
+debug: BUILD_TAGS += debug
+debug: all
 
 tun2socks:
 	$(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)
@@ -55,6 +64,9 @@ tun2socks:
 darwin-amd64:
 	GOARCH=amd64 GOOS=darwin $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+darwin-amd64-v3:
+	GOARCH=amd64 GOOS=darwin GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 darwin-arm64:
 	GOARCH=arm64 GOOS=darwin $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -64,6 +76,9 @@ freebsd-386:
 freebsd-amd64:
 	GOARCH=amd64 GOOS=freebsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+freebsd-amd64-v3:
+	GOARCH=amd64 GOOS=freebsd GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 freebsd-arm64:
 	GOARCH=arm64 GOOS=freebsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -73,6 +88,9 @@ linux-386:
 linux-amd64:
 	GOARCH=amd64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+linux-amd64-v3:
+	GOARCH=amd64 GOOS=linux GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 linux-arm64:
 	GOARCH=arm64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -112,12 +130,15 @@ linux-ppc64le:
 linux-s390x:
 	GOARCH=s390x GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
-openbsd-386:
-	GOARCH=386 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+linux-loong64:
+	GOARCH=loong64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
 openbsd-amd64:
 	GOARCH=amd64 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+openbsd-amd64-v3:
+	GOARCH=amd64 GOOS=openbsd GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 openbsd-arm64:
 	GOARCH=arm64 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -127,6 +148,12 @@ windows-386:
 windows-amd64:
 	GOARCH=amd64 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
 
+windows-amd64-v3:
+	GOARCH=amd64 GOOS=windows GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
+windows-arm64:
+	GOARCH=arm64 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
 windows-arm32v7:
 	GOARCH=arm GOARM=7 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
 
@@ -143,5 +170,12 @@ all-arch: $(UNIX_ARCH_LIST) $(WINDOWS_ARCH_LIST)
 
 releases: $(unix_releases) $(windows_releases)
 
+lint:
+	GOOS=darwin  golangci-lint run ./...
+	GOOS=windows golangci-lint run ./...
+	GOOS=linux   golangci-lint run ./...
+	GOOS=freebsd golangci-lint run ./...
+	GOOS=openbsd golangci-lint run ./...
+
 clean:
 	rm -rf $(BUILD_DIR)

README.md

@@ -1,53 +1,67 @@
-![tun2socks](docs/logo.png)
+![tun2socks](docs/wordmark.png)
 
 [![GitHub Workflow][1]](https://github.com/xjasonlyu/tun2socks/actions)
 [![Go Version][2]](https://github.com/xjasonlyu/tun2socks/blob/main/go.mod)
 [![Go Report][3]](https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks)
-[![GitHub License][4]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
-[![Releases][5]](https://github.com/xjasonlyu/tun2socks/releases)
+[![Maintainability][4]](https://codeclimate.com/github/xjasonlyu/tun2socks/maintainability)
+[![GitHub License][5]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
+[![Docker Pulls][6]](https://hub.docker.com/r/xjasonlyu/tun2socks)
+[![Releases][7]](https://github.com/xjasonlyu/tun2socks/releases)
 
-[1]: https://img.shields.io/github/workflow/status/xjasonlyu/tun2socks/Go?style=flat-square
-[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks/main?style=flat-square
-[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks?style=flat-square
-[4]: https://img.shields.io/github/license/xjasonlyu/tun2socks?style=flat-square
-[5]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?include_prereleases&style=flat-square
-
-English | [简体中文](README_ZH.md)
+[1]: https://img.shields.io/github/actions/workflow/status/xjasonlyu/tun2socks/release.yml?logo=github
+[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks?logo=go
+[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks
+[4]: https://api.codeclimate.com/v1/badges/b5b30239174fc6603aca/maintainability
+[5]: https://img.shields.io/github/license/xjasonlyu/tun2socks
+[6]: https://img.shields.io/docker/pulls/xjasonlyu/tun2socks?logo=docker
+[7]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?logo=smartthings
 
 ## Features
 
-- **Fully support:** IPv4/IPv6/ICMP/TCP/UDP
-- **Proxy protocol:** HTTP/Socks4/Socks5/Shadowsocks
-- **Game ready:** optimized UDP transmission
-- **Pure Go:** no CGO required, stability improved
-- **Router mode:** forwarding packets in LAN
-- **TCP/IP stack:** powered by **[gVisor](https://github.com/google/gvisor)**
-- **High performance:** >2.5Gbps throughput
+- Proxy Everything: Handle all network traffic of any internet programs sent by the device through a proxy.
+- Proxy Protocols: HTTP/Socks4/Socks5/Shadowsocks with authentication support for remote connections.
+- Run Everywhere: Linux/macOS/Windows/FreeBSD/OpenBSD multi-platform support with specific optimization.
+- Gateway Mode: Act as a Layer 3 gateway to handle network traffic from other devices on the same network.
+- Full IPv6 Support: All functions work in IPv6, tunnel IPv4 connections through IPv6 proxy and vice versa.
+- Network Stack: Powered by the user-space TCP/IP stack from Google container application kernel **[gVisor](https://github.com/google/gvisor)**.
 
-## Requirements
+## Benchmarks
 
-| Target | Minimum | Recommended |
-| :----- | :-----: | :---------: |
-| System | Linux MacOS Freebsd OpenBSD Windows | Linux or MacOS |
-| Memory | >20MB | >128MB |
-| CPU | ANY | AMD64 or ARM64 |
+For all scenarios of usage, tun2socks performs best.
+See [benchmarks](https://github.com/xjasonlyu/tun2socks/wiki/Benchmarks) for more details.
+
+![benchmark](docs/benchmark.png)
 
 ## Documentation
 
-Documentations and quick start guides can be found at [Github Wiki](https://github.com/xjasonlyu/tun2socks/wiki).
+- [Install from Source](https://github.com/xjasonlyu/tun2socks/wiki/Install-from-Source)
+- [Quickstart Examples](https://github.com/xjasonlyu/tun2socks/wiki/Examples)
+- [Memory Optimization](https://github.com/xjasonlyu/tun2socks/wiki/Memory-Optimization)
+
+Full documentation and technical guides can be found at [Wiki](https://github.com/xjasonlyu/tun2socks/wiki).
 
 ## Community
 
-Welcome and feel free to ask any questions at [Github Discussions](https://github.com/xjasonlyu/tun2socks/discussions).
+Welcome and feel free to ask any questions at [Discussions](https://github.com/xjasonlyu/tun2socks/discussions).
 
 ## Credits
 
-- [Dreamacro/clash](https://github.com/Dreamacro/clash) - A rule-based tunnel in Go
 - [google/gvisor](https://github.com/google/gvisor) - Application Kernel for Containers
 - [wireguard-go](https://git.zx2c4.com/wireguard-go) - Go Implementation of WireGuard
+- [wintun](https://git.zx2c4.com/wintun/) - Layer 3 TUN Driver for Windows
 
 ## License
 
 [GPL-3.0](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
 
 [![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks?ref=badge_large)
+
+## Star History
+
+<a href="https://star-history.com/#xjasonlyu/tun2socks&Date">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xjasonlyu/tun2socks&type=Date&theme=dark" />
+    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xjasonlyu/tun2socks&type=Date" />
+    <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xjasonlyu/tun2socks&type=Date" />
+  </picture>
+</a>

README_ZH.md

@@ -1,68 +0,0 @@
-![tun2socks](docs/logo.png)
-
-[![GitHub Workflow][1]](https://github.com/xjasonlyu/tun2socks/actions)
-[![Go Version][2]](https://github.com/xjasonlyu/tun2socks/blob/main/go.mod)
-[![Go Report][3]](https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks)
-[![GitHub License][4]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
-[![Releases][5]](https://github.com/xjasonlyu/tun2socks/releases)
-
-[1]: https://img.shields.io/github/workflow/status/xjasonlyu/tun2socks/Go?style=flat-square
-[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks/main?style=flat-square
-[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks?style=flat-square
-[4]: https://img.shields.io/github/license/xjasonlyu/tun2socks?style=flat-square
-[5]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?include_prereleases&style=flat-square
-
-[English](README.md) | 简体中文
-
-## 为什么使用 tun2socks ？
-
-通过在主机上运行`tun2socks`，可以轻松地接管所有的`TCP/UDP`流量，同时提供诸多专业的功能特性，这包括：
-
-- 强制使不支持代理的程序走代理
-- 配合Clash、V2Ray等工具实现全局代理上网
-- 配合Burp、Charles等工具进行应用层数据的调试
-- 配合DHCP、CoreDNS等工具部署路由模式代理局域网流量
-
-## 特性介绍
-
-- **全面支持：** IPv4/IPv6/ICMP/TCP/UDP
-- **代理协议：** HTTP/Socks4/Socks5/Shadowsocks
-- **游戏加速：** 针对UDP传输的优化
-- **纯Go实现：** 无需CGO，稳定性提升
-- **路由模式：** 转发代理局域网内所有流量
-- **TCP/IP栈：** 由 **[gVisor](https://github.com/google/gvisor)** 强力驱动 
-- **高性能：** >2.5Gbps 的带宽吞吐量
-
-## 硬件需求
-
-| 目标 | 最小 | 建议 |
-| :--- | :---: | :---: |
-| 系统 | Linux MacOS Freebsd OpenBSD Windows | Linux or MacOS |
-| 内存 | >20MB | >128MB |
-| 架构 | ANY | AMD64 or ARM64 |
-
-## 使用文档
-
-文档以及使用方式，请看 [Github Wiki](https://github.com/xjasonlyu/tun2socks/wiki)。
-
-## 交流讨论
-
-欢迎来讨论区交流提问，[Github Discussions](https://github.com/xjasonlyu/tun2socks/discussions)。
-
-## 注意事项
-
-1. 由于采用了纯Go实现，所以这一版本的`tun2socks`在有大量连接时内存消耗通常较多。如果您的需求对内存消耗极为敏感，请继续使用 [v1](https://github.com/xjasonlyu/tun2socks/tree/v1) 版本。
-2. `tun2socks`只应该专注于将网络层的TCP/UDP流量转发给SOCKS服务器，其他的如DNS（DoH）、DHCP等模块功能应该交由第三方应用实现，所以弃用了DNS模块。
-3. 因为是通过用户空间的网络栈接管所有流量并处理转发，在高吞吐时CPU的使用量会剧增，所以CPU的性能直接与可以达到的最大带宽挂钩。
-
-## 特别感谢
-
-- [Dreamacro/clash](https://github.com/Dreamacro/clash) - A rule-based tunnel in Go
-- [google/gvisor](https://github.com/google/gvisor) - Application Kernel for Containers
-- [wireguard-go](https://git.zx2c4.com/wireguard-go) - Go Implementation of WireGuard
-
-## License
-
-[GPL-3.0](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
-
-[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks?ref=badge_large)

buffer/allocator/allocator.go

@@ -1,30 +1,29 @@
-package pool
+package allocator
 
 import (
 	"errors"
 	"math/bits"
-	"sync"
-)
 
-var _allocator = NewAllocator()
+	"github.com/xjasonlyu/tun2socks/v2/internal/pool"
+)
 
 // Allocator for incoming frames, optimized to prevent overwriting
 // after zeroing.
 type Allocator struct {
-	buffers []sync.Pool
+	buffers []*pool.Pool[[]byte]
 }
 
-// NewAllocator initiates a []byte allocator for frames less than
-// 65536 bytes, the waste(memory fragmentation) of space allocation
-// is guaranteed to be no more than 50%.
-func NewAllocator() *Allocator {
+// New initiates a []byte allocator for frames less than 65536 bytes,
+// the waste(memory fragmentation) of space allocation is guaranteed
+// to be no more than 50%.
+func New() *Allocator {
 	alloc := &Allocator{}
-	alloc.buffers = make([]sync.Pool, 17) // 1B -> 64K
+	alloc.buffers = make([]*pool.Pool[[]byte], 17) // 1B -> 64K
 	for k := range alloc.buffers {
 		i := k
-		alloc.buffers[k].New = func() interface{} {
+		alloc.buffers[k] = pool.New(func() []byte {
 			return make([]byte, 1<<uint32(i))
-		}
+		})
 	}
 	return alloc
 }
@@ -37,10 +36,10 @@ func (alloc *Allocator) Get(size int) []byte {
 
 	b := msb(size)
 	if size == 1<<b {
-		return alloc.buffers[b].Get().([]byte)[:size]
+		return alloc.buffers[b].Get()[:size]
 	}
 
-	return alloc.buffers[b+1].Get().([]byte)[:size]
+	return alloc.buffers[b+1].Get()[:size]
 }
 
 // Put returns a []byte to pool for future use,
@@ -51,7 +50,6 @@ func (alloc *Allocator) Put(buf []byte) error {
 		return errors.New("allocator Put() incorrect buffer size")
 	}
 
-	//lint:ignore SA6002 ignore temporarily
 	alloc.buffers[b].Put(buf)
 	return nil
 }

buffer/allocator/allocator_test.go

@@ -1,4 +1,4 @@
-package pool
+package allocator
 
 import (
 	"math/rand"
@@ -8,7 +8,7 @@ import (
 )
 
 func TestAllocGet(t *testing.T) {
-	alloc := NewAllocator()
+	alloc := New()
 	assert.Nil(t, alloc.Get(0))
 	assert.Equal(t, 1, len(alloc.Get(1)))
 	assert.Equal(t, 2, len(alloc.Get(2)))
@@ -23,7 +23,7 @@ func TestAllocGet(t *testing.T) {
 }
 
 func TestAllocPut(t *testing.T) {
-	alloc := NewAllocator()
+	alloc := New()
 	assert.NotNil(t, alloc.Put(nil), "put nil misbehavior")
 	assert.NotNil(t, alloc.Put(make([]byte, 3)), "put elem:3 []bytes misbehavior")
 	assert.Nil(t, alloc.Put(make([]byte, 4)), "put elem:4 []bytes misbehavior")
@@ -33,7 +33,7 @@ func TestAllocPut(t *testing.T) {
 }
 
 func TestAllocPutThenGet(t *testing.T) {
-	alloc := NewAllocator()
+	alloc := New()
 	data := alloc.Get(4)
 	_ = alloc.Put(data)
 	newData := alloc.Get(4)

buffer/pool.go

@@ -1,18 +1,23 @@
-// Package pool provides a pool of []byte.
-package pool
+// Package buffer provides a pool of []byte.
+package buffer
 
-// Ref: github.com/Dreamacro/clash/common/pool
+import (
+	"github.com/xjasonlyu/tun2socks/v2/buffer/allocator"
+)
 
 const (
 	// MaxSegmentSize is the largest possible UDP datagram size.
 	MaxSegmentSize = (1 << 16) - 1
 
+	// RelayBufferSize is the default buffer size for TCP relays.
 	// io.Copy default buffer size is 32 KiB, but the maximum packet
 	// size of vmess/shadowsocks is about 16 KiB, so define a buffer
 	// of 20 KiB to reduce the memory of each TCP relay.
 	RelayBufferSize = 20 << 10
 )
 
+var _allocator = allocator.New()
+
 // Get gets a []byte from default allocator with most appropriate cap.
 func Get(size int) []byte {
 	return _allocator.Get(size)

common/observable/iterable.go

@@ -1,3 +0,0 @@
-package observable
-
-type Iterable <-chan interface{}

common/observable/observable.go

@@ -1,67 +0,0 @@
-package observable
-
-// Ref: github.com/Dreamacro/clash/common/observable
-
-import (
-	"errors"
-	"sync"
-)
-
-type Observable struct {
-	iterable Iterable
-	listener map[Subscription]*Subscriber
-	mux      sync.Mutex
-	done     bool
-}
-
-func (o *Observable) process() {
-	for item := range o.iterable {
-		o.mux.Lock()
-		for _, sub := range o.listener {
-			sub.Emit(item)
-		}
-		o.mux.Unlock()
-	}
-	o.close()
-}
-
-func (o *Observable) close() {
-	o.mux.Lock()
-	defer o.mux.Unlock()
-
-	o.done = true
-	for _, sub := range o.listener {
-		sub.Close()
-	}
-}
-
-func (o *Observable) Subscribe() (Subscription, error) {
-	o.mux.Lock()
-	defer o.mux.Unlock()
-	if o.done {
-		return nil, errors.New("observable is closed")
-	}
-	subscriber := newSubscriber()
-	o.listener[subscriber.Out()] = subscriber
-	return subscriber.Out(), nil
-}
-
-func (o *Observable) UnSubscribe(sub Subscription) {
-	o.mux.Lock()
-	defer o.mux.Unlock()
-	subscriber, exist := o.listener[sub]
-	if !exist {
-		return
-	}
-	delete(o.listener, sub)
-	subscriber.Close()
-}
-
-func NewObservable(any Iterable) *Observable {
-	observable := &Observable{
-		iterable: any,
-		listener: map[Subscription]*Subscriber{},
-	}
-	go observable.process()
-	return observable
-}

common/observable/observable_test.go

@@ -1,148 +0,0 @@
-package observable
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"go.uber.org/atomic"
-)
-
-func iterator(item []interface{}) chan interface{} {
-	ch := make(chan interface{})
-	go func() {
-		time.Sleep(100 * time.Millisecond)
-		for _, elm := range item {
-			ch <- elm
-		}
-		close(ch)
-	}()
-	return ch
-}
-
-func TestObservable(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
-	src := NewObservable(iter)
-	data, err := src.Subscribe()
-	assert.Nil(t, err)
-	count := 0
-	for range data {
-		count++
-	}
-	assert.Equal(t, count, 5)
-}
-
-func TestObservable_MultiSubscribe(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
-	src := NewObservable(iter)
-	ch1, _ := src.Subscribe()
-	ch2, _ := src.Subscribe()
-	var count = atomic.NewInt32(0)
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-	waitCh := func(ch <-chan interface{}) {
-		for range ch {
-			count.Inc()
-		}
-		wg.Done()
-	}
-	go waitCh(ch1)
-	go waitCh(ch2)
-	wg.Wait()
-	assert.Equal(t, int32(10), count.Load())
-}
-
-func TestObservable_UnSubscribe(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
-	src := NewObservable(iter)
-	data, err := src.Subscribe()
-	assert.Nil(t, err)
-	src.UnSubscribe(data)
-	_, open := <-data
-	assert.False(t, open)
-}
-
-func TestObservable_SubscribeClosedSource(t *testing.T) {
-	iter := iterator([]interface{}{1})
-	src := NewObservable(iter)
-	data, _ := src.Subscribe()
-	<-data
-
-	_, closed := src.Subscribe()
-	assert.NotNil(t, closed)
-}
-
-func TestObservable_UnSubscribeWithNotExistSubscription(t *testing.T) {
-	sub := Subscription(make(chan interface{}))
-	iter := iterator([]interface{}{1})
-	src := NewObservable(iter)
-	src.UnSubscribe(sub)
-}
-
-func TestObservable_SubscribeGoroutineLeak(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
-	src := NewObservable(iter)
-	max := 100
-
-	var list []Subscription
-	for i := 0; i < max; i++ {
-		ch, _ := src.Subscribe()
-		list = append(list, ch)
-	}
-
-	var wg sync.WaitGroup
-	wg.Add(max)
-	waitCh := func(ch <-chan interface{}) {
-		for range ch {
-		}
-		wg.Done()
-	}
-
-	for _, ch := range list {
-		go waitCh(ch)
-	}
-	wg.Wait()
-
-	for _, sub := range list {
-		_, more := <-sub
-		assert.False(t, more)
-	}
-
-	if len(list) > 0 {
-		_, more := <-list[0]
-		assert.False(t, more)
-	}
-}
-
-func Benchmark_Observable_1000(b *testing.B) {
-	ch := make(chan interface{})
-	o := NewObservable(ch)
-	num := 1000
-
-	var subs []Subscription
-	for i := 0; i < num; i++ {
-		sub, _ := o.Subscribe()
-		subs = append(subs, sub)
-	}
-
-	wg := sync.WaitGroup{}
-	wg.Add(num)
-
-	b.ResetTimer()
-	for _, sub := range subs {
-		go func(s Subscription) {
-			for range s {
-			}
-			wg.Done()
-		}(sub)
-	}
-
-	for i := 0; i < b.N; i++ {
-		ch <- i
-	}
-
-	close(ch)
-	wg.Wait()
-}

common/observable/subscriber.go

@@ -1,33 +0,0 @@
-package observable
-
-import (
-	"sync"
-)
-
-type Subscription <-chan interface{}
-
-type Subscriber struct {
-	buffer chan interface{}
-	once   sync.Once
-}
-
-func (s *Subscriber) Emit(item interface{}) {
-	s.buffer <- item
-}
-
-func (s *Subscriber) Out() Subscription {
-	return s.buffer
-}
-
-func (s *Subscriber) Close() {
-	s.once.Do(func() {
-		close(s.buffer)
-	})
-}
-
-func newSubscriber() *Subscriber {
-	sub := &Subscriber{
-		buffer: make(chan interface{}, 200),
-	}
-	return sub
-}

component/dialer/bind.go

@@ -1,21 +0,0 @@
-package dialer
-
-import (
-	"net"
-	"sync"
-)
-
-var _bindOnce sync.Once
-
-// BindToInterface binds dialer to specific interface.
-func BindToInterface(name string) error {
-	i, err := net.InterfaceByName(name)
-	if err != nil {
-		return err
-	}
-
-	_bindOnce.Do(func() {
-		addControl(bindToInterface(i))
-	})
-	return nil
-}

component/dialer/bind_darwin.go

@@ -1,26 +0,0 @@
-package dialer
-
-import (
-	"net"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func bindToInterface(i *net.Interface) controlFunc {
-	return func(network, address string, c syscall.RawConn) error {
-		ipStr, _, _ := net.SplitHostPort(address)
-		if ip := net.ParseIP(ipStr); ip != nil && !ip.IsGlobalUnicast() {
-			return nil
-		}
-
-		return c.Control(func(fd uintptr) {
-			switch network {
-			case "tcp4", "udp4":
-				unix.SetsockoptInt(int(fd), syscall.IPPROTO_IP, syscall.IP_BOUND_IF, i.Index)
-			case "tcp6", "udp6":
-				unix.SetsockoptInt(int(fd), syscall.IPPROTO_IPV6, syscall.IPV6_BOUND_IF, i.Index)
-			}
-		})
-	}
-}

component/dialer/bind_linux.go

@@ -1,21 +0,0 @@
-package dialer
-
-import (
-	"net"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func bindToInterface(i *net.Interface) controlFunc {
-	return func(network, address string, c syscall.RawConn) error {
-		ipStr, _, _ := net.SplitHostPort(address)
-		if ip := net.ParseIP(ipStr); ip != nil && !ip.IsGlobalUnicast() {
-			return nil
-		}
-
-		return c.Control(func(fd uintptr) {
-			unix.BindToDevice(int(fd), i.Name)
-		})
-	}
-}

component/dialer/bind_others.go

@@ -1,15 +0,0 @@
-// +build !linux,!darwin
-
-package dialer
-
-import (
-	"errors"
-	"net"
-	"syscall"
-)
-
-func bindToInterface(_ *net.Interface) controlFunc {
-	return func(string, string, syscall.RawConn) error {
-		return errors.New("unsupported platform")
-	}
-}

component/dialer/control.go

@@ -1,37 +0,0 @@
-package dialer
-
-import (
-	"errors"
-	"net"
-	"syscall"
-)
-
-type controlFunc func(string, string, syscall.RawConn) error
-
-var (
-	_controlPool = make([]controlFunc, 0, 2)
-)
-
-func addControl(f controlFunc) {
-	_controlPool = append(_controlPool, f)
-}
-
-func setControl(i interface{}) {
-	control := func(address, network string, c syscall.RawConn) error {
-		for _, f := range _controlPool {
-			if err := f(address, network, c); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-
-	switch v := i.(type) {
-	case *net.Dialer:
-		v.Control = control
-	case *net.ListenConfig:
-		v.Control = control
-	default:
-		panic(errors.New("wrong type"))
-	}
-}

component/dialer/dialer.go

@@ -1,22 +0,0 @@
-package dialer
-
-import (
-	"context"
-	"net"
-)
-
-func Dial(network, address string) (net.Conn, error) {
-	return DialContext(context.Background(), network, address)
-}
-
-func DialContext(ctx context.Context, network, address string) (net.Conn, error) {
-	d := &net.Dialer{}
-	setControl(d)
-	return d.DialContext(ctx, network, address)
-}
-
-func ListenPacket(network, address string) (net.PacketConn, error) {
-	lc := &net.ListenConfig{}
-	setControl(lc)
-	return lc.ListenPacket(context.Background(), network, address)
-}

component/dialer/fwmark.go

@@ -1,14 +0,0 @@
-package dialer
-
-import (
-	"sync"
-)
-
-var _setOnce sync.Once
-
-// SetMark sets the mark for each packet sent through this dialer(socket).
-func SetMark(i int) {
-	_setOnce.Do(func() {
-		addControl(setMark(i))
-	})
-}

component/dialer/fwmark_linux.go

@@ -1,15 +0,0 @@
-package dialer
-
-import (
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func setMark(i int) controlFunc {
-	return func(_, _ string, c syscall.RawConn) error {
-		return c.Control(func(fd uintptr) {
-			unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, i)
-		})
-	}
-}

component/dialer/fwmark_others.go

@@ -1,14 +0,0 @@
-// +build !linux
-
-package dialer
-
-import (
-	"errors"
-	"syscall"
-)
-
-func setMark(_ int) controlFunc {
-	return func(string, string, syscall.RawConn) error {
-		return errors.New("fwmark: linux only")
-	}
-}

component/nat/nat.go

@@ -1,31 +0,0 @@
-/*
-Package nat provides simple NAT table implements.
-
-* Normal (Full Cone) NAT
-A full cone NAT is one where all requests from the same internal IP address
-and port are mapped to the same external IP address and port. Furthermore,
-any external host can send a packet to the internal host, by sending a packet
-to the mapped external address.
-
-* Restricted Cone NAT
-A restricted cone NAT is one where all requests from the same internal IP
-address and port are mapped to the same external IP address and port.
-Unlike a full cone NAT, an external host (with IP address X) can send a
-packet to the internal host only if the internal host had previously sent
-a packet to IP address X.
-
-* Port Restricted Cone NAT
-A port restricted cone NAT is like a restricted cone NAT, but the restriction
-includes port numbers. Specifically, an external host can send a packet, with
-source IP address X and source port P, to the internal host only if the internal
-host had previously sent a packet to IP address X and port P.
-
-* Symmetric NAT
-A symmetric NAT is one where all requests from the same internal IP address
-and port, to a specific destination IP address and port, are mapped to the
-same external IP address and port. If the same host sends a packet with the
-same source address and port, but to a different destination, a different mapping
-is used. Furthermore, only the external host that receives a packet can send a
-UDP packet back to the internal host.
-*/
-package nat

component/nat/table.go

@@ -1,35 +0,0 @@
-package nat
-
-import (
-	"net"
-	"sync"
-)
-
-type Table struct {
-	mapping sync.Map
-}
-
-func (t *Table) Set(key string, pc net.PacketConn) {
-	t.mapping.Store(key, pc)
-}
-
-func (t *Table) Get(key string) net.PacketConn {
-	item, exist := t.mapping.Load(key)
-	if !exist {
-		return nil
-	}
-	return item.(net.PacketConn)
-}
-
-func (t *Table) GetOrCreateLock(key string) (*sync.Cond, bool) {
-	item, loaded := t.mapping.LoadOrStore(key, sync.NewCond(&sync.Mutex{}))
-	return item.(*sync.Cond), loaded
-}
-
-func (t *Table) Delete(key string) {
-	t.mapping.Delete(key)
-}
-
-func NewTable() *Table {
-	return &Table{}
-}

constant/metadata.go

@@ -1,89 +0,0 @@
-package constant
-
-import (
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"net"
-	"strconv"
-
-	"github.com/xjasonlyu/tun2socks/transport/socks5"
-)
-
-const (
-	TCP Network = iota
-	UDP
-)
-
-type Network uint8
-
-func (n Network) String() string {
-	switch n {
-	case TCP:
-		return "tcp"
-	case UDP:
-		return "udp"
-	default:
-		return fmt.Sprintf("network(%d)", n)
-	}
-}
-
-func (n Network) MarshalText() ([]byte, error) {
-	return []byte(n.String()), nil
-}
-
-// Metadata implements the net.Addr interface.
-type Metadata struct {
-	Net     Network `json:"network"`
-	SrcIP   net.IP  `json:"sourceIP"`
-	MidIP   net.IP  `json:"dialerIP"`
-	DstIP   net.IP  `json:"destinationIP"`
-	SrcPort uint16  `json:"sourcePort"`
-	MidPort uint16  `json:"dialerPort"`
-	DstPort uint16  `json:"destinationPort"`
-}
-
-func (m *Metadata) DestinationAddress() string {
-	return net.JoinHostPort(m.DstIP.String(), strconv.FormatUint(uint64(m.DstPort), 10))
-}
-
-func (m *Metadata) SourceAddress() string {
-	return net.JoinHostPort(m.SrcIP.String(), strconv.FormatUint(uint64(m.SrcPort), 10))
-}
-
-func (m *Metadata) UDPAddr() *net.UDPAddr {
-	if m.Net != UDP || m.DstIP == nil {
-		return nil
-	}
-	return &net.UDPAddr{
-		IP:   m.DstIP,
-		Port: int(m.DstPort),
-	}
-}
-
-func (m *Metadata) SerializesSocksAddr() socks5.Addr {
-	var (
-		buf  [][]byte
-		port [2]byte
-	)
-	binary.BigEndian.PutUint16(port[:], m.DstPort)
-
-	if m.DstIP.To4() != nil /* IPv4 */ {
-		aType := socks5.AtypIPv4
-		buf = [][]byte{{aType}, m.DstIP.To4(), port[:]}
-	} else /* IPv6 */ {
-		aType := socks5.AtypIPv6
-		buf = [][]byte{{aType}, m.DstIP.To16(), port[:]}
-	}
-	return bytes.Join(buf, nil)
-}
-
-func (m *Metadata) Network() string {
-	return m.Net.String()
-}
-
-// String returns destination address of this metadata.
-// Also for implementing net.Addr interface.
-func (m *Metadata) String() string {
-	return m.DestinationAddress()
-}

constant/version.go

@@ -1,10 +0,0 @@
-package constant
-
-const (
-	Name = "tun2socks"
-)
-
-var (
-	Version   string
-	GitCommit string
-)

core/adapter.go

@@ -1,34 +0,0 @@
-package core
-
-import (
-	"net"
-
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-type TCPConn interface {
-	net.Conn
-	ID() *stack.TransportEndpointID
-}
-
-type UDPPacket interface {
-	// Data get the payload of UDP Packet.
-	Data() []byte
-
-	// Drop call after packet is used, could release resources in this function.
-	Drop()
-
-	// ID returns the transport endpoint id of packet.
-	ID() *stack.TransportEndpointID
-
-	// LocalAddr returns the source IP/Port of packet.
-	LocalAddr() net.Addr
-
-	// RemoteAddr returns the destination IP/Port of packet.
-	RemoteAddr() net.Addr
-
-	// WriteBack writes the payload with source IP/Port equals addr
-	// - variable source IP/Port is important to STUN
-	// - if addr is not provided, WriteBack will write out UDP packet with SourceIP/Port equals to original Target.
-	WriteBack([]byte, net.Addr) (int, error)
-}

core/adapter/adapter.go

@@ -0,0 +1,24 @@
+package adapter
+
+import (
+	"net"
+
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+// TCPConn implements the net.Conn interface.
+type TCPConn interface {
+	net.Conn
+
+	// ID returns the transport endpoint id of TCPConn.
+	ID() *stack.TransportEndpointID
+}
+
+// UDPConn implements net.Conn and net.PacketConn.
+type UDPConn interface {
+	net.Conn
+	net.PacketConn
+
+	// ID returns the transport endpoint id of UDPConn.
+	ID() *stack.TransportEndpointID
+}

core/adapter/handler.go

@@ -0,0 +1,8 @@
+package adapter
+
+// TransportHandler is a TCP/UDP connection handler that implements
+// HandleTCP and HandleUDP methods.
+type TransportHandler interface {
+	HandleTCP(TCPConn)
+	HandleUDP(UDPConn)
+}

core/device/device.go

@@ -9,9 +9,6 @@ import (
 type Device interface {
 	stack.LinkEndpoint
 
-	// Close stops and closes the device.
-	Close() error
-
 	// Name returns the current name of the device.
 	Name() string
 

core/device/fdbased/fd.go

@@ -0,0 +1,3 @@
+package fdbased
+
+const Driver = "fd"

core/device/fdbased/fd_unix.go

@@ -0,0 +1,48 @@
+//go:build unix
+
+package fdbased
+
+import (
+	"fmt"
+	"strconv"
+
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+const defaultMTU = 1500
+
+type FD struct {
+	stack.LinkEndpoint
+
+	fd  int
+	mtu uint32
+}
+
+func Open(name string, mtu uint32, offset int) (device.Device, error) {
+	fd, err := strconv.Atoi(name)
+	if err != nil {
+		return nil, fmt.Errorf("cannot open fd: %s", name)
+	}
+	if mtu == 0 {
+		mtu = defaultMTU
+	}
+	return open(fd, mtu, offset)
+}
+
+func (f *FD) Type() string {
+	return Driver
+}
+
+func (f *FD) Name() string {
+	return strconv.Itoa(f.fd)
+}
+
+func (f *FD) Close() {
+	defer f.LinkEndpoint.Close()
+	_ = unix.Close(f.fd)
+}
+
+var _ device.Device = (*FD)(nil)

core/device/fdbased/fd_windows.go

@@ -0,0 +1,11 @@
+package fdbased
+
+import (
+	"errors"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+func Open(name string, mtu uint32, offset int) (device.Device, error) {
+	return nil, errors.ErrUnsupported
+}

core/device/fdbased/open_linux.go

@@ -0,0 +1,26 @@
+package fdbased
+
+import (
+	"fmt"
+
+	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+func open(fd int, mtu uint32, offset int) (device.Device, error) {
+	f := &FD{fd: fd, mtu: mtu}
+
+	ep, err := fdbased.New(&fdbased.Options{
+		FDs: []int{fd},
+		MTU: mtu,
+		// TUN only, ignore ethernet header.
+		EthernetHeader: false,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	f.LinkEndpoint = ep
+
+	return f, nil
+}

core/device/fdbased/open_unix.go

@@ -0,0 +1,22 @@
+//go:build unix && !linux
+
+package fdbased
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/iobased"
+)
+
+func open(fd int, mtu uint32, offset int) (device.Device, error) {
+	f := &FD{fd: fd, mtu: mtu}
+	ep, err := iobased.New(os.NewFile(uintptr(fd), f.Name()), mtu, offset)
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	f.LinkEndpoint = ep
+
+	return f, nil
+}

core/device/iobased/endpoint.go

@@ -0,0 +1,153 @@
+// Package iobased provides the implementation of io.ReadWriter
+// based data-link layer endpoints.
+package iobased
+
+import (
+	"context"
+	"errors"
+	"io"
+	"sync"
+
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/link/channel"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+const (
+	// Queue length for outbound packet, arriving for read. Overflow
+	// causes packet drops.
+	defaultOutQueueLen = 1 << 10
+)
+
+// Endpoint implements the interface of stack.LinkEndpoint from io.ReadWriter.
+type Endpoint struct {
+	*channel.Endpoint
+
+	// rw is the io.ReadWriter for reading and writing packets.
+	rw io.ReadWriter
+
+	// mtu (maximum transmission unit) is the maximum size of a packet.
+	mtu uint32
+
+	// offset can be useful when perform TUN device I/O with TUN_PI enabled.
+	offset int
+
+	// once is used to perform the init action once when attaching.
+	once sync.Once
+
+	// wg keeps track of running goroutines.
+	wg sync.WaitGroup
+}
+
+// New returns stack.LinkEndpoint(.*Endpoint) and error.
+func New(rw io.ReadWriter, mtu uint32, offset int) (*Endpoint, error) {
+	if mtu == 0 {
+		return nil, errors.New("MTU size is zero")
+	}
+
+	if rw == nil {
+		return nil, errors.New("RW interface is nil")
+	}
+
+	if offset < 0 {
+		return nil, errors.New("offset must be non-negative")
+	}
+
+	return &Endpoint{
+		Endpoint: channel.New(defaultOutQueueLen, mtu, ""),
+		rw:       rw,
+		mtu:      mtu,
+		offset:   offset,
+	}, nil
+}
+
+// Attach launches the goroutine that reads packets from io.Reader and
+// dispatches them via the provided dispatcher.
+func (e *Endpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	e.Endpoint.Attach(dispatcher)
+	e.once.Do(func() {
+		ctx, cancel := context.WithCancel(context.Background())
+		e.wg.Add(2)
+		go func() {
+			e.outboundLoop(ctx)
+			e.wg.Done()
+		}()
+		go func() {
+			e.dispatchLoop(cancel)
+			e.wg.Done()
+		}()
+	})
+}
+
+func (e *Endpoint) Wait() {
+	e.wg.Wait()
+}
+
+// dispatchLoop dispatches packets to upper layer.
+func (e *Endpoint) dispatchLoop(cancel context.CancelFunc) {
+	// Call cancel() to ensure (*Endpoint).outboundLoop(context.Context) exits
+	// gracefully after (*Endpoint).dispatchLoop(context.CancelFunc) returns.
+	defer cancel()
+
+	offset, mtu := e.offset, int(e.mtu)
+
+	for {
+		data := make([]byte, offset+mtu)
+
+		n, err := e.rw.Read(data)
+		if err != nil {
+			break
+		}
+
+		if n == 0 || n > mtu {
+			continue
+		}
+
+		if !e.IsAttached() {
+			continue /* unattached, drop packet */
+		}
+
+		pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
+			Payload: buffer.MakeWithData(data[offset : offset+n]),
+		})
+
+		switch header.IPVersion(data[offset:]) {
+		case header.IPv4Version:
+			e.InjectInbound(header.IPv4ProtocolNumber, pkt)
+		case header.IPv6Version:
+			e.InjectInbound(header.IPv6ProtocolNumber, pkt)
+		}
+		pkt.DecRef()
+	}
+}
+
+// outboundLoop reads outbound packets from channel, and then it calls
+// writePacket to send those packets back to lower layer.
+func (e *Endpoint) outboundLoop(ctx context.Context) {
+	for {
+		pkt := e.ReadContext(ctx)
+		if pkt == nil {
+			break
+		}
+		e.writePacket(pkt)
+	}
+}
+
+// writePacket writes outbound packets to the io.Writer.
+func (e *Endpoint) writePacket(pkt *stack.PacketBuffer) tcpip.Error {
+	defer pkt.DecRef()
+
+	buf := pkt.ToBuffer()
+	defer buf.Release()
+	if e.offset != 0 {
+		v := buffer.NewViewWithData(make([]byte, e.offset))
+		_ = buf.Prepend(v)
+	}
+
+	if _, err := e.rw.Write(buf.Flatten()); err != nil {
+		return &tcpip.ErrInvalidEndpointState{}
+	}
+	return nil
+}

core/device/rwbased/endpoint.go

@@ -1,140 +0,0 @@
-// Package rwbased provides the implementation of io.ReadWriter
-// based data-link layer endpoints.
-package rwbased
-
-import (
-	"errors"
-	"io"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/buffer"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-var _ stack.LinkEndpoint = (*Endpoint)(nil)
-
-// Endpoint implements the interface of stack.LinkEndpoint from io.ReadWriter.
-type Endpoint struct {
-	// rw is the io.ReadWriter for reading and writing packets.
-	rw io.ReadWriter
-
-	// mtu (maximum transmission unit) is the maximum size of a packet.
-	mtu uint32
-
-	dispatcher stack.NetworkDispatcher
-}
-
-// New returns stack.LinkEndpoint(.*Endpoint) and error.
-func New(rw io.ReadWriter, mtu uint32) (*Endpoint, error) {
-	if mtu == 0 {
-		return nil, errors.New("MTU size is zero")
-	}
-
-	if rw == nil {
-		return nil, errors.New("RW interface is nil")
-	}
-
-	return &Endpoint{
-		rw:  rw,
-		mtu: mtu,
-	}, nil
-}
-
-// Attach launches the goroutine that reads packets from io.ReadWriter and
-// dispatches them via the provided dispatcher.
-func (e *Endpoint) Attach(dispatcher stack.NetworkDispatcher) {
-	go e.dispatchLoop()
-	e.dispatcher = dispatcher
-}
-
-// IsAttached implements stack.LinkEndpoint.IsAttached.
-func (e *Endpoint) IsAttached() bool {
-	return e.dispatcher != nil
-}
-
-// dispatchLoop dispatches packets to upper layer.
-func (e *Endpoint) dispatchLoop() {
-	for {
-		packet := make([]byte, e.mtu)
-
-		n, err := e.rw.Read(packet)
-		if err != nil {
-			break
-		}
-
-		if !e.IsAttached() {
-			continue
-		}
-
-		pkb := stack.NewPacketBuffer(stack.PacketBufferOptions{
-			Data: buffer.NewVectorisedView(n, []buffer.View{buffer.NewViewFromBytes(packet)}),
-		})
-
-		switch header.IPVersion(packet) {
-		case header.IPv4Version:
-			e.dispatcher.DeliverNetworkPacket("", "", header.IPv4ProtocolNumber, pkb)
-		case header.IPv6Version:
-			e.dispatcher.DeliverNetworkPacket("", "", header.IPv6ProtocolNumber, pkb)
-		}
-	}
-}
-
-func (e *Endpoint) writePacket(pkt *stack.PacketBuffer) tcpip.Error {
-	vView := buffer.NewVectorisedView(pkt.Size(), pkt.Views())
-
-	if _, err := e.rw.Write(vView.ToView()); err != nil {
-		return &tcpip.ErrInvalidEndpointState{}
-	}
-	return nil
-}
-
-// WritePacket writes packet back into io.ReadWriter.
-func (e *Endpoint) WritePacket(_ stack.RouteInfo, _ tcpip.NetworkProtocolNumber, pkt *stack.PacketBuffer) tcpip.Error {
-	return e.writePacket(pkt)
-}
-
-// WritePackets writes packets back into io.ReadWriter.
-func (e *Endpoint) WritePackets(_ stack.RouteInfo, pkts stack.PacketBufferList, _ tcpip.NetworkProtocolNumber) (int, tcpip.Error) {
-	n := 0
-	for pkt := pkts.Front(); pkt != nil; pkt = pkt.Next() {
-		if err := e.writePacket(pkt); err != nil {
-			break
-		}
-		n++
-	}
-	return n, nil
-}
-
-// MTU implements stack.LinkEndpoint.MTU.
-func (e *Endpoint) MTU() uint32 {
-	return e.mtu
-}
-
-// Capabilities implements stack.LinkEndpoint.Capabilities.
-func (e *Endpoint) Capabilities() stack.LinkEndpointCapabilities {
-	return stack.CapabilityNone
-}
-
-// MaxHeaderLength returns the maximum size of the link layer header. Given it
-// doesn't have a header, it just returns 0.
-func (*Endpoint) MaxHeaderLength() uint16 {
-	return 0
-}
-
-// LinkAddress returns the link address of this endpoint.
-func (*Endpoint) LinkAddress() tcpip.LinkAddress {
-	return ""
-}
-
-// ARPHardwareType implements stack.LinkEndpoint.ARPHardwareType.
-func (*Endpoint) ARPHardwareType() header.ARPHardwareType {
-	return header.ARPHardwareNone
-}
-
-// AddHeader implements stack.LinkEndpoint.AddHeader.
-func (e *Endpoint) AddHeader(tcpip.LinkAddress, tcpip.LinkAddress, tcpip.NetworkProtocolNumber, *stack.PacketBuffer) {
-}
-
-// Wait implements stack.LinkEndpoint.Wait.
-func (e *Endpoint) Wait() {}

core/device/tun/io_unix.go

@@ -1,33 +0,0 @@
-// +build darwin freebsd openbsd
-
-package tun
-
-import (
-	"github.com/xjasonlyu/tun2socks/common/pool"
-)
-
-const (
-	offset = 4 /* 4 bytes TUN_PI */
-
-	defaultMTU = 1500
-)
-
-func (t *TUN) Read(packet []byte) (n int, err error) {
-	buf := pool.Get(offset + len(packet))
-	defer pool.Put(buf)
-
-	if n, err = t.nt.Read(buf, offset); err != nil {
-		return
-	}
-
-	copy(packet, buf[offset:offset+n])
-	return
-}
-
-func (t *TUN) Write(packet []byte) (int, error) {
-	buf := pool.Get(offset + len(packet))
-	defer pool.Put(buf)
-
-	copy(buf[offset:], packet)
-	return t.nt.Write(buf[:offset+len(packet)], offset)
-}

core/device/tun/io_windows.go

@@ -1,15 +0,0 @@
-package tun
-
-const (
-	offset = 0
-
-	defaultMTU = 0 /* auto */
-)
-
-func (t *TUN) Read(packet []byte) (int, error) {
-	return t.nt.Read(packet, offset)
-}
-
-func (t *TUN) Write(packet []byte) (int, error) {
-	return t.nt.Write(packet, offset)
-}

core/device/tun/opts.go

@@ -1,15 +0,0 @@
-package tun
-
-type Option func(*TUN)
-
-func WithName(name string) Option {
-	return func(t *TUN) {
-		t.name = name
-	}
-}
-
-func WithMTU(mtu uint32) Option {
-	return func(t *TUN) {
-		t.mtu = mtu
-	}
-}

core/device/tun/tun.go

@@ -2,7 +2,7 @@
 package tun
 
 import (
-	"github.com/xjasonlyu/tun2socks/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
 )
 
 const Driver = "tun"

core/device/tun/tun_netstack.go

@@ -1,18 +1,17 @@
-// +build linux
+//go:build linux
 
 package tun
 
 import (
 	"fmt"
-	"unsafe"
-
-	"github.com/xjasonlyu/tun2socks/core/device"
 
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/rawfile"
 	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
-	"gvisor.dev/gvisor/pkg/tcpip/link/rawfile"
 	"gvisor.dev/gvisor/pkg/tcpip/link/tun"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
 )
 
 type TUN struct {
@@ -23,12 +22,8 @@ type TUN struct {
 	name string
 }
 
-func Open(opts ...Option) (device.Device, error) {
-	t := &TUN{}
-
-	for _, opt := range opts {
-		opt(t)
-	}
+func Open(name string, mtu uint32) (device.Device, error) {
+	t := &TUN{name: name, mtu: mtu}
 
 	if len(t.name) >= unix.IFNAMSIZ {
 		return nil, fmt.Errorf("interface name too long: %s", t.name)
@@ -46,17 +41,28 @@ func Open(opts ...Option) (device.Device, error) {
 		}
 	}
 
-	mtu, err := rawfile.GetMTU(t.name)
+	_mtu, err := rawfile.GetMTU(t.name)
 	if err != nil {
 		return nil, fmt.Errorf("get mtu: %w", err)
 	}
-	t.mtu = mtu
+	t.mtu = _mtu
 
 	ep, err := fdbased.New(&fdbased.Options{
-		MTU: t.mtu,
 		FDs: []int{fd},
-		// TUN only
+		MTU: t.mtu,
+		// TUN only, ignore ethernet header.
 		EthernetHeader: false,
+		// SYS_READV support only for TUN fd.
+		PacketDispatchMode: fdbased.Readv,
+		// TAP/TUN fd's are not sockets and using the WritePackets calls results
+		// in errors as it always defaults to using SendMMsg which is not supported
+		// for tap/tun device fds.
+		//
+		// This CL changes WritePackets to gracefully degrade to using writev instead
+		// of sendmmsg if the underlying fd is not a socket.
+		//
+		// Fixed: https://github.com/google/gvisor/commit/f33d034fecd7723a1e560ccc62aeeba328454fd0
+		MaxSyscallHeaderBytes: 0x00,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("create endpoint: %w", err)
@@ -70,8 +76,9 @@ func (t *TUN) Name() string {
 	return t.name
 }
 
-func (t *TUN) Close() error {
-	return unix.Close(t.fd)
+func (t *TUN) Close() {
+	defer t.LinkEndpoint.Close()
+	_ = unix.Close(t.fd)
 }
 
 func setMTU(name string, n uint32) error {
@@ -87,22 +94,10 @@ func setMTU(name string, n uint32) error {
 
 	defer unix.Close(fd)
 
-	const ifReqSize = unix.IFNAMSIZ + 64
-
-	// do ioctl call
-	var ifr [ifReqSize]byte
-	copy(ifr[:], name)
-	*(*uint32)(unsafe.Pointer(&ifr[unix.IFNAMSIZ])) = n
-	_, _, errno := unix.Syscall(
-		unix.SYS_IOCTL,
-		uintptr(fd),
-		uintptr(unix.SIOCSIFMTU),
-		uintptr(unsafe.Pointer(&ifr[0])),
-	)
-
-	if errno != 0 {
-		return fmt.Errorf("failed to set MTU: %w", errno)
+	ifr, err := unix.NewIfreq(name)
+	if err != nil {
+		return err
 	}
-
-	return nil
+	ifr.SetUint32(n)
+	return unix.IoctlIfreq(fd, unix.SIOCSIFMTU, ifr)
 }

core/device/tun/tun_wireguard.go

@@ -1,29 +1,46 @@
-// +build !linux
+//go:build !linux
 
 package tun
 
 import (
 	"fmt"
-
-	"github.com/xjasonlyu/tun2socks/core/device"
-	"github.com/xjasonlyu/tun2socks/core/device/rwbased"
+	"sync"
 
 	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/iobased"
 )
 
 type TUN struct {
-	*rwbased.Endpoint
+	*iobased.Endpoint
 
-	nt   *tun.NativeTun
-	mtu  uint32
-	name string
+	nt     *tun.NativeTun
+	mtu    uint32
+	name   string
+	offset int
+
+	rSizes []int
+	rBuffs [][]byte
+	wBuffs [][]byte
+	rMutex sync.Mutex
+	wMutex sync.Mutex
 }
 
-func Open(opts ...Option) (device.Device, error) {
-	t := &TUN{}
+func Open(name string, mtu uint32) (_ device.Device, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("open tun: %v", r)
+		}
+	}()
 
-	for _, opt := range opts {
-		opt(t)
+	t := &TUN{
+		name:   name,
+		mtu:    mtu,
+		offset: offset,
+		rSizes: make([]int, 1),
+		rBuffs: make([][]byte, 1),
+		wBuffs: make([][]byte, 1),
 	}
 
 	forcedMTU := defaultMTU
@@ -31,19 +48,19 @@ func Open(opts ...Option) (device.Device, error) {
 		forcedMTU = int(t.mtu)
 	}
 
-	nt, err := tun.CreateTUN(t.name, forcedMTU)
+	nt, err := createTUN(t.name, forcedMTU)
 	if err != nil {
 		return nil, fmt.Errorf("create tun: %w", err)
 	}
 	t.nt = nt.(*tun.NativeTun)
 
-	mtu, err := nt.MTU()
+	tunMTU, err := nt.MTU()
 	if err != nil {
 		return nil, fmt.Errorf("get mtu: %w", err)
 	}
-	t.mtu = uint32(mtu)
+	t.mtu = uint32(tunMTU)
 
-	ep, err := rwbased.New(t, t.mtu)
+	ep, err := iobased.New(t, t.mtu, offset)
 	if err != nil {
 		return nil, fmt.Errorf("create endpoint: %w", err)
 	}
@@ -52,11 +69,27 @@ func Open(opts ...Option) (device.Device, error) {
 	return t, nil
 }
 
+func (t *TUN) Read(packet []byte) (int, error) {
+	t.rMutex.Lock()
+	defer t.rMutex.Unlock()
+	t.rBuffs[0] = packet
+	_, err := t.nt.Read(t.rBuffs, t.rSizes, t.offset)
+	return t.rSizes[0], err
+}
+
+func (t *TUN) Write(packet []byte) (int, error) {
+	t.wMutex.Lock()
+	defer t.wMutex.Unlock()
+	t.wBuffs[0] = packet
+	return t.nt.Write(t.wBuffs, t.offset)
+}
+
 func (t *TUN) Name() string {
 	name, _ := t.nt.Name()
 	return name
 }
 
-func (t *TUN) Close() error {
-	return t.nt.Close()
+func (t *TUN) Close() {
+	defer t.Endpoint.Close()
+	_ = t.nt.Close()
 }

core/device/tun/tun_wireguard_unix.go

@@ -0,0 +1,16 @@
+//go:build unix && !linux
+
+package tun
+
+import (
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+const (
+	offset     = 4 /* 4 bytes TUN_PI */
+	defaultMTU = 1500
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	return tun.CreateTUN(name, mtu)
+}

core/device/tun/tun_wireguard_windows.go

@@ -0,0 +1,14 @@
+package tun
+
+import (
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+const (
+	offset     = 0
+	defaultMTU = 0 /* auto */
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	return tun.CreateTUN(name, mtu)
+}

core/handler.go

@@ -1,6 +0,0 @@
-package core
-
-type Handler interface {
-	Add(TCPConn)
-	AddPacket(UDPPacket)
-}

core/nic.go

@@ -0,0 +1,119 @@
+package core
+
+import (
+	"fmt"
+	"net/netip"
+
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+const (
+	// nicPromiscuousModeEnabled is the value used by stack to enable
+	// or disable NIC's promiscuous mode.
+	nicPromiscuousModeEnabled = true
+
+	// nicSpoofingEnabled is the value used by stack to enable or disable
+	// NIC's spoofing.
+	nicSpoofingEnabled = true
+)
+
+// withCreatingNIC creates NIC for stack.
+func withCreatingNIC(nicID tcpip.NICID, ep stack.LinkEndpoint) option.Option {
+	return func(s *stack.Stack) error {
+		if err := s.CreateNICWithOptions(nicID, ep,
+			stack.NICOptions{
+				Disabled: false,
+				// If no queueing discipline was specified
+				// provide a stub implementation that just
+				// delegates to the lower link endpoint.
+				QDisc: nil,
+			}); err != nil {
+			return fmt.Errorf("create NIC: %s", err)
+		}
+		return nil
+	}
+}
+
+// withPromiscuousMode sets promiscuous mode in the given NICs.
+func withPromiscuousMode(nicID tcpip.NICID, v bool) option.Option {
+	return func(s *stack.Stack) error {
+		if err := s.SetPromiscuousMode(nicID, v); err != nil {
+			return fmt.Errorf("set promiscuous mode: %s", err)
+		}
+		return nil
+	}
+}
+
+// withSpoofing sets address spoofing in the given NICs, allowing
+// endpoints to bind to any address in the NIC.
+func withSpoofing(nicID tcpip.NICID, v bool) option.Option {
+	return func(s *stack.Stack) error {
+		if err := s.SetSpoofing(nicID, v); err != nil {
+			return fmt.Errorf("set spoofing: %s", err)
+		}
+		return nil
+	}
+}
+
+// withMulticastGroups adds a NIC to the given multicast groups.
+func withMulticastGroups(nicID tcpip.NICID, multicastGroups []netip.Addr) option.Option {
+	return func(s *stack.Stack) error {
+		if len(multicastGroups) == 0 {
+			return nil
+		}
+		// The default NIC of tun2socks is working on Spoofing mode. When the UDP Endpoint
+		// tries to use a non-local address to connect, the network stack will
+		// generate a temporary addressState to build the route, which can be primary
+		// but is ephemeral. Nevertheless, when the UDP Endpoint tries to use a
+		// multicast address to connect, the network stack will select an available
+		// primary addressState to build the route. However, when tun2socks is in the
+		// just-initialized or idle state, there will be no available primary addressState,
+		// and the connect operation will fail. Therefore, we need to add permanent addresses,
+		// e.g. 10.0.0.1/8 and fd00:1/8, to the default NIC, which are only used to build
+		// routes for multicast response and do not affect other connections.
+		//
+		// In fact, for multicast, the sender normally does not expect a response.
+		// So, the ep.net.Connect is unnecessary. If we implement a custom UDP Forwarder
+		// and ForwarderRequest in the future, we can remove these code.
+		s.AddProtocolAddress(
+			nicID,
+			tcpip.ProtocolAddress{
+				Protocol: ipv4.ProtocolNumber,
+				AddressWithPrefix: tcpip.AddressWithPrefix{
+					Address:   tcpip.AddrFrom4([4]byte{0x0a, 0, 0, 0x01}),
+					PrefixLen: 8,
+				},
+			},
+			stack.AddressProperties{PEB: stack.CanBePrimaryEndpoint},
+		)
+		s.AddProtocolAddress(
+			nicID,
+			tcpip.ProtocolAddress{
+				Protocol: ipv6.ProtocolNumber,
+				AddressWithPrefix: tcpip.AddressWithPrefix{
+					Address:   tcpip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x01}),
+					PrefixLen: 8,
+				},
+			},
+			stack.AddressProperties{PEB: stack.CanBePrimaryEndpoint},
+		)
+		for _, multicastGroup := range multicastGroups {
+			var err tcpip.Error
+			switch {
+			case multicastGroup.Is4():
+				err = s.JoinGroup(ipv4.ProtocolNumber, nicID, tcpip.AddrFrom4(multicastGroup.As4()))
+			case multicastGroup.Is6():
+				err = s.JoinGroup(ipv6.ProtocolNumber, nicID, tcpip.AddrFrom16(multicastGroup.As16()))
+			}
+			if err != nil {
+				return fmt.Errorf("join multicast group: %s", err)
+			}
+		}
+		return nil
+	}
+}

core/option/option.go

@@ -1,4 +1,4 @@
-package stack
+package option
 
 import (
 	"fmt"
@@ -7,23 +7,18 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 )
 
 const (
-	// maxBufferSize is the maximum permitted size of a send/receive buffer.
-	maxBufferSize = 4 << 20 // 4 MiB
-
-	// minBufferSize is the smallest size of a receive or send buffer.
-	minBufferSize = 4 << 10 // 4 KiB
-
-	// defaultBufferSize is the default size of the send/recv buffer for
-	// a transport endpoint.
-	defaultBufferSize = 212 << 10 // 212 KiB
-
 	// defaultTimeToLive specifies the default TTL used by stack.
 	defaultTimeToLive uint8 = 64
 
+	// ipForwardingEnabled is the value used by stack to enable packet
+	// forwarding between NICs.
+	ipForwardingEnabled = true
+
 	// icmpBurst is the default number of ICMP messages that can be sent in
 	// a single burst.
 	icmpBurst = 50
@@ -32,10 +27,6 @@ const (
 	// by this rate limiter.
 	icmpLimit rate.Limit = 1000
 
-	// ipForwardingEnabled is the value used by stack to enable packet
-	// forwarding between NICs.
-	ipForwardingEnabled = true
-
 	// tcpCongestionControl is the congestion control algorithm used by
 	// stack. ccReno is the default option in gVisor stack.
 	tcpCongestionControlAlgorithm = "reno" // "reno" or "cubic"
@@ -46,18 +37,35 @@ const (
 
 	// tcpModerateReceiveBufferEnabled is the value used by stack to
 	// enable or disable tcp receive buffer auto-tuning option.
-	tcpModerateReceiveBufferEnabled = true
+	tcpModerateReceiveBufferEnabled = false
 
 	// tcpSACKEnabled is the value used by stack to enable or disable
 	// tcp selective ACK.
 	tcpSACKEnabled = true
+
+	// tcpRecovery is the loss detection algorithm used by TCP.
+	tcpRecovery = tcpip.TCPRACKLossDetection
+
+	// tcpMinBufferSize is the smallest size of a send/recv buffer.
+	tcpMinBufferSize = tcp.MinBufferSize
+
+	// tcpMaxBufferSize is the maximum permitted size of a send/recv buffer.
+	tcpMaxBufferSize = tcp.MaxBufferSize
+
+	// tcpDefaultBufferSize is the default size of the send buffer for
+	// a transport endpoint.
+	tcpDefaultSendBufferSize = tcp.DefaultSendBufferSize
+
+	// tcpDefaultReceiveBufferSize is the default size of the receive buffer
+	// for a transport endpoint.
+	tcpDefaultReceiveBufferSize = tcp.DefaultReceiveBufferSize
 )
 
-type Option func(*Stack) error
+type Option func(*stack.Stack) error
 
 // WithDefault sets all default values for stack.
 func WithDefault() Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opts := []Option{
 			WithDefaultTTL(defaultTimeToLive),
 			WithForwarding(ipForwardingEnabled),
@@ -69,8 +77,9 @@ func WithDefault() Option {
 			// Too large buffers thrash cache, so there is little point
 			// in too large buffers.
 			//
-			// Ref: https://github.com/majek/slirpnetstack/blob/master/stack.go
-			WithTCPBufferSizeRange(minBufferSize, defaultBufferSize, maxBufferSize),
+			// Ref: https://github.com/cloudflare/slirpnetstack/blob/master/stack.go
+			WithTCPSendBufferSizeRange(tcpMinBufferSize, tcpDefaultSendBufferSize, tcpMaxBufferSize),
+			WithTCPReceiveBufferSizeRange(tcpMinBufferSize, tcpDefaultReceiveBufferSize, tcpMaxBufferSize),
 
 			WithTCPCongestionControl(tcpCongestionControlAlgorithm),
 			WithTCPDelay(tcpDelayEnabled),
@@ -82,6 +91,17 @@ func WithDefault() Option {
 			// TCP selective ACK Option, see:
 			// https://tools.ietf.org/html/rfc2018
 			WithTCPSACKEnabled(tcpSACKEnabled),
+
+			// TCPRACKLossDetection: indicates RACK is used for loss detection and
+			// recovery.
+			//
+			// TCPRACKStaticReoWnd: indicates the reordering window should not be
+			// adjusted when DSACK is received.
+			//
+			// TCPRACKNoDupTh: indicates RACK should not consider the classic three
+			// duplicate acknowledgements rule to mark the segments as lost. This
+			// is used when reordering is not detected.
+			WithTCPRecovery(tcpRecovery),
 		}
 
 		for _, opt := range opts {
@@ -96,7 +116,7 @@ func WithDefault() Option {
 
 // WithDefaultTTL sets the default TTL used by stack.
 func WithDefaultTTL(ttl uint8) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.DefaultTTLOption(ttl)
 		if err := s.SetNetworkProtocolOption(ipv4.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set ipv4 default TTL: %s", err)
@@ -110,7 +130,7 @@ func WithDefaultTTL(ttl uint8) Option {
 
 // WithForwarding sets packet forwarding between NICs for IPv4 & IPv6.
 func WithForwarding(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		if err := s.SetForwardingDefaultAndAllNICs(ipv4.ProtocolNumber, v); err != nil {
 			return fmt.Errorf("set ipv4 forwarding: %s", err)
 		}
@@ -124,7 +144,7 @@ func WithForwarding(v bool) Option {
 // WithICMPBurst sets the number of ICMP messages that can be sent
 // in a single burst.
 func WithICMPBurst(burst int) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		s.SetICMPBurst(burst)
 		return nil
 	}
@@ -133,19 +153,26 @@ func WithICMPBurst(burst int) Option {
 // WithICMPLimit sets the maximum number of ICMP messages permitted
 // by rate limiter.
 func WithICMPLimit(limit rate.Limit) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		s.SetICMPLimit(limit)
 		return nil
 	}
 }
 
-// WithTCPBufferSizeRange sets the receive and send buffer size range for TCP.
-func WithTCPBufferSizeRange(a, b, c int) Option {
-	return func(s *Stack) error {
-		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: a, Default: b, Max: c}
-		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
-			return fmt.Errorf("set TCP receive buffer size range: %s", err)
+// WithTCPSendBufferSize sets default the send buffer size for TCP.
+func WithTCPSendBufferSize(size int) Option {
+	return func(s *stack.Stack) error {
+		sndOpt := tcpip.TCPSendBufferSizeRangeOption{Min: tcpMinBufferSize, Default: size, Max: tcpMaxBufferSize}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &sndOpt); err != nil {
+			return fmt.Errorf("set TCP send buffer size range: %s", err)
 		}
+		return nil
+	}
+}
+
+// WithTCPSendBufferSizeRange sets the send buffer size range for TCP.
+func WithTCPSendBufferSizeRange(a, b, c int) Option {
+	return func(s *stack.Stack) error {
 		sndOpt := tcpip.TCPSendBufferSizeRangeOption{Min: a, Default: b, Max: c}
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &sndOpt); err != nil {
 			return fmt.Errorf("set TCP send buffer size range: %s", err)
@@ -154,9 +181,31 @@ func WithTCPBufferSizeRange(a, b, c int) Option {
 	}
 }
 
+// WithTCPReceiveBufferSize sets the default receive buffer size for TCP.
+func WithTCPReceiveBufferSize(size int) Option {
+	return func(s *stack.Stack) error {
+		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: tcpMinBufferSize, Default: size, Max: tcpMaxBufferSize}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
+			return fmt.Errorf("set TCP receive buffer size range: %s", err)
+		}
+		return nil
+	}
+}
+
+// WithTCPReceiveBufferSizeRange sets the receive buffer size range for TCP.
+func WithTCPReceiveBufferSizeRange(a, b, c int) Option {
+	return func(s *stack.Stack) error {
+		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: a, Default: b, Max: c}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
+			return fmt.Errorf("set TCP receive buffer size range: %s", err)
+		}
+		return nil
+	}
+}
+
 // WithTCPCongestionControl sets the current congestion control algorithm.
 func WithTCPCongestionControl(cc string) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.CongestionControlOption(cc)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP congestion control algorithm: %s", err)
@@ -167,7 +216,7 @@ func WithTCPCongestionControl(cc string) Option {
 
 // WithTCPDelay enables or disables Nagle's algorithm in TCP.
 func WithTCPDelay(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.TCPDelayEnabled(v)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP delay: %s", err)
@@ -178,7 +227,7 @@ func WithTCPDelay(v bool) Option {
 
 // WithTCPModerateReceiveBuffer sets receive buffer moderation for TCP.
 func WithTCPModerateReceiveBuffer(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.TCPModerateReceiveBufferOption(v)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP moderate receive buffer: %s", err)
@@ -189,7 +238,7 @@ func WithTCPModerateReceiveBuffer(v bool) Option {
 
 // WithTCPSACKEnabled sets the SACK option for TCP.
 func WithTCPSACKEnabled(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.TCPSACKEnabled(v)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP SACK: %s", err)
@@ -197,3 +246,13 @@ func WithTCPSACKEnabled(v bool) Option {
 		return nil
 	}
 }
+
+// WithTCPRecovery sets the recovery option for TCP.
+func WithTCPRecovery(v tcpip.TCPRecovery) Option {
+	return func(s *stack.Stack) error {
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &v); err != nil {
+			return fmt.Errorf("set TCP Recovery: %s", err)
+		}
+		return nil
+	}
+}

core/route.go

@@ -1,22 +1,23 @@
-package stack
+package core
 
 import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
 )
 
-func withICMPHandler() Option {
-	return func(s *Stack) error {
-		// Add default route table for IPv4 and IPv6.
-		// This will handle all incoming ICMP packets.
+func withRouteTable(nicID tcpip.NICID) option.Option {
+	return func(s *stack.Stack) error {
 		s.SetRouteTable([]tcpip.Route{
 			{
 				Destination: header.IPv4EmptySubnet,
-				NIC:         s.nicID,
+				NIC:         nicID,
 			},
 			{
 				Destination: header.IPv6EmptySubnet,
-				NIC:         s.nicID,
+				NIC:         nicID,
 			},
 		})
 		return nil

core/stack.go

@@ -0,0 +1,107 @@
+package core
+
+import (
+	"net/netip"
+
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+// Config is the configuration to create *stack.Stack.
+type Config struct {
+	// LinkEndpoints is the interface implemented by
+	// data link layer protocols.
+	LinkEndpoint stack.LinkEndpoint
+
+	// TransportHandler is the handler used by internal
+	// stack to set transport handlers.
+	TransportHandler adapter.TransportHandler
+
+	// MulticastGroups is used by internal stack to add
+	// nic to given groups.
+	MulticastGroups []netip.Addr
+
+	// Options are supplement options to apply settings
+	// for the internal stack.
+	Options []option.Option
+}
+
+// CreateStack creates *stack.Stack with given config.
+func CreateStack(cfg *Config) (*stack.Stack, error) {
+	opts := []option.Option{option.WithDefault()}
+	if len(opts) > 0 {
+		opts = append(opts, cfg.Options...)
+	}
+
+	s := stack.New(stack.Options{
+		NetworkProtocols: []stack.NetworkProtocolFactory{
+			ipv4.NewProtocol,
+			ipv6.NewProtocol,
+		},
+		TransportProtocols: []stack.TransportProtocolFactory{
+			tcp.NewProtocol,
+			udp.NewProtocol,
+			icmp.NewProtocol4,
+			icmp.NewProtocol6,
+		},
+	})
+
+	// Generate unique NIC id.
+	nicID := s.NextNICID()
+
+	opts = append(opts,
+		// Important: We must initiate transport protocol handlers
+		// before creating NIC, otherwise NIC would dispatch packets
+		// to stack and cause race condition.
+		// Initiate transport protocol (TCP/UDP) with given handler.
+		withTCPHandler(cfg.TransportHandler.HandleTCP),
+		withUDPHandler(cfg.TransportHandler.HandleUDP),
+
+		// Create stack NIC and then bind link endpoint to it.
+		withCreatingNIC(nicID, cfg.LinkEndpoint),
+
+		// In the past we did s.AddAddressRange to assign 0.0.0.0/0
+		// onto the interface. We need that to be able to terminate
+		// all the incoming connections - to any ip. AddressRange API
+		// has been removed and the suggested workaround is to use
+		// Promiscuous mode. https://github.com/google/gvisor/issues/3876
+		//
+		// Ref: https://github.com/cloudflare/slirpnetstack/blob/master/stack.go
+		withPromiscuousMode(nicID, nicPromiscuousModeEnabled),
+
+		// Enable spoofing if a stack may send packets from unowned
+		// addresses. This change required changes to some netgophers
+		// since previously, promiscuous mode was enough to let the
+		// netstack respond to all incoming packets regardless of the
+		// packet's destination address. Now that a stack.Route is not
+		// held for each incoming packet, finding a route may fail with
+		// local addresses we don't own but accepted packets for while
+		// in promiscuous mode. Since we also want to be able to send
+		// from any address (in response the received promiscuous mode
+		// packets), we need to enable spoofing.
+		//
+		// Ref: https://github.com/google/gvisor/commit/8c0701462a84ff77e602f1626aec49479c308127
+		withSpoofing(nicID, nicSpoofingEnabled),
+
+		// Add default route table for IPv4 and IPv6. This will handle
+		// all incoming ICMP packets.
+		withRouteTable(nicID),
+
+		// Add default NIC to the given multicast groups.
+		withMulticastGroups(nicID, cfg.MulticastGroups),
+	)
+
+	for _, opt := range opts {
+		if err := opt(s); err != nil {
+			return nil, err
+		}
+	}
+	return s, nil
+}

core/stack/nic.go

@@ -1,52 +0,0 @@
-package stack
-
-import (
-	"fmt"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-const (
-	// defaultNICID is the ID of default NIC used by DefaultStack.
-	defaultNICID tcpip.NICID = 0x01
-
-	// nicPromiscuousModeEnabled is the value used by stack to enable
-	// or disable NIC's promiscuous mode.
-	nicPromiscuousModeEnabled = true
-
-	// nicSpoofingEnabled is the value used by stack to enable or disable
-	// NIC's spoofing.
-	nicSpoofingEnabled = true
-)
-
-// withCreatingNIC creates NIC for stack.
-func withCreatingNIC(ep stack.LinkEndpoint) Option {
-	return func(s *Stack) error {
-		if err := s.CreateNIC(s.nicID, ep); err != nil {
-			return fmt.Errorf("create NIC: %s", err)
-		}
-		return nil
-	}
-}
-
-// withPromiscuousMode sets promiscuous mode in the given NIC.
-func withPromiscuousMode(v bool) Option {
-	return func(s *Stack) error {
-		if err := s.SetPromiscuousMode(s.nicID, v); err != nil {
-			return fmt.Errorf("set promiscuous mode: %s", err)
-		}
-		return nil
-	}
-}
-
-// withSpoofing sets address spoofing in the given NIC, allowing
-// endpoints to bind to any address in the NIC.
-func withSpoofing(v bool) Option {
-	return func(s *Stack) error {
-		if err := s.SetSpoofing(s.nicID, v); err != nil {
-			return fmt.Errorf("set spoofing: %s", err)
-		}
-		return nil
-	}
-}

core/stack/stack.go

@@ -1,82 +0,0 @@
-// Package stack provides a thin wrapper around a gVisor's stack.
-package stack
-
-import (
-	"github.com/xjasonlyu/tun2socks/core"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
-	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
-)
-
-type Stack struct {
-	*stack.Stack
-
-	handler core.Handler
-	nicID   tcpip.NICID
-}
-
-// New allocates a new *Stack with given options.
-func New(ep stack.LinkEndpoint, handler core.Handler, opts ...Option) (*Stack, error) {
-	s := &Stack{
-		Stack: stack.New(stack.Options{
-			NetworkProtocols: []stack.NetworkProtocolFactory{
-				ipv4.NewProtocol,
-				ipv6.NewProtocol,
-			},
-			TransportProtocols: []stack.TransportProtocolFactory{
-				tcp.NewProtocol,
-				udp.NewProtocol,
-				icmp.NewProtocol4,
-				icmp.NewProtocol6,
-			},
-		}),
-
-		handler: handler,
-		nicID:   defaultNICID,
-	}
-
-	opts = append(opts,
-		// Important: We must initiate transport protocol handlers
-		// before creating NIC, otherwise NIC would dispatch packets
-		// to stack and cause race condition.
-		withICMPHandler(), withTCPHandler(), withUDPHandler(),
-
-		// Create stack NIC and then bind link endpoint.
-		withCreatingNIC(ep),
-
-		// In past we did s.AddAddressRange to assign 0.0.0.0/0 onto
-		// the interface. We need that to be able to terminate all the
-		// incoming connections - to any ip. AddressRange API has been
-		// removed and the suggested workaround is to use Promiscuous
-		// mode. https://github.com/google/gvisor/issues/3876
-		//
-		// Ref: https://github.com/majek/slirpnetstack/blob/master/stack.go
-		withPromiscuousMode(nicPromiscuousModeEnabled),
-
-		// Enable spoofing if a stack may send packets from unowned addresses.
-		// This change required changes to some netgophers since previously,
-		// promiscuous mode was enough to let the netstack respond to all
-		// incoming packets regardless of the packet's destination address. Now
-		// that a stack.Route is not held for each incoming packet, finding a route
-		// may fail with local addresses we don't own but accepted packets for
-		// while in promiscuous mode. Since we also want to be able to send from
-		// any address (in response the received promiscuous mode packets), we need
-		// to enable spoofing.
-		//
-		// Ref: https://github.com/google/gvisor/commit/8c0701462a84ff77e602f1626aec49479c308127
-		withSpoofing(nicSpoofingEnabled),
-	)
-
-	for _, opt := range opts {
-		if err := opt(s); err != nil {
-			return nil, err
-		}
-	}
-
-	return s, nil
-}

core/stack/tcp.go

@@ -1,83 +0,0 @@
-package stack
-
-import (
-	"fmt"
-	"net"
-	"time"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
-	"gvisor.dev/gvisor/pkg/waiter"
-)
-
-const (
-	// defaultWndSize if set to zero, the default
-	// receive window buffer size is used instead.
-	defaultWndSize = 0
-
-	// maxConnAttempts specifies the maximum number
-	// of in-flight tcp connection attempts.
-	maxConnAttempts = 2 << 10
-
-	// tcpKeepaliveIdle specifies the time a connection
-	// must remain idle before the first TCP keepalive
-	// packet is sent. Once this time is reached,
-	// tcpKeepaliveInterval option is used instead.
-	tcpKeepaliveIdle = 60 * time.Second
-
-	// tcpKeepaliveInterval specifies the interval
-	// time between sending TCP keepalive packets.
-	tcpKeepaliveInterval = 30 * time.Second
-)
-
-func withTCPHandler() Option {
-	return func(s *Stack) error {
-		tcpForwarder := tcp.NewForwarder(s.Stack, defaultWndSize, maxConnAttempts, func(r *tcp.ForwarderRequest) {
-			var wq waiter.Queue
-			id := r.ID()
-			ep, err := r.CreateEndpoint(&wq)
-			if err != nil {
-				// prevent potential half-open TCP connection leak.
-				r.Complete(true)
-				return
-			}
-			r.Complete(false)
-
-			setKeepalive(ep)
-
-			conn := &tcpConn{
-				Conn: gonet.NewTCPConn(&wq, ep),
-				id:   &id,
-			}
-			s.handler.Add(conn)
-		})
-		s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
-		return nil
-	}
-}
-
-func setKeepalive(ep tcpip.Endpoint) error {
-	ep.SocketOptions().SetKeepAlive(true)
-
-	idle := tcpip.KeepaliveIdleOption(tcpKeepaliveIdle)
-	if err := ep.SetSockOpt(&idle); err != nil {
-		return fmt.Errorf("set keepalive idle: %s", err)
-	}
-
-	interval := tcpip.KeepaliveIntervalOption(tcpKeepaliveInterval)
-	if err := ep.SetSockOpt(&interval); err != nil {
-		return fmt.Errorf("set keepalive interval: %s", err)
-	}
-	return nil
-}
-
-type tcpConn struct {
-	net.Conn
-	id *stack.TransportEndpointID
-}
-
-func (c *tcpConn) ID() *stack.TransportEndpointID {
-	return c.id
-}

core/stack/udp.go

@@ -1,181 +0,0 @@
-package stack
-
-import (
-	"fmt"
-	"net"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/buffer"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
-)
-
-const (
-	// udpNoChecksum disables UDP checksum.
-	udpNoChecksum = true
-)
-
-func withUDPHandler() Option {
-	return func(s *Stack) error {
-		udpHandlePacket := func(id stack.TransportEndpointID, pkt *stack.PacketBuffer) bool {
-			// Ref: gVisor pkg/tcpip/transport/udp/endpoint.go HandlePacket
-			udpHdr := header.UDP(pkt.TransportHeader().View())
-			if int(udpHdr.Length()) > pkt.Data().Size()+header.UDPMinimumSize {
-				// Malformed packet.
-				s.Stats().UDP.MalformedPacketsReceived.Increment()
-				return true
-			}
-
-			if !verifyChecksum(udpHdr, pkt) {
-				// Checksum error.
-				s.Stats().UDP.ChecksumErrors.Increment()
-				return true
-			}
-
-			s.Stats().UDP.PacketsReceived.Increment()
-
-			packet := &udpPacket{
-				s:        s,
-				id:       &id,
-				data:     pkt.Data().ExtractVV(),
-				nicID:    pkt.NICID,
-				netHdr:   pkt.Network(),
-				netProto: pkt.NetworkProtocolNumber,
-			}
-
-			s.handler.AddPacket(packet)
-			return true
-		}
-		s.SetTransportProtocolHandler(udp.ProtocolNumber, udpHandlePacket)
-		return nil
-	}
-}
-
-type udpPacket struct {
-	s        *Stack
-	id       *stack.TransportEndpointID
-	data     buffer.VectorisedView
-	nicID    tcpip.NICID
-	netHdr   header.Network
-	netProto tcpip.NetworkProtocolNumber
-}
-
-func (p *udpPacket) Data() []byte {
-	return p.data.ToView()
-}
-
-func (p *udpPacket) Drop() {}
-
-func (p *udpPacket) ID() *stack.TransportEndpointID {
-	return p.id
-}
-
-func (p *udpPacket) LocalAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP(p.id.LocalAddress), Port: int(p.id.LocalPort)}
-}
-
-func (p *udpPacket) RemoteAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP(p.id.RemoteAddress), Port: int(p.id.RemotePort)}
-}
-
-func (p *udpPacket) WriteBack(b []byte, addr net.Addr) (int, error) {
-	v := buffer.View(b)
-	if len(v) > header.UDPMaximumPacketSize {
-		// Payload can't possibly fit in a packet.
-		return 0, fmt.Errorf("%s", &tcpip.ErrMessageTooLong{})
-	}
-
-	var (
-		localAddress tcpip.Address
-		localPort    uint16
-	)
-
-	if udpAddr, ok := addr.(*net.UDPAddr); !ok {
-		localAddress = p.netHdr.DestinationAddress()
-		localPort = p.id.LocalPort
-	} else if ipv4 := udpAddr.IP.To4(); ipv4 != nil {
-		localAddress = tcpip.Address(ipv4)
-		localPort = uint16(udpAddr.Port)
-	} else {
-		localAddress = tcpip.Address(udpAddr.IP)
-		localPort = uint16(udpAddr.Port)
-	}
-
-	route, err := p.s.FindRoute(p.nicID, localAddress, p.netHdr.SourceAddress(), p.netProto, false /* multicastLoop */)
-	if err != nil {
-		return 0, fmt.Errorf("%#v find route: %s", p.id, err)
-	}
-	defer route.Release()
-
-	data := v.ToVectorisedView()
-	if err = sendUDP(route, data, localPort, p.id.RemotePort, udpNoChecksum); err != nil {
-		return 0, fmt.Errorf("%v", err)
-	}
-	return data.Size(), nil
-}
-
-// sendUDP sends a UDP segment via the provided network endpoint and under the
-// provided identity.
-func sendUDP(r *stack.Route, data buffer.VectorisedView, localPort, remotePort uint16, noChecksum bool) tcpip.Error {
-	pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
-		ReserveHeaderBytes: header.UDPMinimumSize + int(r.MaxHeaderLength()),
-		Data:               data,
-	})
-
-	// Initialize the UDP header.
-	udpHdr := header.UDP(pkt.TransportHeader().Push(header.UDPMinimumSize))
-	pkt.TransportProtocolNumber = udp.ProtocolNumber
-
-	length := uint16(pkt.Size())
-	udpHdr.Encode(&header.UDPFields{
-		SrcPort: localPort,
-		DstPort: remotePort,
-		Length:  length,
-	})
-
-	// Set the checksum field unless TX checksum offload is enabled.
-	// On IPv4, UDP checksum is optional, and a zero value indicates the
-	// transmitter skipped the checksum generation (RFC768).
-	// On IPv6, UDP checksum is not optional (RFC2460 Section 8.1).
-	if r.RequiresTXTransportChecksum() &&
-		(!noChecksum || r.NetProto() == header.IPv6ProtocolNumber) {
-		xsum := r.PseudoHeaderChecksum(udp.ProtocolNumber, length)
-		for _, v := range data.Views() {
-			xsum = header.Checksum(v, xsum)
-		}
-		udpHdr.SetChecksum(^udpHdr.CalculateChecksum(xsum))
-	}
-
-	ttl := r.DefaultTTL()
-
-	if err := r.WritePacket(stack.NetworkHeaderParams{
-		Protocol: udp.ProtocolNumber,
-		TTL:      ttl,
-		TOS:      0, /* default */
-	}, pkt); err != nil {
-		r.Stats().UDP.PacketSendErrors.Increment()
-		return err
-	}
-
-	// Track count of packets sent.
-	r.Stats().UDP.PacketsSent.Increment()
-	return nil
-}
-
-// verifyChecksum verifies the checksum unless RX checksum offload is enabled.
-// On IPv4, UDP checksum is optional, and a zero value means the transmitter
-// omitted the checksum generation (RFC768).
-// On IPv6, UDP checksum is not optional (RFC2460 Section 8.1).
-func verifyChecksum(hdr header.UDP, pkt *stack.PacketBuffer) bool {
-	if !pkt.RXTransportChecksumValidated &&
-		(hdr.Checksum() != 0 || pkt.NetworkProtocolNumber == header.IPv6ProtocolNumber) {
-		netHdr := pkt.Network()
-		xsum := header.PseudoHeaderChecksum(udp.ProtocolNumber, netHdr.DestinationAddress(), netHdr.SourceAddress(), hdr.Length())
-		for _, v := range pkt.Data().Views() {
-			xsum = header.Checksum(v, xsum)
-		}
-		return hdr.CalculateChecksum(xsum) == 0xffff
-	}
-	return true
-}

core/tcp.go

@@ -0,0 +1,122 @@
+package core
+
+import (
+	"time"
+
+	glog "gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+const (
+	// defaultWndSize if set to zero, the default
+	// receive window buffer size is used instead.
+	defaultWndSize = 0
+
+	// maxConnAttempts specifies the maximum number
+	// of in-flight tcp connection attempts.
+	maxConnAttempts = 2 << 10
+
+	// tcpKeepaliveCount is the maximum number of
+	// TCP keep-alive probes to send before giving up
+	// and killing the connection if no response is
+	// obtained from the other end.
+	tcpKeepaliveCount = 9
+
+	// tcpKeepaliveIdle specifies the time a connection
+	// must remain idle before the first TCP keepalive
+	// packet is sent. Once this time is reached,
+	// tcpKeepaliveInterval option is used instead.
+	tcpKeepaliveIdle = 60 * time.Second
+
+	// tcpKeepaliveInterval specifies the interval
+	// time between sending TCP keepalive packets.
+	tcpKeepaliveInterval = 30 * time.Second
+)
+
+func withTCPHandler(handle func(adapter.TCPConn)) option.Option {
+	return func(s *stack.Stack) error {
+		tcpForwarder := tcp.NewForwarder(s, defaultWndSize, maxConnAttempts, func(r *tcp.ForwarderRequest) {
+			var (
+				wq  waiter.Queue
+				ep  tcpip.Endpoint
+				err tcpip.Error
+				id  = r.ID()
+			)
+
+			defer func() {
+				if err != nil {
+					glog.Debugf("forward tcp request: %s:%d->%s:%d: %s",
+						id.RemoteAddress, id.RemotePort, id.LocalAddress, id.LocalPort, err)
+				}
+			}()
+
+			// Perform a TCP three-way handshake.
+			ep, err = r.CreateEndpoint(&wq)
+			if err != nil {
+				// RST: prevent potential half-open TCP connection leak.
+				r.Complete(true)
+				return
+			}
+			defer r.Complete(false)
+
+			err = setSocketOptions(s, ep)
+
+			conn := &tcpConn{
+				TCPConn: gonet.NewTCPConn(&wq, ep),
+				id:      id,
+			}
+			handle(conn)
+		})
+		s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
+		return nil
+	}
+}
+
+func setSocketOptions(s *stack.Stack, ep tcpip.Endpoint) tcpip.Error {
+	{ /* TCP keepalive options */
+		ep.SocketOptions().SetKeepAlive(true)
+
+		idle := tcpip.KeepaliveIdleOption(tcpKeepaliveIdle)
+		if err := ep.SetSockOpt(&idle); err != nil {
+			return err
+		}
+
+		interval := tcpip.KeepaliveIntervalOption(tcpKeepaliveInterval)
+		if err := ep.SetSockOpt(&interval); err != nil {
+			return err
+		}
+
+		if err := ep.SetSockOptInt(tcpip.KeepaliveCountOption, tcpKeepaliveCount); err != nil {
+			return err
+		}
+	}
+	{ /* TCP recv/send buffer size */
+		var ss tcpip.TCPSendBufferSizeRangeOption
+		if err := s.TransportProtocolOption(header.TCPProtocolNumber, &ss); err == nil {
+			ep.SocketOptions().SetSendBufferSize(int64(ss.Default), false)
+		}
+
+		var rs tcpip.TCPReceiveBufferSizeRangeOption
+		if err := s.TransportProtocolOption(header.TCPProtocolNumber, &rs); err == nil {
+			ep.SocketOptions().SetReceiveBufferSize(int64(rs.Default), false)
+		}
+	}
+	return nil
+}
+
+type tcpConn struct {
+	*gonet.TCPConn
+	id stack.TransportEndpointID
+}
+
+func (c *tcpConn) ID() *stack.TransportEndpointID {
+	return &c.id
+}

core/udp.go

@@ -0,0 +1,46 @@
+package core
+
+import (
+	glog "gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+func withUDPHandler(handle func(adapter.UDPConn)) option.Option {
+	return func(s *stack.Stack) error {
+		udpForwarder := udp.NewForwarder(s, func(r *udp.ForwarderRequest) {
+			var (
+				wq waiter.Queue
+				id = r.ID()
+			)
+			ep, err := r.CreateEndpoint(&wq)
+			if err != nil {
+				glog.Debugf("forward udp request: %s:%d->%s:%d: %s",
+					id.RemoteAddress, id.RemotePort, id.LocalAddress, id.LocalPort, err)
+				return
+			}
+
+			conn := &udpConn{
+				UDPConn: gonet.NewUDPConn(&wq, ep),
+				id:      id,
+			}
+			handle(conn)
+		})
+		s.SetTransportProtocolHandler(udp.ProtocolNumber, udpForwarder.HandlePacket)
+		return nil
+	}
+}
+
+type udpConn struct {
+	*gonet.UDPConn
+	id stack.TransportEndpointID
+}
+
+func (c *udpConn) ID() *stack.TransportEndpointID {
+	return &c.id
+}

dialer/dialer.go

@@ -0,0 +1,66 @@
+package dialer
+
+import (
+	"context"
+	"net"
+	"syscall"
+
+	"go.uber.org/atomic"
+)
+
+var (
+	DefaultInterfaceName  = atomic.NewString("")
+	DefaultInterfaceIndex = atomic.NewInt32(0)
+	DefaultRoutingMark    = atomic.NewInt32(0)
+)
+
+type Options struct {
+	// InterfaceName is the name of interface/device to bind.
+	// If a socket is bound to an interface, only packets received
+	// from that particular interface are processed by the socket.
+	InterfaceName string
+
+	// InterfaceIndex is the index of interface/device to bind.
+	// It is almost the same as InterfaceName except it uses the
+	// index of the interface instead of the name.
+	InterfaceIndex int
+
+	// RoutingMark is the mark for each packet sent through this
+	// socket. Changing the mark can be used for mark-based routing
+	// without netfilter or for packet filtering.
+	RoutingMark int
+}
+
+func DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return DialContextWithOptions(ctx, network, address, &Options{
+		InterfaceName:  DefaultInterfaceName.Load(),
+		InterfaceIndex: int(DefaultInterfaceIndex.Load()),
+		RoutingMark:    int(DefaultRoutingMark.Load()),
+	})
+}
+
+func DialContextWithOptions(ctx context.Context, network, address string, opts *Options) (net.Conn, error) {
+	d := &net.Dialer{
+		Control: func(network, address string, c syscall.RawConn) error {
+			return setSocketOptions(network, address, c, opts)
+		},
+	}
+	return d.DialContext(ctx, network, address)
+}
+
+func ListenPacket(network, address string) (net.PacketConn, error) {
+	return ListenPacketWithOptions(network, address, &Options{
+		InterfaceName:  DefaultInterfaceName.Load(),
+		InterfaceIndex: int(DefaultInterfaceIndex.Load()),
+		RoutingMark:    int(DefaultRoutingMark.Load()),
+	})
+}
+
+func ListenPacketWithOptions(network, address string, opts *Options) (net.PacketConn, error) {
+	lc := &net.ListenConfig{
+		Control: func(network, address string, c syscall.RawConn) error {
+			return setSocketOptions(network, address, c, opts)
+		},
+	}
+	return lc.ListenPacket(context.Background(), network, address)
+}

dialer/sockopt.go

@@ -0,0 +1,19 @@
+package dialer
+
+func isTCPSocket(network string) bool {
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		return true
+	default:
+		return false
+	}
+}
+
+func isUDPSocket(network string) bool {
+	switch network {
+	case "udp", "udp4", "udp6":
+		return true
+	default:
+		return false
+	}
+}

dialer/sockopt_darwin.go

@@ -0,0 +1,45 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceIndex == 0 && opts.InterfaceName != "" {
+			if iface, err := net.InterfaceByName(opts.InterfaceName); err == nil {
+				opts.InterfaceIndex = iface.Index
+			}
+		}
+
+		if opts.InterfaceIndex != 0 {
+			switch network {
+			case "tcp4", "udp4":
+				innerErr = unix.SetsockoptInt(int(fd), syscall.IPPROTO_IP, syscall.IP_BOUND_IF, opts.InterfaceIndex)
+			case "tcp6", "udp6":
+				innerErr = unix.SetsockoptInt(int(fd), syscall.IPPROTO_IPV6, syscall.IPV6_BOUND_IF, opts.InterfaceIndex)
+			}
+			if innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_freebsd.go

@@ -0,0 +1,33 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_USER_COOKIE, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_linux.go

@@ -0,0 +1,44 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceName == "" && opts.InterfaceIndex != 0 {
+			if iface, err := net.InterfaceByIndex(opts.InterfaceIndex); err == nil {
+				opts.InterfaceName = iface.Name
+			}
+		}
+
+		if opts.InterfaceName != "" {
+			if innerErr = unix.BindToDevice(int(fd), opts.InterfaceName); innerErr != nil {
+				return
+			}
+		}
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_openbsd.go

@@ -0,0 +1,33 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_RTABLE, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_others.go

@@ -0,0 +1,9 @@
+//go:build !unix && !windows
+
+package dialer
+
+import "syscall"
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) error {
+	return nil
+}

dialer/sockopt_windows.go

@@ -0,0 +1,68 @@
+package dialer
+
+import (
+	"encoding/binary"
+	"net"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	IP_UNICAST_IF   = 31
+	IPV6_UNICAST_IF = 31
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		ip := net.ParseIP(host)
+		if ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceIndex == 0 && opts.InterfaceName != "" {
+			if iface, err := net.InterfaceByName(opts.InterfaceName); err == nil {
+				opts.InterfaceIndex = iface.Index
+			}
+		}
+
+		if opts.InterfaceIndex != 0 {
+			switch network {
+			case "tcp4", "udp4":
+				innerErr = bindSocketToInterface4(windows.Handle(fd), uint32(opts.InterfaceIndex))
+			case "tcp6", "udp6":
+				innerErr = bindSocketToInterface6(windows.Handle(fd), uint32(opts.InterfaceIndex))
+				if network == "udp6" && ip == nil {
+					// The underlying IP net maybe IPv4 even if the `network` param is `udp6`,
+					// so we should bind socket to interface4 at the same time.
+					innerErr = bindSocketToInterface4(windows.Handle(fd), uint32(opts.InterfaceIndex))
+				}
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}
+
+func bindSocketToInterface4(handle windows.Handle, index uint32) error {
+	// For IPv4, this parameter must be an interface index in network byte order.
+	// Ref: https://learn.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
+	var bytes [4]byte
+	binary.BigEndian.PutUint32(bytes[:], index)
+	index = *(*uint32)(unsafe.Pointer(&bytes[0]))
+	return windows.SetsockoptInt(handle, windows.IPPROTO_IP, IP_UNICAST_IF, int(index))
+}
+
+func bindSocketToInterface6(handle windows.Handle, index uint32) error {
+	return windows.SetsockoptInt(handle, windows.IPPROTO_IPV6, IPV6_UNICAST_IF, int(index))
+}

dns/resolver.go

@@ -1,10 +1,14 @@
-package dialer
+package dns
 
-import "net"
+import (
+	"net"
+
+	"github.com/xjasonlyu/tun2socks/v2/dialer"
+)
 
 func init() {
 	// We must use this DialContext to query DNS
 	// when using net default resolver.
 	net.DefaultResolver.PreferGo = true
-	net.DefaultResolver.Dial = DialContext
+	net.DefaultResolver.Dial = dialer.DialContext
 }

docker/entrypoint.sh

@@ -47,7 +47,7 @@ config_route() {
   done
 }
 
-main() {
+run() {
   create_tun
   create_table
   config_route
@@ -58,27 +58,39 @@ main() {
   fi
 
   if [ -n "$MTU" ]; then
-    ARGS="-mtu $MTU"
+    ARGS="--mtu $MTU"
   fi
 
-  if [ -n "$STATS" ]; then
-    ARGS="$ARGS -stats $STATS"
-  fi
-
-  if [ -n "$TOKEN" ]; then
-    ARGS="$ARGS -token $TOKEN"
+  if [ -n "$RESTAPI" ]; then
+    ARGS="$ARGS --restapi $RESTAPI"
   fi
 
   if [ -n "$UDP_TIMEOUT" ]; then
-    ARGS="$ARGS -udp-timeout $UDP_TIMEOUT"
+    ARGS="$ARGS --udp-timeout $UDP_TIMEOUT"
+  fi
+
+  if [ -n "$TCP_SNDBUF" ]; then
+    ARGS="$ARGS --tcp-sndbuf $TCP_SNDBUF"
+  fi
+
+  if [ -n "$TCP_RCVBUF" ]; then
+    ARGS="$ARGS --tcp-rcvbuf $TCP_RCVBUF"
+  fi
+
+  if [ "$TCP_AUTO_TUNING" = 1 ]; then
+    ARGS="$ARGS --tcp-auto-tuning"
+  fi
+
+  if [ -n "$MULTICAST_GROUPS" ]; then
+    ARGS="$ARGS --multicast-groups $MULTICAST_GROUPS"
   fi
 
   exec tun2socks \
-    -loglevel "$LOGLEVEL" \
-    -fwmark "$FWMARK" \
-    -device "$TUN" \
-    -proxy "$PROXY" \
+    --loglevel "$LOGLEVEL" \
+    --fwmark "$FWMARK" \
+    --device "$TUN" \
+    --proxy "$PROXY" \
     $ARGS
 }
 
-main || exit 1
+run || exit 1

engine/engine.go

@@ -2,167 +2,241 @@ package engine
 
 import (
 	"errors"
-	"os"
+	"net"
+	"net/netip"
+	"os/exec"
+	"sync"
+	"time"
 
-	"github.com/xjasonlyu/tun2socks/component/dialer"
-	"github.com/xjasonlyu/tun2socks/core/device"
-	"github.com/xjasonlyu/tun2socks/core/stack"
-	"github.com/xjasonlyu/tun2socks/log"
-	"github.com/xjasonlyu/tun2socks/proxy"
-	"github.com/xjasonlyu/tun2socks/stats"
-	"github.com/xjasonlyu/tun2socks/tunnel"
+	"github.com/docker/go-units"
+	"github.com/google/shlex"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core"
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+	"github.com/xjasonlyu/tun2socks/v2/dialer"
+	"github.com/xjasonlyu/tun2socks/v2/log"
+	"github.com/xjasonlyu/tun2socks/v2/proxy"
+	"github.com/xjasonlyu/tun2socks/v2/restapi"
+	"github.com/xjasonlyu/tun2socks/v2/tunnel"
 )
 
-var _engine = &engine{}
+var (
+	_engineMu sync.Mutex
+
+	// _defaultKey holds the default key for the engine.
+	_defaultKey *Key
+
+	// _defaultProxy holds the default proxy for the engine.
+	_defaultProxy proxy.Proxy
+
+	// _defaultDevice holds the default device for the engine.
+	_defaultDevice device.Device
+
+	// _defaultStack holds the default stack for the engine.
+	_defaultStack *stack.Stack
+)
 
 // Start starts the default engine up.
-func Start() error {
-	return _engine.start()
+func Start() {
+	if err := start(); err != nil {
+		log.Fatalf("[ENGINE] failed to start: %v", err)
+	}
 }
 
 // Stop shuts the default engine down.
-func Stop() error {
-	return _engine.stop()
+func Stop() {
+	if err := stop(); err != nil {
+		log.Fatalf("[ENGINE] failed to stop: %v", err)
+	}
 }
 
 // Insert loads *Key to the default engine.
 func Insert(k *Key) {
-	_engine.insert(k)
+	_engineMu.Lock()
+	_defaultKey = k
+	_engineMu.Unlock()
 }
 
-type Key struct {
-	MTU        int
-	Mark       int
-	UDPTimeout int
-	Proxy      string
-	Stats      string
-	Token      string
-	Device     string
-	LogLevel   string
-	Interface  string
-	Version    bool
-}
-
-type engine struct {
-	*Key
-
-	stack  *stack.Stack
-	proxy  proxy.Proxy
-	device device.Device
-}
-
-func (e *engine) start() error {
-	if e.Key == nil {
+func start() error {
+	_engineMu.Lock()
+	if _defaultKey == nil {
 		return errors.New("empty key")
 	}
 
-	if e.Version {
-		showVersion()
-		os.Exit(0)
-	}
-
-	for _, f := range []func() error{
-		e.setLogLevel,
-		e.setMark,
-		e.setInterface,
-		e.setStats,
-		e.setUDPTimeout,
-		e.setProxy,
-		e.setDevice,
-		e.setStack,
+	for _, f := range []func(*Key) error{
+		general,
+		restAPI,
+		netstack,
 	} {
-		if err := f(); err != nil {
+		if err := f(_defaultKey); err != nil {
 			return err
 		}
 	}
+	_engineMu.Unlock()
 	return nil
 }
 
-func (e *engine) stop() error {
-	if e.device != nil {
-		return e.device.Close()
+func stop() (err error) {
+	_engineMu.Lock()
+	if _defaultDevice != nil {
+		_defaultDevice.Close()
 	}
+	if _defaultStack != nil {
+		_defaultStack.Close()
+		_defaultStack.Wait()
+	}
+	_engineMu.Unlock()
 	return nil
 }
 
-func (e *engine) insert(k *Key) {
-	e.Key = k
-}
-
-func (e *engine) setLogLevel() error {
-	level, err := log.ParseLevel(e.LogLevel)
+func execCommand(cmd string) error {
+	parts, err := shlex.Split(cmd)
 	if err != nil {
 		return err
 	}
-	log.SetLevel(level)
-	return nil
-}
-
-func (e *engine) setMark() error {
-	if e.Mark != 0 {
-		dialer.SetMark(e.Mark)
-		log.Infof("[DIALER] set fwmark: %#x", e.Mark)
+	if len(parts) == 0 {
+		return errors.New("empty command")
 	}
-	return nil
+	_, err = exec.Command(parts[0], parts[1:]...).Output()
+	return err
 }
 
-func (e *engine) setInterface() error {
-	if e.Interface != "" {
-		if err := dialer.BindToInterface(e.Interface); err != nil {
+func general(k *Key) error {
+	level, err := log.ParseLevel(k.LogLevel)
+	if err != nil {
+		return err
+	}
+	log.SetLogger(log.Must(log.NewLeveled(level)))
+
+	if k.Interface != "" {
+		iface, err := net.InterfaceByName(k.Interface)
+		if err != nil {
 			return err
 		}
-		log.Infof("[DIALER] use interface: %s", e.Interface)
+		dialer.DefaultInterfaceName.Store(iface.Name)
+		dialer.DefaultInterfaceIndex.Store(int32(iface.Index))
+		log.Infof("[DIALER] bind to interface: %s", k.Interface)
+	}
+
+	if k.Mark != 0 {
+		dialer.DefaultRoutingMark.Store(int32(k.Mark))
+		log.Infof("[DIALER] set fwmark: %#x", k.Mark)
+	}
+
+	if k.UDPTimeout > 0 {
+		if k.UDPTimeout < time.Second {
+			return errors.New("invalid udp timeout value")
+		}
+		tunnel.T().SetUDPTimeout(k.UDPTimeout)
 	}
 	return nil
 }
 
-func (e *engine) setStats() error {
-	if e.Stats != "" {
+func restAPI(k *Key) error {
+	if k.RestAPI != "" {
+		u, err := parseRestAPI(k.RestAPI)
+		if err != nil {
+			return err
+		}
+		host, token := u.Host, u.User.String()
+
+		restapi.SetStatsFunc(func() tcpip.Stats {
+			_engineMu.Lock()
+			defer _engineMu.Unlock()
+
+			// default stack is not initialized.
+			if _defaultStack == nil {
+				return tcpip.Stats{}
+			}
+			return _defaultStack.Stats()
+		})
+
 		go func() {
-			_ = stats.Start(e.Stats, e.Token)
+			if err := restapi.Start(host, token); err != nil {
+				log.Errorf("[RESTAPI] failed to start: %v", err)
+			}
 		}()
-		log.Infof("[STATS] serve at: http://%s", e.Stats)
+		log.Infof("[RESTAPI] serve at: %s", u)
 	}
 	return nil
 }
 
-func (e *engine) setUDPTimeout() error {
-	if e.UDPTimeout > 0 {
-		tunnel.SetUDPTimeout(e.UDPTimeout)
-	}
-	return nil
-}
-
-func (e *engine) setProxy() (err error) {
-	if e.Proxy == "" {
+func netstack(k *Key) (err error) {
+	if k.Proxy == "" {
 		return errors.New("empty proxy")
 	}
-
-	e.proxy, err = parseProxy(e.Proxy)
-	proxy.SetDialer(e.proxy)
-	return
-}
-
-func (e *engine) setDevice() (err error) {
-	if e.Device == "" {
+	if k.Device == "" {
 		return errors.New("empty device")
 	}
 
-	e.device, err = parseDevice(e.Device, uint32(e.MTU))
-	return
-}
+	if k.TUNPreUp != "" {
+		log.Infof("[TUN] pre-execute command: `%s`", k.TUNPreUp)
+		if preUpErr := execCommand(k.TUNPreUp); preUpErr != nil {
+			log.Errorf("[TUN] failed to pre-execute: %s: %v", k.TUNPreUp, preUpErr)
+		}
+	}
 
-func (e *engine) setStack() (err error) {
 	defer func() {
-		if err == nil {
-			log.Infof(
-				"[STACK] %s://%s <-> %s://%s",
-				e.device.Type(), e.device.Name(),
-				e.proxy.Proto(), e.proxy.Addr(),
-			)
+		if k.TUNPostUp == "" || err != nil {
+			return
+		}
+		log.Infof("[TUN] post-execute command: `%s`", k.TUNPostUp)
+		if postUpErr := execCommand(k.TUNPostUp); postUpErr != nil {
+			log.Errorf("[TUN] failed to post-execute: %s: %v", k.TUNPostUp, postUpErr)
 		}
 	}()
 
-	e.stack, err = stack.New(e.device, &fakeTunnel{}, stack.WithDefault())
-	return
+	if _defaultProxy, err = parseProxy(k.Proxy); err != nil {
+		return
+	}
+	tunnel.T().SetDialer(_defaultProxy)
+
+	if _defaultDevice, err = parseDevice(k.Device, uint32(k.MTU)); err != nil {
+		return
+	}
+
+	var multicastGroups []netip.Addr
+	if multicastGroups, err = parseMulticastGroups(k.MulticastGroups); err != nil {
+		return err
+	}
+
+	var opts []option.Option
+	if k.TCPModerateReceiveBuffer {
+		opts = append(opts, option.WithTCPModerateReceiveBuffer(true))
+	}
+
+	if k.TCPSendBufferSize != "" {
+		size, err := units.RAMInBytes(k.TCPSendBufferSize)
+		if err != nil {
+			return err
+		}
+		opts = append(opts, option.WithTCPSendBufferSize(int(size)))
+	}
+
+	if k.TCPReceiveBufferSize != "" {
+		size, err := units.RAMInBytes(k.TCPReceiveBufferSize)
+		if err != nil {
+			return err
+		}
+		opts = append(opts, option.WithTCPReceiveBufferSize(int(size)))
+	}
+
+	if _defaultStack, err = core.CreateStack(&core.Config{
+		LinkEndpoint:     _defaultDevice,
+		TransportHandler: tunnel.T(),
+		MulticastGroups:  multicastGroups,
+		Options:          opts,
+	}); err != nil {
+		return
+	}
+
+	log.Infof(
+		"[STACK] %s://%s <-> %s://%s",
+		_defaultDevice.Type(), _defaultDevice.Name(),
+		_defaultProxy.Proto(), _defaultProxy.Addr(),
+	)
+	return nil
 }

engine/key.go

@@ -0,0 +1,20 @@
+package engine
+
+import "time"
+
+type Key struct {
+	MTU                      int           `yaml:"mtu"`
+	Mark                     int           `yaml:"fwmark"`
+	Proxy                    string        `yaml:"proxy"`
+	RestAPI                  string        `yaml:"restapi"`
+	Device                   string        `yaml:"device"`
+	LogLevel                 string        `yaml:"loglevel"`
+	Interface                string        `yaml:"interface"`
+	TCPModerateReceiveBuffer bool          `yaml:"tcp-moderate-receive-buffer"`
+	TCPSendBufferSize        string        `yaml:"tcp-send-buffer-size"`
+	TCPReceiveBufferSize     string        `yaml:"tcp-receive-buffer-size"`
+	MulticastGroups          string        `yaml:"multicast-groups"`
+	TUNPreUp                 string        `yaml:"tun-pre-up"`
+	TUNPostUp                string        `yaml:"tun-post-up"`
+	UDPTimeout               time.Duration `yaml:"udp-timeout"`
+}

engine/parse.go

@@ -3,18 +3,51 @@ package engine
 import (
 	"encoding/base64"
 	"fmt"
+	"net"
+	"net/netip"
 	"net/url"
+	"runtime"
 	"strings"
 
-	"github.com/xjasonlyu/tun2socks/core/device"
-	"github.com/xjasonlyu/tun2socks/core/device/tun"
-	"github.com/xjasonlyu/tun2socks/proxy"
-	"github.com/xjasonlyu/tun2socks/proxy/proto"
+	"github.com/gorilla/schema"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/fdbased"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/tun"
+	"github.com/xjasonlyu/tun2socks/v2/proxy"
+	"github.com/xjasonlyu/tun2socks/v2/proxy/proto"
 )
 
-func parseDevice(s string, mtu uint32) (device.Device, error) {
+func parseRestAPI(s string) (*url.URL, error) {
 	if !strings.Contains(s, "://") {
-		s = tun.Driver + "://" + s /* default driver */
+		s = fmt.Sprintf("%s://%s", "http", s)
+	}
+
+	u, err := url.Parse(s)
+	if err != nil {
+		return nil, err
+	}
+
+	addr, err := net.ResolveTCPAddr("tcp", u.Host)
+	if err != nil {
+		return nil, err
+	}
+	if addr.IP == nil {
+		addr.IP = net.IPv4zero /* default: 0.0.0.0 */
+	}
+	u.Host = addr.String()
+
+	switch u.Scheme {
+	case "http":
+		return u, nil
+	default:
+		return nil, fmt.Errorf("unsupported scheme: %s", u.Scheme)
+	}
+}
+
+func parseDevice(s string, mtu uint32) (device.Device, error) {
+	if !strings.Contains(s, "://") {
+		s = fmt.Sprintf("%s://%s", tun.Driver /* default driver */, s)
 	}
 
 	u, err := url.Parse(s)
@@ -22,20 +55,31 @@ func parseDevice(s string, mtu uint32) (device.Device, error) {
 		return nil, err
 	}
 
-	name := u.Host
 	driver := strings.ToLower(u.Scheme)
 
 	switch driver {
+	case fdbased.Driver:
+		return parseFD(u, mtu)
 	case tun.Driver:
-		return tun.Open(tun.WithName(name), tun.WithMTU(mtu))
+		return parseTUN(u, mtu)
 	default:
 		return nil, fmt.Errorf("unsupported driver: %s", driver)
 	}
 }
 
+func parseFD(u *url.URL, mtu uint32) (device.Device, error) {
+	offset := 0
+	// fd offset in ios
+	// https://stackoverflow.com/questions/69260852/ios-network-extension-packet-parsing/69487795#69487795
+	if runtime.GOOS == "ios" {
+		offset = 4
+	}
+	return fdbased.Open(u.Host, mtu, offset)
+}
+
 func parseProxy(s string) (proxy.Proxy, error) {
 	if !strings.Contains(s, "://") {
-		s = proto.Socks5.String() + "://" + s /* default protocol */
+		s = fmt.Sprintf("%s://%s", proto.Socks5 /* default protocol */, s)
 	}
 
 	u, err := url.Parse(s)
@@ -51,37 +95,56 @@ func parseProxy(s string) (proxy.Proxy, error) {
 	case proto.Reject.String():
 		return proxy.NewReject(), nil
 	case proto.HTTP.String():
-		return proxy.NewHTTP(parseAddrUserPass(u))
+		return parseHTTP(u)
 	case proto.Socks4.String():
-		return proxy.NewSocks4(parseAddrUser(u))
+		return parseSocks4(u)
 	case proto.Socks5.String():
-		return proxy.NewSocks5(parseAddrUserPass(u))
+		return parseSocks5(u)
 	case proto.Shadowsocks.String():
-		return proxy.NewShadowsocks(parseShadowsocks(u))
+		return parseShadowsocks(u)
+	case proto.Relay.String():
+		return parseRelay(u)
 	default:
 		return nil, fmt.Errorf("unsupported protocol: %s", protocol)
 	}
 }
 
-func parseAddrUser(u *url.URL) (address, username string) {
-	address, username = u.Host, u.User.Username()
-	return
+func parseHTTP(u *url.URL) (proxy.Proxy, error) {
+	address, username := u.Host, u.User.Username()
+	password, _ := u.User.Password()
+	return proxy.NewHTTP(address, username, password)
 }
 
-func parseAddrUserPass(u *url.URL) (address, username, password string) {
-	address, username = parseAddrUser(u)
-	password, _ = u.User.Password()
-	return
+func parseSocks4(u *url.URL) (proxy.Proxy, error) {
+	address, userID := u.Host, u.User.Username()
+	return proxy.NewSocks4(address, userID)
 }
 
-func parseShadowsocks(u *url.URL) (address, method, password, obfsMode, obfsHost string) {
-	address = u.Host
+func parseSocks5(u *url.URL) (proxy.Proxy, error) {
+	address, username := u.Host, u.User.Username()
+	password, _ := u.User.Password()
 
-	if pass, set := u.User.Password(); set {
+	// Socks5 over UDS
+	if address == "" {
+		address = u.Path
+	}
+	return proxy.NewSocks5(address, username, password)
+}
+
+func parseShadowsocks(u *url.URL) (proxy.Proxy, error) {
+	var (
+		address            = u.Host
+		method, password   string
+		obfsMode, obfsHost string
+	)
+
+	if ss := u.User.String(); ss == "" {
+		method = "dummy" // none cipher mode
+	} else if pass, set := u.User.Password(); set {
 		method = u.User.Username()
 		password = pass
 	} else {
-		data, _ := base64.RawURLEncoding.DecodeString(u.User.String())
+		data, _ := base64.RawURLEncoding.DecodeString(ss)
 		userInfo := strings.SplitN(string(data), ":", 2)
 		if len(userInfo) == 2 {
 			method = userInfo[0]
@@ -106,5 +169,36 @@ func parseShadowsocks(u *url.URL) (address, method, password, obfsMode, obfsHost
 		}
 	}
 
+	return proxy.NewShadowsocks(address, method, password, obfsMode, obfsHost)
+}
+
+func parseRelay(u *url.URL) (proxy.Proxy, error) {
+	address, username := u.Host, u.User.Username()
+	password, _ := u.User.Password()
+
+	opts := struct {
+		NoDelay bool
+	}{}
+	if err := schema.NewDecoder().Decode(&opts, u.Query()); err != nil {
+		return nil, err
+	}
+
+	return proxy.NewRelay(address, username, password, opts.NoDelay)
+}
+
+func parseMulticastGroups(s string) (multicastGroups []netip.Addr, _ error) {
+	for _, ip := range strings.Split(s, ",") {
+		if ip = strings.TrimSpace(ip); ip == "" {
+			continue
+		}
+		addr, err := netip.ParseAddr(ip)
+		if err != nil {
+			return nil, err
+		}
+		if !addr.IsMulticast() {
+			return nil, fmt.Errorf("invalid multicast IP: %s", addr)
+		}
+		multicastGroups = append(multicastGroups, addr)
+	}
 	return
 }

engine/parse_unix.go

@@ -0,0 +1,14 @@
+//go:build unix
+
+package engine
+
+import (
+	"net/url"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/tun"
+)
+
+func parseTUN(u *url.URL, mtu uint32) (device.Device, error) {
+	return tun.Open(u.Host, mtu)
+}

engine/parse_windows.go

@@ -0,0 +1,34 @@
+package engine
+
+import (
+	"net/url"
+
+	"github.com/gorilla/schema"
+	"golang.org/x/sys/windows"
+	wun "golang.zx2c4.com/wireguard/tun"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/tun"
+	"github.com/xjasonlyu/tun2socks/v2/internal/version"
+)
+
+func init() {
+	wun.WintunTunnelType = version.Name
+}
+
+func parseTUN(u *url.URL, mtu uint32) (device.Device, error) {
+	opts := struct {
+		GUID string
+	}{}
+	if err := schema.NewDecoder().Decode(&opts, u.Query()); err != nil {
+		return nil, err
+	}
+	if opts.GUID != "" {
+		guid, err := windows.GUIDFromString(opts.GUID)
+		if err != nil {
+			return nil, err
+		}
+		wun.WintunStaticRequestedGUID = &guid
+	}
+	return tun.Open(u.Host, mtu)
+}

engine/tunnel.go

@@ -1,18 +0,0 @@
-package engine
-
-import (
-	"github.com/xjasonlyu/tun2socks/core"
-	"github.com/xjasonlyu/tun2socks/tunnel"
-)
-
-var _ core.Handler = (*fakeTunnel)(nil)
-
-type fakeTunnel struct{}
-
-func (*fakeTunnel) Add(conn core.TCPConn) {
-	tunnel.Add(conn)
-}
-
-func (*fakeTunnel) AddPacket(packet core.UDPPacket) {
-	tunnel.AddPacket(packet)
-}

engine/version.go

@@ -1,22 +0,0 @@
-package engine
-
-import (
-	"fmt"
-	"runtime"
-	"strings"
-
-	V "github.com/xjasonlyu/tun2socks/constant"
-)
-
-func showVersion() {
-	fmt.Print(versionString())
-	fmt.Print(releaseString())
-}
-
-func versionString() string {
-	return fmt.Sprintf("%s-%s\n", V.Name, strings.TrimPrefix(V.Version, "v"))
-}
-
-func releaseString() string {
-	return fmt.Sprintf("%s/%s, %s, %s\n", runtime.GOOS, runtime.GOARCH, runtime.Version(), V.GitCommit)
-}

go.mod

@@ -1,21 +1,35 @@
-module github.com/xjasonlyu/tun2socks
+module github.com/xjasonlyu/tun2socks/v2
 
-go 1.16
+go 1.23.1
 
 require (
-	github.com/Dreamacro/go-shadowsocks2 v0.1.7
-	github.com/go-chi/chi v4.1.2+incompatible
-	github.com/go-chi/cors v1.2.0
-	github.com/go-chi/render v1.0.1
-	github.com/gofrs/uuid v4.0.0+incompatible
-	github.com/gorilla/websocket v1.4.2
-	github.com/sirupsen/logrus v1.8.1
-	github.com/stretchr/testify v1.7.0
-	go.uber.org/atomic v1.9.0
-	golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 // indirect
-	golang.org/x/net v0.0.0-20210716203947-853a461950ff // indirect
-	golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c
-	golang.org/x/time v0.0.0-20210611083556-38a9dc6acbc6
-	golang.zx2c4.com/wireguard v0.0.0-20210624150102-15b24b6179e0
-	gvisor.dev/gvisor v0.0.0-20210716193733-566c23a60eea
+	github.com/docker/go-units v0.5.0
+	github.com/go-chi/chi/v5 v5.1.0
+	github.com/go-chi/cors v1.2.1
+	github.com/go-chi/render v1.0.3
+	github.com/go-gost/relay v0.5.0
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
+	github.com/google/uuid v1.6.0
+	github.com/gorilla/schema v1.4.1
+	github.com/gorilla/websocket v1.5.3
+	github.com/stretchr/testify v1.9.0
+	go.uber.org/atomic v1.11.0
+	go.uber.org/automaxprocs v1.6.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/crypto v0.31.0
+	golang.org/x/sys v0.28.0
+	golang.org/x/time v0.8.0
+	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
+	gopkg.in/yaml.v3 v3.0.1
+	gvisor.dev/gvisor v0.0.0-20241108012608-5901531b85ba
+)
+
+require (
+	github.com/ajg/form v1.5.1 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/net v0.31.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 )

internal/pool/pool.go

@@ -0,0 +1,38 @@
+// Package pool provides internal pool utilities.
+package pool
+
+import (
+	"sync"
+)
+
+// A Pool is a generic wrapper around [sync.Pool] to provide strongly-typed
+// object pooling.
+//
+// Note that SA6002 (ref: https://staticcheck.io/docs/checks/#SA6002) will
+// not be detected, so all internal pool use must take care to only store
+// pointer types.
+type Pool[T any] struct {
+	pool sync.Pool
+}
+
+// New returns a new [Pool] for T, and will use fn to construct new Ts when
+// the pool is empty.
+func New[T any](fn func() T) *Pool[T] {
+	return &Pool[T]{
+		pool: sync.Pool{
+			New: func() any {
+				return fn()
+			},
+		},
+	}
+}
+
+// Get gets a T from the pool, or creates a new one if the pool is empty.
+func (p *Pool[T]) Get() T {
+	return p.pool.Get().(T)
+}
+
+// Put returns x into the pool.
+func (p *Pool[T]) Put(x T) {
+	p.pool.Put(x)
+}

internal/pool/pool_test.go

@@ -0,0 +1,85 @@
+package pool
+
+import (
+	"runtime/debug"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type pooledValue[T any] struct {
+	value T
+}
+
+func TestNew(t *testing.T) {
+	// Disable GC to avoid the victim cache during the test.
+	defer debug.SetGCPercent(debug.SetGCPercent(-1))
+
+	p := New(func() *pooledValue[string] {
+		return &pooledValue[string]{
+			value: "new",
+		}
+	})
+
+	// Probabilistically, 75% of sync.Pool.Put calls will succeed when -race
+	// is enabled (see ref below); attempt to make this quasi-deterministic by
+	// brute force (i.e., put significantly more objects in the pool than we
+	// will need for the test) in order to avoid testing without race enabled.
+	//
+	// ref: https://cs.opensource.google/go/go/+/refs/tags/go1.20.2:src/sync/pool.go;l=100-103
+	for i := 0; i < 1_000; i++ {
+		p.Put(&pooledValue[string]{
+			value: t.Name(),
+		})
+	}
+
+	// Ensure that we always get the expected value. Note that this must only
+	// run a fraction of the number of times that Put is called above.
+	for i := 0; i < 10; i++ {
+		func() {
+			x := p.Get()
+			defer p.Put(x)
+			require.Equal(t, t.Name(), x.value)
+		}()
+	}
+
+	// Depool all objects that might be in the pool to ensure that it's empty.
+	for i := 0; i < 1_000; i++ {
+		p.Get()
+	}
+
+	// Now that the pool is empty, it should use the value specified in the
+	// underlying sync.Pool.New func.
+	require.Equal(t, "new", p.Get().value)
+}
+
+func TestNew_Race(t *testing.T) {
+	p := New(func() *pooledValue[int] {
+		return &pooledValue[int]{
+			value: -1,
+		}
+	})
+
+	var wg sync.WaitGroup
+	defer wg.Wait()
+
+	// Run a number of goroutines that read and write pool object fields to
+	// tease out races.
+	for i := 0; i < 1_000; i++ {
+		i := i
+
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+
+			x := p.Get()
+			defer p.Put(x)
+
+			// Must both read and write the field.
+			if n := x.value; n >= -1 {
+				x.value = i
+			}
+		}()
+	}
+}

internal/version/module.go

@@ -0,0 +1,11 @@
+package version
+
+import (
+	"runtime/debug"
+)
+
+// Info returns project dependencies as []*debug.Module.
+func Info() []*debug.Module {
+	bi, _ := debug.ReadBuildInfo()
+	return bi.Deps
+}

internal/version/version.go

@@ -0,0 +1,27 @@
+package version
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+)
+
+const Name = "tun2socks"
+
+var (
+	// Version can be set at link time by executing
+	// the command: `git describe --abbrev=0 --tags HEAD`
+	Version string
+
+	// GitCommit can be set at link time by executing
+	// the command: `git rev-parse --short HEAD`
+	GitCommit string
+)
+
+func String() string {
+	return fmt.Sprintf("%s-%s", Name, strings.TrimPrefix(Version, "v"))
+}
+
+func BuildString() string {
+	return fmt.Sprintf("%s/%s, %s, %s", runtime.GOOS, runtime.GOARCH, runtime.Version(), GitCommit)
+}

log/doc.go

@@ -0,0 +1,2 @@
+// Package log is a thin wrapper based on "go.uber.org/zap".
+package log

log/emitter.go

@@ -0,0 +1,37 @@
+package log
+
+import (
+	"runtime"
+	"strings"
+	"time"
+
+	glog "gvisor.dev/gvisor/pkg/log"
+)
+
+var _globalE = &emitter{}
+
+func init() {
+	glog.SetTarget(_globalE)
+}
+
+type emitter struct {
+	logger *SugaredLogger
+}
+
+func (e *emitter) setLogger(logger *SugaredLogger) {
+	e.logger = logger.WithOptions(pkgCallerSkip)
+}
+
+func (e *emitter) logf(level glog.Level, format string, args ...any) {
+	e.logger.Logf(1-Level(level), "[STACK] "+format, args...)
+}
+
+func (e *emitter) Emit(depth int, level glog.Level, _ time.Time, format string, args ...any) {
+	if _, file, line, ok := runtime.Caller(depth + 1); ok {
+		// Ignore: gvisor.dev/gvisor/pkg/tcpip/adapters/gonet/gonet.go:457
+		if line == 457 && strings.HasSuffix(file, "gonet/gonet.go") {
+			return
+		}
+	}
+	e.logf(level, format, args...)
+}