Fix: HTTP proxy basic auth error (#266)

Signed-off-by: yusheng <yusheng@tencent.com>

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+xjasonlyu@gmail.com.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,33 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Environment**
- - OS: [e.g. `Ubuntu-20.04`]
- - Version: [e.g. `v2.1.0`]
- - Network: [e.g. route tables, iptables rules]
-
-**Log**
-Paste the tun2socks log below with the log level set to `DEBUG`.
-```
-```
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. [First Step]
-2. [Second Step]
-3. ……
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Additional context**
-Add any other context about the problem here.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,55 @@
+name: Bug report
+description: Create a report to help us improve
+title: "[Bug] "
+body:
+  - type: checkboxes
+    id: ensure
+    attributes:
+      label: Verify steps
+      description: Please verify that you've followed these steps
+      options:
+        - label: Is this something you can **debug and fix**? Send a pull request! Bug fixes and documentation fixes are welcome.
+          required: true
+
+        - label: I have searched on the [issue tracker](……/) for a related issue.
+          required: true
+
+  - type: input
+    attributes:
+      label: Version
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: What OS are you seeing the problem on?
+      multiple: true
+      options:
+        - Windows
+        - Linux
+        - macOS
+        - OpenBSD/FreeBSD
+        - Other
+
+  - type: textarea
+    attributes:
+      label: Description
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: CLI or Config
+      description: Paste the command line parameters or configuration below.
+
+  - type: textarea
+    attributes:
+      render: shell
+      label: Logs
+      description: Paste the logs below with the log level set to `DEBUG`.
+
+  - type: textarea
+    attributes:
+      label: How to Reproduce
+      description: Steps to reproduce the behavior, if any.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,9 @@
+blank_issues_enabled: false
+
+contact_links:
+  - name: tun2socks GitHub Wiki
+    url: https://github.com/xjasonlyu/tun2socks/wiki
+    about: Please see the wiki for common configurations
+  - name: tun2socks GitHub Discussions
+    url: https://github.com/xjasonlyu/tun2socks/discussions
+    about: Ask questions and get help on GitHub Discussions

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,20 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Is your feature request related to a problem?**
-A clear and concise description of what the problem is.
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
-
-**Additional context**
-Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Suggest an idea or improvement
+title: "[Feature] "
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      placeholder: A clear description of the feature or enhancement.
+    validations:
+      required: true
+
+  - type: textarea
+    id: related
+    attributes:
+      label: Is this feature related to a specific bug?
+      description: Please include a bug references if yes.
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Do you have a specific solution in mind?
+      description: >
+        Please include any details about a solution that you have in mind,
+        including any alternatives considered.

.github/SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| :-----: | :----------------: |
+|   2.x   | :white_check_mark: |
+|   1.x   | :x: |
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in this repository, please report it to me through coordinated disclosure.
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Instead, please send an email to xjasonlyu[@]gmail.com.
+
+Please include as much of the information listed below as you can to help me better understand and resolve the issue:
+
+  * The type of issue (e.g., buffer overflow, payload attack)
+  * Full paths of source file(s) related to the manifestation of the issue
+  * The location of the affected source code (tag/branch/commit or direct URL)
+  * Any special configuration required to reproduce the issue
+  * Step-by-step instructions to reproduce the issue
+  * Proof-of-concept or exploit code (if possible)
+  * Impact of the issue, including how an attacker might exploit the issue
+
+This information will help me triage your report more quickly.

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,30 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/docker.yml

@@ -6,9 +6,6 @@ on:
       - 'main'
     tags:
       - '*'
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
 
 jobs:
 
@@ -18,58 +15,62 @@ jobs:
     steps:
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
         with:
           platforms: all
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
         with:
           version: latest
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: xjasonlyu
-          password: ${{ secrets.CR_PAT }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Get Version
         id: shell
         run: |
-          echo ::set-output name=version::$(git describe --tags --abbrev=0)
+          echo "version=$(git describe --tags --abbrev=0)" >> $GITHUB_OUTPUT
 
-      - name: Build and Push (nightly)
+      - name: Build and Push (dev)
         if: github.ref == 'refs/heads/main'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true
-          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
           tags: |
-            xjasonlyu/tun2socks:nightly
-            ghcr.io/xjasonlyu/tun2socks:nightly
+            xjasonlyu/tun2socks:dev
+            ghcr.io/xjasonlyu/tun2socks:dev
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Build and Push (latest)
         if: startsWith(github.ref, 'refs/tags/')
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true
-          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64
           tags: |
             xjasonlyu/tun2socks:latest
             xjasonlyu/tun2socks:${{ steps.shell.outputs.version }}
             ghcr.io/xjasonlyu/tun2socks:latest
             ghcr.io/xjasonlyu/tun2socks:${{ steps.shell.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/go.yml

@@ -1,39 +0,0 @@
-name: Go Static Check
-
-on:
-  push:
-    branches:
-      - '*'
-    tags-ignore:
-      - '*'
-  pull_request:
-
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
-
-      - name: Setup Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.17.x
-
-      - name: Cache go module
-        uses: actions/cache@v2
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
-
-      - name: Get dependencies, run test and static check
-        run: |
-          go test ./...
-          go vet ./...
-          go install honnef.co/go/tools/cmd/staticcheck@latest
-          staticcheck -- $(go list ./...)

.github/workflows/linter.yml

@@ -0,0 +1,18 @@
+name: Linter
+on: [ push, pull_request ]
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup Go
+        uses: actions/setup-go@v4
+        with:
+          check-latest: true
+          go-version: '1.20'
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: latest

.github/workflows/release.yml

@@ -4,10 +4,6 @@ on:
   push:
     tags:
       - '*'
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - 'docker/**'
 
 jobs:
   build:
@@ -15,23 +11,35 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v3
         with:
-          go-version: 1.17.x
+          check-latest: true
+          go-version: '1.20'
+
+      - name: Cache go module
+        uses: actions/cache@v3
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Run test
+        run: |
+          go test ./...
 
       - name: Build
+        if: startsWith(github.ref, 'refs/tags/')
         run: make -j releases
 
       - name: Upload Releases
         uses: softprops/action-gh-release@v1
         if: startsWith(github.ref, 'refs/tags/')
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           files: build/*
           draft: true

.github/workflows/stale.yml

@@ -8,9 +8,9 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v3
+      - uses: actions/stale@v7
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-issue-message: 'This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days'
+          exempt-issue-labels: 'question,bug,enhancement'
           days-before-stale: 60
           days-before-close: 7

.golangci.yaml

@@ -0,0 +1,23 @@
+linters:
+  disable-all: true
+  enable:
+    - gci
+    - gofumpt
+    - gosimple
+    - govet
+    - ineffassign
+    - misspell
+    - staticcheck
+    - unconvert
+    - unused
+    - usestdlibvars
+
+linters-settings:
+  gci:
+    custom-order: true
+    sections:
+      - standard
+      - default
+      - prefix(github.com/xjasonlyu/tun2socks)
+  staticcheck:
+    go: '1.20'

Dockerfile

@@ -1,19 +1,18 @@
 FROM golang:alpine AS builder
 
-WORKDIR /tun2socks-src
-COPY . /tun2socks-src
+WORKDIR /src
+COPY . /src
 
-RUN apk add --no-cache make git \
-    && make tun2socks \
-    && mv ./build/tun2socks /tun2socks
+RUN apk add --update --no-cache make git \
+    && make tun2socks
 
 FROM alpine:latest
 LABEL org.opencontainers.image.source="https://github.com/xjasonlyu/tun2socks"
 
 COPY docker/entrypoint.sh /entrypoint.sh
-COPY --from=builder /tun2socks /usr/bin/tun2socks
+COPY --from=builder /src/build/tun2socks /usr/bin/tun2socks
 
-RUN apk add --update --no-cache iptables iproute2 \
+RUN apk add --update --no-cache iptables iproute2 tzdata \
     && chmod +x /entrypoint.sh
 
 ENV TUN=tun0
@@ -21,9 +20,11 @@ ENV ADDR=198.18.0.1/15
 ENV LOGLEVEL=info
 ENV PROXY=direct://
 ENV MTU=9000
-ENV STATS=
-ENV TOKEN=
+ENV RESTAPI=
 ENV UDP_TIMEOUT=
+ENV TCP_SNDBUF=
+ENV TCP_RCVBUF=
+ENV TCP_AUTO_TUNING=
 ENV EXTRA_COMMANDS=
 ENV TUN_INCLUDED_ROUTES=
 ENV TUN_EXCLUDED_ROUTES=

Makefile

@@ -1,5 +1,5 @@
 BINARY := tun2socks
-MODULE := github.com/xjasonlyu/tun2socks
+MODULE := github.com/xjasonlyu/tun2socks/v2
 
 BUILD_DIR     := build
 BUILD_TAGS    :=
@@ -11,20 +11,23 @@ CGO_ENABLED := 0
 GO111MODULE := on
 
 LDFLAGS += -w -s -buildid=
-LDFLAGS += -X "$(MODULE)/constant.Version=$(BUILD_VERSION)"
-LDFLAGS += -X "$(MODULE)/constant.GitCommit=$(BUILD_COMMIT)"
+LDFLAGS += -X "$(MODULE)/internal/version.Version=$(BUILD_VERSION)"
+LDFLAGS += -X "$(MODULE)/internal/version.GitCommit=$(BUILD_COMMIT)"
 
 GO_BUILD = GO111MODULE=$(GO111MODULE) CGO_ENABLED=$(CGO_ENABLED) \
 	go build $(BUILD_FLAGS) -ldflags '$(LDFLAGS)' -tags '$(BUILD_TAGS)' -trimpath
 
 UNIX_ARCH_LIST = \
 	darwin-amd64 \
+	darwin-amd64-v3 \
 	darwin-arm64 \
 	freebsd-386 \
 	freebsd-amd64 \
+	freebsd-amd64-v3 \
 	freebsd-arm64 \
 	linux-386 \
 	linux-amd64 \
+	linux-amd64-v3 \
 	linux-arm64 \
 	linux-armv5 \
 	linux-armv6 \
@@ -38,17 +41,21 @@ UNIX_ARCH_LIST = \
 	linux-ppc64 \
 	linux-ppc64le \
 	linux-s390x \
-	openbsd-386 \
 	openbsd-amd64 \
+	openbsd-amd64-v3 \
 	openbsd-arm64
 
 WINDOWS_ARCH_LIST = \
 	windows-386 \
 	windows-amd64 \
+	windows-amd64-v3 \
 	windows-arm64 \
 	windows-arm32v7
 
-all: linux-amd64 darwin-amd64 windows-amd64
+all: linux-amd64 linux-arm64 darwin-amd64 darwin-arm64 windows-amd64
+
+debug: BUILD_TAGS += debug
+debug: all
 
 tun2socks:
 	$(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)
@@ -56,6 +63,9 @@ tun2socks:
 darwin-amd64:
 	GOARCH=amd64 GOOS=darwin $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+darwin-amd64-v3:
+	GOARCH=amd64 GOOS=darwin GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 darwin-arm64:
 	GOARCH=arm64 GOOS=darwin $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -65,6 +75,9 @@ freebsd-386:
 freebsd-amd64:
 	GOARCH=amd64 GOOS=freebsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+freebsd-amd64-v3:
+	GOARCH=amd64 GOOS=freebsd GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 freebsd-arm64:
 	GOARCH=arm64 GOOS=freebsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -74,6 +87,9 @@ linux-386:
 linux-amd64:
 	GOARCH=amd64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+linux-amd64-v3:
+	GOARCH=amd64 GOOS=linux GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 linux-arm64:
 	GOARCH=arm64 GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -113,12 +129,12 @@ linux-ppc64le:
 linux-s390x:
 	GOARCH=s390x GOOS=linux $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
-openbsd-386:
-	GOARCH=386 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
-
 openbsd-amd64:
 	GOARCH=amd64 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
+openbsd-amd64-v3:
+	GOARCH=amd64 GOOS=openbsd GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
+
 openbsd-arm64:
 	GOARCH=arm64 GOOS=openbsd $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@
 
@@ -128,6 +144,9 @@ windows-386:
 windows-amd64:
 	GOARCH=amd64 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
 
+windows-amd64-v3:
+	GOARCH=amd64 GOOS=windows GOAMD64=v3 $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
+
 windows-arm64:
 	GOARCH=arm64 GOOS=windows $(GO_BUILD) -o $(BUILD_DIR)/$(BINARY)-$@.exe
 
@@ -147,5 +166,12 @@ all-arch: $(UNIX_ARCH_LIST) $(WINDOWS_ARCH_LIST)
 
 releases: $(unix_releases) $(windows_releases)
 
+lint:
+	GOOS=darwin golangci-lint run ./...
+	GOOS=windows golangci-lint run ./...
+	GOOS=linux golangci-lint run ./...
+	GOOS=freebsd golangci-lint run ./...
+	GOOS=openbsd golangci-lint run ./...
+
 clean:
 	rm -rf $(BUILD_DIR)

README.md

@@ -1,44 +1,49 @@
-![tun2socks](docs/logo.png)
+![tun2socks](docs/wordmark.png)
 
 [![GitHub Workflow][1]](https://github.com/xjasonlyu/tun2socks/actions)
 [![Go Version][2]](https://github.com/xjasonlyu/tun2socks/blob/main/go.mod)
 [![Go Report][3]](https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks)
-[![GitHub License][4]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
-[![Releases][5]](https://github.com/xjasonlyu/tun2socks/releases)
+[![Maintainability][4]](https://codeclimate.com/github/xjasonlyu/tun2socks/maintainability)
+[![GitHub License][5]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
+[![Docker Pulls][6]](https://hub.docker.com/r/xjasonlyu/tun2socks)
+[![Releases][7]](https://github.com/xjasonlyu/tun2socks/releases)
 
-[1]: https://img.shields.io/github/workflow/status/xjasonlyu/tun2socks/Go?style=flat-square
-[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks/main?style=flat-square
-[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks?style=flat-square
-[4]: https://img.shields.io/github/license/xjasonlyu/tun2socks?style=flat-square
-[5]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?include_prereleases&style=flat-square
+[1]: https://img.shields.io/github/actions/workflow/status/xjasonlyu/tun2socks/release.yml?branch=main&logo=github
+[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks?logo=go
+[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks
+[4]: https://api.codeclimate.com/v1/badges/b5b30239174fc6603aca/maintainability
+[5]: https://img.shields.io/github/license/xjasonlyu/tun2socks
+[6]: https://img.shields.io/docker/pulls/xjasonlyu/tun2socks?logo=docker
+[7]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?logo=smartthings
 
 English | [简体中文](README_ZH.md)
 
 ## Features
 
-- **Fully support:** IPv4/IPv6/ICMP/TCP/UDP
-- **Proxy protocol:** HTTP/Socks4/Socks5/Shadowsocks
-- **Game ready:** optimized UDP transmission
-- **Pure Go:** no CGO required, stability improved
-- **Router mode:** forwarding packets in LAN
-- **TCP/IP stack:** powered by **[gVisor](https://github.com/google/gvisor)**
-- **High performance:** >2.5Gbps throughput
+- Proxy Everything: Handle all network traffic of any internet programs sent by the device through a proxy.
+- Proxy Protocols: HTTP/Socks4/Socks5/Shadowsocks with authentication support for remote connections.
+- Run Everywhere: Linux/macOS/Windows/FreeBSD/OpenBSD multi-platform support with specific optimization.
+- Gateway Mode: Act as a layer three gateway to handle network traffic from other devices in the same network.
+- Full IPv6 Support: All functions work in IPv6, tunnel IPv4 connections through IPv6 proxy and vice versa.
+- Network Stack: Powered by user-space TCP/IP stack from Google container application kernel **[gVisor](https://github.com/google/gvisor)**.
 
-## Requirements
+## Benchmarks
 
-| Target | Minimum | Recommended |
-| :----- | :-----: | :---------: |
-| System | Linux MacOS Freebsd OpenBSD Windows | Linux or MacOS |
-| Memory | >20MB | >128MB |
-| CPU | ANY | AMD64 or ARM64 |
+For all scenarios of usage, tun2socks performs best. See [here](https://github.com/xjasonlyu/tun2socks/wiki/Benchmarks) for more details.
+
+![benchmark](docs/benchmark.png)
 
 ## Documentation
 
-Documentations and quick start guides can be found at [Github Wiki](https://github.com/xjasonlyu/tun2socks/wiki).
+- [Install from Source](https://github.com/xjasonlyu/tun2socks/wiki/Install-from-Source)
+- [Quickstart Examples](https://github.com/xjasonlyu/tun2socks/wiki/Examples)
+- [Memory Optimization](https://github.com/xjasonlyu/tun2socks/wiki/Memory-Optimization)
+
+Full documentation and technical guides can be found at [Wiki](https://github.com/xjasonlyu/tun2socks/wiki).
 
 ## Community
 
-Welcome and feel free to ask any questions at [Github Discussions](https://github.com/xjasonlyu/tun2socks/discussions).
+Welcome and feel free to ask any questions at [Discussions](https://github.com/xjasonlyu/tun2socks/discussions).
 
 ## Credits
 
@@ -51,3 +56,7 @@ Welcome and feel free to ask any questions at [Github Discussions](https://githu
 [GPL-3.0](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
 
 [![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks?ref=badge_large)
+
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=xjasonlyu/tun2socks&type=Date)](https://star-history.com/#xjasonlyu/tun2socks&Date)

README_ZH.md

@@ -1,59 +1,49 @@
-![tun2socks](docs/logo.png)
+![tun2socks](docs/wordmark.png)
 
 [![GitHub Workflow][1]](https://github.com/xjasonlyu/tun2socks/actions)
 [![Go Version][2]](https://github.com/xjasonlyu/tun2socks/blob/main/go.mod)
 [![Go Report][3]](https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks)
-[![GitHub License][4]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
-[![Releases][5]](https://github.com/xjasonlyu/tun2socks/releases)
+[![Maintainability][4]](https://codeclimate.com/github/xjasonlyu/tun2socks/maintainability)
+[![GitHub License][5]](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
+[![Docker Pulls][6]](https://hub.docker.com/r/xjasonlyu/tun2socks)
+[![Releases][7]](https://github.com/xjasonlyu/tun2socks/releases)
 
-[1]: https://img.shields.io/github/workflow/status/xjasonlyu/tun2socks/Go?style=flat-square
-[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks/main?style=flat-square
-[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks?style=flat-square
-[4]: https://img.shields.io/github/license/xjasonlyu/tun2socks?style=flat-square
-[5]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?include_prereleases&style=flat-square
+[1]: https://img.shields.io/github/actions/workflow/status/xjasonlyu/tun2socks/release.yml?branch=main&logo=github
+[2]: https://img.shields.io/github/go-mod/go-version/xjasonlyu/tun2socks?logo=go
+[3]: https://goreportcard.com/badge/github.com/xjasonlyu/tun2socks
+[4]: https://api.codeclimate.com/v1/badges/b5b30239174fc6603aca/maintainability
+[5]: https://img.shields.io/github/license/xjasonlyu/tun2socks
+[6]: https://img.shields.io/docker/pulls/xjasonlyu/tun2socks?logo=docker
+[7]: https://img.shields.io/github/v/release/xjasonlyu/tun2socks?logo=smartthings
 
 [English](README.md) | 简体中文
 
-## 为什么使用 tun2socks ？
-
-通过在主机上运行`tun2socks`，可以轻松地接管所有的`TCP/UDP`流量，同时提供诸多专业的功能特性，这包括：
-
-- 强制使不支持代理的程序走代理
-- 配合Clash、V2Ray等工具实现全局代理上网
-- 配合Burp、Charles等工具进行应用层数据的调试
-- 配合DHCP、CoreDNS等工具部署路由模式代理局域网流量
-
 ## 特性介绍
 
-- **全面支持：** IPv4/IPv6/ICMP/TCP/UDP
-- **代理协议：** HTTP/Socks4/Socks5/Shadowsocks
-- **游戏加速：** 针对UDP传输的优化
-- **纯Go实现：** 无需CGO，稳定性提升
-- **路由模式：** 转发代理局域网内所有流量
-- **TCP/IP栈：** 由 **[gVisor](https://github.com/google/gvisor)** 强力驱动 
-- **高性能：** >2.5Gbps 的带宽吞吐量
+- 全局代理: 处理来自本设备的任意网络应用的所有网络流量并通过代理转发。
+- 代理协议: 通过 HTTP/Socks4/Socks5/Shadowsocks 远程连接且支持鉴权。
+- 跨平台性: 具有 Linux/macOS/Windows/FreeBSD/OpenBSD 特定优化的多平台支持。
+- 网关模式: 作为第三层网关处理来自同一网络中其他设备的所有网络流量。
+- IPv6 支持: 所有功能都可以在 IPv6 中工作，允许通过 IPv6 代理转发 IPv4 连接，反之亦然。
+- TCP/IP 栈: 由来自 Google 容器应用程序内核 **[gVisor](https://github.com/google/gvisor)** 的用户空间 TCP/IP 网络栈强力驱动。
 
-## 硬件需求
+## 性能测试
 
-| 目标 | 最小 | 建议 |
-| :--- | :---: | :---: |
-| 系统 | Linux MacOS Freebsd OpenBSD Windows | Linux or MacOS |
-| 内存 | >20MB | >128MB |
-| 架构 | ANY | AMD64 or ARM64 |
+对于任意的使用场景，tun2socks 表现最佳。更多细节看[这里](https://github.com/xjasonlyu/tun2socks/wiki/Benchmarks)。
+
+![benchmark](docs/benchmark.png)
 
 ## 使用文档
 
-文档以及使用方式，请看 [Github Wiki](https://github.com/xjasonlyu/tun2socks/wiki)。
+- [源码安装](https://github.com/xjasonlyu/tun2socks/wiki/Install-from-Source)
+- [使用例子](https://github.com/xjasonlyu/tun2socks/wiki/Examples)
+- [内存优化](https://github.com/xjasonlyu/tun2socks/wiki/Memory-Optimization)
+
+文档以及使用方式可以在 [Wiki](https://github.com/xjasonlyu/tun2socks/wiki) 里找到。
 
 ## 交流讨论
 
-欢迎来讨论区交流提问，[Github Discussions](https://github.com/xjasonlyu/tun2socks/discussions)。
-
-## 注意事项
-
-1. 由于采用了纯Go实现，所以这一版本的`tun2socks`在有大量连接时内存消耗通常较多。如果您的需求对内存消耗极为敏感，请继续使用 [v1](https://github.com/xjasonlyu/tun2socks/tree/v1) 版本。
-2. `tun2socks`只应该专注于将网络层的TCP/UDP流量转发给SOCKS服务器，其他的如DNS（DoH）、DHCP等模块功能应该交由第三方应用实现，所以弃用了DNS模块。
-3. 因为是通过用户空间的网络栈接管所有流量并处理转发，在高吞吐时CPU的使用量会剧增，所以CPU的性能直接与可以达到的最大带宽挂钩。
+欢迎来讨论区 [Discussions](https://github.com/xjasonlyu/tun2socks/discussions) 交流提问。
 
 ## 特别感谢
 
@@ -61,8 +51,12 @@
 - [google/gvisor](https://github.com/google/gvisor) - Application Kernel for Containers
 - [wireguard-go](https://git.zx2c4.com/wireguard-go) - Go Implementation of WireGuard
 
-## License
+## 许可协议
 
 [GPL-3.0](https://github.com/xjasonlyu/tun2socks/blob/main/LICENSE)
 
 [![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fxjasonlyu%2Ftun2socks?ref=badge_large)
+
+## 星星历史
+
+[![Star History Chart](https://api.star-history.com/svg?repos=xjasonlyu/tun2socks&type=Date)](https://star-history.com/#xjasonlyu/tun2socks&Date)

common/observable/iterable.go

@@ -1,3 +1,3 @@
 package observable
 
-type Iterable <-chan interface{}
+type Iterable <-chan any

common/observable/observable.go

@@ -1,7 +1,5 @@
 package observable
 
-// Ref: github.com/Dreamacro/clash/common/observable
-
 import (
 	"errors"
 	"sync"

common/observable/observable_test.go

@@ -9,8 +9,8 @@ import (
 	"go.uber.org/atomic"
 )
 
-func iterator(item []interface{}) chan interface{} {
-	ch := make(chan interface{})
+func iterator(item []any) chan any {
+	ch := make(chan any)
 	go func() {
 		time.Sleep(100 * time.Millisecond)
 		for _, elm := range item {
@@ -22,7 +22,7 @@ func iterator(item []interface{}) chan interface{} {
 }
 
 func TestObservable(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
+	iter := iterator([]any{1, 2, 3, 4, 5})
 	src := NewObservable(iter)
 	data, err := src.Subscribe()
 	assert.Nil(t, err)
@@ -34,15 +34,15 @@ func TestObservable(t *testing.T) {
 }
 
 func TestObservable_MultiSubscribe(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
+	iter := iterator([]any{1, 2, 3, 4, 5})
 	src := NewObservable(iter)
 	ch1, _ := src.Subscribe()
 	ch2, _ := src.Subscribe()
-	var count = atomic.NewInt32(0)
+	count := atomic.NewInt32(0)
 
 	var wg sync.WaitGroup
 	wg.Add(2)
-	waitCh := func(ch <-chan interface{}) {
+	waitCh := func(ch <-chan any) {
 		for range ch {
 			count.Inc()
 		}
@@ -55,7 +55,7 @@ func TestObservable_MultiSubscribe(t *testing.T) {
 }
 
 func TestObservable_UnSubscribe(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
+	iter := iterator([]any{1, 2, 3, 4, 5})
 	src := NewObservable(iter)
 	data, err := src.Subscribe()
 	assert.Nil(t, err)
@@ -65,7 +65,7 @@ func TestObservable_UnSubscribe(t *testing.T) {
 }
 
 func TestObservable_SubscribeClosedSource(t *testing.T) {
-	iter := iterator([]interface{}{1})
+	iter := iterator([]any{1})
 	src := NewObservable(iter)
 	data, _ := src.Subscribe()
 	<-data
@@ -75,14 +75,14 @@ func TestObservable_SubscribeClosedSource(t *testing.T) {
 }
 
 func TestObservable_UnSubscribeWithNotExistSubscription(t *testing.T) {
-	sub := Subscription(make(chan interface{}))
-	iter := iterator([]interface{}{1})
+	sub := Subscription(make(chan any))
+	iter := iterator([]any{1})
 	src := NewObservable(iter)
 	src.UnSubscribe(sub)
 }
 
 func TestObservable_SubscribeGoroutineLeak(t *testing.T) {
-	iter := iterator([]interface{}{1, 2, 3, 4, 5})
+	iter := iterator([]any{1, 2, 3, 4, 5})
 	src := NewObservable(iter)
 	max := 100
 
@@ -94,7 +94,7 @@ func TestObservable_SubscribeGoroutineLeak(t *testing.T) {
 
 	var wg sync.WaitGroup
 	wg.Add(max)
-	waitCh := func(ch <-chan interface{}) {
+	waitCh := func(ch <-chan any) {
 		for range ch {
 		}
 		wg.Done()
@@ -117,7 +117,7 @@ func TestObservable_SubscribeGoroutineLeak(t *testing.T) {
 }
 
 func Benchmark_Observable_1000(b *testing.B) {
-	ch := make(chan interface{})
+	ch := make(chan any)
 	o := NewObservable(ch)
 	num := 1000
 

common/observable/subscriber.go

@@ -4,14 +4,14 @@ import (
 	"sync"
 )
 
-type Subscription <-chan interface{}
+type Subscription <-chan any
 
 type Subscriber struct {
-	buffer chan interface{}
+	buffer chan any
 	once   sync.Once
 }
 
-func (s *Subscriber) Emit(item interface{}) {
+func (s *Subscriber) Emit(item any) {
 	s.buffer <- item
 }
 
@@ -27,7 +27,7 @@ func (s *Subscriber) Close() {
 
 func newSubscriber() *Subscriber {
 	sub := &Subscriber{
-		buffer: make(chan interface{}, 200),
+		buffer: make(chan any, 200),
 	}
 	return sub
 }

common/pool/alloc.go

@@ -22,7 +22,7 @@ func NewAllocator() *Allocator {
 	alloc.buffers = make([]sync.Pool, 17) // 1B -> 64K
 	for k := range alloc.buffers {
 		i := k
-		alloc.buffers[k].New = func() interface{} {
+		alloc.buffers[k].New = func() any {
 			return make([]byte, 1<<uint32(i))
 		}
 	}
@@ -52,6 +52,7 @@ func (alloc *Allocator) Put(buf []byte) error {
 	}
 
 	//lint:ignore SA6002 ignore temporarily
+	//nolint
 	alloc.buffers[b].Put(buf)
 	return nil
 }

common/pool/buffer.go

@@ -0,0 +1,17 @@
+package pool
+
+import (
+	"bytes"
+	"sync"
+)
+
+var bufferPool = sync.Pool{New: func() any { return &bytes.Buffer{} }}
+
+func GetBuffer() *bytes.Buffer {
+	return bufferPool.Get().(*bytes.Buffer)
+}
+
+func PutBuffer(buf *bytes.Buffer) {
+	buf.Reset()
+	bufferPool.Put(buf)
+}

common/pool/pool.go

@@ -1,15 +1,14 @@
 // Package pool provides a pool of []byte.
 package pool
 
-// Ref: github.com/Dreamacro/clash/common/pool
-
 const (
 	// MaxSegmentSize is the largest possible UDP datagram size.
 	MaxSegmentSize = (1 << 16) - 1
 
-	// io.Copy default buffer size is 32 KiB, but the maximum packet
-	// size of vmess/shadowsocks is about 16 KiB, so define a buffer
-	// of 20 KiB to reduce the memory of each TCP relay.
+	// RelayBufferSize is a buffer of 20 KiB to reduce the memory
+	// of each TCP relay as io.Copy default buffer size is 32 KiB,
+	// but the maximum packet size of vmess/shadowsocks is about
+	// 16 KiB, so define .
 	RelayBufferSize = 20 << 10
 )
 

component/dialer/bind.go

@@ -1,21 +0,0 @@
-package dialer
-
-import (
-	"net"
-	"sync"
-)
-
-var _bindOnce sync.Once
-
-// BindToInterface binds dialer to specific interface.
-func BindToInterface(name string) error {
-	i, err := net.InterfaceByName(name)
-	if err != nil {
-		return err
-	}
-
-	_bindOnce.Do(func() {
-		addControl(bindToInterface(i))
-	})
-	return nil
-}

component/dialer/bind_darwin.go

@@ -1,26 +0,0 @@
-package dialer
-
-import (
-	"net"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func bindToInterface(i *net.Interface) controlFunc {
-	return func(network, address string, c syscall.RawConn) error {
-		ipStr, _, _ := net.SplitHostPort(address)
-		if ip := net.ParseIP(ipStr); ip != nil && !ip.IsGlobalUnicast() {
-			return nil
-		}
-
-		return c.Control(func(fd uintptr) {
-			switch network {
-			case "tcp4", "udp4":
-				unix.SetsockoptInt(int(fd), syscall.IPPROTO_IP, syscall.IP_BOUND_IF, i.Index)
-			case "tcp6", "udp6":
-				unix.SetsockoptInt(int(fd), syscall.IPPROTO_IPV6, syscall.IPV6_BOUND_IF, i.Index)
-			}
-		})
-	}
-}

component/dialer/bind_linux.go

@@ -1,21 +0,0 @@
-package dialer
-
-import (
-	"net"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func bindToInterface(i *net.Interface) controlFunc {
-	return func(network, address string, c syscall.RawConn) error {
-		ipStr, _, _ := net.SplitHostPort(address)
-		if ip := net.ParseIP(ipStr); ip != nil && !ip.IsGlobalUnicast() {
-			return nil
-		}
-
-		return c.Control(func(fd uintptr) {
-			unix.BindToDevice(int(fd), i.Name)
-		})
-	}
-}

component/dialer/bind_others.go

@@ -1,15 +0,0 @@
-//go:build !linux && !darwin
-
-package dialer
-
-import (
-	"errors"
-	"net"
-	"syscall"
-)
-
-func bindToInterface(_ *net.Interface) controlFunc {
-	return func(string, string, syscall.RawConn) error {
-		return errors.New("unsupported platform")
-	}
-}

component/dialer/control.go

@@ -1,37 +0,0 @@
-package dialer
-
-import (
-	"errors"
-	"net"
-	"syscall"
-)
-
-type controlFunc func(string, string, syscall.RawConn) error
-
-var (
-	_controlPool = make([]controlFunc, 0, 2)
-)
-
-func addControl(f controlFunc) {
-	_controlPool = append(_controlPool, f)
-}
-
-func setControl(i interface{}) {
-	control := func(address, network string, c syscall.RawConn) error {
-		for _, f := range _controlPool {
-			if err := f(address, network, c); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-
-	switch v := i.(type) {
-	case *net.Dialer:
-		v.Control = control
-	case *net.ListenConfig:
-		v.Control = control
-	default:
-		panic(errors.New("wrong type"))
-	}
-}

component/dialer/dialer.go

@@ -1,22 +0,0 @@
-package dialer
-
-import (
-	"context"
-	"net"
-)
-
-func Dial(network, address string) (net.Conn, error) {
-	return DialContext(context.Background(), network, address)
-}
-
-func DialContext(ctx context.Context, network, address string) (net.Conn, error) {
-	d := &net.Dialer{}
-	setControl(d)
-	return d.DialContext(ctx, network, address)
-}
-
-func ListenPacket(network, address string) (net.PacketConn, error) {
-	lc := &net.ListenConfig{}
-	setControl(lc)
-	return lc.ListenPacket(context.Background(), network, address)
-}

component/dialer/fwmark.go

@@ -1,14 +0,0 @@
-package dialer
-
-import (
-	"sync"
-)
-
-var _setOnce sync.Once
-
-// SetMark sets the mark for each packet sent through this dialer(socket).
-func SetMark(i int) {
-	_setOnce.Do(func() {
-		addControl(setMark(i))
-	})
-}

component/dialer/fwmark_linux.go

@@ -1,15 +0,0 @@
-package dialer
-
-import (
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-func setMark(i int) controlFunc {
-	return func(_, _ string, c syscall.RawConn) error {
-		return c.Control(func(fd uintptr) {
-			unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, i)
-		})
-	}
-}

component/dialer/fwmark_others.go

@@ -1,14 +0,0 @@
-//go:build !linux
-
-package dialer
-
-import (
-	"errors"
-	"syscall"
-)
-
-func setMark(_ int) controlFunc {
-	return func(string, string, syscall.RawConn) error {
-		return errors.New("fwmark: linux only")
-	}
-}

component/nat/nat.go

@@ -1,31 +0,0 @@
-/*
-Package nat provides simple NAT table implements.
-
-* Normal (Full Cone) NAT
-A full cone NAT is one where all requests from the same internal IP address
-and port are mapped to the same external IP address and port. Furthermore,
-any external host can send a packet to the internal host, by sending a packet
-to the mapped external address.
-
-* Restricted Cone NAT
-A restricted cone NAT is one where all requests from the same internal IP
-address and port are mapped to the same external IP address and port.
-Unlike a full cone NAT, an external host (with IP address X) can send a
-packet to the internal host only if the internal host had previously sent
-a packet to IP address X.
-
-* Port Restricted Cone NAT
-A port restricted cone NAT is like a restricted cone NAT, but the restriction
-includes port numbers. Specifically, an external host can send a packet, with
-source IP address X and source port P, to the internal host only if the internal
-host had previously sent a packet to IP address X and port P.
-
-* Symmetric NAT
-A symmetric NAT is one where all requests from the same internal IP address
-and port, to a specific destination IP address and port, are mapped to the
-same external IP address and port. If the same host sends a packet with the
-same source address and port, but to a different destination, a different mapping
-is used. Furthermore, only the external host that receives a packet can send a
-UDP packet back to the internal host.
-*/
-package nat

component/nat/table.go

@@ -1,35 +0,0 @@
-package nat
-
-import (
-	"net"
-	"sync"
-)
-
-type Table struct {
-	mapping sync.Map
-}
-
-func (t *Table) Set(key string, pc net.PacketConn) {
-	t.mapping.Store(key, pc)
-}
-
-func (t *Table) Get(key string) net.PacketConn {
-	item, exist := t.mapping.Load(key)
-	if !exist {
-		return nil
-	}
-	return item.(net.PacketConn)
-}
-
-func (t *Table) GetOrCreateLock(key string) (*sync.Cond, bool) {
-	item, loaded := t.mapping.LoadOrStore(key, sync.NewCond(&sync.Mutex{}))
-	return item.(*sync.Cond), loaded
-}
-
-func (t *Table) Delete(key string) {
-	t.mapping.Delete(key)
-}
-
-func NewTable() *Table {
-	return &Table{}
-}

constant/metadata.go

@@ -1,89 +0,0 @@
-package constant
-
-import (
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"net"
-	"strconv"
-
-	"github.com/xjasonlyu/tun2socks/transport/socks5"
-)
-
-const (
-	TCP Network = iota
-	UDP
-)
-
-type Network uint8
-
-func (n Network) String() string {
-	switch n {
-	case TCP:
-		return "tcp"
-	case UDP:
-		return "udp"
-	default:
-		return fmt.Sprintf("network(%d)", n)
-	}
-}
-
-func (n Network) MarshalText() ([]byte, error) {
-	return []byte(n.String()), nil
-}
-
-// Metadata implements the net.Addr interface.
-type Metadata struct {
-	Net     Network `json:"network"`
-	SrcIP   net.IP  `json:"sourceIP"`
-	MidIP   net.IP  `json:"dialerIP"`
-	DstIP   net.IP  `json:"destinationIP"`
-	SrcPort uint16  `json:"sourcePort"`
-	MidPort uint16  `json:"dialerPort"`
-	DstPort uint16  `json:"destinationPort"`
-}
-
-func (m *Metadata) DestinationAddress() string {
-	return net.JoinHostPort(m.DstIP.String(), strconv.FormatUint(uint64(m.DstPort), 10))
-}
-
-func (m *Metadata) SourceAddress() string {
-	return net.JoinHostPort(m.SrcIP.String(), strconv.FormatUint(uint64(m.SrcPort), 10))
-}
-
-func (m *Metadata) UDPAddr() *net.UDPAddr {
-	if m.Net != UDP || m.DstIP == nil {
-		return nil
-	}
-	return &net.UDPAddr{
-		IP:   m.DstIP,
-		Port: int(m.DstPort),
-	}
-}
-
-func (m *Metadata) SerializesSocksAddr() socks5.Addr {
-	var (
-		buf  [][]byte
-		port [2]byte
-	)
-	binary.BigEndian.PutUint16(port[:], m.DstPort)
-
-	if m.DstIP.To4() != nil /* IPv4 */ {
-		aType := socks5.AtypIPv4
-		buf = [][]byte{{aType}, m.DstIP.To4(), port[:]}
-	} else /* IPv6 */ {
-		aType := socks5.AtypIPv6
-		buf = [][]byte{{aType}, m.DstIP.To16(), port[:]}
-	}
-	return bytes.Join(buf, nil)
-}
-
-func (m *Metadata) Network() string {
-	return m.Net.String()
-}
-
-// String returns destination address of this metadata.
-// Also for implementing net.Addr interface.
-func (m *Metadata) String() string {
-	return m.DestinationAddress()
-}

constant/version.go

@@ -1,10 +0,0 @@
-package constant
-
-const (
-	Name = "tun2socks"
-)
-
-var (
-	Version   string
-	GitCommit string
-)

core/adapter.go

@@ -1,34 +0,0 @@
-package core
-
-import (
-	"net"
-
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-type TCPConn interface {
-	net.Conn
-	ID() *stack.TransportEndpointID
-}
-
-type UDPPacket interface {
-	// Data get the payload of UDP Packet.
-	Data() []byte
-
-	// Drop call after packet is used, could release resources in this function.
-	Drop()
-
-	// ID returns the transport endpoint id of packet.
-	ID() *stack.TransportEndpointID
-
-	// LocalAddr returns the source IP/Port of packet.
-	LocalAddr() net.Addr
-
-	// RemoteAddr returns the destination IP/Port of packet.
-	RemoteAddr() net.Addr
-
-	// WriteBack writes the payload with source IP/Port equals addr
-	// - variable source IP/Port is important to STUN
-	// - if addr is not provided, WriteBack will write out UDP packet with SourceIP/Port equals to original Target.
-	WriteBack([]byte, net.Addr) (int, error)
-}

core/adapter/adapter.go

@@ -0,0 +1,24 @@
+package adapter
+
+import (
+	"net"
+
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+// TCPConn implements the net.Conn interface.
+type TCPConn interface {
+	net.Conn
+
+	// ID returns the transport endpoint id of TCPConn.
+	ID() *stack.TransportEndpointID
+}
+
+// UDPConn implements net.Conn and net.PacketConn.
+type UDPConn interface {
+	net.Conn
+	net.PacketConn
+
+	// ID returns the transport endpoint id of UDPConn.
+	ID() *stack.TransportEndpointID
+}

core/adapter/handler.go

@@ -0,0 +1,8 @@
+package adapter
+
+// TransportHandler is a TCP/UDP connection handler that implements
+// HandleTCP and HandleUDP methods.
+type TransportHandler interface {
+	HandleTCP(TCPConn)
+	HandleUDP(UDPConn)
+}

core/device/fdbased/fd.go

@@ -0,0 +1,3 @@
+package fdbased
+
+const Driver = "fd"

core/device/fdbased/fd_unix.go

@@ -0,0 +1,47 @@
+//go:build !windows
+
+package fdbased
+
+import (
+	"fmt"
+	"strconv"
+
+	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+const defaultMTU = 1500
+
+type FD struct {
+	stack.LinkEndpoint
+
+	fd  int
+	mtu uint32
+}
+
+func Open(name string, mtu uint32) (device.Device, error) {
+	fd, err := strconv.Atoi(name)
+	if err != nil {
+		return nil, fmt.Errorf("cannot open fd: %s", name)
+	}
+	if mtu == 0 {
+		mtu = defaultMTU
+	}
+	return open(fd, mtu)
+}
+
+func (f *FD) Type() string {
+	return Driver
+}
+
+func (f *FD) Name() string {
+	return strconv.Itoa(f.fd)
+}
+
+func (f *FD) Close() error {
+	return unix.Close(f.fd)
+}
+
+var _ device.Device = (*FD)(nil)

core/device/fdbased/fd_windows.go

@@ -0,0 +1,11 @@
+package fdbased
+
+import (
+	"errors"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+func Open(name string, mtu uint32) (device.Device, error) {
+	return nil, errors.New("not supported")
+}

core/device/fdbased/open_linux.go

@@ -0,0 +1,28 @@
+//go:build (linux && amd64) || (linux && arm64)
+
+package fdbased
+
+import (
+	"fmt"
+
+	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+)
+
+func open(fd int, mtu uint32) (device.Device, error) {
+	f := &FD{fd: fd, mtu: mtu}
+
+	ep, err := fdbased.New(&fdbased.Options{
+		FDs: []int{fd},
+		MTU: mtu,
+		// TUN only, ignore ethernet header.
+		EthernetHeader: false,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	f.LinkEndpoint = ep
+
+	return f, nil
+}

core/device/fdbased/open_others.go

@@ -0,0 +1,23 @@
+//go:build !(linux && amd64) && !(linux && arm64) && !windows
+
+package fdbased
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/iobased"
+)
+
+func open(fd int, mtu uint32) (device.Device, error) {
+	f := &FD{fd: fd, mtu: mtu}
+
+	ep, err := iobased.New(os.NewFile(uintptr(fd), f.Name()), mtu, 0)
+	if err != nil {
+		return nil, fmt.Errorf("create endpoint: %w", err)
+	}
+	f.LinkEndpoint = ep
+
+	return f, nil
+}

core/device/iobased/endpoint.go

@@ -0,0 +1,153 @@
+// Package iobased provides the implementation of io.ReadWriter
+// based data-link layer endpoints.
+package iobased
+
+import (
+	"context"
+	"errors"
+	"io"
+	"sync"
+
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/link/channel"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+)
+
+const (
+	// Queue length for outbound packet, arriving for read. Overflow
+	// causes packet drops.
+	defaultOutQueueLen = 1 << 10
+)
+
+// Endpoint implements the interface of stack.LinkEndpoint from io.ReadWriter.
+type Endpoint struct {
+	*channel.Endpoint
+
+	// rw is the io.ReadWriter for reading and writing packets.
+	rw io.ReadWriter
+
+	// mtu (maximum transmission unit) is the maximum size of a packet.
+	mtu uint32
+
+	// offset can be useful when perform TUN device I/O with TUN_PI enabled.
+	offset int
+
+	// once is used to perform the init action once when attaching.
+	once sync.Once
+
+	// wg keeps track of running goroutines.
+	wg sync.WaitGroup
+}
+
+// New returns stack.LinkEndpoint(.*Endpoint) and error.
+func New(rw io.ReadWriter, mtu uint32, offset int) (*Endpoint, error) {
+	if mtu == 0 {
+		return nil, errors.New("MTU size is zero")
+	}
+
+	if rw == nil {
+		return nil, errors.New("RW interface is nil")
+	}
+
+	if offset < 0 {
+		return nil, errors.New("offset must be non-negative")
+	}
+
+	return &Endpoint{
+		Endpoint: channel.New(defaultOutQueueLen, mtu, ""),
+		rw:       rw,
+		mtu:      mtu,
+		offset:   offset,
+	}, nil
+}
+
+// Attach launches the goroutine that reads packets from io.Reader and
+// dispatches them via the provided dispatcher.
+func (e *Endpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	e.Endpoint.Attach(dispatcher)
+	e.once.Do(func() {
+		ctx, cancel := context.WithCancel(context.Background())
+		e.wg.Add(2)
+		go func() {
+			e.outboundLoop(ctx)
+			e.wg.Done()
+		}()
+		go func() {
+			e.dispatchLoop(cancel)
+			e.wg.Done()
+		}()
+	})
+}
+
+func (e *Endpoint) Wait() {
+	e.wg.Wait()
+}
+
+// dispatchLoop dispatches packets to upper layer.
+func (e *Endpoint) dispatchLoop(cancel context.CancelFunc) {
+	// Call cancel() to ensure (*Endpoint).outboundLoop(context.Context) exits
+	// gracefully after (*Endpoint).dispatchLoop(context.CancelFunc) returns.
+	defer cancel()
+
+	offset, mtu := e.offset, int(e.mtu)
+
+	for {
+		data := make([]byte, offset+mtu)
+
+		n, err := e.rw.Read(data)
+		if err != nil {
+			break
+		}
+
+		if n == 0 || n > mtu {
+			continue
+		}
+
+		if !e.IsAttached() {
+			continue /* unattached, drop packet */
+		}
+
+		pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
+			Payload: buffer.MakeWithData(data[offset : offset+n]),
+		})
+
+		switch header.IPVersion(data[offset:]) {
+		case header.IPv4Version:
+			e.InjectInbound(header.IPv4ProtocolNumber, pkt)
+		case header.IPv6Version:
+			e.InjectInbound(header.IPv6ProtocolNumber, pkt)
+		}
+		pkt.DecRef()
+	}
+}
+
+// outboundLoop reads outbound packets from channel, and then it calls
+// writePacket to send those packets back to lower layer.
+func (e *Endpoint) outboundLoop(ctx context.Context) {
+	for {
+		pkt := e.ReadContext(ctx)
+		if pkt.IsNil() {
+			break
+		}
+		e.writePacket(pkt)
+	}
+}
+
+// writePacket writes outbound packets to the io.Writer.
+func (e *Endpoint) writePacket(pkt stack.PacketBufferPtr) tcpip.Error {
+	defer pkt.DecRef()
+
+	buf := pkt.ToBuffer()
+	defer buf.Release()
+	if e.offset != 0 {
+		v := buffer.NewViewWithData(make([]byte, e.offset))
+		_ = buf.Prepend(v)
+	}
+
+	if _, err := e.rw.Write(buf.Flatten()); err != nil {
+		return &tcpip.ErrInvalidEndpointState{}
+	}
+	return nil
+}

core/device/rwbased/endpoint.go

@@ -1,144 +0,0 @@
-// Package rwbased provides the implementation of io.ReadWriter
-// based data-link layer endpoints.
-package rwbased
-
-import (
-	"errors"
-	"io"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/buffer"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-var _ stack.LinkEndpoint = (*Endpoint)(nil)
-
-// Endpoint implements the interface of stack.LinkEndpoint from io.ReadWriter.
-type Endpoint struct {
-	// rw is the io.ReadWriter for reading and writing packets.
-	rw io.ReadWriter
-
-	// mtu (maximum transmission unit) is the maximum size of a packet.
-	mtu uint32
-
-	dispatcher stack.NetworkDispatcher
-}
-
-// New returns stack.LinkEndpoint(.*Endpoint) and error.
-func New(rw io.ReadWriter, mtu uint32) (*Endpoint, error) {
-	if mtu == 0 {
-		return nil, errors.New("MTU size is zero")
-	}
-
-	if rw == nil {
-		return nil, errors.New("RW interface is nil")
-	}
-
-	return &Endpoint{
-		rw:  rw,
-		mtu: mtu,
-	}, nil
-}
-
-// Attach launches the goroutine that reads packets from io.ReadWriter and
-// dispatches them via the provided dispatcher.
-func (e *Endpoint) Attach(dispatcher stack.NetworkDispatcher) {
-	go e.dispatchLoop()
-	e.dispatcher = dispatcher
-}
-
-// IsAttached implements stack.LinkEndpoint.IsAttached.
-func (e *Endpoint) IsAttached() bool {
-	return e.dispatcher != nil
-}
-
-// dispatchLoop dispatches packets to upper layer.
-func (e *Endpoint) dispatchLoop() {
-	for {
-		packet := make([]byte, e.mtu)
-
-		n, err := e.rw.Read(packet)
-		if err != nil {
-			break
-		}
-
-		if !e.IsAttached() {
-			continue
-		}
-
-		pkb := stack.NewPacketBuffer(stack.PacketBufferOptions{
-			Data: buffer.NewVectorisedView(n, []buffer.View{buffer.NewViewFromBytes(packet)}),
-		})
-
-		switch header.IPVersion(packet) {
-		case header.IPv4Version:
-			e.dispatcher.DeliverNetworkPacket("", "", header.IPv4ProtocolNumber, pkb)
-		case header.IPv6Version:
-			e.dispatcher.DeliverNetworkPacket("", "", header.IPv6ProtocolNumber, pkb)
-		}
-	}
-}
-
-func (e *Endpoint) writePacket(pkt *stack.PacketBuffer) tcpip.Error {
-	vView := buffer.NewVectorisedView(pkt.Size(), pkt.Views())
-
-	if _, err := e.rw.Write(vView.ToView()); err != nil {
-		return &tcpip.ErrInvalidEndpointState{}
-	}
-	return nil
-}
-
-// WritePacket writes packet back into io.ReadWriter.
-func (e *Endpoint) WritePacket(_ stack.RouteInfo, _ tcpip.NetworkProtocolNumber, pkt *stack.PacketBuffer) tcpip.Error {
-	return e.writePacket(pkt)
-}
-
-// WritePackets writes packets back into io.ReadWriter.
-func (e *Endpoint) WritePackets(_ stack.RouteInfo, pkts stack.PacketBufferList, _ tcpip.NetworkProtocolNumber) (int, tcpip.Error) {
-	n := 0
-	for pkt := pkts.Front(); pkt != nil; pkt = pkt.Next() {
-		if err := e.writePacket(pkt); err != nil {
-			break
-		}
-		n++
-	}
-	return n, nil
-}
-
-func (e *Endpoint) WriteRawPacket(packetBuffer *stack.PacketBuffer) tcpip.Error {
-	return &tcpip.ErrNotSupported{}
-}
-
-// MTU implements stack.LinkEndpoint.MTU.
-func (e *Endpoint) MTU() uint32 {
-	return e.mtu
-}
-
-// Capabilities implements stack.LinkEndpoint.Capabilities.
-func (e *Endpoint) Capabilities() stack.LinkEndpointCapabilities {
-	return stack.CapabilityNone
-}
-
-// MaxHeaderLength returns the maximum size of the link layer header. Given it
-// doesn't have a header, it just returns 0.
-func (*Endpoint) MaxHeaderLength() uint16 {
-	return 0
-}
-
-// LinkAddress returns the link address of this endpoint.
-func (*Endpoint) LinkAddress() tcpip.LinkAddress {
-	return ""
-}
-
-// ARPHardwareType implements stack.LinkEndpoint.ARPHardwareType.
-func (*Endpoint) ARPHardwareType() header.ARPHardwareType {
-	return header.ARPHardwareNone
-}
-
-// AddHeader implements stack.LinkEndpoint.AddHeader.
-func (e *Endpoint) AddHeader(tcpip.LinkAddress, tcpip.LinkAddress, tcpip.NetworkProtocolNumber, *stack.PacketBuffer) {
-}
-
-// Wait implements stack.LinkEndpoint.Wait.
-func (e *Endpoint) Wait() {}

core/device/tun/io_unix.go

@@ -1,33 +0,0 @@
-//go:build darwin || freebsd || openbsd
-
-package tun
-
-import (
-	"github.com/xjasonlyu/tun2socks/common/pool"
-)
-
-const (
-	offset = 4 /* 4 bytes TUN_PI */
-
-	defaultMTU = 1500
-)
-
-func (t *TUN) Read(packet []byte) (n int, err error) {
-	buf := pool.Get(offset + len(packet))
-	defer pool.Put(buf)
-
-	if n, err = t.nt.Read(buf, offset); err != nil {
-		return
-	}
-
-	copy(packet, buf[offset:offset+n])
-	return
-}
-
-func (t *TUN) Write(packet []byte) (int, error) {
-	buf := pool.Get(offset + len(packet))
-	defer pool.Put(buf)
-
-	copy(buf[offset:], packet)
-	return t.nt.Write(buf[:offset+len(packet)], offset)
-}

core/device/tun/io_windows.go

@@ -1,15 +0,0 @@
-package tun
-
-const (
-	offset = 0
-
-	defaultMTU = 0 /* auto */
-)
-
-func (t *TUN) Read(packet []byte) (int, error) {
-	return t.nt.Read(packet, offset)
-}
-
-func (t *TUN) Write(packet []byte) (int, error) {
-	return t.nt.Write(packet, offset)
-}

core/device/tun/opts.go

@@ -1,15 +0,0 @@
-package tun
-
-type Option func(*TUN)
-
-func WithName(name string) Option {
-	return func(t *TUN) {
-		t.name = name
-	}
-}
-
-func WithMTU(mtu uint32) Option {
-	return func(t *TUN) {
-		t.mtu = mtu
-	}
-}

core/device/tun/tun.go

@@ -2,7 +2,7 @@
 package tun
 
 import (
-	"github.com/xjasonlyu/tun2socks/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
 )
 
 const Driver = "tun"

core/device/tun/tun_netstack.go

@@ -1,18 +1,17 @@
-//go:build linux
+//go:build (linux && amd64) || (linux && arm64)
 
 package tun
 
 import (
 	"fmt"
-	"unsafe"
-
-	"github.com/xjasonlyu/tun2socks/core/device"
 
 	"golang.org/x/sys/unix"
 	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
 	"gvisor.dev/gvisor/pkg/tcpip/link/rawfile"
 	"gvisor.dev/gvisor/pkg/tcpip/link/tun"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
 )
 
 type TUN struct {
@@ -23,12 +22,8 @@ type TUN struct {
 	name string
 }
 
-func Open(opts ...Option) (device.Device, error) {
-	t := &TUN{}
-
-	for _, opt := range opts {
-		opt(t)
-	}
+func Open(name string, mtu uint32) (device.Device, error) {
+	t := &TUN{name: name, mtu: mtu}
 
 	if len(t.name) >= unix.IFNAMSIZ {
 		return nil, fmt.Errorf("interface name too long: %s", t.name)
@@ -46,17 +41,28 @@ func Open(opts ...Option) (device.Device, error) {
 		}
 	}
 
-	mtu, err := rawfile.GetMTU(t.name)
+	_mtu, err := rawfile.GetMTU(t.name)
 	if err != nil {
 		return nil, fmt.Errorf("get mtu: %w", err)
 	}
-	t.mtu = mtu
+	t.mtu = _mtu
 
 	ep, err := fdbased.New(&fdbased.Options{
-		MTU: t.mtu,
 		FDs: []int{fd},
-		// TUN only
+		MTU: t.mtu,
+		// TUN only, ignore ethernet header.
 		EthernetHeader: false,
+		// SYS_READV support only for TUN fd.
+		PacketDispatchMode: fdbased.Readv,
+		// TAP/TUN fd's are not sockets and using the WritePackets calls results
+		// in errors as it always defaults to using SendMMsg which is not supported
+		// for tap/tun device fds.
+		//
+		// This CL changes WritePackets to gracefully degrade to using writev instead
+		// of sendmmsg if the underlying fd is not a socket.
+		//
+		// Fixed: https://github.com/google/gvisor/commit/f33d034fecd7723a1e560ccc62aeeba328454fd0
+		MaxSyscallHeaderBytes: 0x00,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("create endpoint: %w", err)
@@ -87,22 +93,10 @@ func setMTU(name string, n uint32) error {
 
 	defer unix.Close(fd)
 
-	const ifReqSize = unix.IFNAMSIZ + 64
-
-	// do ioctl call
-	var ifr [ifReqSize]byte
-	copy(ifr[:], name)
-	*(*uint32)(unsafe.Pointer(&ifr[unix.IFNAMSIZ])) = n
-	_, _, errno := unix.Syscall(
-		unix.SYS_IOCTL,
-		uintptr(fd),
-		uintptr(unix.SIOCSIFMTU),
-		uintptr(unsafe.Pointer(&ifr[0])),
-	)
-
-	if errno != 0 {
-		return fmt.Errorf("failed to set MTU: %w", errno)
+	ifr, err := unix.NewIfreq(name)
+	if err != nil {
+		return err
 	}
-
-	return nil
+	ifr.SetUint32(n)
+	return unix.IoctlIfreq(fd, unix.SIOCSIFMTU, ifr)
 }

core/device/tun/tun_wireguard.go

@@ -1,29 +1,46 @@
-//go:build !linux
+//go:build !(linux && amd64) && !(linux && arm64)
 
 package tun
 
 import (
 	"fmt"
-
-	"github.com/xjasonlyu/tun2socks/core/device"
-	"github.com/xjasonlyu/tun2socks/core/device/rwbased"
+	"sync"
 
 	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/iobased"
 )
 
 type TUN struct {
-	*rwbased.Endpoint
+	*iobased.Endpoint
 
-	nt   *tun.NativeTun
-	mtu  uint32
-	name string
+	nt     *tun.NativeTun
+	mtu    uint32
+	name   string
+	offset int
+
+	rSizes []int
+	rBuffs [][]byte
+	wBuffs [][]byte
+	rMutex sync.Mutex
+	wMutex sync.Mutex
 }
 
-func Open(opts ...Option) (device.Device, error) {
-	t := &TUN{}
+func Open(name string, mtu uint32) (_ device.Device, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			err = fmt.Errorf("open tun: %v", r)
+		}
+	}()
 
-	for _, opt := range opts {
-		opt(t)
+	t := &TUN{
+		name:   name,
+		mtu:    mtu,
+		offset: offset,
+		rSizes: make([]int, 1),
+		rBuffs: make([][]byte, 1),
+		wBuffs: make([][]byte, 1),
 	}
 
 	forcedMTU := defaultMTU
@@ -31,19 +48,19 @@ func Open(opts ...Option) (device.Device, error) {
 		forcedMTU = int(t.mtu)
 	}
 
-	nt, err := tun.CreateTUN(t.name, forcedMTU)
+	nt, err := createTUN(t.name, forcedMTU)
 	if err != nil {
 		return nil, fmt.Errorf("create tun: %w", err)
 	}
 	t.nt = nt.(*tun.NativeTun)
 
-	mtu, err := nt.MTU()
+	tunMTU, err := nt.MTU()
 	if err != nil {
 		return nil, fmt.Errorf("get mtu: %w", err)
 	}
-	t.mtu = uint32(mtu)
+	t.mtu = uint32(tunMTU)
 
-	ep, err := rwbased.New(t, t.mtu)
+	ep, err := iobased.New(t, t.mtu, offset)
 	if err != nil {
 		return nil, fmt.Errorf("create endpoint: %w", err)
 	}
@@ -52,11 +69,27 @@ func Open(opts ...Option) (device.Device, error) {
 	return t, nil
 }
 
+func (t *TUN) Read(packet []byte) (int, error) {
+	t.rMutex.Lock()
+	defer t.rMutex.Unlock()
+	t.rBuffs[0] = packet
+	_, err := t.nt.Read(t.rBuffs, t.rSizes, t.offset)
+	return t.rSizes[0], err
+}
+
+func (t *TUN) Write(packet []byte) (int, error) {
+	t.wMutex.Lock()
+	defer t.wMutex.Unlock()
+	t.wBuffs[0] = packet
+	return t.nt.Write(t.wBuffs, t.offset)
+}
+
 func (t *TUN) Name() string {
 	name, _ := t.nt.Name()
 	return name
 }
 
 func (t *TUN) Close() error {
+	defer t.Endpoint.Close()
 	return t.nt.Close()
 }

core/device/tun/tun_wireguard_linux.go

@@ -0,0 +1,26 @@
+//go:build linux && !(amd64 || arm64)
+
+package tun
+
+import (
+	"fmt"
+	"os"
+
+	"golang.zx2c4.com/wireguard/tun"
+	gun "gvisor.dev/gvisor/pkg/tcpip/link/tun"
+)
+
+const (
+	offset     = 0 /* IFF_NO_PI */
+	defaultMTU = 1500
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	nfd, err := gun.Open(name)
+	if err != nil {
+		return nil, fmt.Errorf("create tun: %w", err)
+	}
+
+	fd := os.NewFile(uintptr(nfd), "/dev/net/tun")
+	return tun.CreateTUNFromFile(fd, mtu)
+}

core/device/tun/tun_wireguard_unix.go

@@ -0,0 +1,16 @@
+//go:build unix && !linux
+
+package tun
+
+import (
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+const (
+	offset     = 4 /* 4 bytes TUN_PI */
+	defaultMTU = 1500
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	return tun.CreateTUN(name, mtu)
+}

core/device/tun/tun_wireguard_windows.go

@@ -0,0 +1,14 @@
+package tun
+
+import (
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+const (
+	offset     = 0
+	defaultMTU = 0 /* auto */
+)
+
+func createTUN(name string, mtu int) (tun.Device, error) {
+	return tun.CreateTUN(name, mtu)
+}

core/handler.go

@@ -1,6 +0,0 @@
-package core
-
-type Handler interface {
-	Add(TCPConn)
-	AddPacket(UDPPacket)
-}

core/nic.go

@@ -0,0 +1,58 @@
+package core
+
+import (
+	"fmt"
+
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+const (
+	// nicPromiscuousModeEnabled is the value used by stack to enable
+	// or disable NIC's promiscuous mode.
+	nicPromiscuousModeEnabled = true
+
+	// nicSpoofingEnabled is the value used by stack to enable or disable
+	// NIC's spoofing.
+	nicSpoofingEnabled = true
+)
+
+// withCreatingNIC creates NIC for stack.
+func withCreatingNIC(nicID tcpip.NICID, ep stack.LinkEndpoint) option.Option {
+	return func(s *stack.Stack) error {
+		if err := s.CreateNICWithOptions(nicID, ep,
+			stack.NICOptions{
+				Disabled: false,
+				// If no queueing discipline was specified
+				// provide a stub implementation that just
+				// delegates to the lower link endpoint.
+				QDisc: nil,
+			}); err != nil {
+			return fmt.Errorf("create NIC: %s", err)
+		}
+		return nil
+	}
+}
+
+// withPromiscuousMode sets promiscuous mode in the given NICs.
+func withPromiscuousMode(nicID tcpip.NICID, v bool) option.Option {
+	return func(s *stack.Stack) error {
+		if err := s.SetPromiscuousMode(nicID, v); err != nil {
+			return fmt.Errorf("set promiscuous mode: %s", err)
+		}
+		return nil
+	}
+}
+
+// withSpoofing sets address spoofing in the given NICs, allowing
+// endpoints to bind to any address in the NIC.
+func withSpoofing(nicID tcpip.NICID, v bool) option.Option {
+	return func(s *stack.Stack) error {
+		if err := s.SetSpoofing(nicID, v); err != nil {
+			return fmt.Errorf("set spoofing: %s", err)
+		}
+		return nil
+	}
+}

core/option/option.go

@@ -1,4 +1,4 @@
-package stack
+package option
 
 import (
 	"fmt"
@@ -7,23 +7,18 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
 	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 )
 
 const (
-	// maxBufferSize is the maximum permitted size of a send/receive buffer.
-	maxBufferSize = 4 << 20 // 4 MiB
-
-	// minBufferSize is the smallest size of a receive or send buffer.
-	minBufferSize = 4 << 10 // 4 KiB
-
-	// defaultBufferSize is the default size of the send/recv buffer for
-	// a transport endpoint.
-	defaultBufferSize = 212 << 10 // 212 KiB
-
 	// defaultTimeToLive specifies the default TTL used by stack.
 	defaultTimeToLive uint8 = 64
 
+	// ipForwardingEnabled is the value used by stack to enable packet
+	// forwarding between NICs.
+	ipForwardingEnabled = true
+
 	// icmpBurst is the default number of ICMP messages that can be sent in
 	// a single burst.
 	icmpBurst = 50
@@ -32,10 +27,6 @@ const (
 	// by this rate limiter.
 	icmpLimit rate.Limit = 1000
 
-	// ipForwardingEnabled is the value used by stack to enable packet
-	// forwarding between NICs.
-	ipForwardingEnabled = true
-
 	// tcpCongestionControl is the congestion control algorithm used by
 	// stack. ccReno is the default option in gVisor stack.
 	tcpCongestionControlAlgorithm = "reno" // "reno" or "cubic"
@@ -46,18 +37,35 @@ const (
 
 	// tcpModerateReceiveBufferEnabled is the value used by stack to
 	// enable or disable tcp receive buffer auto-tuning option.
-	tcpModerateReceiveBufferEnabled = true
+	tcpModerateReceiveBufferEnabled = false
 
 	// tcpSACKEnabled is the value used by stack to enable or disable
 	// tcp selective ACK.
 	tcpSACKEnabled = true
+
+	// tcpRecovery is the loss detection algorithm used by TCP.
+	tcpRecovery = tcpip.TCPRACKLossDetection
+
+	// tcpMinBufferSize is the smallest size of a send/recv buffer.
+	tcpMinBufferSize = tcp.MinBufferSize
+
+	// tcpMaxBufferSize is the maximum permitted size of a send/recv buffer.
+	tcpMaxBufferSize = tcp.MaxBufferSize
+
+	// tcpDefaultBufferSize is the default size of the send buffer for
+	// a transport endpoint.
+	tcpDefaultSendBufferSize = tcp.DefaultSendBufferSize
+
+	// tcpDefaultReceiveBufferSize is the default size of the receive buffer
+	// for a transport endpoint.
+	tcpDefaultReceiveBufferSize = tcp.DefaultReceiveBufferSize
 )
 
-type Option func(*Stack) error
+type Option func(*stack.Stack) error
 
 // WithDefault sets all default values for stack.
 func WithDefault() Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opts := []Option{
 			WithDefaultTTL(defaultTimeToLive),
 			WithForwarding(ipForwardingEnabled),
@@ -69,8 +77,9 @@ func WithDefault() Option {
 			// Too large buffers thrash cache, so there is little point
 			// in too large buffers.
 			//
-			// Ref: https://github.com/majek/slirpnetstack/blob/master/stack.go
-			WithTCPBufferSizeRange(minBufferSize, defaultBufferSize, maxBufferSize),
+			// Ref: https://github.com/cloudflare/slirpnetstack/blob/master/stack.go
+			WithTCPSendBufferSizeRange(tcpMinBufferSize, tcpDefaultSendBufferSize, tcpMaxBufferSize),
+			WithTCPReceiveBufferSizeRange(tcpMinBufferSize, tcpDefaultReceiveBufferSize, tcpMaxBufferSize),
 
 			WithTCPCongestionControl(tcpCongestionControlAlgorithm),
 			WithTCPDelay(tcpDelayEnabled),
@@ -82,6 +91,17 @@ func WithDefault() Option {
 			// TCP selective ACK Option, see:
 			// https://tools.ietf.org/html/rfc2018
 			WithTCPSACKEnabled(tcpSACKEnabled),
+
+			// TCPRACKLossDetection: indicates RACK is used for loss detection and
+			// recovery.
+			//
+			// TCPRACKStaticReoWnd: indicates the reordering window should not be
+			// adjusted when DSACK is received.
+			//
+			// TCPRACKNoDupTh: indicates RACK should not consider the classic three
+			// duplicate acknowledgements rule to mark the segments as lost. This
+			// is used when reordering is not detected.
+			WithTCPRecovery(tcpRecovery),
 		}
 
 		for _, opt := range opts {
@@ -96,7 +116,7 @@ func WithDefault() Option {
 
 // WithDefaultTTL sets the default TTL used by stack.
 func WithDefaultTTL(ttl uint8) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.DefaultTTLOption(ttl)
 		if err := s.SetNetworkProtocolOption(ipv4.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set ipv4 default TTL: %s", err)
@@ -110,7 +130,7 @@ func WithDefaultTTL(ttl uint8) Option {
 
 // WithForwarding sets packet forwarding between NICs for IPv4 & IPv6.
 func WithForwarding(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		if err := s.SetForwardingDefaultAndAllNICs(ipv4.ProtocolNumber, v); err != nil {
 			return fmt.Errorf("set ipv4 forwarding: %s", err)
 		}
@@ -124,7 +144,7 @@ func WithForwarding(v bool) Option {
 // WithICMPBurst sets the number of ICMP messages that can be sent
 // in a single burst.
 func WithICMPBurst(burst int) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		s.SetICMPBurst(burst)
 		return nil
 	}
@@ -133,19 +153,26 @@ func WithICMPBurst(burst int) Option {
 // WithICMPLimit sets the maximum number of ICMP messages permitted
 // by rate limiter.
 func WithICMPLimit(limit rate.Limit) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		s.SetICMPLimit(limit)
 		return nil
 	}
 }
 
-// WithTCPBufferSizeRange sets the receive and send buffer size range for TCP.
-func WithTCPBufferSizeRange(a, b, c int) Option {
-	return func(s *Stack) error {
-		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: a, Default: b, Max: c}
-		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
-			return fmt.Errorf("set TCP receive buffer size range: %s", err)
+// WithTCPSendBufferSize sets default the send buffer size for TCP.
+func WithTCPSendBufferSize(size int) Option {
+	return func(s *stack.Stack) error {
+		sndOpt := tcpip.TCPSendBufferSizeRangeOption{Min: tcpMinBufferSize, Default: size, Max: tcpMaxBufferSize}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &sndOpt); err != nil {
+			return fmt.Errorf("set TCP send buffer size range: %s", err)
 		}
+		return nil
+	}
+}
+
+// WithTCPSendBufferSizeRange sets the send buffer size range for TCP.
+func WithTCPSendBufferSizeRange(a, b, c int) Option {
+	return func(s *stack.Stack) error {
 		sndOpt := tcpip.TCPSendBufferSizeRangeOption{Min: a, Default: b, Max: c}
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &sndOpt); err != nil {
 			return fmt.Errorf("set TCP send buffer size range: %s", err)
@@ -154,9 +181,31 @@ func WithTCPBufferSizeRange(a, b, c int) Option {
 	}
 }
 
+// WithTCPReceiveBufferSize sets the default receive buffer size for TCP.
+func WithTCPReceiveBufferSize(size int) Option {
+	return func(s *stack.Stack) error {
+		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: tcpMinBufferSize, Default: size, Max: tcpMaxBufferSize}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
+			return fmt.Errorf("set TCP receive buffer size range: %s", err)
+		}
+		return nil
+	}
+}
+
+// WithTCPReceiveBufferSizeRange sets the receive buffer size range for TCP.
+func WithTCPReceiveBufferSizeRange(a, b, c int) Option {
+	return func(s *stack.Stack) error {
+		rcvOpt := tcpip.TCPReceiveBufferSizeRangeOption{Min: a, Default: b, Max: c}
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &rcvOpt); err != nil {
+			return fmt.Errorf("set TCP receive buffer size range: %s", err)
+		}
+		return nil
+	}
+}
+
 // WithTCPCongestionControl sets the current congestion control algorithm.
 func WithTCPCongestionControl(cc string) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.CongestionControlOption(cc)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP congestion control algorithm: %s", err)
@@ -167,7 +216,7 @@ func WithTCPCongestionControl(cc string) Option {
 
 // WithTCPDelay enables or disables Nagle's algorithm in TCP.
 func WithTCPDelay(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.TCPDelayEnabled(v)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP delay: %s", err)
@@ -178,7 +227,7 @@ func WithTCPDelay(v bool) Option {
 
 // WithTCPModerateReceiveBuffer sets receive buffer moderation for TCP.
 func WithTCPModerateReceiveBuffer(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.TCPModerateReceiveBufferOption(v)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP moderate receive buffer: %s", err)
@@ -189,7 +238,7 @@ func WithTCPModerateReceiveBuffer(v bool) Option {
 
 // WithTCPSACKEnabled sets the SACK option for TCP.
 func WithTCPSACKEnabled(v bool) Option {
-	return func(s *Stack) error {
+	return func(s *stack.Stack) error {
 		opt := tcpip.TCPSACKEnabled(v)
 		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
 			return fmt.Errorf("set TCP SACK: %s", err)
@@ -197,3 +246,13 @@ func WithTCPSACKEnabled(v bool) Option {
 		return nil
 	}
 }
+
+// WithTCPRecovery sets the recovery option for TCP.
+func WithTCPRecovery(v tcpip.TCPRecovery) Option {
+	return func(s *stack.Stack) error {
+		if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &v); err != nil {
+			return fmt.Errorf("set TCP Recovery: %s", err)
+		}
+		return nil
+	}
+}

core/route.go

@@ -1,22 +1,23 @@
-package stack
+package core
 
 import (
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
 )
 
-func withICMPHandler() Option {
-	return func(s *Stack) error {
-		// Add default route table for IPv4 and IPv6.
-		// This will handle all incoming ICMP packets.
+func withRouteTable(nicID tcpip.NICID) option.Option {
+	return func(s *stack.Stack) error {
 		s.SetRouteTable([]tcpip.Route{
 			{
 				Destination: header.IPv4EmptySubnet,
-				NIC:         s.nicID,
+				NIC:         nicID,
 			},
 			{
 				Destination: header.IPv6EmptySubnet,
-				NIC:         s.nicID,
+				NIC:         nicID,
 			},
 		})
 		return nil

core/stack.go

@@ -0,0 +1,99 @@
+package core
+
+import (
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+// Config is the configuration to create *stack.Stack.
+type Config struct {
+	// LinkEndpoints is the interface implemented by
+	// data link layer protocols.
+	LinkEndpoint stack.LinkEndpoint
+
+	// TransportHandler is the handler used by internal
+	// stack to set transport handlers.
+	TransportHandler adapter.TransportHandler
+
+	// Options are supplement options to apply settings
+	// for the internal stack.
+	Options []option.Option
+}
+
+// CreateStack creates *stack.Stack with given config.
+func CreateStack(cfg *Config) (*stack.Stack, error) {
+	opts := []option.Option{option.WithDefault()}
+	if len(opts) > 0 {
+		opts = append(opts, cfg.Options...)
+	}
+
+	s := stack.New(stack.Options{
+		NetworkProtocols: []stack.NetworkProtocolFactory{
+			ipv4.NewProtocol,
+			ipv6.NewProtocol,
+		},
+		TransportProtocols: []stack.TransportProtocolFactory{
+			tcp.NewProtocol,
+			udp.NewProtocol,
+			icmp.NewProtocol4,
+			icmp.NewProtocol6,
+		},
+	})
+
+	// Generate unique NIC id.
+	nicID := tcpip.NICID(s.UniqueID())
+
+	opts = append(opts,
+		// Important: We must initiate transport protocol handlers
+		// before creating NIC, otherwise NIC would dispatch packets
+		// to stack and cause race condition.
+		// Initiate transport protocol (TCP/UDP) with given handler.
+		withTCPHandler(cfg.TransportHandler.HandleTCP),
+		withUDPHandler(cfg.TransportHandler.HandleUDP),
+
+		// Create stack NIC and then bind link endpoint to it.
+		withCreatingNIC(nicID, cfg.LinkEndpoint),
+
+		// In the past we did s.AddAddressRange to assign 0.0.0.0/0
+		// onto the interface. We need that to be able to terminate
+		// all the incoming connections - to any ip. AddressRange API
+		// has been removed and the suggested workaround is to use
+		// Promiscuous mode. https://github.com/google/gvisor/issues/3876
+		//
+		// Ref: https://github.com/cloudflare/slirpnetstack/blob/master/stack.go
+		withPromiscuousMode(nicID, nicPromiscuousModeEnabled),
+
+		// Enable spoofing if a stack may send packets from unowned
+		// addresses. This change required changes to some netgophers
+		// since previously, promiscuous mode was enough to let the
+		// netstack respond to all incoming packets regardless of the
+		// packet's destination address. Now that a stack.Route is not
+		// held for each incoming packet, finding a route may fail with
+		// local addresses we don't own but accepted packets for while
+		// in promiscuous mode. Since we also want to be able to send
+		// from any address (in response the received promiscuous mode
+		// packets), we need to enable spoofing.
+		//
+		// Ref: https://github.com/google/gvisor/commit/8c0701462a84ff77e602f1626aec49479c308127
+		withSpoofing(nicID, nicSpoofingEnabled),
+
+		// Add default route table for IPv4 and IPv6. This will handle
+		// all incoming ICMP packets.
+		withRouteTable(nicID),
+	)
+
+	for _, opt := range opts {
+		if err := opt(s); err != nil {
+			return nil, err
+		}
+	}
+	return s, nil
+}

core/stack/nic.go

@@ -1,52 +0,0 @@
-package stack
-
-import (
-	"fmt"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-)
-
-const (
-	// defaultNICID is the ID of default NIC used by DefaultStack.
-	defaultNICID tcpip.NICID = 0x01
-
-	// nicPromiscuousModeEnabled is the value used by stack to enable
-	// or disable NIC's promiscuous mode.
-	nicPromiscuousModeEnabled = true
-
-	// nicSpoofingEnabled is the value used by stack to enable or disable
-	// NIC's spoofing.
-	nicSpoofingEnabled = true
-)
-
-// withCreatingNIC creates NIC for stack.
-func withCreatingNIC(ep stack.LinkEndpoint) Option {
-	return func(s *Stack) error {
-		if err := s.CreateNIC(s.nicID, ep); err != nil {
-			return fmt.Errorf("create NIC: %s", err)
-		}
-		return nil
-	}
-}
-
-// withPromiscuousMode sets promiscuous mode in the given NIC.
-func withPromiscuousMode(v bool) Option {
-	return func(s *Stack) error {
-		if err := s.SetPromiscuousMode(s.nicID, v); err != nil {
-			return fmt.Errorf("set promiscuous mode: %s", err)
-		}
-		return nil
-	}
-}
-
-// withSpoofing sets address spoofing in the given NIC, allowing
-// endpoints to bind to any address in the NIC.
-func withSpoofing(v bool) Option {
-	return func(s *Stack) error {
-		if err := s.SetSpoofing(s.nicID, v); err != nil {
-			return fmt.Errorf("set spoofing: %s", err)
-		}
-		return nil
-	}
-}

core/stack/stack.go

@@ -1,82 +0,0 @@
-// Package stack provides a thin wrapper around a gVisor's stack.
-package stack
-
-import (
-	"github.com/xjasonlyu/tun2socks/core"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
-	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
-)
-
-type Stack struct {
-	*stack.Stack
-
-	handler core.Handler
-	nicID   tcpip.NICID
-}
-
-// New allocates a new *Stack with given options.
-func New(ep stack.LinkEndpoint, handler core.Handler, opts ...Option) (*Stack, error) {
-	s := &Stack{
-		Stack: stack.New(stack.Options{
-			NetworkProtocols: []stack.NetworkProtocolFactory{
-				ipv4.NewProtocol,
-				ipv6.NewProtocol,
-			},
-			TransportProtocols: []stack.TransportProtocolFactory{
-				tcp.NewProtocol,
-				udp.NewProtocol,
-				icmp.NewProtocol4,
-				icmp.NewProtocol6,
-			},
-		}),
-
-		handler: handler,
-		nicID:   defaultNICID,
-	}
-
-	opts = append(opts,
-		// Important: We must initiate transport protocol handlers
-		// before creating NIC, otherwise NIC would dispatch packets
-		// to stack and cause race condition.
-		withICMPHandler(), withTCPHandler(), withUDPHandler(),
-
-		// Create stack NIC and then bind link endpoint.
-		withCreatingNIC(ep),
-
-		// In past we did s.AddAddressRange to assign 0.0.0.0/0 onto
-		// the interface. We need that to be able to terminate all the
-		// incoming connections - to any ip. AddressRange API has been
-		// removed and the suggested workaround is to use Promiscuous
-		// mode. https://github.com/google/gvisor/issues/3876
-		//
-		// Ref: https://github.com/majek/slirpnetstack/blob/master/stack.go
-		withPromiscuousMode(nicPromiscuousModeEnabled),
-
-		// Enable spoofing if a stack may send packets from unowned addresses.
-		// This change required changes to some netgophers since previously,
-		// promiscuous mode was enough to let the netstack respond to all
-		// incoming packets regardless of the packet's destination address. Now
-		// that a stack.Route is not held for each incoming packet, finding a route
-		// may fail with local addresses we don't own but accepted packets for
-		// while in promiscuous mode. Since we also want to be able to send from
-		// any address (in response the received promiscuous mode packets), we need
-		// to enable spoofing.
-		//
-		// Ref: https://github.com/google/gvisor/commit/8c0701462a84ff77e602f1626aec49479c308127
-		withSpoofing(nicSpoofingEnabled),
-	)
-
-	for _, opt := range opts {
-		if err := opt(s); err != nil {
-			return nil, err
-		}
-	}
-
-	return s, nil
-}

core/stack/tcp.go

@@ -1,83 +0,0 @@
-package stack
-
-import (
-	"fmt"
-	"net"
-	"time"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
-	"gvisor.dev/gvisor/pkg/waiter"
-)
-
-const (
-	// defaultWndSize if set to zero, the default
-	// receive window buffer size is used instead.
-	defaultWndSize = 0
-
-	// maxConnAttempts specifies the maximum number
-	// of in-flight tcp connection attempts.
-	maxConnAttempts = 2 << 10
-
-	// tcpKeepaliveIdle specifies the time a connection
-	// must remain idle before the first TCP keepalive
-	// packet is sent. Once this time is reached,
-	// tcpKeepaliveInterval option is used instead.
-	tcpKeepaliveIdle = 60 * time.Second
-
-	// tcpKeepaliveInterval specifies the interval
-	// time between sending TCP keepalive packets.
-	tcpKeepaliveInterval = 30 * time.Second
-)
-
-func withTCPHandler() Option {
-	return func(s *Stack) error {
-		tcpForwarder := tcp.NewForwarder(s.Stack, defaultWndSize, maxConnAttempts, func(r *tcp.ForwarderRequest) {
-			var wq waiter.Queue
-			id := r.ID()
-			ep, err := r.CreateEndpoint(&wq)
-			if err != nil {
-				// prevent potential half-open TCP connection leak.
-				r.Complete(true)
-				return
-			}
-			r.Complete(false)
-
-			setKeepalive(ep)
-
-			conn := &tcpConn{
-				Conn: gonet.NewTCPConn(&wq, ep),
-				id:   &id,
-			}
-			s.handler.Add(conn)
-		})
-		s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
-		return nil
-	}
-}
-
-func setKeepalive(ep tcpip.Endpoint) error {
-	ep.SocketOptions().SetKeepAlive(true)
-
-	idle := tcpip.KeepaliveIdleOption(tcpKeepaliveIdle)
-	if err := ep.SetSockOpt(&idle); err != nil {
-		return fmt.Errorf("set keepalive idle: %s", err)
-	}
-
-	interval := tcpip.KeepaliveIntervalOption(tcpKeepaliveInterval)
-	if err := ep.SetSockOpt(&interval); err != nil {
-		return fmt.Errorf("set keepalive interval: %s", err)
-	}
-	return nil
-}
-
-type tcpConn struct {
-	net.Conn
-	id *stack.TransportEndpointID
-}
-
-func (c *tcpConn) ID() *stack.TransportEndpointID {
-	return c.id
-}

core/stack/udp.go

@@ -1,181 +0,0 @@
-package stack
-
-import (
-	"fmt"
-	"net"
-
-	"gvisor.dev/gvisor/pkg/tcpip"
-	"gvisor.dev/gvisor/pkg/tcpip/buffer"
-	"gvisor.dev/gvisor/pkg/tcpip/header"
-	"gvisor.dev/gvisor/pkg/tcpip/stack"
-	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
-)
-
-const (
-	// udpNoChecksum disables UDP checksum.
-	udpNoChecksum = true
-)
-
-func withUDPHandler() Option {
-	return func(s *Stack) error {
-		udpHandlePacket := func(id stack.TransportEndpointID, pkt *stack.PacketBuffer) bool {
-			// Ref: gVisor pkg/tcpip/transport/udp/endpoint.go HandlePacket
-			udpHdr := header.UDP(pkt.TransportHeader().View())
-			if int(udpHdr.Length()) > pkt.Data().Size()+header.UDPMinimumSize {
-				// Malformed packet.
-				s.Stats().UDP.MalformedPacketsReceived.Increment()
-				return true
-			}
-
-			if !verifyChecksum(udpHdr, pkt) {
-				// Checksum error.
-				s.Stats().UDP.ChecksumErrors.Increment()
-				return true
-			}
-
-			s.Stats().UDP.PacketsReceived.Increment()
-
-			packet := &udpPacket{
-				s:        s,
-				id:       &id,
-				data:     pkt.Data().ExtractVV(),
-				nicID:    pkt.NICID,
-				netHdr:   pkt.Network(),
-				netProto: pkt.NetworkProtocolNumber,
-			}
-
-			s.handler.AddPacket(packet)
-			return true
-		}
-		s.SetTransportProtocolHandler(udp.ProtocolNumber, udpHandlePacket)
-		return nil
-	}
-}
-
-type udpPacket struct {
-	s        *Stack
-	id       *stack.TransportEndpointID
-	data     buffer.VectorisedView
-	nicID    tcpip.NICID
-	netHdr   header.Network
-	netProto tcpip.NetworkProtocolNumber
-}
-
-func (p *udpPacket) Data() []byte {
-	return p.data.ToView()
-}
-
-func (p *udpPacket) Drop() {}
-
-func (p *udpPacket) ID() *stack.TransportEndpointID {
-	return p.id
-}
-
-func (p *udpPacket) LocalAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP(p.id.LocalAddress), Port: int(p.id.LocalPort)}
-}
-
-func (p *udpPacket) RemoteAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP(p.id.RemoteAddress), Port: int(p.id.RemotePort)}
-}
-
-func (p *udpPacket) WriteBack(b []byte, addr net.Addr) (int, error) {
-	v := buffer.View(b)
-	if len(v) > header.UDPMaximumPacketSize {
-		// Payload can't possibly fit in a packet.
-		return 0, fmt.Errorf("%s", &tcpip.ErrMessageTooLong{})
-	}
-
-	var (
-		localAddress tcpip.Address
-		localPort    uint16
-	)
-
-	if udpAddr, ok := addr.(*net.UDPAddr); !ok {
-		localAddress = p.netHdr.DestinationAddress()
-		localPort = p.id.LocalPort
-	} else if ipv4 := udpAddr.IP.To4(); ipv4 != nil {
-		localAddress = tcpip.Address(ipv4)
-		localPort = uint16(udpAddr.Port)
-	} else {
-		localAddress = tcpip.Address(udpAddr.IP)
-		localPort = uint16(udpAddr.Port)
-	}
-
-	route, err := p.s.FindRoute(p.nicID, localAddress, p.netHdr.SourceAddress(), p.netProto, false /* multicastLoop */)
-	if err != nil {
-		return 0, fmt.Errorf("%#v find route: %s", p.id, err)
-	}
-	defer route.Release()
-
-	data := v.ToVectorisedView()
-	if err = sendUDP(route, data, localPort, p.id.RemotePort, udpNoChecksum); err != nil {
-		return 0, fmt.Errorf("%v", err)
-	}
-	return data.Size(), nil
-}
-
-// sendUDP sends a UDP segment via the provided network endpoint and under the
-// provided identity.
-func sendUDP(r *stack.Route, data buffer.VectorisedView, localPort, remotePort uint16, noChecksum bool) tcpip.Error {
-	pkt := stack.NewPacketBuffer(stack.PacketBufferOptions{
-		ReserveHeaderBytes: header.UDPMinimumSize + int(r.MaxHeaderLength()),
-		Data:               data,
-	})
-
-	// Initialize the UDP header.
-	udpHdr := header.UDP(pkt.TransportHeader().Push(header.UDPMinimumSize))
-	pkt.TransportProtocolNumber = udp.ProtocolNumber
-
-	length := uint16(pkt.Size())
-	udpHdr.Encode(&header.UDPFields{
-		SrcPort: localPort,
-		DstPort: remotePort,
-		Length:  length,
-	})
-
-	// Set the checksum field unless TX checksum offload is enabled.
-	// On IPv4, UDP checksum is optional, and a zero value indicates the
-	// transmitter skipped the checksum generation (RFC768).
-	// On IPv6, UDP checksum is not optional (RFC2460 Section 8.1).
-	if r.RequiresTXTransportChecksum() &&
-		(!noChecksum || r.NetProto() == header.IPv6ProtocolNumber) {
-		xsum := r.PseudoHeaderChecksum(udp.ProtocolNumber, length)
-		for _, v := range data.Views() {
-			xsum = header.Checksum(v, xsum)
-		}
-		udpHdr.SetChecksum(^udpHdr.CalculateChecksum(xsum))
-	}
-
-	ttl := r.DefaultTTL()
-
-	if err := r.WritePacket(stack.NetworkHeaderParams{
-		Protocol: udp.ProtocolNumber,
-		TTL:      ttl,
-		TOS:      0, /* default */
-	}, pkt); err != nil {
-		r.Stats().UDP.PacketSendErrors.Increment()
-		return err
-	}
-
-	// Track count of packets sent.
-	r.Stats().UDP.PacketsSent.Increment()
-	return nil
-}
-
-// verifyChecksum verifies the checksum unless RX checksum offload is enabled.
-// On IPv4, UDP checksum is optional, and a zero value means the transmitter
-// omitted the checksum generation (RFC768).
-// On IPv6, UDP checksum is not optional (RFC2460 Section 8.1).
-func verifyChecksum(hdr header.UDP, pkt *stack.PacketBuffer) bool {
-	if !pkt.RXTransportChecksumValidated &&
-		(hdr.Checksum() != 0 || pkt.NetworkProtocolNumber == header.IPv6ProtocolNumber) {
-		netHdr := pkt.Network()
-		xsum := header.PseudoHeaderChecksum(udp.ProtocolNumber, netHdr.DestinationAddress(), netHdr.SourceAddress(), hdr.Length())
-		for _, v := range pkt.Data().Views() {
-			xsum = header.Checksum(v, xsum)
-		}
-		return hdr.CalculateChecksum(xsum) == 0xffff
-	}
-	return true
-}

core/tcp.go

@@ -0,0 +1,122 @@
+package core
+
+import (
+	"time"
+
+	glog "gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+const (
+	// defaultWndSize if set to zero, the default
+	// receive window buffer size is used instead.
+	defaultWndSize = 0
+
+	// maxConnAttempts specifies the maximum number
+	// of in-flight tcp connection attempts.
+	maxConnAttempts = 2 << 10
+
+	// tcpKeepaliveCount is the maximum number of
+	// TCP keep-alive probes to send before giving up
+	// and killing the connection if no response is
+	// obtained from the other end.
+	tcpKeepaliveCount = 9
+
+	// tcpKeepaliveIdle specifies the time a connection
+	// must remain idle before the first TCP keepalive
+	// packet is sent. Once this time is reached,
+	// tcpKeepaliveInterval option is used instead.
+	tcpKeepaliveIdle = 60 * time.Second
+
+	// tcpKeepaliveInterval specifies the interval
+	// time between sending TCP keepalive packets.
+	tcpKeepaliveInterval = 30 * time.Second
+)
+
+func withTCPHandler(handle func(adapter.TCPConn)) option.Option {
+	return func(s *stack.Stack) error {
+		tcpForwarder := tcp.NewForwarder(s, defaultWndSize, maxConnAttempts, func(r *tcp.ForwarderRequest) {
+			var (
+				wq  waiter.Queue
+				ep  tcpip.Endpoint
+				err tcpip.Error
+				id  = r.ID()
+			)
+
+			defer func() {
+				if err != nil {
+					glog.Debugf("forward tcp request: %s:%d->%s:%d: %s",
+						id.RemoteAddress, id.RemotePort, id.LocalAddress, id.LocalPort, err)
+				}
+			}()
+
+			// Perform a TCP three-way handshake.
+			ep, err = r.CreateEndpoint(&wq)
+			if err != nil {
+				// RST: prevent potential half-open TCP connection leak.
+				r.Complete(true)
+				return
+			}
+			defer r.Complete(false)
+
+			err = setSocketOptions(s, ep)
+
+			conn := &tcpConn{
+				TCPConn: gonet.NewTCPConn(&wq, ep),
+				id:      id,
+			}
+			handle(conn)
+		})
+		s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
+		return nil
+	}
+}
+
+func setSocketOptions(s *stack.Stack, ep tcpip.Endpoint) tcpip.Error {
+	{ /* TCP keepalive options */
+		ep.SocketOptions().SetKeepAlive(true)
+
+		idle := tcpip.KeepaliveIdleOption(tcpKeepaliveIdle)
+		if err := ep.SetSockOpt(&idle); err != nil {
+			return err
+		}
+
+		interval := tcpip.KeepaliveIntervalOption(tcpKeepaliveInterval)
+		if err := ep.SetSockOpt(&interval); err != nil {
+			return err
+		}
+
+		if err := ep.SetSockOptInt(tcpip.KeepaliveCountOption, tcpKeepaliveCount); err != nil {
+			return err
+		}
+	}
+	{ /* TCP recv/send buffer size */
+		var ss tcpip.TCPSendBufferSizeRangeOption
+		if err := s.TransportProtocolOption(header.TCPProtocolNumber, &ss); err == nil {
+			ep.SocketOptions().SetReceiveBufferSize(int64(ss.Default), false)
+		}
+
+		var rs tcpip.TCPReceiveBufferSizeRangeOption
+		if err := s.TransportProtocolOption(header.TCPProtocolNumber, &rs); err == nil {
+			ep.SocketOptions().SetReceiveBufferSize(int64(rs.Default), false)
+		}
+	}
+	return nil
+}
+
+type tcpConn struct {
+	*gonet.TCPConn
+	id stack.TransportEndpointID
+}
+
+func (c *tcpConn) ID() *stack.TransportEndpointID {
+	return &c.id
+}

core/udp.go

@@ -0,0 +1,46 @@
+package core
+
+import (
+	glog "gvisor.dev/gvisor/pkg/log"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+)
+
+func withUDPHandler(handle func(adapter.UDPConn)) option.Option {
+	return func(s *stack.Stack) error {
+		udpForwarder := udp.NewForwarder(s, func(r *udp.ForwarderRequest) {
+			var (
+				wq waiter.Queue
+				id = r.ID()
+			)
+			ep, err := r.CreateEndpoint(&wq)
+			if err != nil {
+				glog.Debugf("forward udp request: %s:%d->%s:%d: %s",
+					id.RemoteAddress, id.RemotePort, id.LocalAddress, id.LocalPort, err)
+				return
+			}
+
+			conn := &udpConn{
+				UDPConn: gonet.NewUDPConn(s, &wq, ep),
+				id:      id,
+			}
+			handle(conn)
+		})
+		s.SetTransportProtocolHandler(udp.ProtocolNumber, udpForwarder.HandlePacket)
+		return nil
+	}
+}
+
+type udpConn struct {
+	*gonet.UDPConn
+	id stack.TransportEndpointID
+}
+
+func (c *udpConn) ID() *stack.TransportEndpointID {
+	return &c.id
+}

dialer/dialer.go

@@ -0,0 +1,66 @@
+package dialer
+
+import (
+	"context"
+	"net"
+	"syscall"
+
+	"go.uber.org/atomic"
+)
+
+var (
+	DefaultInterfaceName  = atomic.NewString("")
+	DefaultInterfaceIndex = atomic.NewInt32(0)
+	DefaultRoutingMark    = atomic.NewInt32(0)
+)
+
+type Options struct {
+	// InterfaceName is the name of interface/device to bind.
+	// If a socket is bound to an interface, only packets received
+	// from that particular interface are processed by the socket.
+	InterfaceName string
+
+	// InterfaceIndex is the index of interface/device to bind.
+	// It is almost the same as InterfaceName except it uses the
+	// index of the interface instead of the name.
+	InterfaceIndex int
+
+	// RoutingMark is the mark for each packet sent through this
+	// socket. Changing the mark can be used for mark-based routing
+	// without netfilter or for packet filtering.
+	RoutingMark int
+}
+
+func DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return DialContextWithOptions(ctx, network, address, &Options{
+		InterfaceName:  DefaultInterfaceName.Load(),
+		InterfaceIndex: int(DefaultInterfaceIndex.Load()),
+		RoutingMark:    int(DefaultRoutingMark.Load()),
+	})
+}
+
+func DialContextWithOptions(ctx context.Context, network, address string, opts *Options) (net.Conn, error) {
+	d := &net.Dialer{
+		Control: func(network, address string, c syscall.RawConn) error {
+			return setSocketOptions(network, address, c, opts)
+		},
+	}
+	return d.DialContext(ctx, network, address)
+}
+
+func ListenPacket(network, address string) (net.PacketConn, error) {
+	return ListenPacketWithOptions(network, address, &Options{
+		InterfaceName:  DefaultInterfaceName.Load(),
+		InterfaceIndex: int(DefaultInterfaceIndex.Load()),
+		RoutingMark:    int(DefaultRoutingMark.Load()),
+	})
+}
+
+func ListenPacketWithOptions(network, address string, opts *Options) (net.PacketConn, error) {
+	lc := &net.ListenConfig{
+		Control: func(network, address string, c syscall.RawConn) error {
+			return setSocketOptions(network, address, c, opts)
+		},
+	}
+	return lc.ListenPacket(context.Background(), network, address)
+}

dialer/sockopt.go

@@ -0,0 +1,19 @@
+package dialer
+
+func isTCPSocket(network string) bool {
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		return true
+	default:
+		return false
+	}
+}
+
+func isUDPSocket(network string) bool {
+	switch network {
+	case "udp", "udp4", "udp6":
+		return true
+	default:
+		return false
+	}
+}

dialer/sockopt_darwin.go

@@ -0,0 +1,45 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceIndex == 0 && opts.InterfaceName != "" {
+			if iface, err := net.InterfaceByName(opts.InterfaceName); err == nil {
+				opts.InterfaceIndex = iface.Index
+			}
+		}
+
+		if opts.InterfaceIndex != 0 {
+			switch network {
+			case "tcp4", "udp4":
+				innerErr = unix.SetsockoptInt(int(fd), syscall.IPPROTO_IP, syscall.IP_BOUND_IF, opts.InterfaceIndex)
+			case "tcp6", "udp6":
+				innerErr = unix.SetsockoptInt(int(fd), syscall.IPPROTO_IPV6, syscall.IPV6_BOUND_IF, opts.InterfaceIndex)
+			}
+			if innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_freebsd.go

@@ -0,0 +1,33 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_USER_COOKIE, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_linux.go

@@ -0,0 +1,44 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceName == "" && opts.InterfaceIndex != 0 {
+			if iface, err := net.InterfaceByIndex(opts.InterfaceIndex); err == nil {
+				opts.InterfaceName = iface.Name
+			}
+		}
+
+		if opts.InterfaceName != "" {
+			if innerErr = unix.BindToDevice(int(fd), opts.InterfaceName); innerErr != nil {
+				return
+			}
+		}
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_MARK, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_openbsd.go

@@ -0,0 +1,33 @@
+package dialer
+
+import (
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		if ip := net.ParseIP(host); ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.RoutingMark != 0 {
+			if innerErr = unix.SetsockoptInt(int(fd), unix.SOL_SOCKET, unix.SO_RTABLE, opts.RoutingMark); innerErr != nil {
+				return
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}

dialer/sockopt_others.go

@@ -0,0 +1,9 @@
+//go:build !unix && !windows
+
+package dialer
+
+import "syscall"
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) error {
+	return nil
+}

dialer/sockopt_windows.go

@@ -0,0 +1,68 @@
+package dialer
+
+import (
+	"encoding/binary"
+	"net"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	IP_UNICAST_IF   = 31
+	IPV6_UNICAST_IF = 31
+)
+
+func setSocketOptions(network, address string, c syscall.RawConn, opts *Options) (err error) {
+	if opts == nil || !isTCPSocket(network) && !isUDPSocket(network) {
+		return
+	}
+
+	var innerErr error
+	err = c.Control(func(fd uintptr) {
+		host, _, _ := net.SplitHostPort(address)
+		ip := net.ParseIP(host)
+		if ip != nil && !ip.IsGlobalUnicast() {
+			return
+		}
+
+		if opts.InterfaceIndex == 0 && opts.InterfaceName != "" {
+			if iface, err := net.InterfaceByName(opts.InterfaceName); err == nil {
+				opts.InterfaceIndex = iface.Index
+			}
+		}
+
+		if opts.InterfaceIndex != 0 {
+			switch network {
+			case "tcp4", "udp4":
+				innerErr = bindSocketToInterface4(windows.Handle(fd), uint32(opts.InterfaceIndex))
+			case "tcp6", "udp6":
+				innerErr = bindSocketToInterface6(windows.Handle(fd), uint32(opts.InterfaceIndex))
+				if network == "udp6" && ip == nil {
+					// The underlying IP net maybe IPv4 even if the `network` param is `udp6`,
+					// so we should bind socket to interface4 at the same time.
+					innerErr = bindSocketToInterface4(windows.Handle(fd), uint32(opts.InterfaceIndex))
+				}
+			}
+		}
+	})
+
+	if innerErr != nil {
+		err = innerErr
+	}
+	return
+}
+
+func bindSocketToInterface4(handle windows.Handle, index uint32) error {
+	// For IPv4, this parameter must be an interface index in network byte order.
+	// Ref: https://learn.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
+	var bytes [4]byte
+	binary.BigEndian.PutUint32(bytes[:], index)
+	index = *(*uint32)(unsafe.Pointer(&bytes[0]))
+	return windows.SetsockoptInt(handle, windows.IPPROTO_IP, IP_UNICAST_IF, int(index))
+}
+
+func bindSocketToInterface6(handle windows.Handle, index uint32) error {
+	return windows.SetsockoptInt(handle, windows.IPPROTO_IPV6, IPV6_UNICAST_IF, int(index))
+}

dns/resolver.go

@@ -1,10 +1,14 @@
-package dialer
+package dns
 
-import "net"
+import (
+	"net"
+
+	"github.com/xjasonlyu/tun2socks/v2/dialer"
+)
 
 func init() {
 	// We must use this DialContext to query DNS
 	// when using net default resolver.
 	net.DefaultResolver.PreferGo = true
-	net.DefaultResolver.Dial = DialContext
+	net.DefaultResolver.Dial = dialer.DialContext
 }

docker/entrypoint.sh

@@ -47,7 +47,7 @@ config_route() {
   done
 }
 
-main() {
+run() {
   create_tun
   create_table
   config_route
@@ -58,27 +58,35 @@ main() {
   fi
 
   if [ -n "$MTU" ]; then
-    ARGS="-mtu $MTU"
+    ARGS="--mtu $MTU"
   fi
 
-  if [ -n "$STATS" ]; then
-    ARGS="$ARGS -stats $STATS"
-  fi
-
-  if [ -n "$TOKEN" ]; then
-    ARGS="$ARGS -token $TOKEN"
+  if [ -n "$RESTAPI" ]; then
+    ARGS="$ARGS --restapi $RESTAPI"
   fi
 
   if [ -n "$UDP_TIMEOUT" ]; then
-    ARGS="$ARGS -udp-timeout $UDP_TIMEOUT"
+    ARGS="$ARGS --udp-timeout $UDP_TIMEOUT"
+  fi
+
+  if [ -n "$TCP_SNDBUF" ]; then
+    ARGS="$ARGS --tcp-sndbuf $TCP_SNDBUF"
+  fi
+
+  if [ -n "$TCP_RCVBUF" ]; then
+    ARGS="$ARGS --tcp-rcvbuf $TCP_RCVBUF"
+  fi
+
+  if [ "$TCP_AUTO_TUNING" = 1 ]; then
+    ARGS="$ARGS --tcp-auto-tuning"
   fi
 
   exec tun2socks \
-    -loglevel "$LOGLEVEL" \
-    -fwmark "$FWMARK" \
-    -device "$TUN" \
-    -proxy "$PROXY" \
+    --loglevel "$LOGLEVEL" \
+    --fwmark "$FWMARK" \
+    --device "$TUN" \
+    --proxy "$PROXY" \
     $ARGS
 }
 
-main || exit 1
+run || exit 1

engine/engine.go

@@ -2,167 +2,230 @@ package engine
 
 import (
 	"errors"
-	"os"
+	"net"
+	"os/exec"
+	"strings"
+	"sync"
+	"time"
 
-	"github.com/xjasonlyu/tun2socks/component/dialer"
-	"github.com/xjasonlyu/tun2socks/core/device"
-	"github.com/xjasonlyu/tun2socks/core/stack"
-	"github.com/xjasonlyu/tun2socks/log"
-	"github.com/xjasonlyu/tun2socks/proxy"
-	"github.com/xjasonlyu/tun2socks/stats"
-	"github.com/xjasonlyu/tun2socks/tunnel"
+	"github.com/docker/go-units"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+
+	"github.com/xjasonlyu/tun2socks/v2/core"
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/option"
+	"github.com/xjasonlyu/tun2socks/v2/dialer"
+	"github.com/xjasonlyu/tun2socks/v2/engine/mirror"
+	"github.com/xjasonlyu/tun2socks/v2/log"
+	"github.com/xjasonlyu/tun2socks/v2/proxy"
+	"github.com/xjasonlyu/tun2socks/v2/restapi"
+	"github.com/xjasonlyu/tun2socks/v2/tunnel"
 )
 
-var _engine = &engine{}
+var (
+	_engineMu sync.Mutex
+
+	// _defaultKey holds the default key for the engine.
+	_defaultKey *Key
+
+	// _defaultProxy holds the default proxy for the engine.
+	_defaultProxy proxy.Proxy
+
+	// _defaultDevice holds the default device for the engine.
+	_defaultDevice device.Device
+
+	// _defaultStack holds the default stack for the engine.
+	_defaultStack *stack.Stack
+)
 
 // Start starts the default engine up.
-func Start() error {
-	return _engine.start()
+func Start() {
+	if err := start(); err != nil {
+		log.Fatalf("[ENGINE] failed to start: %v", err)
+	}
 }
 
 // Stop shuts the default engine down.
-func Stop() error {
-	return _engine.stop()
+func Stop() {
+	if err := stop(); err != nil {
+		log.Fatalf("[ENGINE] failed to stop: %v", err)
+	}
 }
 
 // Insert loads *Key to the default engine.
 func Insert(k *Key) {
-	_engine.insert(k)
+	_engineMu.Lock()
+	_defaultKey = k
+	_engineMu.Unlock()
 }
 
-type Key struct {
-	MTU        int
-	Mark       int
-	UDPTimeout int
-	Proxy      string
-	Stats      string
-	Token      string
-	Device     string
-	LogLevel   string
-	Interface  string
-	Version    bool
-}
-
-type engine struct {
-	*Key
-
-	stack  *stack.Stack
-	proxy  proxy.Proxy
-	device device.Device
-}
-
-func (e *engine) start() error {
-	if e.Key == nil {
+func start() error {
+	_engineMu.Lock()
+	if _defaultKey == nil {
 		return errors.New("empty key")
 	}
 
-	if e.Version {
-		showVersion()
-		os.Exit(0)
-	}
-
-	for _, f := range []func() error{
-		e.setLogLevel,
-		e.setMark,
-		e.setInterface,
-		e.setStats,
-		e.setUDPTimeout,
-		e.setProxy,
-		e.setDevice,
-		e.setStack,
+	for _, f := range []func(*Key) error{
+		general,
+		restAPI,
+		netstack,
 	} {
-		if err := f(); err != nil {
+		if err := f(_defaultKey); err != nil {
 			return err
 		}
 	}
+	_engineMu.Unlock()
 	return nil
 }
 
-func (e *engine) stop() error {
-	if e.device != nil {
-		return e.device.Close()
+func stop() (err error) {
+	_engineMu.Lock()
+	if _defaultDevice != nil {
+		err = _defaultDevice.Close()
 	}
-	return nil
+	if _defaultStack != nil {
+		_defaultStack.Close()
+		_defaultStack.Wait()
+	}
+	_engineMu.Unlock()
+	return err
 }
 
-func (e *engine) insert(k *Key) {
-	e.Key = k
+func execCommand(cmd string) error {
+	parts := strings.Fields(cmd)
+	if len(parts) == 0 {
+		return errors.New("empty command")
+	}
+	_, err := exec.Command(parts[0], parts[1:]...).Output()
+	return err
 }
 
-func (e *engine) setLogLevel() error {
-	level, err := log.ParseLevel(e.LogLevel)
+func general(k *Key) error {
+	level, err := log.ParseLevel(k.LogLevel)
 	if err != nil {
 		return err
 	}
 	log.SetLevel(level)
-	return nil
-}
 
-func (e *engine) setMark() error {
-	if e.Mark != 0 {
-		dialer.SetMark(e.Mark)
-		log.Infof("[DIALER] set fwmark: %#x", e.Mark)
-	}
-	return nil
-}
-
-func (e *engine) setInterface() error {
-	if e.Interface != "" {
-		if err := dialer.BindToInterface(e.Interface); err != nil {
+	if k.Interface != "" {
+		iface, err := net.InterfaceByName(k.Interface)
+		if err != nil {
 			return err
 		}
-		log.Infof("[DIALER] use interface: %s", e.Interface)
+		dialer.DefaultInterfaceName.Store(iface.Name)
+		dialer.DefaultInterfaceIndex.Store(int32(iface.Index))
+		log.Infof("[DIALER] bind to interface: %s", k.Interface)
+	}
+
+	if k.Mark != 0 {
+		dialer.DefaultRoutingMark.Store(int32(k.Mark))
+		log.Infof("[DIALER] set fwmark: %#x", k.Mark)
+	}
+
+	if k.UDPTimeout > 0 {
+		if k.UDPTimeout < time.Second {
+			return errors.New("invalid udp timeout value")
+		}
+		tunnel.SetUDPTimeout(k.UDPTimeout)
 	}
 	return nil
 }
 
-func (e *engine) setStats() error {
-	if e.Stats != "" {
+func restAPI(k *Key) error {
+	if k.RestAPI != "" {
+		u, err := parseRestAPI(k.RestAPI)
+		if err != nil {
+			return err
+		}
+		host, token := u.Host, u.User.String()
+
+		restapi.SetStatsFunc(func() tcpip.Stats {
+			_engineMu.Lock()
+			defer _engineMu.Unlock()
+
+			// default stack is not initialized.
+			if _defaultStack == nil {
+				return tcpip.Stats{}
+			}
+			return _defaultStack.Stats()
+		})
+
 		go func() {
-			_ = stats.Start(e.Stats, e.Token)
+			if err := restapi.Start(host, token); err != nil {
+				log.Warnf("[RESTAPI] failed to start: %v", err)
+			}
 		}()
-		log.Infof("[STATS] serve at: http://%s", e.Stats)
+		log.Infof("[RESTAPI] serve at: %s", u)
 	}
 	return nil
 }
 
-func (e *engine) setUDPTimeout() error {
-	if e.UDPTimeout > 0 {
-		tunnel.SetUDPTimeout(e.UDPTimeout)
-	}
-	return nil
-}
-
-func (e *engine) setProxy() (err error) {
-	if e.Proxy == "" {
+func netstack(k *Key) (err error) {
+	if k.Proxy == "" {
 		return errors.New("empty proxy")
 	}
-
-	e.proxy, err = parseProxy(e.Proxy)
-	proxy.SetDialer(e.proxy)
-	return
-}
-
-func (e *engine) setDevice() (err error) {
-	if e.Device == "" {
+	if k.Device == "" {
 		return errors.New("empty device")
 	}
 
-	e.device, err = parseDevice(e.Device, uint32(e.MTU))
-	return
-}
+	if k.TUNPreUp != "" {
+		if preUpErr := execCommand(k.TUNPreUp); preUpErr != nil {
+			log.Warnf("[TUN] failed to pre-execute: %s: %v", k.TUNPreUp, preUpErr)
+		}
+	}
 
-func (e *engine) setStack() (err error) {
 	defer func() {
-		if err == nil {
-			log.Infof(
-				"[STACK] %s://%s <-> %s://%s",
-				e.device.Type(), e.device.Name(),
-				e.proxy.Proto(), e.proxy.Addr(),
-			)
+		if k.TUNPostUp == "" || err != nil {
+			return
+		}
+		if postUpErr := execCommand(k.TUNPostUp); postUpErr != nil {
+			log.Warnf("[TUN] failed to post-execute: %s: %v", k.TUNPostUp, postUpErr)
 		}
 	}()
 
-	e.stack, err = stack.New(e.device, &fakeTunnel{}, stack.WithDefault())
-	return
+	if _defaultProxy, err = parseProxy(k.Proxy); err != nil {
+		return
+	}
+	proxy.SetDialer(_defaultProxy)
+
+	if _defaultDevice, err = parseDevice(k.Device, uint32(k.MTU)); err != nil {
+		return
+	}
+
+	var opts []option.Option
+	if k.TCPModerateReceiveBuffer {
+		opts = append(opts, option.WithTCPModerateReceiveBuffer(true))
+	}
+
+	if k.TCPSendBufferSize != "" {
+		size, err := units.RAMInBytes(k.TCPSendBufferSize)
+		if err != nil {
+			return err
+		}
+		opts = append(opts, option.WithTCPSendBufferSize(int(size)))
+	}
+
+	if k.TCPReceiveBufferSize != "" {
+		size, err := units.RAMInBytes(k.TCPReceiveBufferSize)
+		if err != nil {
+			return err
+		}
+		opts = append(opts, option.WithTCPReceiveBufferSize(int(size)))
+	}
+
+	if _defaultStack, err = core.CreateStack(&core.Config{
+		LinkEndpoint:     _defaultDevice,
+		TransportHandler: &mirror.Tunnel{},
+		Options:          opts,
+	}); err != nil {
+		return
+	}
+
+	log.Infof(
+		"[STACK] %s://%s <-> %s://%s",
+		_defaultDevice.Type(), _defaultDevice.Name(),
+		_defaultProxy.Proto(), _defaultProxy.Addr(),
+	)
+	return nil
 }

engine/key.go

@@ -0,0 +1,19 @@
+package engine
+
+import "time"
+
+type Key struct {
+	MTU                      int           `yaml:"mtu"`
+	Mark                     int           `yaml:"fwmark"`
+	Proxy                    string        `yaml:"proxy"`
+	RestAPI                  string        `yaml:"restapi"`
+	Device                   string        `yaml:"device"`
+	LogLevel                 string        `yaml:"loglevel"`
+	Interface                string        `yaml:"interface"`
+	TCPModerateReceiveBuffer bool          `yaml:"tcp-moderate-receive-buffer"`
+	TCPSendBufferSize        string        `yaml:"tcp-send-buffer-size"`
+	TCPReceiveBufferSize     string        `yaml:"tcp-receive-buffer-size"`
+	TUNPreUp                 string        `yaml:"tun-pre-up"`
+	TUNPostUp                string        `yaml:"tun-post-up"`
+	UDPTimeout               time.Duration `yaml:"udp-timeout"`
+}

engine/mirror/tunnel.go

@@ -0,0 +1,18 @@
+package mirror
+
+import (
+	"github.com/xjasonlyu/tun2socks/v2/core/adapter"
+	"github.com/xjasonlyu/tun2socks/v2/tunnel"
+)
+
+var _ adapter.TransportHandler = (*Tunnel)(nil)
+
+type Tunnel struct{}
+
+func (*Tunnel) HandleTCP(conn adapter.TCPConn) {
+	tunnel.TCPIn() <- conn
+}
+
+func (*Tunnel) HandleUDP(conn adapter.UDPConn) {
+	tunnel.UDPIn() <- conn
+}

engine/parse.go

@@ -3,15 +3,44 @@ package engine
 import (
 	"encoding/base64"
 	"fmt"
+	"net"
 	"net/url"
 	"strings"
 
-	"github.com/xjasonlyu/tun2socks/core/device"
-	"github.com/xjasonlyu/tun2socks/core/device/tun"
-	"github.com/xjasonlyu/tun2socks/proxy"
-	"github.com/xjasonlyu/tun2socks/proxy/proto"
+	"github.com/xjasonlyu/tun2socks/v2/core/device"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/fdbased"
+	"github.com/xjasonlyu/tun2socks/v2/core/device/tun"
+	"github.com/xjasonlyu/tun2socks/v2/proxy"
+	"github.com/xjasonlyu/tun2socks/v2/proxy/proto"
 )
 
+func parseRestAPI(s string) (*url.URL, error) {
+	if !strings.Contains(s, "://") {
+		s = fmt.Sprintf("%s://%s", "http", s)
+	}
+
+	u, err := url.Parse(s)
+	if err != nil {
+		return nil, err
+	}
+
+	addr, err := net.ResolveTCPAddr("tcp", u.Host)
+	if err != nil {
+		return nil, err
+	}
+	if addr.IP == nil {
+		addr.IP = net.IPv4zero /* default: 0.0.0.0 */
+	}
+	u.Host = addr.String()
+
+	switch u.Scheme {
+	case "http":
+		return u, nil
+	default:
+		return nil, fmt.Errorf("unsupported scheme: %s", u.Scheme)
+	}
+}
+
 func parseDevice(s string, mtu uint32) (device.Device, error) {
 	if !strings.Contains(s, "://") {
 		s = fmt.Sprintf("%s://%s", tun.Driver /* default driver */, s)
@@ -26,8 +55,10 @@ func parseDevice(s string, mtu uint32) (device.Device, error) {
 	driver := strings.ToLower(u.Scheme)
 
 	switch driver {
+	case fdbased.Driver:
+		return fdbased.Open(name, mtu)
 	case tun.Driver:
-		return tun.Open(tun.WithName(name), tun.WithMTU(mtu))
+		return tun.Open(name, mtu)
 	default:
 		return nil, fmt.Errorf("unsupported driver: %s", driver)
 	}

engine/tunnel.go

@@ -1,18 +0,0 @@
-package engine
-
-import (
-	"github.com/xjasonlyu/tun2socks/core"
-	"github.com/xjasonlyu/tun2socks/tunnel"
-)
-
-var _ core.Handler = (*fakeTunnel)(nil)
-
-type fakeTunnel struct{}
-
-func (*fakeTunnel) Add(conn core.TCPConn) {
-	tunnel.Add(conn)
-}
-
-func (*fakeTunnel) AddPacket(packet core.UDPPacket) {
-	tunnel.AddPacket(packet)
-}

engine/version.go

@@ -1,22 +0,0 @@
-package engine
-
-import (
-	"fmt"
-	"runtime"
-	"strings"
-
-	V "github.com/xjasonlyu/tun2socks/constant"
-)
-
-func showVersion() {
-	fmt.Print(versionString())
-	fmt.Print(releaseString())
-}
-
-func versionString() string {
-	return fmt.Sprintf("%s-%s\n", V.Name, strings.TrimPrefix(V.Version, "v"))
-}
-
-func releaseString() string {
-	return fmt.Sprintf("%s/%s, %s, %s\n", runtime.GOOS, runtime.GOARCH, runtime.Version(), V.GitCommit)
-}

go.mod

@@ -1,28 +1,33 @@
-module github.com/xjasonlyu/tun2socks
+module github.com/xjasonlyu/tun2socks/v2
 
-go 1.17
+go 1.20
 
 require (
-	github.com/Dreamacro/go-shadowsocks2 v0.1.7
-	github.com/go-chi/chi v4.1.2+incompatible
-	github.com/go-chi/cors v1.2.0
-	github.com/go-chi/render v1.0.1
-	github.com/gofrs/uuid v4.0.0+incompatible
-	github.com/gorilla/websocket v1.4.2
-	github.com/sirupsen/logrus v1.8.1
-	github.com/stretchr/testify v1.7.0
-	go.uber.org/atomic v1.9.0
-	golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 // indirect
-	golang.org/x/net v0.0.0-20210929193557-e81a3d93ecf6 // indirect
-	golang.org/x/sys v0.0.0-20211003122950-b1ebd4e1001c
-	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac
-	golang.zx2c4.com/wireguard v0.0.0-20210927201915-bb745b2ea326
-	gvisor.dev/gvisor v0.0.0-20211002000755-82b90506164f
+	github.com/Dreamacro/go-shadowsocks2 v0.1.8
+	github.com/docker/go-units v0.5.0
+	github.com/go-chi/chi/v5 v5.0.8
+	github.com/go-chi/cors v1.2.1
+	github.com/go-chi/render v1.0.2
+	github.com/google/uuid v1.3.0
+	github.com/gorilla/websocket v1.5.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/stretchr/testify v1.7.1
+	go.uber.org/atomic v1.11.0
+	go.uber.org/automaxprocs v1.5.2
+	golang.org/x/sys v0.8.0
+	golang.org/x/time v0.3.0
+	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
+	gopkg.in/yaml.v3 v3.0.1
+	gvisor.dev/gvisor v0.0.0-20230603040744-5c9219dedd33
 )
 
 require (
+	github.com/ajg/form v1.5.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/google/btree v1.0.1 // indirect
+	github.com/google/btree v1.1.2 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
+	golang.org/x/crypto v0.9.0 // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 )

internal/version/debug.go

@@ -0,0 +1,7 @@
+//go:build debug
+
+package version
+
+func init() {
+	_debug = true
+}

internal/version/module.go

@@ -0,0 +1,11 @@
+package version
+
+import (
+	"runtime/debug"
+)
+
+// Info returns project dependencies as []*debug.Module.
+func Info() []*debug.Module {
+	bi, _ := debug.ReadBuildInfo()
+	return bi.Deps
+}

internal/version/version.go

@@ -0,0 +1,40 @@
+package version
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+)
+
+const Name = "tun2socks"
+
+var (
+	_debug = false
+
+	// Version can be set at link time by executing
+	// the command: `git describe --abbrev=0 --tags HEAD`
+	Version string
+
+	// GitCommit can be set at link time by executing
+	// the command: `git rev-parse --short HEAD`
+	GitCommit string
+)
+
+func versionize(s string) string {
+	return strings.TrimPrefix(s, "v")
+}
+
+func Debug() bool {
+	return _debug
+}
+
+func String() string {
+	if !Debug() {
+		return fmt.Sprintf("%s-%s", Name, versionize(Version))
+	}
+	return fmt.Sprintf("%s-%s (debug)", Name, versionize(Version))
+}
+
+func BuildString() string {
+	return fmt.Sprintf("%s/%s, %s, %s", runtime.GOOS, runtime.GOARCH, runtime.Version(), GitCommit)
+}

log/emitter.go

@@ -0,0 +1,34 @@
+package log
+
+import (
+	"io"
+	"runtime"
+	"strings"
+	"time"
+
+	glog "gvisor.dev/gvisor/pkg/log"
+)
+
+func init() {
+	EnableStackLog(true)
+}
+
+func EnableStackLog(v bool) {
+	if v {
+		glog.SetTarget(&emitter{}) // built-in logger
+	} else {
+		glog.SetTarget(&glog.Writer{Next: io.Discard})
+	}
+}
+
+type emitter struct{}
+
+func (emitter) Emit(depth int, level glog.Level, _ time.Time, format string, args ...any) {
+	if _, file, line, ok := runtime.Caller(depth + 1); ok {
+		// Ignore (*gonet.TCPConn).RemoteAddr() warning: `ep.GetRemoteAddress() failed`.
+		if line == 457 && strings.HasSuffix(file, "/pkg/tcpip/adapters/gonet/gonet.go") {
+			return
+		}
+	}
+	logf(Level(level)+2, "[STACK] "+format, args...)
+}

log/event.go

@@ -4,11 +4,11 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/xjasonlyu/tun2socks/common/observable"
+	"github.com/xjasonlyu/tun2socks/v2/common/observable"
 )
 
 var (
-	_logCh  = make(chan interface{})
+	_logCh  = make(chan any)
 	_source = observable.NewObservable(_logCh)
 )
 
@@ -18,7 +18,7 @@ type Event struct {
 	Time    time.Time `json:"time"`
 }
 
-func newEvent(level Level, format string, args ...interface{}) *Event {
+func newEvent(level Level, format string, args ...any) *Event {
 	event := &Event{
 		Level:   level,
 		Time:    time.Now(),

log/level.go

@@ -60,7 +60,7 @@ func ParseLevel(lvl string) (Level, error) {
 		return SilentLevel, nil
 	case "error":
 		return ErrorLevel, nil
-	case "warn":
+	case "warning":
 		return WarnLevel, nil
 	case "info":
 		return InfoLevel, nil

log/log.go

@@ -1,47 +1,50 @@
 package log
 
 import (
+	"io"
 	"os"
 
 	"github.com/sirupsen/logrus"
 	"go.uber.org/atomic"
 )
 
-var (
-	// _defaultLevel is package default logging level.
-	_defaultLevel = atomic.NewUint32(uint32(InfoLevel))
-)
+// _defaultLevel is package default logging level.
+var _defaultLevel = atomic.NewUint32(uint32(InfoLevel))
 
 func init() {
 	logrus.SetOutput(os.Stdout)
 	logrus.SetLevel(logrus.DebugLevel)
 }
 
+func SetOutput(out io.Writer) {
+	logrus.SetOutput(out)
+}
+
 func SetLevel(level Level) {
 	_defaultLevel.Store(uint32(level))
 }
 
-func Debugf(format string, args ...interface{}) {
+func Debugf(format string, args ...any) {
 	logf(DebugLevel, format, args...)
 }
 
-func Infof(format string, args ...interface{}) {
+func Infof(format string, args ...any) {
 	logf(InfoLevel, format, args...)
 }
 
-func Warnf(format string, args ...interface{}) {
+func Warnf(format string, args ...any) {
 	logf(WarnLevel, format, args...)
 }
 
-func Errorf(format string, args ...interface{}) {
+func Errorf(format string, args ...any) {
 	logf(ErrorLevel, format, args...)
 }
 
-func Fatalf(format string, args ...interface{}) {
+func Fatalf(format string, args ...any) {
 	logrus.Fatalf(format, args...)
 }
 
-func logf(level Level, format string, args ...interface{}) {
+func logf(level Level, format string, args ...any) {
 	event := newEvent(level, format, args...)
 	if uint32(event.Level) > _defaultLevel.Load() {
 		return

main.go

@@ -2,41 +2,69 @@ package main
 
 import (
 	"flag"
+	"fmt"
 	"os"
 	"os/signal"
 	"syscall"
 
-	"github.com/xjasonlyu/tun2socks/engine"
-	"github.com/xjasonlyu/tun2socks/log"
+	"go.uber.org/automaxprocs/maxprocs"
+	"gopkg.in/yaml.v3"
+
+	_ "github.com/xjasonlyu/tun2socks/v2/dns"
+	"github.com/xjasonlyu/tun2socks/v2/engine"
+	"github.com/xjasonlyu/tun2socks/v2/internal/version"
+	"github.com/xjasonlyu/tun2socks/v2/log"
 )
 
-var key = new(engine.Key)
+var (
+	key = new(engine.Key)
+
+	configFile  string
+	versionFlag bool
+)
 
 func init() {
 	flag.IntVar(&key.Mark, "fwmark", 0, "Set firewall MARK (Linux only)")
 	flag.IntVar(&key.MTU, "mtu", 0, "Set device maximum transmission unit (MTU)")
-	flag.IntVar(&key.UDPTimeout, "udp-timeout", 0, "Set timeout for each UDP session")
-	flag.BoolVar(&key.Version, "version", false, "Show version information and quit")
+	flag.DurationVar(&key.UDPTimeout, "udp-timeout", 0, "Set timeout for each UDP session")
+	flag.StringVar(&configFile, "config", "", "YAML format configuration file")
 	flag.StringVar(&key.Device, "device", "", "Use this device [driver://]name")
 	flag.StringVar(&key.Interface, "interface", "", "Use network INTERFACE (Linux/MacOS only)")
-	flag.StringVar(&key.LogLevel, "loglevel", "info", "Log level [debug|info|warn|error|silent]")
+	flag.StringVar(&key.LogLevel, "loglevel", "info", "Log level [debug|info|warning|error|silent]")
 	flag.StringVar(&key.Proxy, "proxy", "", "Use this proxy [protocol://]host[:port]")
-	flag.StringVar(&key.Stats, "stats", "", "HTTP statistic server listen address")
-	flag.StringVar(&key.Token, "token", "", "HTTP statistic server auth token")
+	flag.StringVar(&key.RestAPI, "restapi", "", "HTTP statistic server listen address")
+	flag.StringVar(&key.TCPSendBufferSize, "tcp-sndbuf", "", "Set TCP send buffer size for netstack")
+	flag.StringVar(&key.TCPReceiveBufferSize, "tcp-rcvbuf", "", "Set TCP receive buffer size for netstack")
+	flag.BoolVar(&key.TCPModerateReceiveBuffer, "tcp-auto-tuning", false, "Enable TCP receive buffer auto-tuning")
+	flag.StringVar(&key.TUNPreUp, "tun-pre-up", "", "Execute a command before TUN device setup")
+	flag.StringVar(&key.TUNPostUp, "tun-post-up", "", "Execute a command after TUN device setup")
+	flag.BoolVar(&versionFlag, "version", false, "Show version and then quit")
 	flag.Parse()
 }
 
 func main() {
-	engine.Insert(key)
+	maxprocs.Set(maxprocs.Logger(func(string, ...any) {}))
 
-	checkErr := func(msg string, f func() error) {
-		if err := f(); err != nil {
-			log.Fatalf("Failed to %s: %v", msg, err)
+	if versionFlag {
+		fmt.Println(version.String())
+		fmt.Println(version.BuildString())
+		os.Exit(0)
+	}
+
+	if configFile != "" {
+		data, err := os.ReadFile(configFile)
+		if err != nil {
+			log.Fatalf("Failed to read config file '%s': %v", configFile, err)
+		}
+		if err = yaml.Unmarshal(data, key); err != nil {
+			log.Fatalf("Failed to unmarshal config file '%s': %v", configFile, err)
 		}
 	}
 
-	checkErr("start engine", engine.Start)
-	defer checkErr("stop engine", engine.Stop)
+	engine.Insert(key)
+
+	engine.Start()
+	defer engine.Stop()
 
 	sigCh := make(chan os.Signal, 1)
 	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)

metadata/metadata.go

@@ -0,0 +1,66 @@
+package metadata
+
+import (
+	"net"
+	"strconv"
+)
+
+// Metadata contains metadata of transport protocol sessions.
+type Metadata struct {
+	Network Network `json:"network"`
+	SrcIP   net.IP  `json:"sourceIP"`
+	MidIP   net.IP  `json:"dialerIP"`
+	DstIP   net.IP  `json:"destinationIP"`
+	SrcPort uint16  `json:"sourcePort"`
+	MidPort uint16  `json:"dialerPort"`
+	DstPort uint16  `json:"destinationPort"`
+}
+
+func (m *Metadata) DestinationAddress() string {
+	return net.JoinHostPort(m.DstIP.String(), strconv.FormatUint(uint64(m.DstPort), 10))
+}
+
+func (m *Metadata) SourceAddress() string {
+	return net.JoinHostPort(m.SrcIP.String(), strconv.FormatUint(uint64(m.SrcPort), 10))
+}
+
+func (m *Metadata) Addr() net.Addr {
+	return &Addr{metadata: m}
+}
+
+func (m *Metadata) TCPAddr() *net.TCPAddr {
+	if m.Network != TCP || m.DstIP == nil {
+		return nil
+	}
+	return &net.TCPAddr{
+		IP:   m.DstIP,
+		Port: int(m.DstPort),
+	}
+}
+
+func (m *Metadata) UDPAddr() *net.UDPAddr {
+	if m.Network != UDP || m.DstIP == nil {
+		return nil
+	}
+	return &net.UDPAddr{
+		IP:   m.DstIP,
+		Port: int(m.DstPort),
+	}
+}
+
+// Addr implements the net.Addr interface.
+type Addr struct {
+	metadata *Metadata
+}
+
+func (a *Addr) Metadata() *Metadata {
+	return a.metadata
+}
+
+func (a *Addr) Network() string {
+	return a.metadata.Network.String()
+}
+
+func (a *Addr) String() string {
+	return a.metadata.DestinationAddress()
+}