mirror of
https://github.com/SagerNet/sing-box.git
synced 2026-07-19 21:08:40 +08:00
331 lines
11 KiB
Go
331 lines
11 KiB
Go
package wireguard
|
|
|
|
import (
|
|
"context"
|
|
"net"
|
|
"net/netip"
|
|
"sync/atomic"
|
|
"time"
|
|
|
|
"github.com/sagernet/sing-box/adapter"
|
|
"github.com/sagernet/sing-box/adapter/endpoint"
|
|
"github.com/sagernet/sing-box/common/dialer"
|
|
C "github.com/sagernet/sing-box/constant"
|
|
"github.com/sagernet/sing-box/log"
|
|
"github.com/sagernet/sing-box/option"
|
|
"github.com/sagernet/sing-box/transport/wireguard"
|
|
"github.com/sagernet/sing-tun"
|
|
"github.com/sagernet/sing/common"
|
|
"github.com/sagernet/sing/common/bufio"
|
|
E "github.com/sagernet/sing/common/exceptions"
|
|
"github.com/sagernet/sing/common/logger"
|
|
M "github.com/sagernet/sing/common/metadata"
|
|
N "github.com/sagernet/sing/common/network"
|
|
"github.com/sagernet/sing/service"
|
|
)
|
|
|
|
var (
|
|
_ adapter.OutboundWithPreferredRoutes = (*Endpoint)(nil)
|
|
_ adapter.InterfaceUpdateListener = (*Endpoint)(nil)
|
|
_ dialer.PacketDialerWithDestination = (*Endpoint)(nil)
|
|
)
|
|
|
|
func RegisterEndpoint(registry *endpoint.Registry) {
|
|
endpoint.Register[option.WireGuardEndpointOptions](registry, C.TypeWireGuard, NewEndpoint)
|
|
}
|
|
|
|
type Endpoint struct {
|
|
endpoint.Adapter
|
|
ctx context.Context
|
|
router adapter.Router
|
|
dnsRouter adapter.DNSRouter
|
|
logger logger.ContextLogger
|
|
localAddresses []netip.Prefix
|
|
endpoint *wireguard.Endpoint
|
|
started atomic.Bool
|
|
}
|
|
|
|
func NewEndpoint(ctx context.Context, router adapter.Router, logger log.ContextLogger, tag string, options option.WireGuardEndpointOptions) (adapter.Endpoint, error) {
|
|
ep := &Endpoint{
|
|
Adapter: endpoint.NewAdapterWithDialerOptions(C.TypeWireGuard, tag, []string{N.NetworkTCP, N.NetworkUDP, N.NetworkICMP}, options.DialerOptions),
|
|
ctx: ctx,
|
|
router: router,
|
|
dnsRouter: service.FromContext[adapter.DNSRouter](ctx),
|
|
logger: logger,
|
|
localAddresses: options.Address,
|
|
}
|
|
if options.Detour != "" && options.ListenPort != 0 {
|
|
return nil, E.New("`listen_port` is conflict with `detour`")
|
|
}
|
|
outboundDialer, err := dialer.NewWithOptions(dialer.Options{
|
|
Context: ctx,
|
|
Options: options.DialerOptions,
|
|
RemoteIsDomain: common.Any(options.Peers, func(it option.WireGuardPeer) bool {
|
|
return !M.ParseAddr(it.Address).IsValid()
|
|
}),
|
|
ResolverOnDetour: true,
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
var udpTimeout time.Duration
|
|
if options.UDPTimeout != 0 {
|
|
udpTimeout = time.Duration(options.UDPTimeout)
|
|
} else {
|
|
udpTimeout = C.UDPTimeout
|
|
}
|
|
networkManager := service.FromContext[adapter.NetworkManager](ctx)
|
|
var egressPool *tun.UDPEgressPool
|
|
udpListener, isUDPListener := common.Cast[dialer.UDPListener](outboundDialer)
|
|
if isUDPListener {
|
|
anchorControl, egressEnabled := udpListener.UDPListenerControl()
|
|
if egressEnabled {
|
|
egressPool = tun.NewUDPEgressPool(tun.UDPEgressPoolOptions{
|
|
Logger: logger,
|
|
Control: anchorControl,
|
|
InterfaceFinder: networkManager.InterfaceFinder(),
|
|
InterfaceMonitor: networkManager.InterfaceMonitor(),
|
|
ExcludeInterface: options.Name,
|
|
IsExempt: func() bool {
|
|
return networkManager.AutoRedirectOutputMark() != 0
|
|
},
|
|
})
|
|
}
|
|
}
|
|
wgEndpoint, err := wireguard.NewEndpoint(wireguard.EndpointOptions{
|
|
Context: ctx,
|
|
Logger: logger,
|
|
System: options.System,
|
|
Handler: ep,
|
|
UDPTimeout: udpTimeout,
|
|
ICMPTimeout: C.ICMPTimeout,
|
|
UDPMapping: tun.NATMapping(options.UDPMapping),
|
|
UDPFiltering: tun.NATFiltering(options.UDPFiltering),
|
|
UDPNATMax: options.UDPNATMax,
|
|
InterfaceFinder: networkManager.InterfaceFinder(),
|
|
EgressPool: egressPool,
|
|
Dialer: outboundDialer,
|
|
CreateDialer: func(interfaceName string) N.Dialer {
|
|
return common.Must1(dialer.NewDefault(ctx, option.DialerOptions{
|
|
BindInterface: interfaceName,
|
|
}))
|
|
},
|
|
Name: options.Name,
|
|
MTU: options.MTU,
|
|
Address: options.Address,
|
|
PrivateKey: options.PrivateKey,
|
|
ListenPort: options.ListenPort,
|
|
ResolvePeer: func(domain string) (netip.Addr, error) {
|
|
endpointAddresses, lookupErr := ep.dnsRouter.Lookup(ctx, domain, outboundDialer.(dialer.ResolveDialer).QueryOptions())
|
|
if lookupErr != nil {
|
|
return netip.Addr{}, lookupErr
|
|
}
|
|
return endpointAddresses[0], nil
|
|
},
|
|
Peers: common.Map(options.Peers, func(it option.WireGuardPeer) wireguard.PeerOptions {
|
|
return wireguard.PeerOptions{
|
|
Endpoint: M.ParseSocksaddrHostPort(it.Address, it.Port),
|
|
PublicKey: it.PublicKey,
|
|
PreSharedKey: it.PreSharedKey,
|
|
AllowedIPs: it.AllowedIPs,
|
|
PersistentKeepaliveInterval: it.PersistentKeepaliveInterval,
|
|
Reserved: it.Reserved,
|
|
}
|
|
}),
|
|
Workers: options.Workers,
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
ep.endpoint = wgEndpoint
|
|
return ep, nil
|
|
}
|
|
|
|
func (w *Endpoint) Start(stage adapter.StartStage) error {
|
|
switch stage {
|
|
case adapter.StartStateStart:
|
|
return w.endpoint.Start(false)
|
|
case adapter.StartStatePostStart:
|
|
err := w.endpoint.Start(true)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
w.started.Store(true)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (w *Endpoint) Close() error {
|
|
w.started.Store(false)
|
|
return w.endpoint.Close()
|
|
}
|
|
|
|
func (w *Endpoint) InterfaceUpdated() {
|
|
if !w.started.Load() {
|
|
return
|
|
}
|
|
err := w.endpoint.BindUpdate()
|
|
if err != nil {
|
|
w.logger.Error(E.Cause(err, "update bind"))
|
|
}
|
|
}
|
|
|
|
func (w *Endpoint) PreMatchFlow(network string, destination netip.Addr) adapter.PreMatchAction {
|
|
return adapter.PreMatchFlow
|
|
}
|
|
|
|
func (w *Endpoint) PortAddresses() (netip.Addr, netip.Addr) {
|
|
return w.endpoint.PortAddresses()
|
|
}
|
|
|
|
func (w *Endpoint) PortMTU() uint32 {
|
|
return w.endpoint.PortMTU()
|
|
}
|
|
|
|
func (w *Endpoint) AttachReturn(returnPath tun.Return) error {
|
|
return w.endpoint.AttachReturn(returnPath)
|
|
}
|
|
|
|
func (w *Endpoint) DetachReturn(returnPath tun.Return) error {
|
|
return w.endpoint.DetachReturn(returnPath)
|
|
}
|
|
|
|
func (w *Endpoint) JudgeFlow(network uint8, source netip.AddrPort, destination netip.AddrPort, firstPacket []byte) tun.FlowVerdict {
|
|
for _, localPrefix := range w.localAddresses {
|
|
if localPrefix.Contains(destination.Addr()) {
|
|
return tun.FlowVerdict{Action: tun.ActionAccept}
|
|
}
|
|
}
|
|
return adapter.JudgeFlow(w.router, w.Tag(), w.Type(), network, source, destination, firstPacket)
|
|
}
|
|
|
|
func (w *Endpoint) NewDNSPacket(payload []byte, source M.Socksaddr, destination M.Socksaddr, writer N.PacketWriter) {
|
|
ctx := log.ContextWithNewID(w.ctx)
|
|
var metadata adapter.InboundContext
|
|
metadata.Inbound = w.Tag()
|
|
metadata.InboundType = w.Type()
|
|
metadata.Network = N.NetworkUDP
|
|
metadata.Source = source
|
|
metadata.Destination = destination
|
|
metadata.Protocol = C.ProtocolDNS
|
|
w.logger.InfoContext(ctx, "inbound DNS packet from ", source)
|
|
w.router.HijackDNSPacket(ctx, payload, writer, metadata)
|
|
}
|
|
|
|
func (w *Endpoint) WritePackets(packets [][]byte) error {
|
|
if !w.started.Load() {
|
|
return E.New("WireGuard is not ready yet")
|
|
}
|
|
return w.endpoint.WritePackets(packets)
|
|
}
|
|
|
|
func (w *Endpoint) NewConnectionEx(ctx context.Context, conn net.Conn, source M.Socksaddr, destination M.Socksaddr, onClose N.CloseHandlerFunc) {
|
|
var metadata adapter.InboundContext
|
|
metadata.Inbound = w.Tag()
|
|
metadata.InboundType = w.Type()
|
|
metadata.Source = source
|
|
for _, localPrefix := range w.localAddresses {
|
|
if localPrefix.Contains(destination.Addr) {
|
|
metadata.OriginDestination = destination
|
|
if destination.Addr.Is4() {
|
|
destination.Addr = netip.AddrFrom4([4]uint8{127, 0, 0, 1})
|
|
} else {
|
|
destination.Addr = netip.IPv6Loopback()
|
|
}
|
|
break
|
|
}
|
|
}
|
|
metadata.Destination = destination
|
|
w.logger.InfoContext(ctx, "inbound connection from ", source)
|
|
w.logger.InfoContext(ctx, "inbound connection to ", metadata.Destination)
|
|
w.router.RouteConnectionEx(ctx, conn, metadata, onClose)
|
|
}
|
|
|
|
func (w *Endpoint) NewPacketConnectionEx(ctx context.Context, conn N.PacketConn, source M.Socksaddr, destination M.Socksaddr, onClose N.CloseHandlerFunc) {
|
|
var metadata adapter.InboundContext
|
|
metadata.Inbound = w.Tag()
|
|
metadata.InboundType = w.Type()
|
|
metadata.Source = source
|
|
metadata.Destination = destination
|
|
for _, localPrefix := range w.localAddresses {
|
|
if localPrefix.Contains(destination.Addr) {
|
|
metadata.OriginDestination = destination
|
|
if destination.Addr.Is4() {
|
|
metadata.Destination.Addr = netip.AddrFrom4([4]uint8{127, 0, 0, 1})
|
|
} else {
|
|
metadata.Destination.Addr = netip.IPv6Loopback()
|
|
}
|
|
conn = bufio.NewNATPacketConn(bufio.NewNetPacketConn(conn), metadata.OriginDestination, metadata.Destination)
|
|
}
|
|
}
|
|
w.logger.InfoContext(ctx, "inbound packet connection from ", source)
|
|
w.logger.InfoContext(ctx, "inbound packet connection to ", destination)
|
|
w.router.RoutePacketConnectionEx(ctx, conn, metadata, onClose)
|
|
}
|
|
|
|
func (w *Endpoint) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
|
|
switch network {
|
|
case N.NetworkTCP:
|
|
w.logger.InfoContext(ctx, "outbound connection to ", destination)
|
|
case N.NetworkUDP:
|
|
w.logger.InfoContext(ctx, "outbound packet connection to ", destination)
|
|
}
|
|
if !w.started.Load() {
|
|
return nil, E.New("WireGuard is not ready yet")
|
|
}
|
|
if destination.IsDomain() {
|
|
destinationAddresses, err := w.dnsRouter.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return N.DialSerial(ctx, w.endpoint, network, destination, destinationAddresses)
|
|
} else if !destination.Addr.IsValid() {
|
|
return nil, E.New("invalid destination: ", destination)
|
|
}
|
|
return w.endpoint.DialContext(ctx, network, destination)
|
|
}
|
|
|
|
func (w *Endpoint) ListenPacketWithDestination(ctx context.Context, destination M.Socksaddr) (net.PacketConn, netip.Addr, error) {
|
|
w.logger.InfoContext(ctx, "outbound packet connection to ", destination)
|
|
if !w.started.Load() {
|
|
return nil, netip.Addr{}, E.New("WireGuard is not ready yet")
|
|
}
|
|
if destination.IsDomain() {
|
|
destinationAddresses, err := w.dnsRouter.Lookup(ctx, destination.Fqdn, adapter.DNSQueryOptions{})
|
|
if err != nil {
|
|
return nil, netip.Addr{}, err
|
|
}
|
|
return N.ListenSerial(ctx, w.endpoint, destination, destinationAddresses)
|
|
}
|
|
packetConn, err := w.endpoint.ListenPacket(ctx, destination)
|
|
if err != nil {
|
|
return nil, netip.Addr{}, err
|
|
}
|
|
if destination.IsIP() {
|
|
return packetConn, destination.Addr, nil
|
|
}
|
|
return packetConn, netip.Addr{}, nil
|
|
}
|
|
|
|
func (w *Endpoint) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
|
|
packetConn, destinationAddress, err := w.ListenPacketWithDestination(ctx, destination)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if destinationAddress.IsValid() && destination != M.SocksaddrFrom(destinationAddress, destination.Port) {
|
|
return bufio.NewNATPacketConn(bufio.NewPacketConn(packetConn), M.SocksaddrFrom(destinationAddress, destination.Port), destination), nil
|
|
}
|
|
return packetConn, nil
|
|
}
|
|
|
|
func (w *Endpoint) PreferredDomain(metadata *adapter.InboundContext, domain string) bool {
|
|
return false
|
|
}
|
|
|
|
func (w *Endpoint) PreferredAddress(metadata *adapter.InboundContext, address netip.Addr) bool {
|
|
if !w.started.Load() {
|
|
return false
|
|
}
|
|
return w.endpoint.Lookup(address) != nil
|
|
}
|