Refactor wireguard & add tun support

transport/wireguard/client_bind.go

@@ -0,0 +1,132 @@
+package wireguard
+
+import (
+	"context"
+	"net"
+	"sync"
+
+	"github.com/sagernet/sing/common"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+
+	"golang.zx2c4.com/wireguard/conn"
+)
+
+var _ conn.Bind = (*ClientBind)(nil)
+
+type ClientBind struct {
+	ctx        context.Context
+	dialer     N.Dialer
+	peerAddr   M.Socksaddr
+	connAccess sync.Mutex
+	conn       *wireConn
+}
+
+func NewClientBind(ctx context.Context, dialer N.Dialer, peerAddr M.Socksaddr) *ClientBind {
+	return &ClientBind{
+		ctx:      ctx,
+		dialer:   dialer,
+		peerAddr: peerAddr,
+	}
+}
+
+func (c *ClientBind) connect() (*wireConn, error) {
+	serverConn := c.conn
+	if serverConn != nil {
+		select {
+		case <-serverConn.done:
+			serverConn = nil
+		default:
+			return serverConn, nil
+		}
+	}
+	c.connAccess.Lock()
+	defer c.connAccess.Unlock()
+	serverConn = c.conn
+	if serverConn != nil {
+		select {
+		case <-serverConn.done:
+			serverConn = nil
+		default:
+			return serverConn, nil
+		}
+	}
+	udpConn, err := c.dialer.DialContext(c.ctx, "udp", c.peerAddr)
+	if err != nil {
+		return nil, &wireError{err}
+	}
+	c.conn = &wireConn{
+		Conn: udpConn,
+		done: make(chan struct{}),
+	}
+	return c.conn, nil
+}
+
+func (c *ClientBind) Open(port uint16) (fns []conn.ReceiveFunc, actualPort uint16, err error) {
+	return []conn.ReceiveFunc{c.receive}, 0, nil
+}
+
+func (c *ClientBind) receive(b []byte) (n int, ep conn.Endpoint, err error) {
+	udpConn, err := c.connect()
+	if err != nil {
+		err = &wireError{err}
+		return
+	}
+	n, err = udpConn.Read(b)
+	if err != nil {
+		udpConn.Close()
+		err = &wireError{err}
+	}
+	ep = Endpoint(c.peerAddr)
+	return
+}
+
+func (c *ClientBind) Close() error {
+	c.connAccess.Lock()
+	defer c.connAccess.Unlock()
+	common.Close(common.PtrOrNil(c.conn))
+	return nil
+}
+
+func (c *ClientBind) SetMark(mark uint32) error {
+	return nil
+}
+
+func (c *ClientBind) Send(b []byte, ep conn.Endpoint) error {
+	udpConn, err := c.connect()
+	if err != nil {
+		return err
+	}
+	_, err = udpConn.Write(b)
+	if err != nil {
+		udpConn.Close()
+	}
+	return err
+}
+
+func (c *ClientBind) ParseEndpoint(s string) (conn.Endpoint, error) {
+	return Endpoint(c.peerAddr), nil
+}
+
+func (c *ClientBind) Endpoint() conn.Endpoint {
+	return Endpoint(c.peerAddr)
+}
+
+type wireConn struct {
+	net.Conn
+	access sync.Mutex
+	done   chan struct{}
+}
+
+func (w *wireConn) Close() error {
+	w.access.Lock()
+	defer w.access.Unlock()
+	select {
+	case <-w.done:
+		return net.ErrClosed
+	default:
+	}
+	w.Conn.Close()
+	close(w.done)
+	return nil
+}

transport/wireguard/device.go

@@ -0,0 +1,14 @@
+package wireguard
+
+import (
+	N "github.com/sagernet/sing/common/network"
+
+	"golang.zx2c4.com/wireguard/tun"
+)
+
+type Device interface {
+	tun.Device
+	N.Dialer
+	Start() error
+	// NewEndpoint() (stack.LinkEndpoint, error)
+}

transport/wireguard/device_stack.go

@@ -0,0 +1,254 @@
+//go:build !no_gvisor
+
+package wireguard
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"os"
+
+	E "github.com/sagernet/sing/common/exceptions"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+
+	"golang.zx2c4.com/wireguard/tun"
+	"gvisor.dev/gvisor/pkg/bufferv2"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+)
+
+var _ Device = (*StackDevice)(nil)
+
+const defaultNIC tcpip.NICID = 1
+
+type StackDevice struct {
+	stack      *stack.Stack
+	mtu        uint32
+	events     chan tun.Event
+	outbound   chan *stack.PacketBuffer
+	dispatcher stack.NetworkDispatcher
+	done       chan struct{}
+	addr4      tcpip.Address
+	addr6      tcpip.Address
+}
+
+func NewStackDevice(localAddresses []netip.Prefix, mtu uint32) (*StackDevice, error) {
+	ipStack := stack.New(stack.Options{
+		NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
+		TransportProtocols: []stack.TransportProtocolFactory{tcp.NewProtocol, udp.NewProtocol, icmp.NewProtocol4, icmp.NewProtocol6},
+		HandleLocal:        true,
+	})
+	tunDevice := &StackDevice{
+		stack:    ipStack,
+		mtu:      mtu,
+		events:   make(chan tun.Event, 1),
+		outbound: make(chan *stack.PacketBuffer, 256),
+		done:     make(chan struct{}),
+	}
+	err := ipStack.CreateNIC(defaultNIC, (*wireEndpoint)(tunDevice))
+	if err != nil {
+		return nil, E.New(err.String())
+	}
+	for _, prefix := range localAddresses {
+		addr := tcpip.Address(prefix.Addr().AsSlice())
+		protoAddr := tcpip.ProtocolAddress{
+			AddressWithPrefix: tcpip.AddressWithPrefix{
+				Address:   addr,
+				PrefixLen: prefix.Bits(),
+			},
+		}
+		if prefix.Addr().Is4() {
+			tunDevice.addr4 = addr
+			protoAddr.Protocol = ipv4.ProtocolNumber
+		} else {
+			tunDevice.addr6 = addr
+			protoAddr.Protocol = ipv6.ProtocolNumber
+		}
+		err = ipStack.AddProtocolAddress(defaultNIC, protoAddr, stack.AddressProperties{})
+		if err != nil {
+			return nil, E.New("parse local address ", protoAddr.AddressWithPrefix, ": ", err.String())
+		}
+	}
+	sOpt := tcpip.TCPSACKEnabled(true)
+	ipStack.SetTransportProtocolOption(tcp.ProtocolNumber, &sOpt)
+	cOpt := tcpip.CongestionControlOption("cubic")
+	ipStack.SetTransportProtocolOption(tcp.ProtocolNumber, &cOpt)
+	ipStack.AddRoute(tcpip.Route{Destination: header.IPv4EmptySubnet, NIC: defaultNIC})
+	ipStack.AddRoute(tcpip.Route{Destination: header.IPv6EmptySubnet, NIC: defaultNIC})
+	return tunDevice, nil
+}
+
+func (w *StackDevice) NewEndpoint() (stack.LinkEndpoint, error) {
+	return (*wireEndpoint)(w), nil
+}
+
+func (w *StackDevice) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	addr := tcpip.FullAddress{
+		NIC:  defaultNIC,
+		Port: destination.Port,
+		Addr: tcpip.Address(destination.Addr.AsSlice()),
+	}
+	bind := tcpip.FullAddress{
+		NIC: defaultNIC,
+	}
+	var networkProtocol tcpip.NetworkProtocolNumber
+	if destination.IsIPv4() {
+		networkProtocol = header.IPv4ProtocolNumber
+		bind.Addr = w.addr4
+	} else {
+		networkProtocol = header.IPv6ProtocolNumber
+		bind.Addr = w.addr6
+	}
+	switch N.NetworkName(network) {
+	case N.NetworkTCP:
+		return gonet.DialTCPWithBind(ctx, w.stack, bind, addr, networkProtocol)
+	case N.NetworkUDP:
+		return gonet.DialUDP(w.stack, &bind, &addr, networkProtocol)
+	default:
+		return nil, E.Extend(N.ErrUnknownNetwork, network)
+	}
+}
+
+func (w *StackDevice) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	bind := tcpip.FullAddress{
+		NIC: defaultNIC,
+	}
+	var networkProtocol tcpip.NetworkProtocolNumber
+	if destination.IsIPv4() || w.addr6 == "" {
+		networkProtocol = header.IPv4ProtocolNumber
+		bind.Addr = w.addr4
+	} else {
+		networkProtocol = header.IPv6ProtocolNumber
+		bind.Addr = w.addr6
+	}
+	return gonet.DialUDP(w.stack, &bind, nil, networkProtocol)
+}
+
+func (w *StackDevice) Start() error {
+	w.events <- tun.EventUp
+	return nil
+}
+
+func (w *StackDevice) File() *os.File {
+	return nil
+}
+
+func (w *StackDevice) Read(p []byte, offset int) (n int, err error) {
+	packetBuffer, ok := <-w.outbound
+	if !ok {
+		return 0, os.ErrClosed
+	}
+	defer packetBuffer.DecRef()
+	p = p[offset:]
+	for _, slice := range packetBuffer.AsSlices() {
+		n += copy(p[n:], slice)
+	}
+	return
+}
+
+func (w *StackDevice) Write(p []byte, offset int) (n int, err error) {
+	p = p[offset:]
+	if len(p) == 0 {
+		return
+	}
+	var networkProtocol tcpip.NetworkProtocolNumber
+	switch header.IPVersion(p) {
+	case header.IPv4Version:
+		networkProtocol = header.IPv4ProtocolNumber
+	case header.IPv6Version:
+		networkProtocol = header.IPv6ProtocolNumber
+	}
+	packetBuffer := stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Payload: bufferv2.MakeWithData(p),
+	})
+	defer packetBuffer.DecRef()
+	w.dispatcher.DeliverNetworkPacket(networkProtocol, packetBuffer)
+	n = len(p)
+	return
+}
+
+func (w *StackDevice) Flush() error {
+	return nil
+}
+
+func (w *StackDevice) MTU() (int, error) {
+	return int(w.mtu), nil
+}
+
+func (w *StackDevice) Name() (string, error) {
+	return "sing-box", nil
+}
+
+func (w *StackDevice) Events() chan tun.Event {
+	return w.events
+}
+
+func (w *StackDevice) Close() error {
+	select {
+	case <-w.done:
+		return os.ErrClosed
+	default:
+	}
+	close(w.done)
+	w.stack.Close()
+	for _, endpoint := range w.stack.CleanupEndpoints() {
+		endpoint.Abort()
+	}
+	w.stack.Wait()
+	close(w.outbound)
+	return nil
+}
+
+var _ stack.LinkEndpoint = (*wireEndpoint)(nil)
+
+type wireEndpoint StackDevice
+
+func (ep *wireEndpoint) MTU() uint32 {
+	return ep.mtu
+}
+
+func (ep *wireEndpoint) MaxHeaderLength() uint16 {
+	return 0
+}
+
+func (ep *wireEndpoint) LinkAddress() tcpip.LinkAddress {
+	return ""
+}
+
+func (ep *wireEndpoint) Capabilities() stack.LinkEndpointCapabilities {
+	return stack.CapabilityNone
+}
+
+func (ep *wireEndpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	ep.dispatcher = dispatcher
+}
+
+func (ep *wireEndpoint) IsAttached() bool {
+	return ep.dispatcher != nil
+}
+
+func (ep *wireEndpoint) Wait() {
+}
+
+func (ep *wireEndpoint) ARPHardwareType() header.ARPHardwareType {
+	return header.ARPHardwareNone
+}
+
+func (ep *wireEndpoint) AddHeader(buffer *stack.PacketBuffer) {
+}
+
+func (ep *wireEndpoint) WritePackets(list stack.PacketBufferList) (int, tcpip.Error) {
+	for _, packetBuffer := range list.AsSlice() {
+		packetBuffer.IncRef()
+		ep.outbound <- packetBuffer
+	}
+	return list.Len(), nil
+}

transport/wireguard/device_stack_stub.go

@@ -0,0 +1,9 @@
+//go:build no_gvisor
+
+package wireguard
+
+import "github.com/sagernet/sing-tun"
+
+func NewStackDevice(localAddresses []netip.Prefix, mtu uint32) (Device, error) {
+	return nil, tun.ErrGVisorNotIncluded
+}

transport/wireguard/device_system.go

@@ -0,0 +1,110 @@
+package wireguard
+
+import (
+	"context"
+	"net"
+	"net/netip"
+	"os"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/dialer"
+	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing-tun"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+
+	wgTun "golang.zx2c4.com/wireguard/tun"
+)
+
+var _ Device = (*SystemDevice)(nil)
+
+type SystemDevice struct {
+	dialer N.Dialer
+	device tun.Tun
+	name   string
+	mtu    int
+	events chan wgTun.Event
+}
+
+/*func (w *SystemDevice) NewEndpoint() (stack.LinkEndpoint, error) {
+	gTun, isGTun := w.device.(tun.GVisorTun)
+	if !isGTun {
+		return nil, tun.ErrGVisorUnsupported
+	}
+	return gTun.NewEndpoint()
+}*/
+
+func NewSystemDevice(router adapter.Router, interfaceName string, localPrefixes []netip.Prefix, mtu uint32) (*SystemDevice, error) {
+	var inet4Addresses []netip.Prefix
+	var inet6Addresses []netip.Prefix
+	for _, prefixes := range localPrefixes {
+		if prefixes.Addr().Is4() {
+			inet4Addresses = append(inet4Addresses, prefixes)
+		} else {
+			inet6Addresses = append(inet6Addresses, prefixes)
+		}
+	}
+	if interfaceName == "" {
+		interfaceName = tun.CalculateInterfaceName("wg")
+	}
+	tunInterface, err := tun.Open(tun.Options{
+		Name:         interfaceName,
+		Inet4Address: inet4Addresses,
+		Inet6Address: inet6Addresses,
+		MTU:          mtu,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &SystemDevice{
+		dialer.NewDefault(router, option.DialerOptions{
+			BindInterface: interfaceName,
+		}),
+		tunInterface, interfaceName, int(mtu), make(chan wgTun.Event),
+	}, nil
+}
+
+func (w *SystemDevice) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	return w.dialer.DialContext(ctx, network, destination)
+}
+
+func (w *SystemDevice) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return w.dialer.ListenPacket(ctx, destination)
+}
+
+func (w *SystemDevice) Start() error {
+	w.events <- wgTun.EventUp
+	return nil
+}
+
+func (w *SystemDevice) File() *os.File {
+	return nil
+}
+
+func (w *SystemDevice) Read(bytes []byte, index int) (int, error) {
+	return w.device.Read(bytes[index-tunPacketOffset:])
+}
+
+func (w *SystemDevice) Write(bytes []byte, index int) (int, error) {
+	return w.device.Write(bytes[index:])
+}
+
+func (w *SystemDevice) Flush() error {
+	return nil
+}
+
+func (w *SystemDevice) MTU() (int, error) {
+	return w.mtu, nil
+}
+
+func (w *SystemDevice) Name() (string, error) {
+	return w.name, nil
+}
+
+func (w *SystemDevice) Events() chan wgTun.Event {
+	return w.events
+}
+
+func (w *SystemDevice) Close() error {
+	return w.device.Close()
+}

transport/wireguard/endpoint.go

@@ -0,0 +1,37 @@
+package wireguard
+
+import (
+	"net/netip"
+
+	M "github.com/sagernet/sing/common/metadata"
+
+	"golang.zx2c4.com/wireguard/conn"
+)
+
+var _ conn.Endpoint = (*Endpoint)(nil)
+
+type Endpoint M.Socksaddr
+
+func (e Endpoint) ClearSrc() {
+}
+
+func (e Endpoint) SrcToString() string {
+	return ""
+}
+
+func (e Endpoint) DstToString() string {
+	return (M.Socksaddr)(e).String()
+}
+
+func (e Endpoint) DstToBytes() []byte {
+	b, _ := (M.Socksaddr)(e).AddrPort().MarshalBinary()
+	return b
+}
+
+func (e Endpoint) DstIP() netip.Addr {
+	return (M.Socksaddr)(e).Addr
+}
+
+func (e Endpoint) SrcIP() netip.Addr {
+	return netip.Addr{}
+}

transport/wireguard/error.go

@@ -0,0 +1,22 @@
+package wireguard
+
+import "net"
+
+type wireError struct {
+	cause error
+}
+
+func (w *wireError) Error() string {
+	return w.cause.Error()
+}
+
+func (w *wireError) Timeout() bool {
+	if cause, causeNet := w.cause.(net.Error); causeNet {
+		return cause.Timeout()
+	}
+	return false
+}
+
+func (w *wireError) Temporary() bool {
+	return true
+}

transport/wireguard/server_bind.go

@@ -0,0 +1,96 @@
+package wireguard
+
+import (
+	"io"
+
+	"github.com/sagernet/sing/common/buf"
+	E "github.com/sagernet/sing/common/exceptions"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+
+	"golang.zx2c4.com/wireguard/conn"
+)
+
+var _ conn.Bind = (*ServerBind)(nil)
+
+type ServerBind struct {
+	inbound   chan serverPacket
+	done      chan struct{}
+	writeBack N.PacketWriter
+}
+
+func NewServerBind(writeBack N.PacketWriter) *ServerBind {
+	return &ServerBind{
+		inbound:   make(chan serverPacket, 256),
+		done:      make(chan struct{}),
+		writeBack: writeBack,
+	}
+}
+
+func (s *ServerBind) Abort() error {
+	select {
+	case <-s.done:
+		return io.ErrClosedPipe
+	default:
+		close(s.done)
+	}
+	return nil
+}
+
+type serverPacket struct {
+	buffer *buf.Buffer
+	source M.Socksaddr
+}
+
+func (s *ServerBind) Open(port uint16) (fns []conn.ReceiveFunc, actualPort uint16, err error) {
+	fns = []conn.ReceiveFunc{s.receive}
+	return
+}
+
+func (s *ServerBind) receive(b []byte) (n int, ep conn.Endpoint, err error) {
+	select {
+	case packet := <-s.inbound:
+		defer packet.buffer.Release()
+		n = copy(b, packet.buffer.Bytes())
+		ep = Endpoint(packet.source)
+		return
+	case <-s.done:
+		err = io.ErrClosedPipe
+		return
+	}
+}
+
+func (s *ServerBind) WriteIsThreadUnsafe() {
+}
+
+func (s *ServerBind) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
+	select {
+	case s.inbound <- serverPacket{
+		buffer: buffer,
+		source: destination,
+	}:
+		return nil
+	case <-s.done:
+		return io.ErrClosedPipe
+	}
+}
+
+func (s *ServerBind) Close() error {
+	return nil
+}
+
+func (s *ServerBind) SetMark(mark uint32) error {
+	return nil
+}
+
+func (s *ServerBind) Send(b []byte, ep conn.Endpoint) error {
+	return s.writeBack.WritePacket(buf.As(b), M.Socksaddr(ep.(Endpoint)))
+}
+
+func (s *ServerBind) ParseEndpoint(addr string) (conn.Endpoint, error) {
+	destination := M.ParseSocksaddr(addr)
+	if !destination.IsValid() || destination.Port == 0 {
+		return nil, E.New("invalid endpoint: ", addr)
+	}
+	return Endpoint(destination), nil
+}

transport/wireguard/tun_darwin.go

@@ -0,0 +1,3 @@
+package wireguard
+
+const tunPacketOffset = 4

transport/wireguard/tun_nondarwin.go

@@ -0,0 +1,5 @@
+//go:build !darwin
+
+package wireguard
+
+const tunPacketOffset = 0