init

go-gost/x/admission/admission.go

@@ -0,0 +1,292 @@
+package admission
+
+import (
+	"bufio"
+	"context"
+	"io"
+	"net"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/admission"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/matcher"
+)
+
+type options struct {
+	whitelist   bool
+	matchers    []string
+	fileLoader  loader.Loader
+	redisLoader loader.Loader
+	httpLoader  loader.Loader
+	period      time.Duration
+	logger      logger.Logger
+}
+
+type Option func(opts *options)
+
+func WhitelistOption(whitelist bool) Option {
+	return func(opts *options) {
+		opts.whitelist = whitelist
+	}
+}
+
+func MatchersOption(matchers []string) Option {
+	return func(opts *options) {
+		opts.matchers = matchers
+	}
+}
+
+func ReloadPeriodOption(period time.Duration) Option {
+	return func(opts *options) {
+		opts.period = period
+	}
+}
+
+func FileLoaderOption(fileLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.fileLoader = fileLoader
+	}
+}
+
+func RedisLoaderOption(redisLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.redisLoader = redisLoader
+	}
+}
+
+func HTTPLoaderOption(httpLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.httpLoader = httpLoader
+	}
+}
+
+func LoggerOption(logger logger.Logger) Option {
+	return func(opts *options) {
+		opts.logger = logger
+	}
+}
+
+type localAdmission struct {
+	ipMatcher   matcher.Matcher
+	cidrMatcher matcher.Matcher
+	mu          sync.RWMutex
+	cancelFunc  context.CancelFunc
+	options     options
+}
+
+// NewAdmission creates and initializes a new Admission using matcher patterns as its match rules.
+// The rules will be reversed if the reverse is true.
+func NewAdmission(opts ...Option) admission.Admission {
+	var options options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	ctx, cancel := context.WithCancel(context.TODO())
+	p := &localAdmission{
+		cancelFunc: cancel,
+		options:    options,
+	}
+
+	if err := p.reload(ctx); err != nil {
+		options.logger.Warnf("reload: %v", err)
+	}
+	if p.options.period > 0 {
+		go p.periodReload(ctx)
+	}
+
+	return p
+}
+
+func (p *localAdmission) Admit(ctx context.Context, addr string, opts ...admission.Option) bool {
+	if addr == "" || p == nil {
+		return true
+	}
+
+	// try to strip the port
+	if host, _, _ := net.SplitHostPort(addr); host != "" {
+		addr = host
+	}
+
+	matched := p.matched(addr)
+
+	b := !p.options.whitelist && !matched ||
+		p.options.whitelist && matched
+
+	if !b {
+		p.options.logger.Debugf("%s is denied", addr)
+	}
+	return b
+}
+
+func (p *localAdmission) periodReload(ctx context.Context) error {
+	period := p.options.period
+	if period < time.Second {
+		period = time.Second
+	}
+	ticker := time.NewTicker(period)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if err := p.reload(ctx); err != nil {
+				p.options.logger.Warnf("reload: %v", err)
+				// return err
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+func (p *localAdmission) reload(ctx context.Context) error {
+	v, err := p.load(ctx)
+	if err != nil {
+		return err
+	}
+	patterns := append(p.options.matchers, v...)
+
+	var ips []net.IP
+	var inets []*net.IPNet
+	for _, pattern := range patterns {
+		if ip := net.ParseIP(pattern); ip != nil {
+			ips = append(ips, ip)
+			continue
+		}
+		if _, inet, err := net.ParseCIDR(pattern); err == nil {
+			inets = append(inets, inet)
+			continue
+		}
+		if ipAddr, _ := net.ResolveIPAddr("ip", pattern); ipAddr != nil {
+			p.options.logger.Debugf("resolve IP: %s -> %s", pattern, ipAddr)
+			ips = append(ips, ipAddr.IP)
+		}
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.ipMatcher = matcher.IPMatcher(ips)
+	p.cidrMatcher = matcher.CIDRMatcher(inets)
+
+	return nil
+}
+
+func (p *localAdmission) load(ctx context.Context) (patterns []string, err error) {
+	if p.options.fileLoader != nil {
+		if lister, ok := p.options.fileLoader.(loader.Lister); ok {
+			list, er := lister.List(ctx)
+			if er != nil {
+				p.options.logger.Warnf("file loader: %v", er)
+			}
+			for _, s := range list {
+				if line := p.parseLine(s); line != "" {
+					patterns = append(patterns, line)
+				}
+			}
+		} else {
+			r, er := p.options.fileLoader.Load(ctx)
+			if er != nil {
+				p.options.logger.Warnf("file loader: %v", er)
+			}
+			if v, _ := p.parsePatterns(r); v != nil {
+				patterns = append(patterns, v...)
+			}
+		}
+	}
+	if p.options.redisLoader != nil {
+		if lister, ok := p.options.redisLoader.(loader.Lister); ok {
+			list, er := lister.List(ctx)
+			if er != nil {
+				p.options.logger.Warnf("redis loader: %v", er)
+			}
+			patterns = append(patterns, list...)
+		} else {
+			r, er := p.options.redisLoader.Load(ctx)
+			if er != nil {
+				p.options.logger.Warnf("redis loader: %v", er)
+			}
+			if v, _ := p.parsePatterns(r); v != nil {
+				patterns = append(patterns, v...)
+			}
+		}
+	}
+
+	if p.options.httpLoader != nil {
+		r, er := p.options.httpLoader.Load(ctx)
+		if er != nil {
+			p.options.logger.Warnf("http loader: %v", er)
+		}
+		if v, _ := p.parsePatterns(r); v != nil {
+			patterns = append(patterns, v...)
+		}
+	}
+
+	p.options.logger.Debugf("load items %d", len(patterns))
+	return
+}
+
+func (p *localAdmission) parsePatterns(r io.Reader) (patterns []string, err error) {
+	if r == nil {
+		return
+	}
+
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		if line := p.parseLine(scanner.Text()); line != "" {
+			patterns = append(patterns, line)
+		}
+	}
+
+	err = scanner.Err()
+	return
+}
+
+func (p *localAdmission) parseLine(s string) string {
+	if n := strings.IndexByte(s, '#'); n >= 0 {
+		s = s[:n]
+	}
+	return strings.TrimSpace(s)
+}
+
+func (p *localAdmission) matched(addr string) bool {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	return p.ipMatcher.Match(addr) ||
+		p.cidrMatcher.Match(addr)
+}
+
+func (p *localAdmission) Close() error {
+	p.cancelFunc()
+	if p.options.fileLoader != nil {
+		p.options.fileLoader.Close()
+	}
+	if p.options.redisLoader != nil {
+		p.options.redisLoader.Close()
+	}
+	return nil
+}
+
+type admissionGroup struct {
+	admissions []admission.Admission
+}
+
+func AdmissionGroup(admissions ...admission.Admission) admission.Admission {
+	return &admissionGroup{
+		admissions: admissions,
+	}
+}
+
+func (p *admissionGroup) Admit(ctx context.Context, addr string, opts ...admission.Option) bool {
+	for _, admission := range p.admissions {
+		if admission != nil && !admission.Admit(ctx, addr, opts...) {
+			return false
+		}
+	}
+	return true
+}

go-gost/x/admission/plugin/grpc.go

@@ -0,0 +1,67 @@
+package admission
+
+import (
+	"context"
+	"io"
+
+	"github.com/go-gost/core/admission"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/plugin/admission/proto"
+	"github.com/go-gost/x/internal/plugin"
+	"google.golang.org/grpc"
+)
+
+type grpcPlugin struct {
+	conn   grpc.ClientConnInterface
+	client proto.AdmissionClient
+	log    logger.Logger
+}
+
+// NewGRPCPlugin creates an Admission plugin based on gRPC.
+func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) admission.Admission {
+	var options plugin.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	log := logger.Default().WithFields(map[string]any{
+		"kind":      "admission",
+		"admission": name,
+	})
+	conn, err := plugin.NewGRPCConn(addr, &options)
+	if err != nil {
+		log.Error(err)
+	}
+
+	p := &grpcPlugin{
+		conn: conn,
+		log:  log,
+	}
+	if conn != nil {
+		p.client = proto.NewAdmissionClient(conn)
+	}
+	return p
+}
+
+func (p *grpcPlugin) Admit(ctx context.Context, addr string, opts ...admission.Option) bool {
+	if p.client == nil {
+		return false
+	}
+
+	r, err := p.client.Admit(ctx,
+		&proto.AdmissionRequest{
+			Addr: addr,
+		})
+	if err != nil {
+		p.log.Error(err)
+		return false
+	}
+	return r.Ok
+}
+
+func (p *grpcPlugin) Close() error {
+	if closer, ok := p.conn.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}

go-gost/x/admission/plugin/http.go

@@ -0,0 +1,84 @@
+package admission
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/go-gost/core/admission"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/internal/plugin"
+)
+
+type httpPluginRequest struct {
+	Addr string `json:"addr"`
+}
+
+type httpPluginResponse struct {
+	OK bool `json:"ok"`
+}
+
+type httpPlugin struct {
+	url    string
+	client *http.Client
+	header http.Header
+	log    logger.Logger
+}
+
+// NewHTTPPlugin creates an Admission plugin based on HTTP.
+func NewHTTPPlugin(name string, url string, opts ...plugin.Option) admission.Admission {
+	var options plugin.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &httpPlugin{
+		url:    url,
+		client: plugin.NewHTTPClient(&options),
+		header: options.Header,
+		log: logger.Default().WithFields(map[string]any{
+			"kind":      "admission",
+			"admission": name,
+		}),
+	}
+}
+
+func (p *httpPlugin) Admit(ctx context.Context, addr string, opts ...admission.Option) (ok bool) {
+	if p.client == nil {
+		return
+	}
+
+	rb := httpPluginRequest{
+		Addr: addr,
+	}
+	v, err := json.Marshal(&rb)
+	if err != nil {
+		return
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.url, bytes.NewReader(v))
+	if err != nil {
+		return
+	}
+
+	if p.header != nil {
+		req.Header = p.header.Clone()
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return
+	}
+
+	res := httpPluginResponse{}
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return
+	}
+	return res.OK
+}

go-gost/x/admission/wrapper/conn.go

@@ -0,0 +1,242 @@
+package wrapper
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"syscall"
+
+	"github.com/go-gost/core/admission"
+	"github.com/go-gost/core/metadata"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/udp"
+)
+
+var (
+	errUnsupport = errors.New("unsupported operation")
+)
+
+type serverConn struct {
+	net.Conn
+	admission admission.Admission
+}
+
+func WrapConn(admission admission.Admission, c net.Conn) net.Conn {
+	if admission == nil {
+		return c
+	}
+	return &serverConn{
+		Conn:      c,
+		admission: admission,
+	}
+}
+
+func (c *serverConn) Read(b []byte) (n int, err error) {
+	if c.admission != nil &&
+		!c.admission.Admit(context.Background(), c.RemoteAddr().String()) {
+		err = io.EOF
+		return
+	}
+	return c.Conn.Read(b)
+}
+
+func (c *serverConn) SyscallConn() (rc syscall.RawConn, err error) {
+	if sc, ok := c.Conn.(syscall.Conn); ok {
+		rc, err = sc.SyscallConn()
+		return
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *serverConn) Metadata() metadata.Metadata {
+	if md, ok := c.Conn.(metadata.Metadatable); ok {
+		return md.Metadata()
+	}
+	return nil
+}
+
+type packetConn struct {
+	net.PacketConn
+	admission admission.Admission
+}
+
+func WrapPacketConn(admission admission.Admission, pc net.PacketConn) net.PacketConn {
+	if admission == nil {
+		return pc
+	}
+	return &packetConn{
+		PacketConn: pc,
+		admission:  admission,
+	}
+}
+
+func (c *packetConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
+	for {
+		n, addr, err = c.PacketConn.ReadFrom(p)
+		if err != nil {
+			return
+		}
+
+		if c.admission != nil &&
+			!c.admission.Admit(context.Background(), addr.String()) {
+			continue
+		}
+
+		return
+	}
+}
+
+func (c *packetConn) Metadata() metadata.Metadata {
+	if md, ok := c.PacketConn.(metadata.Metadatable); ok {
+		return md.Metadata()
+	}
+	return nil
+}
+
+type udpConn struct {
+	net.PacketConn
+	admission admission.Admission
+}
+
+func WrapUDPConn(admission admission.Admission, pc net.PacketConn) udp.Conn {
+	return &udpConn{
+		PacketConn: pc,
+		admission:  admission,
+	}
+}
+
+func (c *udpConn) RemoteAddr() net.Addr {
+	if nc, ok := c.PacketConn.(xnet.RemoteAddr); ok {
+		return nc.RemoteAddr()
+	}
+	return nil
+}
+
+func (c *udpConn) SetReadBuffer(n int) error {
+	if nc, ok := c.PacketConn.(xnet.SetBuffer); ok {
+		return nc.SetReadBuffer(n)
+	}
+	return errUnsupport
+}
+
+func (c *udpConn) SetWriteBuffer(n int) error {
+	if nc, ok := c.PacketConn.(xnet.SetBuffer); ok {
+		return nc.SetWriteBuffer(n)
+	}
+	return errUnsupport
+}
+
+func (c *udpConn) Read(b []byte) (n int, err error) {
+	if nc, ok := c.PacketConn.(io.Reader); ok {
+		n, err = nc.Read(b)
+		return
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *udpConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
+	for {
+		n, addr, err = c.PacketConn.ReadFrom(p)
+		if err != nil {
+			return
+		}
+		if c.admission != nil &&
+			!c.admission.Admit(context.Background(), addr.String()) {
+			continue
+		}
+		return
+	}
+}
+
+func (c *udpConn) ReadFromUDP(b []byte) (n int, addr *net.UDPAddr, err error) {
+	if nc, ok := c.PacketConn.(udp.ReadUDP); ok {
+		for {
+			n, addr, err = nc.ReadFromUDP(b)
+			if err != nil {
+				return
+			}
+			if c.admission != nil &&
+				!c.admission.Admit(context.Background(), addr.String()) {
+				continue
+			}
+			return
+		}
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *udpConn) ReadMsgUDP(b, oob []byte) (n, oobn, flags int, addr *net.UDPAddr, err error) {
+	if nc, ok := c.PacketConn.(udp.ReadUDP); ok {
+		for {
+			n, oobn, flags, addr, err = nc.ReadMsgUDP(b, oob)
+			if err != nil {
+				return
+			}
+			if c.admission != nil &&
+				!c.admission.Admit(context.Background(), addr.String()) {
+				continue
+			}
+			return
+		}
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *udpConn) Write(b []byte) (n int, err error) {
+	if nc, ok := c.PacketConn.(io.Writer); ok {
+		n, err = nc.Write(b)
+		return
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *udpConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
+	n, err = c.PacketConn.WriteTo(p, addr)
+	return
+}
+
+func (c *udpConn) WriteToUDP(b []byte, addr *net.UDPAddr) (n int, err error) {
+	if nc, ok := c.PacketConn.(udp.WriteUDP); ok {
+		n, err = nc.WriteToUDP(b, addr)
+		return
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *udpConn) WriteMsgUDP(b, oob []byte, addr *net.UDPAddr) (n, oobn int, err error) {
+	if nc, ok := c.PacketConn.(udp.WriteUDP); ok {
+		n, oobn, err = nc.WriteMsgUDP(b, oob, addr)
+		return
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *udpConn) SyscallConn() (rc syscall.RawConn, err error) {
+	if nc, ok := c.PacketConn.(xnet.SyscallConn); ok {
+		return nc.SyscallConn()
+	}
+	err = errUnsupport
+	return
+}
+
+func (c *udpConn) SetDSCP(n int) error {
+	if nc, ok := c.PacketConn.(xnet.SetDSCP); ok {
+		return nc.SetDSCP(n)
+	}
+	return nil
+}
+
+func (c *udpConn) Metadata() metadata.Metadata {
+	if md, ok := c.PacketConn.(metadata.Metadatable); ok {
+		return md.Metadata()
+	}
+	return nil
+}

go-gost/x/admission/wrapper/listener.go

@@ -0,0 +1,40 @@
+package wrapper
+
+import (
+	"context"
+	"net"
+
+	"github.com/go-gost/core/admission"
+	"github.com/go-gost/core/logger"
+)
+
+type listener struct {
+	net.Listener
+	admission admission.Admission
+	log       logger.Logger
+}
+
+func WrapListener(admission admission.Admission, ln net.Listener) net.Listener {
+	if admission == nil {
+		return ln
+	}
+	return &listener{
+		Listener:  ln,
+		admission: admission,
+	}
+}
+
+func (ln *listener) Accept() (net.Conn, error) {
+	for {
+		c, err := ln.Listener.Accept()
+		if err != nil {
+			return nil, err
+		}
+		if ln.admission != nil &&
+			!ln.admission.Admit(context.Background(), c.RemoteAddr().String()) {
+			c.Close()
+			continue
+		}
+		return c, err
+	}
+}

go-gost/x/api/api.go

@@ -0,0 +1,132 @@
+package api
+
+import (
+	"embed"
+	"net/http"
+
+	"github.com/gin-contrib/cors"
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/core/auth"
+)
+
+var (
+	//go:embed swagger.yaml
+	swaggerDoc embed.FS
+)
+
+type Response struct {
+	Code int    `json:"code,omitempty"`
+	Msg  string `json:"msg,omitempty"`
+}
+
+type Options struct {
+	AccessLog  bool
+	PathPrefix string
+	Auther     auth.Authenticator
+}
+
+func Register(r *gin.Engine, opts *Options) {
+	if opts == nil {
+		opts = &Options{}
+	}
+
+	r.Use(
+		cors.New((cors.Config{
+			AllowAllOrigins:     true,
+			AllowMethods:        []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+			AllowHeaders:        []string{"*"},
+			AllowPrivateNetwork: true,
+		})),
+		gin.Recovery(),
+	)
+	if opts.AccessLog {
+		r.Use(mwLogger())
+	}
+
+	router := r.Group("")
+	if opts.PathPrefix != "" {
+		router = router.Group(opts.PathPrefix)
+	}
+
+	router.StaticFS("/docs", http.FS(swaggerDoc))
+
+	config := router.Group("/config")
+	config.Use(mwBasicAuth(opts.Auther))
+
+	config.GET("", getConfig)
+	config.POST("", saveConfig)
+
+	config.POST("/reload", reloadConfig)
+
+	config.POST("/services", createService)
+	config.PUT("/services/:service", updateService)
+	config.DELETE("/services/:service", deleteService)
+	config.POST("/services/:service/pause", pauseService)
+	config.POST("/services/:service/resume", resumeService)
+	config.GET("/services/:service/status", getServiceStatus)
+	config.POST("/services/batch", createServices)
+	config.PUT("/services/batch", updateServices)
+	config.DELETE("/services/batch", deleteServices)
+	config.POST("/services/batch/pause", pauseServices)
+	config.POST("/services/batch/resume", resumeServices)
+
+	config.POST("/chains", createChain)
+	config.PUT("/chains/:chain", updateChain)
+	config.DELETE("/chains/:chain", deleteChain)
+
+	config.POST("/hops", createHop)
+	config.PUT("/hops/:hop", updateHop)
+	config.DELETE("/hops/:hop", deleteHop)
+
+	config.POST("/authers", createAuther)
+	config.PUT("/authers/:auther", updateAuther)
+	config.DELETE("/authers/:auther", deleteAuther)
+
+	config.POST("/admissions", createAdmission)
+	config.PUT("/admissions/:admission", updateAdmission)
+	config.DELETE("/admissions/:admission", deleteAdmission)
+
+	config.POST("/bypasses", createBypass)
+	config.PUT("/bypasses/:bypass", updateBypass)
+	config.DELETE("/bypasses/:bypass", deleteBypass)
+
+	config.POST("/resolvers", createResolver)
+	config.PUT("/resolvers/:resolver", updateResolver)
+	config.DELETE("/resolvers/:resolver", deleteResolver)
+
+	config.POST("/hosts", createHosts)
+	config.PUT("/hosts/:hosts", updateHosts)
+	config.DELETE("/hosts/:hosts", deleteHosts)
+
+	config.POST("/ingresses", createIngress)
+	config.PUT("/ingresses/:ingress", updateIngress)
+	config.DELETE("/ingresses/:ingress", deleteIngress)
+
+	config.POST("/routers", createRouter)
+	config.PUT("/routers/:router", updateRouter)
+	config.DELETE("/routers/:router", deleteRouter)
+
+	config.POST("/observers", createObserver)
+	config.PUT("/observers/:observer", updateObserver)
+	config.DELETE("/observers/:observer", deleteObserver)
+
+	config.POST("/recorders", createRecorder)
+	config.PUT("/recorders/:recorder", updateRecorder)
+	config.DELETE("/recorders/:recorder", deleteRecorder)
+
+	config.POST("/sds", createSD)
+	config.PUT("/sds/:sd", updateSD)
+	config.DELETE("/sds/:sd", deleteSD)
+
+	config.POST("/limiters", createLimiter)
+	config.PUT("/limiters/:limiter", updateLimiter)
+	config.DELETE("/limiters/:limiter", deleteLimiter)
+
+	config.POST("/climiters", createConnLimiter)
+	config.PUT("/climiters/:limiter", updateConnLimiter)
+	config.DELETE("/climiters/:limiter", deleteConnLimiter)
+
+	config.POST("/rlimiters", createRateLimiter)
+	config.PUT("/rlimiters/:limiter", updateRateLimiter)
+	config.DELETE("/rlimiters/:limiter", deleteRateLimiter)
+}

go-gost/x/api/config.go

@@ -0,0 +1,166 @@
+package api
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"os"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/registry"
+	"github.com/go-gost/x/service"
+)
+
+type serviceStatus interface {
+	Status() *service.Status
+}
+
+// swagger:parameters getConfigRequest
+type getConfigRequest struct {
+	// output format, one of yaml|json, default is json.
+	// in: query
+	Format string `form:"format" json:"format"`
+}
+
+// successful operation.
+// swagger:response getConfigResponse
+type getConfigResponse struct {
+	Config *config.Config
+}
+
+func getConfig(ctx *gin.Context) {
+	// swagger:route GET /config Config getConfigRequest
+	//
+	// Get current config.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: getConfigResponse
+
+	var req getConfigRequest
+	ctx.ShouldBindQuery(&req)
+
+	config.OnUpdate(func(c *config.Config) error {
+		for _, svc := range c.Services {
+			if svc == nil {
+				continue
+			}
+			s := registry.ServiceRegistry().Get(svc.Name)
+			ss, ok := s.(serviceStatus)
+			if ok && ss != nil {
+				status := ss.Status()
+				svc.Status = &config.ServiceStatus{
+					CreateTime: status.CreateTime().Unix(),
+					State:      string(status.State()),
+				}
+				if st := status.Stats(); st != nil {
+					svc.Status.Stats = &config.ServiceStats{
+						TotalConns:   st.Get(stats.KindTotalConns),
+						CurrentConns: st.Get(stats.KindCurrentConns),
+						TotalErrs:    st.Get(stats.KindTotalErrs),
+						InputBytes:   st.Get(stats.KindInputBytes),
+						OutputBytes:  st.Get(stats.KindOutputBytes),
+					}
+				}
+				for _, ev := range status.Events() {
+					if !ev.Time.IsZero() {
+						svc.Status.Events = append(svc.Status.Events, config.ServiceEvent{
+							Time: ev.Time.Unix(),
+							Msg:  ev.Message,
+						})
+					}
+				}
+			}
+		}
+		return nil
+	})
+	var resp getConfigResponse
+	resp.Config = config.Global()
+
+	buf := &bytes.Buffer{}
+	switch req.Format {
+	case "yaml":
+	default:
+		req.Format = "json"
+	}
+
+	resp.Config.Write(buf, req.Format)
+
+	contentType := "application/json"
+	if req.Format == "yaml" {
+		contentType = "text/x-yaml"
+	}
+
+	ctx.Data(http.StatusOK, contentType, buf.Bytes())
+}
+
+// swagger:parameters saveConfigRequest
+type saveConfigRequest struct {
+	// output format, one of yaml|json, default is yaml.
+	// in: query
+	Format string `form:"format" json:"format"`
+	// file path, default is gost.yaml|gost.json in current working directory.
+	// in: query
+	Path string `form:"path" json:"path"`
+}
+
+// successful operation.
+// swagger:response saveConfigResponse
+type saveConfigResponse struct {
+	Data Response
+}
+
+func saveConfig(ctx *gin.Context) {
+	// swagger:route POST /config Config saveConfigRequest
+	//
+	// Save current config to file (gost.yaml or gost.json).
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: saveConfigResponse
+
+	var req saveConfigRequest
+	ctx.ShouldBindQuery(&req)
+
+	file := "gost.yaml"
+	switch req.Format {
+	case "json":
+		file = "gost.json"
+	default:
+		req.Format = "yaml"
+	}
+
+	if req.Path != "" {
+		file = req.Path
+	}
+
+	f, err := os.Create(file)
+	if err != nil {
+		writeError(ctx, &Error{
+			statusCode: http.StatusInternalServerError,
+			Code:       ErrCodeSaveConfigFailed,
+			Msg:        fmt.Sprintf("create file: %s", err.Error()),
+		})
+		return
+	}
+	defer f.Close()
+
+	if err := config.Global().Write(f, req.Format); err != nil {
+		writeError(ctx, &Error{
+			statusCode: http.StatusInternalServerError,
+			Code:       ErrCodeSaveConfigFailed,
+			Msg:        fmt.Sprintf("save config: %s", err.Error()),
+		})
+		return
+	}
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_admission.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/admission"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createAdmissionRequest
+type createAdmissionRequest struct {
+	// in: body
+	Data config.AdmissionConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createAdmissionResponse
+type createAdmissionResponse struct {
+	Data Response
+}
+
+func createAdmission(ctx *gin.Context) {
+	// swagger:route POST /config/admissions Admission createAdmissionRequest
+	//
+	// Create a new admission, the name of admission must be unique in admission list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createAdmissionResponse
+
+	var req createAdmissionRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "admission name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.AdmissionRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("admission %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseAdmission(&req.Data)
+
+	if err := registry.AdmissionRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("admission %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Admissions = append(c.Admissions, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateAdmissionRequest
+type updateAdmissionRequest struct {
+	// in: path
+	// required: true
+	Admission string `uri:"admission" json:"admission"`
+	// in: body
+	Data config.AdmissionConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateAdmissionResponse
+type updateAdmissionResponse struct {
+	Data Response
+}
+
+func updateAdmission(ctx *gin.Context) {
+	// swagger:route PUT /config/admissions/{admission} Admission updateAdmissionRequest
+	//
+	// Update admission by name, the admission must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateAdmissionResponse
+
+	var req updateAdmissionRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Admission)
+
+	if !registry.AdmissionRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("admission %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseAdmission(&req.Data)
+
+	registry.AdmissionRegistry().Unregister(name)
+
+	if err := registry.AdmissionRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("admission %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Admissions {
+			if c.Admissions[i].Name == name {
+				c.Admissions[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteAdmissionRequest
+type deleteAdmissionRequest struct {
+	// in: path
+	// required: true
+	Admission string `uri:"admission" json:"admission"`
+}
+
+// successful operation.
+// swagger:response deleteAdmissionResponse
+type deleteAdmissionResponse struct {
+	Data Response
+}
+
+func deleteAdmission(ctx *gin.Context) {
+	// swagger:route DELETE /config/admissions/{admission} Admission deleteAdmissionRequest
+	//
+	// Delete admission by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteAdmissionResponse
+
+	var req deleteAdmissionRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Admission)
+
+	if !registry.AdmissionRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("admission %s not found", name)))
+		return
+	}
+	registry.AdmissionRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		admissiones := c.Admissions
+		c.Admissions = nil
+		for _, s := range admissiones {
+			if s.Name == name {
+				continue
+			}
+			c.Admissions = append(c.Admissions, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_auther.go

@@ -0,0 +1,180 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/auth"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createAutherRequest
+type createAutherRequest struct {
+	// in: body
+	Data config.AutherConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createAutherResponse
+type createAutherResponse struct {
+	Data Response
+}
+
+func createAuther(ctx *gin.Context) {
+	// swagger:route POST /config/authers Auther createAutherRequest
+	//
+	// Create a new auther, the name of the auther must be unique in auther list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createAutherResponse
+
+	var req createAutherRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "auther name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.AutherRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("auther %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseAuther(&req.Data)
+	if err := registry.AutherRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("auther %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Authers = append(c.Authers, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateAutherRequest
+type updateAutherRequest struct {
+	// in: path
+	// required: true
+	Auther string `uri:"auther" json:"auther"`
+	// in: body
+	Data config.AutherConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateAutherResponse
+type updateAutherResponse struct {
+	Data Response
+}
+
+func updateAuther(ctx *gin.Context) {
+	// swagger:route PUT /config/authers/{auther} Auther updateAutherRequest
+	//
+	// Update auther by name, the auther must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateAutherResponse
+
+	var req updateAutherRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Auther)
+
+	if !registry.AutherRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("auther %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseAuther(&req.Data)
+	registry.AutherRegistry().Unregister(name)
+
+	if err := registry.AutherRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("auther %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Authers {
+			if c.Authers[i].Name == name {
+				c.Authers[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteAutherRequest
+type deleteAutherRequest struct {
+	// in: path
+	// required: true
+	Auther string `uri:"auther" json:"auther"`
+}
+
+// successful operation.
+// swagger:response deleteAutherResponse
+type deleteAutherResponse struct {
+	Data Response
+}
+
+func deleteAuther(ctx *gin.Context) {
+	// swagger:route DELETE /config/authers/{auther} Auther deleteAutherRequest
+	//
+	// Delete auther by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteAutherResponse
+
+	var req deleteAutherRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Auther)
+
+	if !registry.AutherRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("auther %s not found", name)))
+		return
+	}
+	registry.AutherRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		authers := c.Authers
+		c.Authers = nil
+		for _, s := range authers {
+			if s.Name == name {
+				continue
+			}
+			c.Authers = append(c.Authers, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_bypass.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/bypass"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createBypassRequest
+type createBypassRequest struct {
+	// in: body
+	Data config.BypassConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createBypassResponse
+type createBypassResponse struct {
+	Data Response
+}
+
+func createBypass(ctx *gin.Context) {
+	// swagger:route POST /config/bypasses Bypass createBypassRequest
+	//
+	// Create a new bypass, the name of bypass must be unique in bypass list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createBypassResponse
+
+	var req createBypassRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "bypass name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.BypassRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("bypass %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseBypass(&req.Data)
+
+	if err := registry.BypassRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("bypass %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Bypasses = append(c.Bypasses, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateBypassRequest
+type updateBypassRequest struct {
+	// in: path
+	// required: true
+	Bypass string `uri:"bypass" json:"bypass"`
+	// in: body
+	Data config.BypassConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateBypassResponse
+type updateBypassResponse struct {
+	Data Response
+}
+
+func updateBypass(ctx *gin.Context) {
+	// swagger:route PUT /config/bypasses/{bypass} Bypass updateBypassRequest
+	//
+	// Update bypass by name, the bypass must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateBypassResponse
+
+	var req updateBypassRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Bypass)
+
+	if !registry.BypassRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("bypass %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseBypass(&req.Data)
+
+	registry.BypassRegistry().Unregister(name)
+
+	if err := registry.BypassRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("bypass %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Bypasses {
+			if c.Bypasses[i].Name == name {
+				c.Bypasses[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteBypassRequest
+type deleteBypassRequest struct {
+	// in: path
+	// required: true
+	Bypass string `uri:"bypass" json:"bypass"`
+}
+
+// successful operation.
+// swagger:response deleteBypassResponse
+type deleteBypassResponse struct {
+	Data Response
+}
+
+func deleteBypass(ctx *gin.Context) {
+	// swagger:route DELETE /config/bypasses/{bypass} Bypass deleteBypassRequest
+	//
+	// Delete bypass by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteBypassResponse
+
+	var req deleteBypassRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Bypass)
+
+	if !registry.BypassRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("bypass %s not found", name)))
+		return
+	}
+	registry.BypassRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		bypasses := c.Bypasses
+		c.Bypasses = nil
+		for _, s := range bypasses {
+			if s.Name == name {
+				continue
+			}
+			c.Bypasses = append(c.Bypasses, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_chain.go

@@ -0,0 +1,192 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/chain"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createChainRequest
+type createChainRequest struct {
+	// in: body
+	Data config.ChainConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createChainResponse
+type createChainResponse struct {
+	Data Response
+}
+
+func createChain(ctx *gin.Context) {
+	// swagger:route POST /config/chains Chain createChainRequest
+	//
+	// Create a new chain, the name of chain must be unique in chain list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createChainResponse
+
+	var req createChainRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "chain name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.ChainRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("chain %s already exists", name)))
+		return
+	}
+
+	v, err := parser.ParseChain(&req.Data, logger.Default())
+	if err != nil {
+		writeError(ctx, NewError(http.StatusInternalServerError, ErrCodeFailed, fmt.Sprintf("create chain %s failed: %s", name, err.Error())))
+		return
+	}
+
+	if err := registry.ChainRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("chain %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Chains = append(c.Chains, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateChainRequest
+type updateChainRequest struct {
+	// in: path
+	// required: true
+	// chain name
+	Chain string `uri:"chain" json:"chain"`
+	// in: body
+	Data config.ChainConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateChainResponse
+type updateChainResponse struct {
+	Data Response
+}
+
+func updateChain(ctx *gin.Context) {
+	// swagger:route PUT /config/chains/{chain} Chain updateChainRequest
+	//
+	// Update chain by name, the chain must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateChainResponse
+
+	var req updateChainRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Chain)
+
+	if !registry.ChainRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("chain %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v, err := parser.ParseChain(&req.Data, logger.Default())
+	if err != nil {
+		writeError(ctx, NewError(http.StatusInternalServerError, ErrCodeFailed, fmt.Sprintf("create chain %s failed: %s", name, err.Error())))
+		return
+	}
+
+	registry.ChainRegistry().Unregister(name)
+
+	if err := registry.ChainRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("chain %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Chains {
+			if c.Chains[i].Name == name {
+				c.Chains[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteChainRequest
+type deleteChainRequest struct {
+	// in: path
+	// required: true
+	Chain string `uri:"chain" json:"chain"`
+}
+
+// successful operation.
+// swagger:response deleteChainResponse
+type deleteChainResponse struct {
+	Data Response
+}
+
+func deleteChain(ctx *gin.Context) {
+	// swagger:route DELETE /config/chains/{chain} Chain deleteChainRequest
+	//
+	// Delete chain by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteChainResponse
+
+	var req deleteChainRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Chain)
+
+	if !registry.ChainRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("chain %s not found", name)))
+		return
+	}
+	registry.ChainRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		chains := c.Chains
+		c.Chains = nil
+		for _, s := range chains {
+			if s.Name == name {
+				continue
+			}
+			c.Chains = append(c.Chains, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_conn_limiter.go

@@ -0,0 +1,181 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/limiter"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createConnLimiterRequest
+type createConnLimiterRequest struct {
+	// in: body
+	Data config.LimiterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createConnLimiterResponse
+type createConnLimiterResponse struct {
+	Data Response
+}
+
+func createConnLimiter(ctx *gin.Context) {
+	// swagger:route POST /config/climiters Limiter createConnLimiterRequest
+	//
+	// Create a new conn limiter, the name of limiter must be unique in limiter list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createConnLimiterResponse
+
+	var req createConnLimiterRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "limiter name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.ConnLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseConnLimiter(&req.Data)
+	if err := registry.ConnLimiterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusInternalServerError, ErrCodeFailed, fmt.Sprintf("create limmiter %s failed: %s", name, err.Error())))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.CLimiters = append(c.CLimiters, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateConnLimiterRequest
+type updateConnLimiterRequest struct {
+	// in: path
+	// required: true
+	Limiter string `uri:"limiter" json:"limiter"`
+	// in: body
+	Data config.LimiterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateConnLimiterResponse
+type updateConnLimiterResponse struct {
+	Data Response
+}
+
+func updateConnLimiter(ctx *gin.Context) {
+	// swagger:route PUT /config/climiters/{limiter} Limiter updateConnLimiterRequest
+	//
+	// Update conn limiter by name, the limiter must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateConnLimiterResponse
+
+	var req updateConnLimiterRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Limiter)
+
+	if !registry.ConnLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("limiter %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseConnLimiter(&req.Data)
+
+	registry.ConnLimiterRegistry().Unregister(name)
+
+	if err := registry.ConnLimiterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.CLimiters {
+			if c.CLimiters[i].Name == name {
+				c.CLimiters[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteConnLimiterRequest
+type deleteConnLimiterRequest struct {
+	// in: path
+	// required: true
+	Limiter string `uri:"limiter" json:"limiter"`
+}
+
+// successful operation.
+// swagger:response deleteConnLimiterResponse
+type deleteConnLimiterResponse struct {
+	Data Response
+}
+
+func deleteConnLimiter(ctx *gin.Context) {
+	// swagger:route DELETE /config/climiters/{limiter} Limiter deleteConnLimiterRequest
+	//
+	// Delete conn limiter by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteConnLimiterResponse
+
+	var req deleteConnLimiterRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Limiter)
+
+	if !registry.ConnLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("limiter %s not found", name)))
+		return
+	}
+	registry.ConnLimiterRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		limiteres := c.CLimiters
+		c.CLimiters = nil
+		for _, s := range limiteres {
+			if s.Name == name {
+				continue
+			}
+			c.CLimiters = append(c.CLimiters, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_hop.go

@@ -0,0 +1,191 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/hop"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createHopRequest
+type createHopRequest struct {
+	// in: body
+	Data config.HopConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createHopResponse
+type createHopResponse struct {
+	Data Response
+}
+
+func createHop(ctx *gin.Context) {
+	// swagger:route POST /config/hops Hop createHopRequest
+	//
+	// Create a new hop, the name of hop must be unique in hop list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createHopResponse
+
+	var req createHopRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "hop name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.HopRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("hop %s already exists", name)))
+		return
+	}
+
+	v, err := parser.ParseHop(&req.Data, logger.Default())
+	if err != nil {
+		writeError(ctx, NewError(http.StatusInternalServerError, ErrCodeFailed, fmt.Sprintf("create hop %s failed: %s", name, err.Error())))
+		return
+	}
+
+	if err := registry.HopRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("hop %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Hops = append(c.Hops, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateHopRequest
+type updateHopRequest struct {
+	// in: path
+	// required: true
+	// hop name
+	Hop string `uri:"hop" json:"hop"`
+	// in: body
+	Data config.HopConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateHopResponse
+type updateHopResponse struct {
+	Data Response
+}
+
+func updateHop(ctx *gin.Context) {
+	// swagger:route PUT /config/hops/{hop} Hop updateHopRequest
+	//
+	// Update hop by name, the hop must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateHopResponse
+
+	var req updateHopRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Hop)
+	if !registry.HopRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("hop %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v, err := parser.ParseHop(&req.Data, logger.Default())
+	if err != nil {
+		writeError(ctx, NewError(http.StatusInternalServerError, ErrCodeFailed, fmt.Sprintf("create hop %s failed: %s", name, err.Error())))
+		return
+	}
+
+	registry.HopRegistry().Unregister(name)
+
+	if err := registry.HopRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("hop %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Hops {
+			if c.Hops[i].Name == name {
+				c.Hops[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteHopRequest
+type deleteHopRequest struct {
+	// in: path
+	// required: true
+	Hop string `uri:"hop" json:"hop"`
+}
+
+// successful operation.
+// swagger:response deleteHopResponse
+type deleteHopResponse struct {
+	Data Response
+}
+
+func deleteHop(ctx *gin.Context) {
+	// swagger:route DELETE /config/hops/{hop} Hop deleteHopRequest
+	//
+	// Delete hop by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteHopResponse
+
+	var req deleteHopRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Hop)
+
+	if !registry.HopRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("hop %s not found", name)))
+		return
+	}
+	registry.HopRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		hops := c.Hops
+		c.Hops = nil
+		for _, s := range hops {
+			if s.Name == name {
+				continue
+			}
+			c.Hops = append(c.Hops, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_hosts.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/hosts"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createHostsRequest
+type createHostsRequest struct {
+	// in: body
+	Data config.HostsConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createHostsResponse
+type createHostsesponse struct {
+	Data Response
+}
+
+func createHosts(ctx *gin.Context) {
+	// swagger:route POST /config/hosts Hosts createHostsRequest
+	//
+	// Create a new hosts, the name of the hosts must be unique in hosts list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createHostsResponse
+
+	var req createHostsRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "hosts name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.HostsRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("hosts %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseHostMapper(&req.Data)
+
+	if err := registry.HostsRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("hosts %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Hosts = append(c.Hosts, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateHostsRequest
+type updateHostsRequest struct {
+	// in: path
+	// required: true
+	Hosts string `uri:"hosts" json:"hosts"`
+	// in: body
+	Data config.HostsConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateHostsResponse
+type updateHostsResponse struct {
+	Data Response
+}
+
+func updateHosts(ctx *gin.Context) {
+	// swagger:route PUT /config/hosts/{hosts} Hosts updateHostsRequest
+	//
+	// Update hosts by name, the hosts must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateHostsResponse
+
+	var req updateHostsRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Hosts)
+
+	if !registry.HostsRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("hosts %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseHostMapper(&req.Data)
+
+	registry.HostsRegistry().Unregister(name)
+
+	if err := registry.HostsRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("hosts %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Hosts {
+			if c.Hosts[i].Name == name {
+				c.Hosts[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteHostsRequest
+type deleteHostsRequest struct {
+	// in: path
+	// required: true
+	Hosts string `uri:"hosts" json:"hosts"`
+}
+
+// successful operation.
+// swagger:response deleteHostsResponse
+type deleteHostsResponse struct {
+	Data Response
+}
+
+func deleteHosts(ctx *gin.Context) {
+	// swagger:route DELETE /config/hosts/{hosts} Hosts deleteHostsRequest
+	//
+	// Delete hosts by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteHostsResponse
+
+	var req deleteHostsRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Hosts)
+
+	if !registry.HostsRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("hosts %s not found", name)))
+		return
+	}
+	registry.HostsRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		hosts := c.Hosts
+		c.Hosts = nil
+		for _, s := range hosts {
+			if s.Name == name {
+				continue
+			}
+			c.Hosts = append(c.Hosts, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_ingress.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/ingress"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createIngressRequest
+type createIngressRequest struct {
+	// in: body
+	Data config.IngressConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createIngressResponse
+type createIngressResponse struct {
+	Data Response
+}
+
+func createIngress(ctx *gin.Context) {
+	// swagger:route POST /config/ingresses Ingress createIngressRequest
+	//
+	// Create a new ingress, the name of the ingress must be unique in ingress list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createIngressResponse
+
+	var req createIngressRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "ingress name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.IngressRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("ingress %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseIngress(&req.Data)
+
+	if err := registry.IngressRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("ingress %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Ingresses = append(c.Ingresses, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateIngressRequest
+type updateIngressRequest struct {
+	// in: path
+	// required: true
+	Ingress string `uri:"ingress" json:"ingress"`
+	// in: body
+	Data config.IngressConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateIngressResponse
+type updateIngressResponse struct {
+	Data Response
+}
+
+func updateIngress(ctx *gin.Context) {
+	// swagger:route PUT /config/ingresses/{ingress} Ingress updateIngressRequest
+	//
+	// Update ingress by name, the ingress must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateIngressResponse
+
+	var req updateIngressRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Ingress)
+
+	if !registry.IngressRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("ingress %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseIngress(&req.Data)
+
+	registry.IngressRegistry().Unregister(name)
+
+	if err := registry.IngressRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("ingress %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Ingresses {
+			if c.Ingresses[i].Name == name {
+				c.Ingresses[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteIngressRequest
+type deleteIngressRequest struct {
+	// in: path
+	// required: true
+	Ingress string `uri:"ingress" json:"ingress"`
+}
+
+// successful operation.
+// swagger:response deleteIngressResponse
+type deleteIngressResponse struct {
+	Data Response
+}
+
+func deleteIngress(ctx *gin.Context) {
+	// swagger:route DELETE /config/ingresses/{ingress} Ingress deleteIngressRequest
+	//
+	// Delete ingress by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteIngressResponse
+
+	var req deleteIngressRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Ingress)
+
+	if !registry.IngressRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("ingress %s not found", name)))
+		return
+	}
+	registry.IngressRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		ingresses := c.Ingresses
+		c.Ingresses = nil
+		for _, s := range ingresses {
+			if s.Name == name {
+				continue
+			}
+			c.Ingresses = append(c.Ingresses, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_limiter.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/limiter"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createLimiterRequest
+type createLimiterRequest struct {
+	// in: body
+	Data config.LimiterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createLimiterResponse
+type createLimiterResponse struct {
+	Data Response
+}
+
+func createLimiter(ctx *gin.Context) {
+	// swagger:route POST /config/limiters Limiter createLimiterRequest
+	//
+	// Create a new limiter, the name of limiter must be unique in limiter list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createLimiterResponse
+
+	var req createLimiterRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "limiter name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.TrafficLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseTrafficLimiter(&req.Data)
+
+	if err := registry.TrafficLimiterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Limiters = append(c.Limiters, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateLimiterRequest
+type updateLimiterRequest struct {
+	// in: path
+	// required: true
+	Limiter string `uri:"limiter" json:"limiter"`
+	// in: body
+	Data config.LimiterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateLimiterResponse
+type updateLimiterResponse struct {
+	Data Response
+}
+
+func updateLimiter(ctx *gin.Context) {
+	// swagger:route PUT /config/limiters/{limiter} Limiter updateLimiterRequest
+	//
+	// Update limiter by name, the limiter must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateLimiterResponse
+
+	var req updateLimiterRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Limiter)
+
+	if !registry.TrafficLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("limiter %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseTrafficLimiter(&req.Data)
+
+	registry.TrafficLimiterRegistry().Unregister(name)
+
+	if err := registry.TrafficLimiterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Limiters {
+			if c.Limiters[i].Name == name {
+				c.Limiters[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteLimiterRequest
+type deleteLimiterRequest struct {
+	// in: path
+	// required: true
+	Limiter string `uri:"limiter" json:"limiter"`
+}
+
+// successful operation.
+// swagger:response deleteLimiterResponse
+type deleteLimiterResponse struct {
+	Data Response
+}
+
+func deleteLimiter(ctx *gin.Context) {
+	// swagger:route DELETE /config/limiters/{limiter} Limiter deleteLimiterRequest
+	//
+	// Delete limiter by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteLimiterResponse
+
+	var req deleteLimiterRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Limiter)
+
+	if !registry.TrafficLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("limiter %s not found", name)))
+		return
+	}
+	registry.TrafficLimiterRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		limiteres := c.Limiters
+		c.Limiters = nil
+		for _, s := range limiteres {
+			if s.Name == name {
+				continue
+			}
+			c.Limiters = append(c.Limiters, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_observer.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/observer"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createObserverRequest
+type createObserverRequest struct {
+	// in: body
+	Data config.ObserverConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createObserverResponse
+type createObserverResponse struct {
+	Data Response
+}
+
+func createObserver(ctx *gin.Context) {
+	// swagger:route POST /config/observers Observer createObserverRequest
+	//
+	// Create a new observer, the name of the observer must be unique in observer list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createObserverResponse
+
+	var req createObserverRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "observer name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.ObserverRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("observer %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseObserver(&req.Data)
+
+	if err := registry.ObserverRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("observer %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Observers = append(c.Observers, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateObserverRequest
+type updateObserverRequest struct {
+	// in: path
+	// required: true
+	Observer string `uri:"observer" json:"observer"`
+	// in: body
+	Data config.ObserverConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateObserverResponse
+type updateObserverResponse struct {
+	Data Response
+}
+
+func updateObserver(ctx *gin.Context) {
+	// swagger:route PUT /config/observers/{observer} Observer updateObserverRequest
+	//
+	// Update observer by name, the observer must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateObserverResponse
+
+	var req updateObserverRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Observer)
+
+	if !registry.ObserverRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("observer %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseObserver(&req.Data)
+
+	registry.ObserverRegistry().Unregister(name)
+
+	if err := registry.ObserverRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("observer %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Observers {
+			if c.Observers[i].Name == name {
+				c.Observers[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteObserverRequest
+type deleteObserverRequest struct {
+	// in: path
+	// required: true
+	Observer string `uri:"observer" json:"observer"`
+}
+
+// successful operation.
+// swagger:response deleteObserverResponse
+type deleteObserverResponse struct {
+	Data Response
+}
+
+func deleteObserver(ctx *gin.Context) {
+	// swagger:route DELETE /config/observers/{observer} Observer deleteObserverRequest
+	//
+	// Delete observer by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteObserverResponse
+
+	var req deleteObserverRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Observer)
+
+	if !registry.ObserverRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("observer %s not found", name)))
+		return
+	}
+	registry.ObserverRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		observers := c.Observers
+		c.Observers = nil
+		for _, s := range observers {
+			if s.Name == name {
+				continue
+			}
+			c.Observers = append(c.Observers, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_rate_limiter.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/limiter"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createRateLimiterRequest
+type createRateLimiterRequest struct {
+	// in: body
+	Data config.LimiterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createRateLimiterResponse
+type createRateLimiterResponse struct {
+	Data Response
+}
+
+func createRateLimiter(ctx *gin.Context) {
+	// swagger:route POST /config/rlimiters Limiter createRateLimiterRequest
+	//
+	// Create a new rate limiter, the name of limiter must be unique in limiter list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createRateLimiterResponse
+
+	var req createRateLimiterRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "limiter name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.RateLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseRateLimiter(&req.Data)
+
+	if err := registry.RateLimiterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.RLimiters = append(c.RLimiters, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateRateLimiterRequest
+type updateRateLimiterRequest struct {
+	// in: path
+	// required: true
+	Limiter string `uri:"limiter" json:"limiter"`
+	// in: body
+	Data config.LimiterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateRateLimiterResponse
+type updateRateLimiterResponse struct {
+	Data Response
+}
+
+func updateRateLimiter(ctx *gin.Context) {
+	// swagger:route PUT /config/rlimiters/{limiter} Limiter updateRateLimiterRequest
+	//
+	// Update rate limiter by name, the limiter must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateRateLimiterResponse
+
+	var req updateRateLimiterRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Limiter)
+
+	if !registry.RateLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("limiter %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseRateLimiter(&req.Data)
+
+	registry.RateLimiterRegistry().Unregister(name)
+
+	if err := registry.RateLimiterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("limiter %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.RLimiters {
+			if c.RLimiters[i].Name == name {
+				c.RLimiters[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteRateLimiterRequest
+type deleteRateLimiterRequest struct {
+	// in: path
+	// required: true
+	Limiter string `uri:"limiter" json:"limiter"`
+}
+
+// successful operation.
+// swagger:response deleteRateLimiterResponse
+type deleteRateLimiterResponse struct {
+	Data Response
+}
+
+func deleteRateLimiter(ctx *gin.Context) {
+	// swagger:route DELETE /config/rlimiters/{limiter} Limiter deleteRateLimiterRequest
+	//
+	// Delete rate limiter by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteRateLimiterResponse
+
+	var req deleteRateLimiterRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Limiter)
+
+	if !registry.RateLimiterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("limiter %s not found", name)))
+		return
+	}
+	registry.RateLimiterRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		limiteres := c.RLimiters
+		c.RLimiters = nil
+		for _, s := range limiteres {
+			if s.Name == name {
+				continue
+			}
+			c.RLimiters = append(c.RLimiters, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_recorder.go

@@ -0,0 +1,181 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createRecorderRequest
+type createRecorderRequest struct {
+	// in: body
+	Data config.RecorderConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createRecorderResponse
+type createRecorderResponse struct {
+	Data Response
+}
+
+func createRecorder(ctx *gin.Context) {
+	// swagger:route POST /config/recorders Recorder createRecorderRequest
+	//
+	// Create a new recorder, the name of the recorder must be unique in recorder list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createRecorderResponse
+
+	var req createRecorderRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "recorder name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.RecorderRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("recorder %s already exists", name)))
+		return
+	}
+	v := parser.ParseRecorder(&req.Data)
+
+	if err := registry.RecorderRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("recorder %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Recorders = append(c.Recorders, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateRecorderRequest
+type updateRecorderRequest struct {
+	// in: path
+	// required: true
+	Recorder string `uri:"recorder" json:"recorder"`
+	// in: body
+	Data config.RecorderConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateRecorderResponse
+type updateRecorderResponse struct {
+	Data Response
+}
+
+func updateRecorder(ctx *gin.Context) {
+	// swagger:route PUT /config/recorders/{recorder} Recorder updateRecorderRequest
+	//
+	// Update recorder by name, the recorder must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateRecorderResponse
+
+	var req updateRecorderRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Recorder)
+
+	if !registry.RecorderRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("recorder %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseRecorder(&req.Data)
+
+	registry.RecorderRegistry().Unregister(name)
+
+	if err := registry.RecorderRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("recorder %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Recorders {
+			if c.Recorders[i].Name == name {
+				c.Recorders[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteRecorderRequest
+type deleteRecorderRequest struct {
+	// in: path
+	// required: true
+	Recorder string `uri:"recorder" json:"recorder"`
+}
+
+// successful operation.
+// swagger:response deleteRecorderResponse
+type deleteRecorderResponse struct {
+	Data Response
+}
+
+func deleteRecorder(ctx *gin.Context) {
+	// swagger:route DELETE /config/recorders/{recorder} Recorder deleteRecorderRequest
+	//
+	// Delete recorder by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteRecorderResponse
+
+	var req deleteRecorderRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Recorder)
+
+	if !registry.RecorderRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("recorder %s not found", name)))
+		return
+	}
+	registry.RecorderRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		recorders := c.Recorders
+		c.Recorders = nil
+		for _, s := range recorders {
+			if s.Name == name {
+				continue
+			}
+			c.Recorders = append(c.Recorders, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_reload.go

@@ -0,0 +1,56 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/config/loader"
+	"github.com/go-gost/x/config/parsing/parser"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters reloadConfigRequest
+type reloadConfigRequest struct{}
+
+// successful operation.
+// swagger:response reloadConfigResponse
+type reloadConfigResponse struct {
+	Data Response
+}
+
+func reloadConfig(ctx *gin.Context) {
+	// swagger:route POST /config/reload Reload reloadConfigRequest
+	//
+	// Hot reload config.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: reloadConfigResponse
+
+	cfg, err := parser.Parse()
+	if err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, err.Error()))
+		return
+	}
+
+	config.Set(cfg)
+
+	if err := loader.Load(cfg); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, err.Error()))
+		return
+	}
+
+	for _, svc := range registry.ServiceRegistry().GetAll() {
+		svc := svc
+		go func() {
+			svc.Serve()
+		}()
+	}
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_resolver.go

@@ -0,0 +1,190 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/resolver"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createResolverRequest
+type createResolverRequest struct {
+	// in: body
+	Data config.ResolverConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createResolverResponse
+type createResolverResponse struct {
+	Data Response
+}
+
+func createResolver(ctx *gin.Context) {
+	// swagger:route POST /config/resolvers Resolver createResolverRequest
+	//
+	// Create a new resolver, the name of the resolver must be unique in resolver list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createResolverResponse
+
+	var req createResolverRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "resolver name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.ResolverRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("resolver %s already exists", name)))
+		return
+	}
+
+	v, err := parser.ParseResolver(&req.Data)
+	if err != nil {
+		writeError(ctx, NewError(http.StatusInternalServerError, ErrCodeFailed, fmt.Sprintf("create resolver %s failed: %s", name, err.Error())))
+		return
+	}
+
+	if err := registry.ResolverRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("resolver %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Resolvers = append(c.Resolvers, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateResolverRequest
+type updateResolverRequest struct {
+	// in: path
+	// required: true
+	Resolver string `uri:"resolver" json:"resolver"`
+	// in: body
+	Data config.ResolverConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateResolverResponse
+type updateResolverResponse struct {
+	Data Response
+}
+
+func updateResolver(ctx *gin.Context) {
+	// swagger:route PUT /config/resolvers/{resolver} Resolver updateResolverRequest
+	//
+	// Update resolver by name, the resolver must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateResolverResponse
+
+	var req updateResolverRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Resolver)
+
+	if !registry.ResolverRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("resolver %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v, err := parser.ParseResolver(&req.Data)
+	if err != nil {
+		writeError(ctx, NewError(http.StatusInternalServerError, ErrCodeFailed, fmt.Sprintf("create resolver %s failed: %s", name, err.Error())))
+		return
+	}
+
+	registry.ResolverRegistry().Unregister(name)
+
+	if err := registry.ResolverRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("resolver %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Resolvers {
+			if c.Resolvers[i].Name == name {
+				c.Resolvers[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteResolverRequest
+type deleteResolverRequest struct {
+	// in: path
+	// required: true
+	Resolver string `uri:"resolver" json:"resolver"`
+}
+
+// successful operation.
+// swagger:response deleteResolverResponse
+type deleteResolverResponse struct {
+	Data Response
+}
+
+func deleteResolver(ctx *gin.Context) {
+	// swagger:route DELETE /config/resolvers/{resolver} Resolver deleteResolverRequest
+	//
+	// Delete resolver by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteResolverResponse
+
+	var req deleteResolverRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Resolver)
+
+	if !registry.ResolverRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("resolver %s not found", name)))
+		return
+	}
+	registry.ResolverRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		resolvers := c.Resolvers
+		c.Resolvers = nil
+		for _, s := range resolvers {
+			if s.Name == name {
+				continue
+			}
+			c.Resolvers = append(c.Resolvers, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_router.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/router"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createRouterRequest
+type createRouterRequest struct {
+	// in: body
+	Data config.RouterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createRouterResponse
+type createRouterResponse struct {
+	Data Response
+}
+
+func createRouter(ctx *gin.Context) {
+	// swagger:route POST /config/routers Router createRouterRequest
+	//
+	// Create a new router, the name of the router must be unique in router list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createRouterResponse
+
+	var req createRouterRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "router name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.RouterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("router %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseRouter(&req.Data)
+
+	if err := registry.RouterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("router %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.Routers = append(c.Routers, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateRouterRequest
+type updateRouterRequest struct {
+	// in: path
+	// required: true
+	Router string `uri:"router" json:"router"`
+	// in: body
+	Data config.RouterConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateRouterResponse
+type updateRouterResponse struct {
+	Data Response
+}
+
+func updateRouter(ctx *gin.Context) {
+	// swagger:route PUT /config/routers/{router} Router updateRouterRequest
+	//
+	// Update router by name, the router must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateRouterResponse
+
+	var req updateRouterRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Router)
+
+	if !registry.RouterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("router %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseRouter(&req.Data)
+
+	registry.RouterRegistry().Unregister(name)
+
+	if err := registry.RouterRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("router %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.Routers {
+			if c.Routers[i].Name == name {
+				c.Routers[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteRouterRequest
+type deleteRouterRequest struct {
+	// in: path
+	// required: true
+	Router string `uri:"router" json:"router"`
+}
+
+// successful operation.
+// swagger:response deleteRouterResponse
+type deleteRouterResponse struct {
+	Data Response
+}
+
+func deleteRouter(ctx *gin.Context) {
+	// swagger:route DELETE /config/routers/{router} Router deleteRouterRequest
+	//
+	// Delete router by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteRouterResponse
+
+	var req deleteRouterRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.Router)
+
+	if !registry.RouterRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("router %s not found", name)))
+		return
+	}
+	registry.RouterRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		routeres := c.Routers
+		c.Routers = nil
+		for _, s := range routeres {
+			if s.Name == name {
+				continue
+			}
+			c.Routers = append(c.Routers, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/config_sd.go

@@ -0,0 +1,182 @@
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/x/config"
+	parser "github.com/go-gost/x/config/parsing/sd"
+	"github.com/go-gost/x/registry"
+)
+
+// swagger:parameters createSDRequest
+type createSDRequest struct {
+	// in: body
+	Data config.SDConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response createSDResponse
+type createSDResponse struct {
+	Data Response
+}
+
+func createSD(ctx *gin.Context) {
+	// swagger:route POST /config/sds SD createSDRequest
+	//
+	// Create a new SD, the name of the SD must be unique in SD list.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: createSDResponse
+
+	var req createSDRequest
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.Data.Name)
+	if name == "" {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeInvalid, "sd name is required"))
+		return
+	}
+	req.Data.Name = name
+
+	if registry.SDRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("sd %s already exists", name)))
+		return
+	}
+
+	v := parser.ParseSD(&req.Data)
+
+	if err := registry.SDRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("sd %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		c.SDs = append(c.SDs, &req.Data)
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters updateSDRequest
+type updateSDRequest struct {
+	// in: path
+	// required: true
+	SD string `uri:"sd" json:"sd"`
+	// in: body
+	Data config.SDConfig `json:"data"`
+}
+
+// successful operation.
+// swagger:response updateSDResponse
+type updateSDResponse struct {
+	Data Response
+}
+
+func updateSD(ctx *gin.Context) {
+	// swagger:route PUT /config/sds/{sd} SD updateSDRequest
+	//
+	// Update SD by name, the SD must already exist.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: updateSDResponse
+
+	var req updateSDRequest
+	ctx.ShouldBindUri(&req)
+	ctx.ShouldBindJSON(&req.Data)
+
+	name := strings.TrimSpace(req.SD)
+
+	if !registry.SDRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("sd %s not found", name)))
+		return
+	}
+
+	req.Data.Name = name
+
+	v := parser.ParseSD(&req.Data)
+
+	registry.SDRegistry().Unregister(name)
+
+	if err := registry.SDRegistry().Register(name, v); err != nil {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeDup, fmt.Sprintf("sd %s already exists", name)))
+		return
+	}
+
+	config.OnUpdate(func(c *config.Config) error {
+		for i := range c.SDs {
+			if c.SDs[i].Name == name {
+				c.SDs[i] = &req.Data
+				break
+			}
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}
+
+// swagger:parameters deleteSDRequest
+type deleteSDRequest struct {
+	// in: path
+	// required: true
+	SD string `uri:"sd" json:"sd"`
+}
+
+// successful operation.
+// swagger:response deleteSDResponse
+type deleteSDResponse struct {
+	Data Response
+}
+
+func deleteSD(ctx *gin.Context) {
+	// swagger:route DELETE /config/sds/{sd} SD deleteSDRequest
+	//
+	// Delete SD by name.
+	//
+	//     Security:
+	//       basicAuth: []
+	//
+	//     Responses:
+	//       200: deleteSDResponse
+
+	var req deleteSDRequest
+	ctx.ShouldBindUri(&req)
+
+	name := strings.TrimSpace(req.SD)
+
+	if !registry.SDRegistry().IsRegistered(name) {
+		writeError(ctx, NewError(http.StatusBadRequest, ErrCodeNotFound, fmt.Sprintf("sd %s not found", name)))
+		return
+	}
+	registry.SDRegistry().Unregister(name)
+
+	config.OnUpdate(func(c *config.Config) error {
+		sds := c.SDs
+		c.SDs = nil
+		for _, s := range sds {
+			if s.Name == name {
+				continue
+			}
+			c.SDs = append(c.SDs, s)
+		}
+		return nil
+	})
+
+	ctx.JSON(http.StatusOK, Response{
+		Msg: "OK",
+	})
+}

go-gost/x/api/doc.go

@@ -0,0 +1,18 @@
+// Documentation of Web API.
+//
+//     Schemes: https, http
+//     BasePath: /
+//     Version: 1.0.0
+//
+//     Consumes:
+//     - application/json
+//
+//     Produces:
+//     - application/json
+//
+//     SecurityDefinitions:
+//     basicAuth:
+//       type: basic
+//
+// swagger:meta
+package api

go-gost/x/api/error.go

@@ -0,0 +1,63 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+var (
+	ErrInvalid  = &Error{statusCode: http.StatusBadRequest, Code: 40001, Msg: "object invalid"}
+	ErrDup      = &Error{statusCode: http.StatusBadRequest, Code: 40002, Msg: "object duplicated"}
+	ErrCreate   = &Error{statusCode: http.StatusConflict, Code: 40003, Msg: "object creation failed"}
+	ErrNotFound = &Error{statusCode: http.StatusBadRequest, Code: 40004, Msg: "object not found"}
+	ErrSave     = &Error{statusCode: http.StatusInternalServerError, Code: 40005, Msg: "save config failed"}
+)
+
+type ErrCode int
+
+const (
+	ErrCodeInvalid          = 40001
+	ErrCodeDup              = 40002
+	ErrCodeFailed           = 40003
+	ErrCodeNotFound         = 40004
+	ErrCodeSaveConfigFailed = 40005
+)
+
+// Error is an api error.
+type Error struct {
+	statusCode int
+	Code       int    `json:"code"`
+	Msg        string `json:"msg"`
+}
+
+func NewError(status, code int, msg string) error {
+	return &Error{
+		statusCode: status,
+		Code:       code,
+		Msg:        msg,
+	}
+}
+
+func (e *Error) Error() string {
+	b, _ := json.Marshal(e)
+	return string(b)
+}
+
+func writeError(c *gin.Context, err error) {
+	// c.Set(HTTPResponseTag, err)
+	c.JSON(getStatusCode(err), err)
+}
+
+func getStatusCode(err error) int {
+	if err == nil {
+		return http.StatusOK
+	}
+	if e, ok := err.(*Error); ok {
+		if e.statusCode >= http.StatusOK && e.statusCode < 600 {
+			return e.statusCode
+		}
+	}
+	return http.StatusInternalServerError
+}

go-gost/x/api/middleware.go

@@ -0,0 +1,47 @@
+package api
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/logger"
+)
+
+func mwLogger() gin.HandlerFunc {
+	return func(ctx *gin.Context) {
+		// start time
+		startTime := time.Now()
+		// Processing request
+		ctx.Next()
+		duration := time.Since(startTime)
+
+		logger.Default().WithFields(map[string]any{
+			"kind":     "api",
+			"method":   ctx.Request.Method,
+			"uri":      ctx.Request.RequestURI,
+			"code":     ctx.Writer.Status(),
+			"client":   ctx.ClientIP(),
+			"duration": duration,
+		}).Infof("| %3d | %13v | %15s | %-7s %s",
+			ctx.Writer.Status(), duration, ctx.ClientIP(), ctx.Request.Method, ctx.Request.RequestURI)
+	}
+}
+
+func mwBasicAuth(auther auth.Authenticator) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if auther == nil {
+			return
+		}
+		u, p, _ := c.Request.BasicAuth()
+		if _, ok := auther.Authenticate(c, u, p); !ok {
+			c.Writer.Header().Set("WWW-Authenticate", "Basic")
+			c.JSON(http.StatusUnauthorized, Response{
+				Code: http.StatusUnauthorized,
+				Msg:  "Unauthorized",
+			})
+			c.Abort()
+		}
+	}
+}

go-gost/x/api/service/service.go

@@ -0,0 +1,96 @@
+package service
+
+import (
+	"net"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/service"
+	"github.com/go-gost/x/api"
+)
+
+type options struct {
+	accessLog  bool
+	pathPrefix string
+	auther     auth.Authenticator
+}
+
+type Option func(*options)
+
+func PathPrefixOption(pathPrefix string) Option {
+	return func(o *options) {
+		o.pathPrefix = pathPrefix
+	}
+}
+
+func AccessLogOption(enable bool) Option {
+	return func(o *options) {
+		o.accessLog = enable
+	}
+}
+
+func AutherOption(auther auth.Authenticator) Option {
+	return func(o *options) {
+		o.auther = auther
+	}
+}
+
+type server struct {
+	s      *http.Server
+	ln     net.Listener
+	cclose chan struct{}
+}
+
+func NewService(network, addr string, opts ...Option) (service.Service, error) {
+	if network == "" {
+		network = "tcp"
+	}
+	ln, err := net.Listen(network, addr)
+	if err != nil {
+		return nil, err
+	}
+
+	var options options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	gin.SetMode(gin.ReleaseMode)
+
+	r := gin.New()
+	api.Register(r, &api.Options{
+		AccessLog:  options.accessLog,
+		PathPrefix: options.pathPrefix,
+		Auther:     options.auther,
+	})
+
+	return &server{
+		s: &http.Server{
+			Handler: r,
+		},
+		ln:     ln,
+		cclose: make(chan struct{}),
+	}, nil
+}
+
+func (s *server) Serve() error {
+	return s.s.Serve(s.ln)
+}
+
+func (s *server) Addr() net.Addr {
+	return s.ln.Addr()
+}
+
+func (s *server) Close() error {
+	return s.s.Close()
+}
+
+func (s *server) IsClosed() bool {
+	select {
+	case <-s.cclose:
+		return true
+	default:
+		return false
+	}
+}

go-gost/x/auth/auth.go

@@ -0,0 +1,280 @@
+package auth
+
+import (
+	"bufio"
+	"context"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/internal/loader"
+	xlogger "github.com/go-gost/x/logger"
+)
+
+type options struct {
+	auths       map[string]string
+	fileLoader  loader.Loader
+	redisLoader loader.Loader
+	httpLoader  loader.Loader
+	period      time.Duration
+	logger      logger.Logger
+}
+
+type Option func(opts *options)
+
+func AuthsOption(auths map[string]string) Option {
+	return func(opts *options) {
+		opts.auths = auths
+	}
+}
+
+func ReloadPeriodOption(period time.Duration) Option {
+	return func(opts *options) {
+		opts.period = period
+	}
+}
+
+func FileLoaderOption(fileLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.fileLoader = fileLoader
+	}
+}
+
+func RedisLoaderOption(redisLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.redisLoader = redisLoader
+	}
+}
+
+func HTTPLoaderOption(httpLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.httpLoader = httpLoader
+	}
+}
+
+func LoggerOption(logger logger.Logger) Option {
+	return func(opts *options) {
+		opts.logger = logger
+	}
+}
+
+// authenticator is an Authenticator that authenticates client by key-value pairs.
+type authenticator struct {
+	kvs        map[string]string
+	mu         sync.RWMutex
+	cancelFunc context.CancelFunc
+	options    options
+}
+
+// NewAuthenticator creates an Authenticator that authenticates client by pre-defined user mapping.
+func NewAuthenticator(opts ...Option) auth.Authenticator {
+	var options options
+	for _, opt := range opts {
+		opt(&options)
+	}
+	if options.logger == nil {
+		options.logger = xlogger.Nop()
+	}
+
+	ctx, cancel := context.WithCancel(context.TODO())
+	p := &authenticator{
+		kvs:        make(map[string]string),
+		cancelFunc: cancel,
+		options:    options,
+	}
+
+	if err := p.reload(ctx); err != nil {
+		options.logger.Warnf("reload: %v", err)
+	}
+	if p.options.period > 0 {
+		go p.periodReload(ctx)
+	}
+
+	return p
+}
+
+// Authenticate checks the validity of the provided user-password pair.
+func (p *authenticator) Authenticate(ctx context.Context, user, password string, opts ...auth.Option) (string, bool) {
+	if p == nil {
+		return "", true
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	if len(p.kvs) == 0 {
+		return "", false
+	}
+
+	v, ok := p.kvs[user]
+	return user, ok && (v == "" || password == v)
+}
+
+func (p *authenticator) periodReload(ctx context.Context) error {
+	period := p.options.period
+	if period < time.Second {
+		period = time.Second
+	}
+	ticker := time.NewTicker(period)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if err := p.reload(ctx); err != nil {
+				p.options.logger.Warnf("reload: %v", err)
+				// return err
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+func (p *authenticator) reload(ctx context.Context) (err error) {
+	kvs := make(map[string]string)
+	for k, v := range p.options.auths {
+		kvs[k] = v
+	}
+
+	m, err := p.load(ctx)
+	for k, v := range m {
+		kvs[k] = v
+	}
+
+	p.options.logger.Debugf("load items %d", len(m))
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.kvs = kvs
+
+	return
+}
+
+func (p *authenticator) load(ctx context.Context) (m map[string]string, err error) {
+	m = make(map[string]string)
+
+	if p.options.fileLoader != nil {
+		if mapper, ok := p.options.fileLoader.(loader.Mapper); ok {
+			auths, er := mapper.Map(ctx)
+			if er != nil {
+				p.options.logger.Warnf("file loader: %v", er)
+			}
+			m = auths
+		} else {
+			r, er := p.options.fileLoader.Load(ctx)
+			if er != nil {
+				p.options.logger.Warnf("file loader: %v", er)
+			}
+			if auths, _ := p.parseAuths(r); auths != nil {
+				m = auths
+			}
+		}
+	}
+	if p.options.redisLoader != nil {
+		if mapper, ok := p.options.fileLoader.(loader.Mapper); ok {
+			auths, er := mapper.Map(ctx)
+			if er != nil {
+				p.options.logger.Warnf("file loader: %v", er)
+			}
+			for k, v := range auths {
+				m[k] = v
+			}
+		} else {
+			r, er := p.options.redisLoader.Load(ctx)
+			if er != nil {
+				p.options.logger.Warnf("redis loader: %v", er)
+			}
+			if auths, _ := p.parseAuths(r); auths != nil {
+				for k, v := range auths {
+					m[k] = v
+				}
+			}
+		}
+	}
+	if p.options.httpLoader != nil {
+		r, er := p.options.httpLoader.Load(ctx)
+		if er != nil {
+			p.options.logger.Warnf("http loader: %v", er)
+		}
+		if auths, _ := p.parseAuths(r); auths != nil {
+			for k, v := range auths {
+				m[k] = v
+			}
+		}
+	}
+
+	return
+}
+
+func (p *authenticator) parseAuths(r io.Reader) (auths map[string]string, err error) {
+	if r == nil {
+		return
+	}
+
+	auths = make(map[string]string)
+
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		line := strings.Replace(scanner.Text(), "\t", " ", -1)
+		line = strings.TrimSpace(line)
+		if n := strings.IndexByte(line, '#'); n == 0 {
+			continue
+		}
+		sp := strings.SplitN(line, " ", 2)
+		if len(sp) == 1 {
+			if k := strings.TrimSpace(sp[0]); k != "" {
+				auths[k] = ""
+			}
+		}
+		if len(sp) == 2 {
+			if k := strings.TrimSpace(sp[0]); k != "" {
+				auths[k] = strings.TrimSpace(sp[1])
+			}
+		}
+	}
+
+	err = scanner.Err()
+	return
+}
+
+func (p *authenticator) Close() error {
+	p.cancelFunc()
+	if p.options.fileLoader != nil {
+		p.options.fileLoader.Close()
+	}
+	if p.options.redisLoader != nil {
+		p.options.redisLoader.Close()
+	}
+	return nil
+}
+
+type authenticatorGroup struct {
+	authers []auth.Authenticator
+}
+
+func AuthenticatorGroup(authers ...auth.Authenticator) auth.Authenticator {
+	return &authenticatorGroup{
+		authers: authers,
+	}
+}
+
+func (p *authenticatorGroup) Authenticate(ctx context.Context, user, password string, opts ...auth.Option) (string, bool) {
+	if len(p.authers) == 0 {
+		return "", false
+	}
+	for _, auther := range p.authers {
+		if auther == nil {
+			continue
+		}
+
+		if id, ok := auther.Authenticate(ctx, user, password, opts...); ok {
+			return id, ok
+		}
+	}
+	return "", false
+}

go-gost/x/auth/plugin/grpc.go

@@ -0,0 +1,72 @@
+package auth
+
+import (
+	"context"
+	"io"
+
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/plugin/auth/proto"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/plugin"
+	"google.golang.org/grpc"
+)
+
+type grpcPlugin struct {
+	conn   grpc.ClientConnInterface
+	client proto.AuthenticatorClient
+	log    logger.Logger
+}
+
+// NewGRPCPlugin creates an Authenticator plugin based on gRPC.
+func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) auth.Authenticator {
+	var options plugin.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	log := logger.Default().WithFields(map[string]any{
+		"kind":   "auther",
+		"auther": name,
+	})
+	conn, err := plugin.NewGRPCConn(addr, &options)
+	if err != nil {
+		log.Error(err)
+	}
+
+	p := &grpcPlugin{
+		conn: conn,
+		log:  log,
+	}
+
+	if conn != nil {
+		p.client = proto.NewAuthenticatorClient(conn)
+	}
+	return p
+}
+
+// Authenticate checks the validity of the provided user-password pair.
+func (p *grpcPlugin) Authenticate(ctx context.Context, user, password string, opts ...auth.Option) (string, bool) {
+	if p.client == nil {
+		return "", false
+	}
+
+	r, err := p.client.Authenticate(ctx,
+		&proto.AuthenticateRequest{
+			Username: user,
+			Password: password,
+			Client:   string(ctxvalue.ClientAddrFromContext(ctx)),
+		})
+	if err != nil {
+		p.log.Error(err)
+		return "", false
+	}
+	return r.Id, r.Ok
+}
+
+func (p *grpcPlugin) Close() error {
+	if closer, ok := p.conn.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}

go-gost/x/auth/plugin/http.go

@@ -0,0 +1,90 @@
+package auth
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/logger"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/plugin"
+)
+
+type httpPluginRequest struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+	Client   string `json:"client"`
+}
+
+type httpPluginResponse struct {
+	OK bool   `json:"ok"`
+	ID string `json:"id"`
+}
+
+type httpPlugin struct {
+	url    string
+	client *http.Client
+	header http.Header
+	log    logger.Logger
+}
+
+// NewHTTPPlugin creates an Authenticator plugin based on HTTP.
+func NewHTTPPlugin(name string, url string, opts ...plugin.Option) auth.Authenticator {
+	var options plugin.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &httpPlugin{
+		url:    url,
+		client: plugin.NewHTTPClient(&options),
+		header: options.Header,
+		log: logger.Default().WithFields(map[string]any{
+			"kind":   "auther",
+			"auther": name,
+		}),
+	}
+}
+
+func (p *httpPlugin) Authenticate(ctx context.Context, user, password string, opts ...auth.Option) (id string, ok bool) {
+	if p.client == nil {
+		return
+	}
+
+	rb := httpPluginRequest{
+		Username: user,
+		Password: password,
+		Client:   string(ctxvalue.ClientAddrFromContext(ctx)),
+	}
+	v, err := json.Marshal(&rb)
+	if err != nil {
+		return
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.url, bytes.NewReader(v))
+	if err != nil {
+		return
+	}
+
+	if p.header != nil {
+		req.Header = p.header.Clone()
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return
+	}
+
+	res := httpPluginResponse{}
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return
+	}
+	return res.ID, res.OK
+}

go-gost/x/bypass/bypass.go

@@ -0,0 +1,349 @@
+package bypass
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"io"
+	"net"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/matcher"
+	xnet "github.com/go-gost/x/internal/net"
+)
+
+var (
+	ErrBypass = errors.New("bypass")
+)
+
+type options struct {
+	whitelist   bool
+	matchers    []string
+	fileLoader  loader.Loader
+	redisLoader loader.Loader
+	httpLoader  loader.Loader
+	period      time.Duration
+	logger      logger.Logger
+}
+
+type Option func(opts *options)
+
+func WhitelistOption(whitelist bool) Option {
+	return func(opts *options) {
+		opts.whitelist = whitelist
+	}
+}
+
+func MatchersOption(matchers []string) Option {
+	return func(opts *options) {
+		opts.matchers = matchers
+	}
+}
+
+func ReloadPeriodOption(period time.Duration) Option {
+	return func(opts *options) {
+		opts.period = period
+	}
+}
+
+func FileLoaderOption(fileLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.fileLoader = fileLoader
+	}
+}
+
+func RedisLoaderOption(redisLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.redisLoader = redisLoader
+	}
+}
+
+func HTTPLoaderOption(httpLoader loader.Loader) Option {
+	return func(opts *options) {
+		opts.httpLoader = httpLoader
+	}
+}
+
+func LoggerOption(logger logger.Logger) Option {
+	return func(opts *options) {
+		opts.logger = logger
+	}
+}
+
+type localBypass struct {
+	cidrMatcher     matcher.Matcher
+	addrMatcher     matcher.Matcher
+	wildcardMatcher matcher.Matcher
+	ipRangeMatcher  matcher.Matcher
+	cancelFunc      context.CancelFunc
+	options         options
+	mu              sync.RWMutex
+}
+
+// NewBypass creates and initializes a new Bypass.
+// The rules will be reversed if the reverse option is true.
+func NewBypass(opts ...Option) bypass.Bypass {
+	var options options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	ctx, cancel := context.WithCancel(context.TODO())
+
+	bp := &localBypass{
+		cancelFunc: cancel,
+		options:    options,
+	}
+
+	if err := bp.reload(ctx); err != nil {
+		options.logger.Warnf("reload: %v", err)
+	}
+	if bp.options.period > 0 {
+		go bp.periodReload(ctx)
+	}
+
+	return bp
+}
+
+func (bp *localBypass) periodReload(ctx context.Context) error {
+	period := bp.options.period
+	if period < time.Second {
+		period = time.Second
+	}
+	ticker := time.NewTicker(period)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if err := bp.reload(ctx); err != nil {
+				bp.options.logger.Warnf("reload: %v", err)
+				// return err
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+func (bp *localBypass) reload(ctx context.Context) error {
+	v, err := bp.load(ctx)
+	if err != nil {
+		return err
+	}
+	patterns := append(bp.options.matchers, v...)
+	bp.options.logger.Debugf("load items %d", len(patterns))
+
+	var addrs []string
+	var inets []*net.IPNet
+	var wildcards []string
+	var ipRanges []xnet.IPRange
+	for _, pattern := range patterns {
+		if _, inet, err := net.ParseCIDR(pattern); err == nil {
+			inets = append(inets, inet)
+			continue
+		}
+
+		if strings.ContainsAny(pattern, "*?") {
+			wildcards = append(wildcards, pattern)
+			continue
+		}
+
+		r := xnet.IPRange{}
+		if err := r.Parse(pattern); err == nil {
+			ipRanges = append(ipRanges, r)
+			continue
+		}
+
+		addrs = append(addrs, pattern)
+	}
+
+	bp.mu.Lock()
+	defer bp.mu.Unlock()
+
+	bp.cidrMatcher = matcher.CIDRMatcher(inets)
+	bp.addrMatcher = matcher.AddrMatcher(addrs)
+	bp.wildcardMatcher = matcher.WildcardMatcher(wildcards)
+	bp.ipRangeMatcher = matcher.IPRangeMatcher(ipRanges)
+
+	return nil
+}
+
+func (bp *localBypass) load(ctx context.Context) (patterns []string, err error) {
+	if bp.options.fileLoader != nil {
+		if lister, ok := bp.options.fileLoader.(loader.Lister); ok {
+			list, er := lister.List(ctx)
+			if er != nil {
+				bp.options.logger.Warnf("file loader: %v", er)
+			}
+			for _, s := range list {
+				if line := bp.parseLine(s); line != "" {
+					patterns = append(patterns, line)
+				}
+			}
+		} else {
+			r, er := bp.options.fileLoader.Load(ctx)
+			if er != nil {
+				bp.options.logger.Warnf("file loader: %v", er)
+			}
+			if v, _ := bp.parsePatterns(r); v != nil {
+				patterns = append(patterns, v...)
+			}
+		}
+	}
+	if bp.options.redisLoader != nil {
+		if lister, ok := bp.options.redisLoader.(loader.Lister); ok {
+			list, er := lister.List(ctx)
+			if er != nil {
+				bp.options.logger.Warnf("redis loader: %v", er)
+			}
+			patterns = append(patterns, list...)
+		} else {
+			r, er := bp.options.redisLoader.Load(ctx)
+			if er != nil {
+				bp.options.logger.Warnf("redis loader: %v", er)
+			}
+			if v, _ := bp.parsePatterns(r); v != nil {
+				patterns = append(patterns, v...)
+			}
+		}
+	}
+	if bp.options.httpLoader != nil {
+		r, er := bp.options.httpLoader.Load(ctx)
+		if er != nil {
+			bp.options.logger.Warnf("http loader: %v", er)
+		}
+		if v, _ := bp.parsePatterns(r); v != nil {
+			patterns = append(patterns, v...)
+		}
+	}
+
+	return
+}
+
+func (bp *localBypass) parsePatterns(r io.Reader) (patterns []string, err error) {
+	if r == nil {
+		return
+	}
+
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		if line := bp.parseLine(scanner.Text()); line != "" {
+			patterns = append(patterns, line)
+		}
+	}
+
+	err = scanner.Err()
+	return
+}
+
+func (bp *localBypass) Contains(ctx context.Context, network, addr string, opts ...bypass.Option) bool {
+	if addr == "" || bp == nil {
+		return false
+	}
+
+	matched := bp.matched(addr)
+
+	b := !bp.options.whitelist && matched ||
+		bp.options.whitelist && !matched
+	if b {
+		bp.options.logger.Debugf("bypass: %s, whitelist: %t", addr, bp.options.whitelist)
+	} else {
+		bp.options.logger.Debugf("pass: %s, whitelist: %t", addr, bp.options.whitelist)
+	}
+	return b
+}
+
+func (p *localBypass) IsWhitelist() bool {
+	return p.options.whitelist
+}
+
+func (bp *localBypass) parseLine(s string) string {
+	if n := strings.IndexByte(s, '#'); n >= 0 {
+		s = s[:n]
+	}
+	return strings.TrimSpace(s)
+}
+
+func (bp *localBypass) matched(addr string) bool {
+	bp.mu.RLock()
+	defer bp.mu.RUnlock()
+
+	if bp.ipRangeMatcher.Match(addr) {
+		return true
+	}
+
+	if bp.addrMatcher.Match(addr) {
+		return true
+	}
+
+	host, _, _ := net.SplitHostPort(addr)
+	if host == "" {
+		host = addr
+	}
+
+	if ip := net.ParseIP(host); ip != nil && bp.cidrMatcher.Match(host) {
+		return true
+	}
+
+	return bp.wildcardMatcher.Match(addr)
+}
+
+func (bp *localBypass) Close() error {
+	bp.cancelFunc()
+	if bp.options.fileLoader != nil {
+		bp.options.fileLoader.Close()
+	}
+	if bp.options.redisLoader != nil {
+		bp.options.redisLoader.Close()
+	}
+	return nil
+}
+
+type bypassGroup struct {
+	bypasses []bypass.Bypass
+}
+
+func BypassGroup(bypasses ...bypass.Bypass) bypass.Bypass {
+	return &bypassGroup{
+		bypasses: bypasses,
+	}
+}
+
+func (p *bypassGroup) Contains(ctx context.Context, network, addr string, opts ...bypass.Option) bool {
+	var whitelist, blacklist []bool
+	for _, bypass := range p.bypasses {
+		result := bypass.Contains(ctx, network, addr, opts...)
+		if bypass.IsWhitelist() {
+			whitelist = append(whitelist, result)
+		} else {
+			blacklist = append(blacklist, result)
+		}
+	}
+	status := false
+	if len(whitelist) > 0 {
+		if slices.Contains(whitelist, false) {
+			status = false
+		} else {
+			status = true
+		}
+	}
+	if !status && len(blacklist) > 0 {
+		if slices.Contains(blacklist, true) {
+			status = true
+		} else {
+			status = false
+		}
+	}
+	return status
+}
+
+func (p *bypassGroup) IsWhitelist() bool {
+	return false
+}

go-gost/x/bypass/plugin/grpc.go

@@ -0,0 +1,81 @@
+package bypass
+
+import (
+	"context"
+	"io"
+
+	"github.com/go-gost/core/bypass"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/plugin/bypass/proto"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/plugin"
+	"google.golang.org/grpc"
+)
+
+type grpcPlugin struct {
+	conn   grpc.ClientConnInterface
+	client proto.BypassClient
+	log    logger.Logger
+}
+
+// NewGRPCPlugin creates a Bypass plugin based on gRPC.
+func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) bypass.Bypass {
+	var options plugin.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	log := logger.Default().WithFields(map[string]any{
+		"kind":   "bypass",
+		"bypass": name,
+	})
+	conn, err := plugin.NewGRPCConn(addr, &options)
+	if err != nil {
+		log.Error(err)
+	}
+
+	p := &grpcPlugin{
+		conn: conn,
+		log:  log,
+	}
+	if conn != nil {
+		p.client = proto.NewBypassClient(conn)
+	}
+	return p
+}
+
+func (p *grpcPlugin) Contains(ctx context.Context, network, addr string, opts ...bypass.Option) bool {
+	if p.client == nil {
+		return true
+	}
+
+	var options bypass.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	r, err := p.client.Bypass(ctx,
+		&proto.BypassRequest{
+			Network: network,
+			Addr:    addr,
+			Client:  string(ctxvalue.ClientIDFromContext(ctx)),
+			Host:    options.Host,
+			Path:    options.Path,
+		})
+	if err != nil {
+		p.log.Error(err)
+		return true
+	}
+	return r.Ok
+}
+
+func (p *grpcPlugin) Close() error {
+	if closer, ok := p.conn.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}
+
+func (p *grpcPlugin) IsWhitelist() bool {
+	return false
+}

go-gost/x/bypass/plugin/http.go

@@ -0,0 +1,102 @@
+package bypass
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/go-gost/core/bypass"
+	"github.com/go-gost/core/logger"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/plugin"
+)
+
+type httpPluginRequest struct {
+	Network string `json:"network"`
+	Addr    string `json:"addr"`
+	Client  string `json:"client"`
+	Host    string `json:"host"`
+	Path    string `json:"path"`
+}
+
+type httpPluginResponse struct {
+	OK bool `json:"ok"`
+}
+
+type httpPlugin struct {
+	url    string
+	client *http.Client
+	header http.Header
+	log    logger.Logger
+}
+
+// NewHTTPPlugin creates an Bypass plugin based on HTTP.
+func NewHTTPPlugin(name string, url string, opts ...plugin.Option) bypass.Bypass {
+	var options plugin.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &httpPlugin{
+		url:    url,
+		client: plugin.NewHTTPClient(&options),
+		header: options.Header,
+		log: logger.Default().WithFields(map[string]any{
+			"kind":   "bypass",
+			"bypass": name,
+		}),
+	}
+}
+
+func (p *httpPlugin) Contains(ctx context.Context, network, addr string, opts ...bypass.Option) (ok bool) {
+	if p.client == nil {
+		return
+	}
+
+	var options bypass.Options
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	rb := httpPluginRequest{
+		Network: network,
+		Addr:    addr,
+		Client:  string(ctxvalue.ClientIDFromContext(ctx)),
+		Host:    options.Host,
+		Path:    options.Path,
+	}
+	v, err := json.Marshal(&rb)
+	if err != nil {
+		return
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.url, bytes.NewReader(v))
+	if err != nil {
+		return
+	}
+
+	if p.header != nil {
+		req.Header = p.header.Clone()
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return
+	}
+
+	res := httpPluginResponse{}
+	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
+		return
+	}
+	return res.OK
+}
+
+func (p *httpPlugin) IsWhitelist() bool {
+	return false
+}

go-gost/x/chain/chain.go

@@ -0,0 +1,142 @@
+package chain
+
+import (
+	"context"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/selector"
+)
+
+var (
+	_ chain.Chainer = (*chainGroup)(nil)
+)
+
+type ChainOptions struct {
+	Metadata metadata.Metadata
+	Logger   logger.Logger
+}
+
+type ChainOption func(*ChainOptions)
+
+func MetadataChainOption(md metadata.Metadata) ChainOption {
+	return func(opts *ChainOptions) {
+		opts.Metadata = md
+	}
+}
+
+func LoggerChainOption(logger logger.Logger) ChainOption {
+	return func(opts *ChainOptions) {
+		opts.Logger = logger
+	}
+}
+
+type chainNamer interface {
+	Name() string
+}
+
+type Chain struct {
+	name     string
+	hops     []hop.Hop
+	marker   selector.Marker
+	metadata metadata.Metadata
+	logger   logger.Logger
+}
+
+func NewChain(name string, opts ...ChainOption) *Chain {
+	var options ChainOptions
+	for _, opt := range opts {
+		if opt != nil {
+			opt(&options)
+		}
+	}
+
+	return &Chain{
+		name:     name,
+		metadata: options.Metadata,
+		marker:   selector.NewFailMarker(),
+		logger:   options.Logger,
+	}
+}
+
+func (c *Chain) AddHop(hop hop.Hop) {
+	c.hops = append(c.hops, hop)
+}
+
+// Metadata implements metadata.Metadatable interface.
+func (c *Chain) Metadata() metadata.Metadata {
+	return c.metadata
+}
+
+// Marker implements selector.Markable interface.
+func (c *Chain) Marker() selector.Marker {
+	return c.marker
+}
+
+func (c *Chain) Name() string {
+	return c.name
+}
+
+func (c *Chain) Route(ctx context.Context, network, address string, opts ...chain.RouteOption) chain.Route {
+	if c == nil || len(c.hops) == 0 {
+		return nil
+	}
+
+	var options chain.RouteOptions
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	rt := NewRoute(ChainRouteOption(c))
+	for _, h := range c.hops {
+		node := h.Select(ctx,
+			hop.NetworkSelectOption(network),
+			hop.AddrSelectOption(address),
+			hop.HostSelectOption(options.Host),
+		)
+		if node == nil {
+			return rt
+		}
+		if node.Options().Transport.Multiplex() {
+			tr := node.Options().Transport.Copy()
+			tr.Options().Route = rt
+			node = node.Copy()
+			node.Options().Transport = tr
+			rt = NewRoute(ChainRouteOption(c))
+		}
+
+		rt.addNode(node)
+	}
+	return rt
+}
+
+type chainGroup struct {
+	chains   []chain.Chainer
+	selector selector.Selector[chain.Chainer]
+}
+
+func NewChainGroup(chains ...chain.Chainer) *chainGroup {
+	return &chainGroup{chains: chains}
+}
+
+func (p *chainGroup) WithSelector(s selector.Selector[chain.Chainer]) *chainGroup {
+	p.selector = s
+	return p
+}
+
+func (p *chainGroup) Route(ctx context.Context, network, address string, opts ...chain.RouteOption) chain.Route {
+	if chain := p.next(ctx); chain != nil {
+		return chain.Route(ctx, network, address, opts...)
+	}
+	return nil
+}
+
+func (p *chainGroup) next(ctx context.Context) chain.Chainer {
+	if p == nil || len(p.chains) == 0 {
+		return nil
+	}
+
+	return p.selector.Select(ctx, p.chains...)
+}

go-gost/x/chain/route.go

@@ -0,0 +1,312 @@
+package chain
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/metrics"
+	"github.com/go-gost/core/selector"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/dialer"
+	"github.com/go-gost/x/internal/net/udp"
+	xmetrics "github.com/go-gost/x/metrics"
+)
+
+var (
+	ErrEmptyRoute = errors.New("empty route")
+)
+
+var (
+	DefaultRoute chain.Route = &defaultRoute{}
+)
+
+// defaultRoute is a Route without nodes.
+type defaultRoute struct{}
+
+func (*defaultRoute) Dial(ctx context.Context, network, address string, opts ...chain.DialOption) (net.Conn, error) {
+	var options chain.DialOptions
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	netd := dialer.Dialer{
+		Interface: options.Interface,
+		Netns:     options.Netns,
+		Logger:    options.Logger,
+	}
+	if options.SockOpts != nil {
+		netd.Mark = options.SockOpts.Mark
+	}
+
+	return netd.Dial(ctx, network, address)
+}
+
+func (*defaultRoute) Bind(ctx context.Context, network, address string, opts ...chain.BindOption) (net.Listener, error) {
+	var options chain.BindOptions
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		addr, err := net.ResolveTCPAddr(network, address)
+		if err != nil {
+			return nil, err
+		}
+		return net.ListenTCP(network, addr)
+	case "udp", "udp4", "udp6":
+		addr, err := net.ResolveUDPAddr(network, address)
+		if err != nil {
+			return nil, err
+		}
+		conn, err := net.ListenUDP(network, addr)
+		if err != nil {
+			return nil, err
+		}
+		logger := logger.Default().WithFields(map[string]any{
+			"network": network,
+			"address": address,
+		})
+		ln := udp.NewListener(conn, &udp.ListenConfig{
+			Backlog:        options.Backlog,
+			ReadQueueSize:  options.UDPDataQueueSize,
+			ReadBufferSize: options.UDPDataBufferSize,
+			TTL:            options.UDPConnTTL,
+			Keepalive:      true,
+			Logger:         logger,
+		})
+		return ln, err
+	default:
+		err := fmt.Errorf("network %s unsupported", network)
+		return nil, err
+	}
+}
+
+func (r *defaultRoute) Nodes() []*chain.Node {
+	return nil
+}
+
+type RouteOptions struct {
+	Chain chain.Chainer
+}
+
+type RouteOption func(*RouteOptions)
+
+func ChainRouteOption(c chain.Chainer) RouteOption {
+	return func(o *RouteOptions) {
+		o.Chain = c
+	}
+}
+
+type chainRoute struct {
+	nodes   []*chain.Node
+	options RouteOptions
+}
+
+func NewRoute(opts ...RouteOption) *chainRoute {
+	var options RouteOptions
+	for _, opt := range opts {
+		if opt != nil {
+			opt(&options)
+		}
+	}
+
+	return &chainRoute{
+		options: options,
+	}
+}
+
+func (r *chainRoute) addNode(nodes ...*chain.Node) {
+	r.nodes = append(r.nodes, nodes...)
+}
+
+func (r *chainRoute) Dial(ctx context.Context, network, address string, opts ...chain.DialOption) (net.Conn, error) {
+	if len(r.Nodes()) == 0 {
+		return DefaultRoute.Dial(ctx, network, address, opts...)
+	}
+
+	var options chain.DialOptions
+	for _, opt := range opts {
+		if opt != nil {
+			opt(&options)
+		}
+	}
+	conn, err := r.connect(ctx, options.Logger)
+	if err != nil {
+		return nil, err
+	}
+
+	cc, err := r.getNode(len(r.Nodes())-1).Options().Transport.Connect(ctx, conn, network, address)
+	if err != nil {
+		if conn != nil {
+			conn.Close()
+		}
+		return nil, err
+	}
+	return cc, nil
+}
+
+func (r *chainRoute) Bind(ctx context.Context, network, address string, opts ...chain.BindOption) (net.Listener, error) {
+	if len(r.Nodes()) == 0 {
+		return DefaultRoute.Bind(ctx, network, address, opts...)
+	}
+
+	var options chain.BindOptions
+	for _, opt := range opts {
+		if opt != nil {
+			opt(&options)
+		}
+	}
+
+	conn, err := r.connect(ctx, options.Logger)
+	if err != nil {
+		return nil, err
+	}
+
+	ln, err := r.getNode(len(r.Nodes())-1).Options().Transport.Bind(ctx,
+		conn, network, address,
+		connector.BacklogBindOption(options.Backlog),
+		connector.MuxBindOption(options.Mux),
+		connector.UDPConnTTLBindOption(options.UDPConnTTL),
+		connector.UDPDataBufferSizeBindOption(options.UDPDataBufferSize),
+		connector.UDPDataQueueSizeBindOption(options.UDPDataQueueSize),
+	)
+	if err != nil {
+		conn.Close()
+		return nil, err
+	}
+
+	return ln, nil
+}
+
+func (r *chainRoute) connect(ctx context.Context, logger logger.Logger) (conn net.Conn, err error) {
+	network := "ip"
+	node := r.nodes[0]
+
+	defer func() {
+		if r.options.Chain != nil {
+			var marker selector.Marker
+			if m, ok := r.options.Chain.(selector.Markable); ok && m != nil {
+				marker = m.Marker()
+			}
+			var name string
+			if cn, _ := r.options.Chain.(chainNamer); cn != nil {
+				name = cn.Name()
+			}
+			// chain error
+			if err != nil {
+				if marker != nil {
+					marker.Mark()
+				}
+				if v := xmetrics.GetCounter(xmetrics.MetricChainErrorsCounter,
+					metrics.Labels{"chain": name, "node": node.Name}); v != nil {
+					v.Inc()
+				}
+				return
+			}
+
+			if marker != nil {
+				marker.Reset()
+			}
+		}
+	}()
+
+	addr, err := xnet.Resolve(ctx, network, node.Addr, node.Options().Resolver, node.Options().HostMapper, logger)
+	marker := node.Marker()
+	if err != nil {
+		if marker != nil {
+			marker.Mark()
+		}
+		return
+	}
+
+	start := time.Now()
+	cc, err := node.Options().Transport.Dial(ctx, addr)
+	if err != nil {
+		if marker != nil {
+			marker.Mark()
+		}
+		return
+	}
+
+	cn, err := node.Options().Transport.Handshake(ctx, cc)
+	if err != nil {
+		cc.Close()
+		if marker != nil {
+			marker.Mark()
+		}
+		return
+	}
+	if marker != nil {
+		marker.Reset()
+	}
+
+	if r.options.Chain != nil {
+		var name string
+		if cn, _ := r.options.Chain.(chainNamer); cn != nil {
+			name = cn.Name()
+		}
+		if v := xmetrics.GetObserver(xmetrics.MetricNodeConnectDurationObserver,
+			metrics.Labels{"chain": name, "node": node.Name}); v != nil {
+			v.Observe(time.Since(start).Seconds())
+		}
+	}
+
+	preNode := node
+	for _, node := range r.nodes[1:] {
+		marker := node.Marker()
+		addr, err = xnet.Resolve(ctx, network, node.Addr, node.Options().Resolver, node.Options().HostMapper, logger)
+		if err != nil {
+			cn.Close()
+			if marker != nil {
+				marker.Mark()
+			}
+			return
+		}
+		cc, err = preNode.Options().Transport.Connect(ctx, cn, "tcp", addr)
+		if err != nil {
+			cn.Close()
+			if marker != nil {
+				marker.Mark()
+			}
+			return
+		}
+		cc, err = node.Options().Transport.Handshake(ctx, cc)
+		if err != nil {
+			cn.Close()
+			if marker != nil {
+				marker.Mark()
+			}
+			return
+		}
+		if marker != nil {
+			marker.Reset()
+		}
+
+		cn = cc
+		preNode = node
+	}
+
+	conn = cn
+	return
+}
+
+func (r *chainRoute) getNode(index int) *chain.Node {
+	if r == nil || len(r.Nodes()) == 0 || index < 0 || index >= len(r.Nodes()) {
+		return nil
+	}
+	return r.nodes[index]
+}
+
+func (r *chainRoute) Nodes() []*chain.Node {
+	if r != nil {
+		return r.nodes
+	}
+	return nil
+}

go-gost/x/chain/router.go

@@ -0,0 +1,223 @@
+package chain
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+)
+
+type Router struct {
+	options chain.RouterOptions
+}
+
+func NewRouter(opts ...chain.RouterOption) *Router {
+	r := &Router{}
+	for _, opt := range opts {
+		if opt != nil {
+			opt(&r.options)
+		}
+	}
+	if r.options.Timeout == 0 {
+		r.options.Timeout = 15 * time.Second
+	}
+
+	if r.options.Logger == nil {
+		r.options.Logger = logger.Default().WithFields(map[string]any{"kind": "router"})
+	}
+	return r
+}
+
+func (r *Router) Options() *chain.RouterOptions {
+	if r == nil {
+		return nil
+	}
+	return &r.options
+}
+
+func (r *Router) Dial(ctx context.Context, network, address string) (conn net.Conn, err error) {
+	host := address
+	if h, _, _ := net.SplitHostPort(address); h != "" {
+		host = h
+	}
+	r.record(ctx, recorder.RecorderServiceRouterDialAddress, []byte(host))
+
+	log := r.options.Logger.WithFields(map[string]any{
+		"sid": ctxvalue.SidFromContext(ctx),
+	})
+
+	conn, err = r.dial(ctx, network, address, log)
+	if err != nil {
+		r.record(ctx, recorder.RecorderServiceRouterDialAddressError, []byte(host))
+		return
+	}
+
+	if network == "udp" || network == "udp4" || network == "udp6" {
+		if _, ok := conn.(net.PacketConn); !ok {
+			return &packetConn{conn}, nil
+		}
+	}
+	return
+}
+
+func (r *Router) record(ctx context.Context, name string, data []byte) error {
+	if len(data) == 0 {
+		return nil
+	}
+
+	for _, rec := range r.options.Recorders {
+		if rec.Record == name {
+			return rec.Recorder.Record(ctx, data)
+		}
+	}
+	return nil
+}
+
+func (r *Router) dial(ctx context.Context, network, address string, log logger.Logger) (conn net.Conn, err error) {
+	count := r.options.Retries + 1
+	if count <= 0 {
+		count = 1
+	}
+
+	log.Debugf("dial %s/%s", address, network)
+
+	for i := 0; i < count; i++ {
+		ctx := ctx
+		if r.options.Timeout > 0 {
+			var cancel context.CancelFunc
+			ctx, cancel = context.WithTimeout(ctx, r.options.Timeout)
+			defer cancel()
+		}
+
+		buf := ctxvalue.BufferFromContext(ctx)
+		if buf != nil {
+			buf.Reset()
+		}
+
+		var ipAddr string
+		ipAddr, err = xnet.Resolve(ctx, "ip", address, r.options.Resolver, r.options.HostMapper, log)
+		if err != nil {
+			log.Error(err)
+			break
+		}
+
+		if buf != nil {
+			buf.Reset()
+		}
+
+		var route chain.Route
+		if r.options.Chain != nil {
+			route = r.options.Chain.Route(ctx, network, ipAddr, chain.WithHostRouteOption(address))
+		}
+
+		if buf == nil {
+			buf = &bytes.Buffer{}
+		}
+		for _, node := range routePath(route) {
+			fmt.Fprintf(buf, "%s@%s > ", node.Name, node.Addr)
+		}
+		fmt.Fprintf(buf, "%s", ipAddr)
+		log.Debugf("route(retry=%d) %s", i, buf.String())
+
+		if route == nil {
+			route = DefaultRoute
+		}
+		conn, err = route.Dial(ctx, network, ipAddr,
+			chain.InterfaceDialOption(r.options.IfceName),
+			chain.NetnsDialOption(r.options.Netns),
+			chain.SockOptsDialOption(r.options.SockOpts),
+			chain.LoggerDialOption(log),
+		)
+		if err == nil {
+			break
+		}
+		log.Errorf("route(retry=%d) %s", i, err)
+	}
+
+	return
+}
+
+func (r *Router) Bind(ctx context.Context, network, address string, opts ...chain.BindOption) (ln net.Listener, err error) {
+	count := r.options.Retries + 1
+	if count <= 0 {
+		count = 1
+	}
+
+	log := r.options.Logger.WithFields(map[string]any{
+		"sid": ctxvalue.SidFromContext(ctx),
+	})
+
+	log.Debugf("bind on %s/%s", address, network)
+
+	for i := 0; i < count; i++ {
+		ctx := ctx
+		if r.options.Timeout > 0 {
+			var cancel context.CancelFunc
+			ctx, cancel = context.WithTimeout(ctx, r.options.Timeout)
+			defer cancel()
+		}
+
+		var route chain.Route
+		if r.options.Chain != nil {
+			route = r.options.Chain.Route(ctx, network, address)
+			if route == nil || len(route.Nodes()) == 0 {
+				err = ErrEmptyRoute
+				return
+			}
+		}
+
+		if log.IsLevelEnabled(logger.DebugLevel) {
+			buf := bytes.Buffer{}
+			for _, node := range routePath(route) {
+				fmt.Fprintf(&buf, "%s@%s > ", node.Name, node.Addr)
+			}
+			fmt.Fprintf(&buf, "%s", address)
+			log.Debugf("route(retry=%d) %s", i, buf.String())
+		}
+
+		if route == nil {
+			route = DefaultRoute
+		}
+		ln, err = route.Bind(ctx, network, address, opts...)
+		if err == nil {
+			break
+		}
+		log.Errorf("route(retry=%d) %s", i, err)
+	}
+
+	return
+}
+
+func routePath(route chain.Route) (path []*chain.Node) {
+	if route == nil {
+		return
+	}
+	for _, node := range route.Nodes() {
+		if tr := node.Options().Transport; tr != nil {
+			path = append(path, routePath(tr.Options().Route)...)
+		}
+		path = append(path, node)
+	}
+	return
+}
+
+type packetConn struct {
+	net.Conn
+}
+
+func (c *packetConn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
+	n, err = c.Read(b)
+	addr = c.Conn.RemoteAddr()
+	return
+}
+
+func (c *packetConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
+	return c.Write(b)
+}

go-gost/x/chain/transport.go

@@ -0,0 +1,106 @@
+package chain
+
+import (
+	"context"
+	"net"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/dialer"
+	net_dialer "github.com/go-gost/x/internal/net/dialer"
+)
+
+type Transport struct {
+	dialer    dialer.Dialer
+	connector connector.Connector
+	options   chain.TransportOptions
+}
+
+func NewTransport(d dialer.Dialer, c connector.Connector, opts ...chain.TransportOption) *Transport {
+	tr := &Transport{
+		dialer:    d,
+		connector: c,
+	}
+	for _, opt := range opts {
+		if opt != nil {
+			opt(&tr.options)
+		}
+	}
+
+	return tr
+}
+
+func (tr *Transport) Dial(ctx context.Context, addr string) (net.Conn, error) {
+	netd := &net_dialer.Dialer{
+		Interface: tr.options.IfceName,
+		Netns:     tr.options.Netns,
+	}
+	if tr.options.SockOpts != nil {
+		netd.Mark = tr.options.SockOpts.Mark
+	}
+	if tr.options.Route != nil && len(tr.options.Route.Nodes()) > 0 {
+		netd.DialFunc = func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return tr.options.Route.Dial(ctx, network, addr)
+		}
+	}
+	opts := []dialer.DialOption{
+		dialer.HostDialOption(tr.options.Addr),
+		dialer.NetDialerDialOption(netd),
+	}
+	return tr.dialer.Dial(ctx, addr, opts...)
+}
+
+func (tr *Transport) Handshake(ctx context.Context, conn net.Conn) (net.Conn, error) {
+	var err error
+	if hs, ok := tr.dialer.(dialer.Handshaker); ok {
+		conn, err = hs.Handshake(ctx, conn,
+			dialer.AddrHandshakeOption(tr.options.Addr))
+		if err != nil {
+			return nil, err
+		}
+	}
+	if hs, ok := tr.connector.(connector.Handshaker); ok {
+		return hs.Handshake(ctx, conn)
+	}
+	return conn, nil
+}
+
+func (tr *Transport) Connect(ctx context.Context, conn net.Conn, network, address string) (net.Conn, error) {
+	netd := &net_dialer.Dialer{
+		Interface: tr.options.IfceName,
+		Netns:     tr.options.Netns,
+	}
+	if tr.options.SockOpts != nil {
+		netd.Mark = tr.options.SockOpts.Mark
+	}
+	return tr.connector.Connect(ctx, conn, network, address,
+		connector.DialerConnectOption(netd),
+	)
+}
+
+func (tr *Transport) Bind(ctx context.Context, conn net.Conn, network, address string, opts ...connector.BindOption) (net.Listener, error) {
+	if binder, ok := tr.connector.(connector.Binder); ok {
+		return binder.Bind(ctx, conn, network, address, opts...)
+	}
+	return nil, connector.ErrBindUnsupported
+}
+
+func (tr *Transport) Multiplex() bool {
+	if mux, ok := tr.dialer.(dialer.Multiplexer); ok {
+		return mux.Multiplex()
+	}
+	return false
+}
+
+func (tr *Transport) Options() *chain.TransportOptions {
+	if tr != nil {
+		return &tr.options
+	}
+	return nil
+}
+
+func (tr *Transport) Copy() chain.Transporter {
+	tr2 := &Transport{}
+	*tr2 = *tr
+	return tr
+}

go-gost/x/config/cmd/cmd.go

@@ -0,0 +1,682 @@
+package cmd
+
+import (
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-gost/x/config"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/limiter/conn"
+	"github.com/go-gost/x/limiter/traffic"
+	mdx "github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	ErrInvalidCmd  = errors.New("invalid cmd")
+	ErrInvalidNode = errors.New("invalid node")
+)
+
+func BuildConfigFromCmd(serviceList, nodeList []string) (*config.Config, error) {
+	namePrefix := ""
+	cfg := &config.Config{}
+
+	var chain *config.ChainConfig
+	if len(nodeList) > 0 {
+		chain = &config.ChainConfig{
+			Name: fmt.Sprintf("%schain-0", namePrefix),
+		}
+		cfg.Chains = append(cfg.Chains, chain)
+	}
+
+	for i, node := range nodeList {
+		url, err := Norm(node)
+		if err != nil {
+			return nil, err
+		}
+
+		nodeConfig, err := buildNodeConfig(url)
+		if err != nil {
+			return nil, err
+		}
+		nodeConfig.Name = fmt.Sprintf("%snode-0", namePrefix)
+
+		var nodes []*config.NodeConfig
+		for _, host := range strings.Split(nodeConfig.Addr, ",") {
+			if host == "" {
+				continue
+			}
+			nodeCfg := &config.NodeConfig{}
+			*nodeCfg = *nodeConfig
+			nodeCfg.Name = fmt.Sprintf("%snode-%d", namePrefix, len(nodes))
+			nodeCfg.Addr = host
+			nodes = append(nodes, nodeCfg)
+		}
+
+		m := map[string]any{}
+		for k, v := range url.Query() {
+			if len(v) > 0 {
+				m[k] = v[0]
+			}
+		}
+		md := mdx.NewMetadata(m)
+
+		hopConfig := &config.HopConfig{
+			Name:     fmt.Sprintf("%shop-%d", namePrefix, i),
+			Selector: parseSelector(m),
+			Nodes:    nodes,
+			Metadata: m,
+		}
+
+		if v := mdutil.GetString(md, "bypass"); v != "" {
+			bypassCfg := &config.BypassConfig{
+				Name: fmt.Sprintf("%sbypass-%d", namePrefix, len(cfg.Bypasses)),
+			}
+			if v[0] == '~' {
+				bypassCfg.Whitelist = true
+				v = v[1:]
+			}
+			for _, s := range strings.Split(v, ",") {
+				if s == "" {
+					continue
+				}
+				bypassCfg.Matchers = append(bypassCfg.Matchers, s)
+			}
+			hopConfig.Bypass = bypassCfg.Name
+			cfg.Bypasses = append(cfg.Bypasses, bypassCfg)
+			delete(m, "bypass")
+		}
+		if v := mdutil.GetString(md, "resolver"); v != "" {
+			resolverCfg := &config.ResolverConfig{
+				Name: fmt.Sprintf("%sresolver-%d", namePrefix, len(cfg.Resolvers)),
+			}
+			for _, rs := range strings.Split(v, ",") {
+				if rs == "" {
+					continue
+				}
+				resolverCfg.Nameservers = append(
+					resolverCfg.Nameservers,
+					&config.NameserverConfig{
+						Addr: rs,
+					},
+				)
+			}
+			hopConfig.Resolver = resolverCfg.Name
+			cfg.Resolvers = append(cfg.Resolvers, resolverCfg)
+			delete(m, "resolver")
+		}
+		if v := mdutil.GetString(md, "hosts"); v != "" {
+			hostsCfg := &config.HostsConfig{
+				Name: fmt.Sprintf("%shosts-%d", namePrefix, len(cfg.Hosts)),
+			}
+			for _, s := range strings.Split(v, ",") {
+				ss := strings.SplitN(s, ":", 2)
+				if len(ss) != 2 {
+					continue
+				}
+				hostsCfg.Mappings = append(
+					hostsCfg.Mappings,
+					&config.HostMappingConfig{
+						Hostname: ss[0],
+						IP:       ss[1],
+					},
+				)
+			}
+			hopConfig.Hosts = hostsCfg.Name
+			cfg.Hosts = append(cfg.Hosts, hostsCfg)
+			delete(m, "hosts")
+		}
+
+		if v := mdutil.GetString(md, "interface"); v != "" {
+			hopConfig.Interface = v
+			delete(m, "interface")
+		}
+		if v := mdutil.GetInt(md, "so_mark"); v > 0 {
+			hopConfig.SockOpts = &config.SockOptsConfig{
+				Mark: v,
+			}
+			delete(m, "so_mark")
+		}
+
+		chain.Hops = append(chain.Hops, hopConfig)
+	}
+
+	var services []*config.ServiceConfig
+	for _, svc := range serviceList {
+		svc = strings.TrimSpace(svc)
+		if svc == "" {
+			continue
+		}
+
+		if svc[0] == ':' || !strings.Contains(svc, "://") {
+			svc = "auto://" + svc
+		}
+
+		host, svc := cutHost(svc)
+
+		url, err := Norm(svc)
+		if err != nil {
+			return nil, err
+		}
+		url.Host = host
+
+		svcs, err := buildServiceConfig(url)
+		if err != nil {
+			return nil, err
+		}
+		services = append(services, svcs...)
+	}
+
+	for i, service := range services {
+		service.Name = fmt.Sprintf("%sservice-%d", namePrefix, i)
+		if chain != nil {
+			if service.Listener.Type == "rtcp" || service.Listener.Type == "rudp" {
+				service.Listener.Chain = chain.Name
+			} else {
+				service.Handler.Chain = chain.Name
+			}
+		}
+		cfg.Services = append(cfg.Services, service)
+
+		mh := service.Handler.Metadata
+		md := mdx.NewMetadata(mh)
+		if v := mdutil.GetInt(md, "retries"); v > 0 {
+			service.Handler.Retries = v
+			delete(mh, "retries")
+		}
+		if v := mdutil.GetString(md, "admission"); v != "" {
+			admCfg := &config.AdmissionConfig{
+				Name: fmt.Sprintf("%sadmission-%d", namePrefix, len(cfg.Admissions)),
+			}
+			if v[0] == '~' {
+				admCfg.Whitelist = true
+				v = v[1:]
+			}
+			for _, s := range strings.Split(v, ",") {
+				if s == "" {
+					continue
+				}
+				admCfg.Matchers = append(admCfg.Matchers, s)
+			}
+			service.Admission = admCfg.Name
+			cfg.Admissions = append(cfg.Admissions, admCfg)
+			delete(mh, "admission")
+		}
+		if v := mdutil.GetString(md, "bypass"); v != "" {
+			bypassCfg := &config.BypassConfig{
+				Name: fmt.Sprintf("%sbypass-%d", namePrefix, len(cfg.Bypasses)),
+			}
+			if v[0] == '~' {
+				bypassCfg.Whitelist = true
+				v = v[1:]
+			}
+			for _, s := range strings.Split(v, ",") {
+				if s == "" {
+					continue
+				}
+				bypassCfg.Matchers = append(bypassCfg.Matchers, s)
+			}
+			service.Bypass = bypassCfg.Name
+			cfg.Bypasses = append(cfg.Bypasses, bypassCfg)
+			delete(mh, "bypass")
+		}
+		if v := mdutil.GetString(md, "resolver"); v != "" {
+			resolverCfg := &config.ResolverConfig{
+				Name: fmt.Sprintf("%sresolver-%d", namePrefix, len(cfg.Resolvers)),
+			}
+			for _, rs := range strings.Split(v, ",") {
+				if rs == "" {
+					continue
+				}
+				resolverCfg.Nameservers = append(
+					resolverCfg.Nameservers,
+					&config.NameserverConfig{
+						Addr:   rs,
+						Prefer: mdutil.GetString(md, "prefer"),
+					},
+				)
+			}
+			service.Resolver = resolverCfg.Name
+			cfg.Resolvers = append(cfg.Resolvers, resolverCfg)
+			delete(mh, "resolver")
+		}
+		if v := mdutil.GetString(md, "hosts"); v != "" {
+			hostsCfg := &config.HostsConfig{
+				Name: fmt.Sprintf("%shosts-%d", namePrefix, len(cfg.Hosts)),
+			}
+			for _, s := range strings.Split(v, ",") {
+				ss := strings.SplitN(s, ":", 2)
+				if len(ss) != 2 {
+					continue
+				}
+				hostsCfg.Mappings = append(
+					hostsCfg.Mappings,
+					&config.HostMappingConfig{
+						Hostname: ss[0],
+						IP:       ss[1],
+					},
+				)
+			}
+			service.Hosts = hostsCfg.Name
+			cfg.Hosts = append(cfg.Hosts, hostsCfg)
+			delete(mh, "hosts")
+		}
+
+		in := mdutil.GetString(md, "limiter.in")
+		out := mdutil.GetString(md, "limiter.out")
+		cin := mdutil.GetString(md, "limiter.conn.in")
+		cout := mdutil.GetString(md, "limiter.conn.out")
+		if in != "" || cin != "" || out != "" || cout != "" {
+			limiter := &config.LimiterConfig{
+				Name: fmt.Sprintf("%slimiter-%d", namePrefix, len(cfg.Limiters)),
+			}
+			if in != "" || out != "" {
+				limiter.Limits = append(limiter.Limits,
+					fmt.Sprintf("%s %s %s", traffic.ServiceLimitKey, in, out))
+			}
+			if cin != "" || cout != "" {
+				limiter.Limits = append(limiter.Limits,
+					fmt.Sprintf("%s %s %s", traffic.ConnLimitKey, cin, cout))
+			}
+			service.Limiter = limiter.Name
+			cfg.Limiters = append(cfg.Limiters, limiter)
+			delete(mh, "limiter.in")
+			delete(mh, "limiter.out")
+			delete(mh, "limiter.conn.in")
+			delete(mh, "limiter.conn.out")
+		}
+
+		if climit := mdutil.GetInt(md, "climiter"); climit > 0 {
+			limiter := &config.LimiterConfig{
+				Name:   fmt.Sprintf("%sclimiter-%d", namePrefix, len(cfg.CLimiters)),
+				Limits: []string{fmt.Sprintf("%s %d", conn.GlobalLimitKey, climit)},
+			}
+			service.CLimiter = limiter.Name
+			cfg.CLimiters = append(cfg.CLimiters, limiter)
+			delete(mh, "climiter")
+		}
+
+		if rlimit := mdutil.GetFloat(md, "rlimiter"); rlimit > 0 {
+			limiter := &config.LimiterConfig{
+				Name:   fmt.Sprintf("%srlimiter-%d", namePrefix, len(cfg.RLimiters)),
+				Limits: []string{fmt.Sprintf("%s %s", conn.GlobalLimitKey, strconv.FormatFloat(rlimit, 'f', -1, 64))},
+			}
+			service.RLimiter = limiter.Name
+			cfg.RLimiters = append(cfg.RLimiters, limiter)
+			delete(mh, "rlimiter")
+		}
+	}
+
+	return cfg, nil
+}
+
+func cutHost(s string) (host, remain string) {
+	if s == "" {
+		return
+	}
+
+	n := strings.IndexByte(s, ':')
+	start := n + 3
+	end := strings.IndexAny(s[start:], "/?")
+	if end < 0 {
+		end = len(s)
+	} else {
+		end += start
+	}
+	// auth info
+	if n = strings.LastIndexByte(s[start:end], '@'); n >= 0 {
+		start += (n + 1)
+	}
+	host = s[start:end]
+
+	remain = s[:start] + s[end:]
+
+	return
+}
+
+func buildServiceConfig(url *url.URL) ([]*config.ServiceConfig, error) {
+	namePrefix := ""
+	if v := os.Getenv("_GOST_ID"); v != "" {
+		namePrefix = fmt.Sprintf("go-%s@", v)
+	}
+
+	var handler, listener string
+	schemes := strings.Split(url.Scheme, "+")
+	if len(schemes) == 1 {
+		handler = schemes[0]
+		listener = schemes[0]
+	}
+	if len(schemes) == 2 {
+		handler = schemes[0]
+		listener = schemes[1]
+	}
+
+	addrs := xnet.AddrPortRange(url.Host).Addrs()
+	if len(addrs) == 0 {
+		addrs = append(addrs, url.Host)
+	}
+
+	var services []*config.ServiceConfig
+	for _, addr := range addrs {
+		services = append(services, &config.ServiceConfig{
+			Addr: addr,
+		})
+	}
+
+	if h := registry.HandlerRegistry().Get(handler); h == nil {
+		handler = "auto"
+	}
+	if ln := registry.ListenerRegistry().Get(listener); ln == nil {
+		listener = "tcp"
+		if handler == "ssu" {
+			listener = "udp"
+		}
+	}
+
+	var nodes []*config.ForwardNodeConfig
+	// forward mode
+	if remotes := strings.Trim(url.EscapedPath(), "/"); remotes != "" {
+		i := 0
+		for _, addr := range strings.Split(remotes, ",") {
+			addrs := xnet.AddrPortRange(addr).Addrs()
+			if len(addrs) == 0 {
+				addrs = append(addrs, addr)
+			}
+			for _, adr := range addrs {
+				nodes = append(nodes, &config.ForwardNodeConfig{
+					Name: fmt.Sprintf("%starget-%d", namePrefix, i),
+					Addr: adr,
+				})
+				i++
+			}
+		}
+
+		if handler != "relay" {
+			if listener == "tcp" || listener == "udp" ||
+				listener == "rtcp" || listener == "rudp" ||
+				listener == "tun" || listener == "tap" ||
+				listener == "dns" || listener == "unix" ||
+				listener == "serial" {
+				handler = listener
+			} else {
+				handler = "forward"
+			}
+		}
+	}
+
+	if len(nodes) > 0 {
+		if len(services) == 1 {
+			services[0].Forwarder = &config.ForwarderConfig{
+				Nodes: nodes,
+			}
+		} else {
+			for i, svc := range services {
+				if len(nodes) == 1 {
+					svc.Forwarder = &config.ForwarderConfig{
+						Nodes: nodes,
+					}
+				} else {
+					if i < len(nodes) {
+						svc.Forwarder = &config.ForwarderConfig{
+							Nodes: []*config.ForwardNodeConfig{nodes[i]},
+						}
+					}
+				}
+			}
+		}
+	}
+
+	var auth *config.AuthConfig
+	if url.User != nil {
+		auth = &config.AuthConfig{
+			Username: url.User.Username(),
+		}
+		auth.Password, _ = url.User.Password()
+	}
+
+	m := map[string]any{}
+	for k, v := range url.Query() {
+		if len(v) > 0 {
+			m[k] = v[0]
+		}
+	}
+	md := mdx.NewMetadata(m)
+
+	if sa := mdutil.GetString(md, "auth"); sa != "" {
+		au, err := parseAuthFromCmd(sa)
+		if err != nil {
+			return nil, err
+		}
+		auth = au
+	}
+	delete(m, "auth")
+
+	tlsConfig := &config.TLSConfig{
+		CertFile: mdutil.GetString(md, "tls.certFile", "certFile", "cert"),
+		KeyFile:  mdutil.GetString(md, "tls.keyFile", "keyFile", "key"),
+		CAFile:   mdutil.GetString(md, "tls.caFile", "caFile", "ca"),
+	}
+
+	delete(m, "tls.certFile")
+	delete(m, "certFile")
+	delete(m, "cert")
+	delete(m, "tls.keyFile")
+	delete(m, "keyFile")
+	delete(m, "key")
+	delete(m, "tls.caFile")
+	delete(m, "caFile")
+	delete(m, "ca")
+
+	if tlsConfig.CertFile == "" {
+		tlsConfig = nil
+	}
+
+	if v := mdutil.GetString(md, "dns"); v != "" {
+		md.Set("dns", strings.Split(v, ","))
+	}
+
+	selector := parseSelector(m)
+	handlerCfg := &config.HandlerConfig{
+		Type:     handler,
+		Auth:     auth,
+		Metadata: m,
+	}
+	listenerCfg := &config.ListenerConfig{
+		Type:     listener,
+		TLS:      tlsConfig,
+		Metadata: m,
+	}
+	if listenerCfg.Type == "ssh" || listenerCfg.Type == "sshd" {
+		handlerCfg.Auth = nil
+		listenerCfg.Auth = auth
+	}
+
+	for _, svc := range services {
+		if svc.Forwarder != nil {
+			svc.Forwarder.Selector = selector
+		}
+		svc.Handler = handlerCfg
+		svc.Listener = listenerCfg
+		svc.Metadata = m
+	}
+
+	return services, nil
+}
+
+func buildNodeConfig(url *url.URL) (*config.NodeConfig, error) {
+	var connector, dialer string
+	schemes := strings.Split(url.Scheme, "+")
+	if len(schemes) == 1 {
+		connector = schemes[0]
+		dialer = schemes[0]
+	}
+	if len(schemes) == 2 {
+		connector = schemes[0]
+		dialer = schemes[1]
+	}
+
+	m := map[string]any{}
+	for k, v := range url.Query() {
+		if len(v) > 0 {
+			m[k] = v[0]
+		}
+	}
+	md := mdx.NewMetadata(m)
+
+	node := &config.NodeConfig{
+		Addr:     url.Host,
+		Metadata: m,
+	}
+
+	if c := registry.ConnectorRegistry().Get(connector); c == nil {
+		connector = "http"
+	}
+	if d := registry.DialerRegistry().Get(dialer); d == nil {
+		dialer = "tcp"
+		if connector == "ssu" {
+			dialer = "udp"
+		}
+	}
+
+	var auth *config.AuthConfig
+	if url.User != nil {
+		auth = &config.AuthConfig{
+			Username: url.User.Username(),
+		}
+		auth.Password, _ = url.User.Password()
+	}
+
+	if sauth := mdutil.GetString(md, "auth"); sauth != "" && auth == nil {
+		au, err := parseAuthFromCmd(sauth)
+		if err != nil {
+			return nil, err
+		}
+		auth = au
+	}
+	delete(m, "auth")
+
+	tlsConfig := &config.TLSConfig{
+		CertFile:   mdutil.GetString(md, "tls.certFile", "certFile", "cert"),
+		KeyFile:    mdutil.GetString(md, "tls.keyFile", "keyFile", "key"),
+		CAFile:     mdutil.GetString(md, "tls.caFile", "caFile", "ca"),
+		Secure:     mdutil.GetBool(md, "tls.secure", "secure"),
+		ServerName: mdutil.GetString(md, "tls.servername", "servername"),
+	}
+	if tlsConfig.ServerName == "" {
+		tlsConfig.ServerName = url.Hostname()
+	}
+
+	delete(m, "tls.certFile")
+	delete(m, "certFile")
+	delete(m, "cert")
+	delete(m, "tls.keyFile")
+	delete(m, "keyFile")
+	delete(m, "key")
+	delete(m, "tls.caFile")
+	delete(m, "caFile")
+	delete(m, "ca")
+	delete(m, "tls.secure")
+	delete(m, "secure")
+	delete(m, "tls.servername")
+	delete(m, "serverName")
+
+	if !tlsConfig.Secure && tlsConfig.CertFile == "" && tlsConfig.CAFile == "" && tlsConfig.ServerName == "" {
+		tlsConfig = nil
+	}
+
+	node.Connector = &config.ConnectorConfig{
+		Type:     connector,
+		Auth:     auth,
+		Metadata: m,
+	}
+	node.Dialer = &config.DialerConfig{
+		Type:     dialer,
+		TLS:      tlsConfig,
+		Metadata: m,
+	}
+
+	if node.Dialer.Type == "ssh" || node.Dialer.Type == "sshd" {
+		node.Connector.Auth = nil
+		node.Dialer.Auth = auth
+	}
+
+	return node, nil
+}
+
+func Norm(s string) (*url.URL, error) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return nil, ErrInvalidCmd
+	}
+
+	if s[0] == ':' || !strings.Contains(s, "://") {
+		s = "auto://" + s
+	}
+
+	url, err := url.Parse(s)
+	if err != nil {
+		return nil, err
+	}
+	if url.Scheme == "https" {
+		url.Scheme = "http+tls"
+	}
+
+	return url, nil
+}
+
+func parseAuthFromCmd(sa string) (*config.AuthConfig, error) {
+	v, err := base64.StdEncoding.DecodeString(sa)
+	if err != nil {
+		return nil, err
+	}
+	cs := string(v)
+	n := strings.IndexByte(cs, ':')
+	if n < 0 {
+		return &config.AuthConfig{
+			Username: cs,
+		}, nil
+	}
+
+	return &config.AuthConfig{
+		Username: cs[:n],
+		Password: cs[n+1:],
+	}, nil
+}
+
+func parseSelector(m map[string]any) *config.SelectorConfig {
+	md := mdx.NewMetadata(m)
+	strategy := mdutil.GetString(md, "strategy")
+	maxFails := mdutil.GetInt(md, "maxFails", "max_fails")
+	failTimeout := mdutil.GetDuration(md, "failTimeout", "fail_timeout")
+	if strategy == "" && maxFails <= 0 && failTimeout <= 0 {
+		return nil
+	}
+	if strategy == "" {
+		strategy = "round"
+	}
+	if maxFails <= 0 {
+		maxFails = 1
+	}
+	if failTimeout <= 0 {
+		failTimeout = 30 * time.Second
+	}
+
+	delete(m, "strategy")
+	delete(m, "maxFails")
+	delete(m, "max_fails")
+	delete(m, "failTimeout")
+	delete(m, "fail_timeout")
+
+	return &config.SelectorConfig{
+		Strategy:    strategy,
+		MaxFails:    maxFails,
+		FailTimeout: failTimeout,
+	}
+}

go-gost/x/config/config.go

@@ -0,0 +1,612 @@
+package config
+
+import (
+	"encoding/json"
+	"io"
+	"sync"
+	"time"
+
+	"github.com/spf13/viper"
+	"gopkg.in/yaml.v3"
+)
+
+var (
+	v = viper.GetViper()
+)
+
+func init() {
+	v.SetConfigName("gost")
+	v.AddConfigPath("/etc/gost/")
+	v.AddConfigPath("$HOME/.gost/")
+	v.AddConfigPath(".")
+}
+
+var (
+	global    = &Config{}
+	globalMux sync.RWMutex
+)
+
+func Global() *Config {
+	globalMux.RLock()
+	defer globalMux.RUnlock()
+
+	cfg := &Config{}
+	*cfg = *global
+	return cfg
+}
+
+func Set(c *Config) {
+	globalMux.Lock()
+	defer globalMux.Unlock()
+
+	global = c
+}
+
+func OnUpdate(f func(c *Config) error) error {
+	globalMux.Lock()
+	defer globalMux.Unlock()
+
+	return f(global)
+}
+
+type LogConfig struct {
+	Output   string             `yaml:",omitempty" json:"output,omitempty"`
+	Level    string             `yaml:",omitempty" json:"level,omitempty"`
+	Format   string             `yaml:",omitempty" json:"format,omitempty"`
+	Rotation *LogRotationConfig `yaml:",omitempty" json:"rotation,omitempty"`
+}
+
+type LogRotationConfig struct {
+	// MaxSize is the maximum size in megabytes of the log file before it gets
+	// rotated. It defaults to 100 megabytes.
+	MaxSize int `yaml:"maxSize,omitempty" json:"maxSize,omitempty"`
+	// MaxAge is the maximum number of days to retain old log files based on the
+	// timestamp encoded in their filename.  Note that a day is defined as 24
+	// hours and may not exactly correspond to calendar days due to daylight
+	// savings, leap seconds, etc. The default is not to remove old log files
+	// based on age.
+	MaxAge int `yaml:"maxAge,omitempty" json:"maxAge,omitempty"`
+	// MaxBackups is the maximum number of old log files to retain.  The default
+	// is to retain all old log files (though MaxAge may still cause them to get
+	// deleted.)
+	MaxBackups int `yaml:"maxBackups,omitempty" json:"maxBackups,omitempty"`
+	// LocalTime determines if the time used for formatting the timestamps in
+	// backup files is the computer's local time. The default is to use UTC
+	// time.
+	LocalTime bool `yaml:"localTime,omitempty" json:"localTime,omitempty"`
+	// Compress determines if the rotated log files should be compressed
+	// using gzip. The default is not to perform compression.
+	Compress bool `yaml:"compress,omitempty" json:"compress,omitempty"`
+}
+
+type LoggerConfig struct {
+	Name string     `json:"name"`
+	Log  *LogConfig `yaml:",omitempty" json:"log,omitempty"`
+}
+
+type ProfilingConfig struct {
+	Addr string `json:"addr"`
+}
+
+type APIConfig struct {
+	Addr       string      `json:"addr"`
+	PathPrefix string      `yaml:"pathPrefix,omitempty" json:"pathPrefix,omitempty"`
+	AccessLog  bool        `yaml:"accesslog,omitempty" json:"accesslog,omitempty"`
+	Auth       *AuthConfig `yaml:",omitempty" json:"auth,omitempty"`
+	Auther     string      `yaml:",omitempty" json:"auther,omitempty"`
+}
+
+type MetricsConfig struct {
+	Addr   string      `json:"addr"`
+	Path   string      `yaml:",omitempty" json:"path,omitempty"`
+	Auth   *AuthConfig `yaml:",omitempty" json:"auth,omitempty"`
+	Auther string      `yaml:",omitempty" json:"auther,omitempty"`
+}
+
+type TLSConfig struct {
+	CertFile   string      `yaml:"certFile,omitempty" json:"certFile,omitempty"`
+	KeyFile    string      `yaml:"keyFile,omitempty" json:"keyFile,omitempty"`
+	CAFile     string      `yaml:"caFile,omitempty" json:"caFile,omitempty"`
+	Secure     bool        `yaml:",omitempty" json:"secure,omitempty"`
+	ServerName string      `yaml:"serverName,omitempty" json:"serverName,omitempty"`
+	Options    *TLSOptions `yaml:",omitempty" json:"options,omitempty"`
+
+	// for auto-generated default certificate.
+	Validity     time.Duration `yaml:",omitempty" json:"validity,omitempty"`
+	CommonName   string        `yaml:"commonName,omitempty" json:"commonName,omitempty"`
+	Organization string        `yaml:",omitempty" json:"organization,omitempty"`
+}
+
+type TLSOptions struct {
+	MinVersion   string   `yaml:"minVersion,omitempty" json:"minVersion,omitempty"`
+	MaxVersion   string   `yaml:"maxVersion,omitempty" json:"maxVersion,omitempty"`
+	CipherSuites []string `yaml:"cipherSuites,omitempty" json:"cipherSuites,omitempty"`
+	ALPN         []string `yaml:"alpn,omitempty" json:"alpn,omitempty"`
+}
+
+type PluginConfig struct {
+	Type    string        `json:"type"`
+	Addr    string        `json:"addr"`
+	TLS     *TLSConfig    `yaml:",omitempty" json:"tls,omitempty"`
+	Timeout time.Duration `yaml:",omitempty" json:"timeout,omitempty"`
+	Token   string        `yaml:",omitempty" json:"token,omitempty"`
+}
+
+type AutherConfig struct {
+	Name   string        `json:"name"`
+	Auths  []*AuthConfig `yaml:",omitempty" json:"auths,omitempty"`
+	Reload time.Duration `yaml:",omitempty" json:"reload,omitempty"`
+	File   *FileLoader   `yaml:",omitempty" json:"file,omitempty"`
+	Redis  *RedisLoader  `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP   *HTTPLoader   `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin *PluginConfig `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type AuthConfig struct {
+	Username string `json:"username"`
+	Password string `yaml:",omitempty" json:"password,omitempty"`
+}
+
+type SelectorConfig struct {
+	Strategy    string        `json:"strategy"`
+	MaxFails    int           `yaml:"maxFails" json:"maxFails"`
+	FailTimeout time.Duration `yaml:"failTimeout" json:"failTimeout"`
+}
+
+type AdmissionConfig struct {
+	Name string `json:"name"`
+	// Deprecated: use whitelist instead
+	Reverse   bool          `yaml:",omitempty" json:"reverse,omitempty"`
+	Whitelist bool          `yaml:",omitempty" json:"whitelist,omitempty"`
+	Matchers  []string      `yaml:",omitempty" json:"matchers,omitempty"`
+	Reload    time.Duration `yaml:",omitempty" json:"reload,omitempty"`
+	File      *FileLoader   `yaml:",omitempty" json:"file,omitempty"`
+	Redis     *RedisLoader  `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP      *HTTPLoader   `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin    *PluginConfig `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type BypassConfig struct {
+	Name string `json:"name"`
+	// Deprecated: use whitelist instead
+	Reverse   bool          `yaml:",omitempty" json:"reverse,omitempty"`
+	Whitelist bool          `yaml:",omitempty" json:"whitelist,omitempty"`
+	Matchers  []string      `yaml:",omitempty" json:"matchers,omitempty"`
+	Reload    time.Duration `yaml:",omitempty" json:"reload,omitempty"`
+	File      *FileLoader   `yaml:",omitempty" json:"file,omitempty"`
+	Redis     *RedisLoader  `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP      *HTTPLoader   `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin    *PluginConfig `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type FileLoader struct {
+	Path string `json:"path"`
+}
+
+type RedisLoader struct {
+	Addr     string `json:"addr"`
+	DB       int    `yaml:",omitempty" json:"db,omitempty"`
+	Username string `yaml:",omitempty" json:"username,omitempty"`
+	Password string `yaml:",omitempty" json:"password,omitempty"`
+	Key      string `yaml:",omitempty" json:"key,omitempty"`
+	Type     string `yaml:",omitempty" json:"type,omitempty"`
+}
+
+type HTTPLoader struct {
+	URL     string        `yaml:"url" json:"url"`
+	Timeout time.Duration `yaml:",omitempty" json:"timeout,omitempty"`
+}
+
+type NameserverConfig struct {
+	Addr     string        `json:"addr"`
+	Chain    string        `yaml:",omitempty" json:"chain,omitempty"`
+	Prefer   string        `yaml:",omitempty" json:"prefer,omitempty"`
+	ClientIP string        `yaml:"clientIP,omitempty" json:"clientIP,omitempty"`
+	Hostname string        `yaml:",omitempty" json:"hostname,omitempty"`
+	TTL      time.Duration `yaml:",omitempty" json:"ttl,omitempty"`
+	Timeout  time.Duration `yaml:",omitempty" json:"timeout,omitempty"`
+	Async    bool          `yaml:",omitempty" json:"async,omitempty"`
+	Only     string        `yaml:",omitempty" json:"only,omitempty"`
+}
+
+type ResolverConfig struct {
+	Name        string              `json:"name"`
+	Nameservers []*NameserverConfig `yaml:",omitempty" json:"nameservers,omitempty"`
+	Plugin      *PluginConfig       `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type HostMappingConfig struct {
+	IP       string   `json:"ip"`
+	Hostname string   `json:"hostname"`
+	Aliases  []string `yaml:",omitempty" json:"aliases,omitempty"`
+}
+
+type HostsConfig struct {
+	Name     string               `json:"name"`
+	Mappings []*HostMappingConfig `yaml:",omitempty" json:"mappings,omitempty"`
+	Reload   time.Duration        `yaml:",omitempty" json:"reload,omitempty"`
+	File     *FileLoader          `yaml:",omitempty" json:"file,omitempty"`
+	Redis    *RedisLoader         `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP     *HTTPLoader          `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin   *PluginConfig        `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type IngressRuleConfig struct {
+	Hostname string `json:"hostname"`
+	Endpoint string `json:"endpoint"`
+}
+
+type IngressConfig struct {
+	Name   string               `json:"name"`
+	Rules  []*IngressRuleConfig `yaml:",omitempty" json:"rules,omitempty"`
+	Reload time.Duration        `yaml:",omitempty" json:"reload,omitempty"`
+	File   *FileLoader          `yaml:",omitempty" json:"file,omitempty"`
+	Redis  *RedisLoader         `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP   *HTTPLoader          `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin *PluginConfig        `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type SDConfig struct {
+	Name   string        `json:"name"`
+	Plugin *PluginConfig `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type RouterRouteConfig struct {
+	// Deprecated: use dst instead
+	Net     string `yaml:",omitempty" json:"net,omitempty"`
+	Dst     string `yaml:",omitempty" json:"dst,omitempty"`
+	Gateway string `json:"gateway"`
+}
+
+type RouterConfig struct {
+	Name   string               `json:"name"`
+	Routes []*RouterRouteConfig `yaml:",omitempty" json:"routes,omitempty"`
+	Reload time.Duration        `yaml:",omitempty" json:"reload,omitempty"`
+	File   *FileLoader          `yaml:",omitempty" json:"file,omitempty"`
+	Redis  *RedisLoader         `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP   *HTTPLoader          `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin *PluginConfig        `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type RecorderConfig struct {
+	Name   string         `json:"name"`
+	File   *FileRecorder  `yaml:",omitempty" json:"file,omitempty"`
+	TCP    *TCPRecorder   `yaml:"tcp,omitempty" json:"tcp,omitempty"`
+	HTTP   *HTTPRecorder  `yaml:"http,omitempty" json:"http,omitempty"`
+	Redis  *RedisRecorder `yaml:",omitempty" json:"redis,omitempty"`
+	Plugin *PluginConfig  `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type FileRecorder struct {
+	Path     string             `json:"path"`
+	Sep      string             `yaml:",omitempty" json:"sep,omitempty"`
+	Rotation *LogRotationConfig `yaml:",omitempty" json:"rotation,omitempty"`
+}
+
+type TCPRecorder struct {
+	Addr    string        `json:"addr"`
+	Timeout time.Duration `json:"timeout"`
+}
+
+type HTTPRecorder struct {
+	URL     string            `yaml:"url" json:"url"`
+	Timeout time.Duration     `yaml:",omitempty" json:"timeout,omitempty"`
+	Header  map[string]string `yaml:",omitempty" json:"header,omitempty"`
+}
+
+type RedisRecorder struct {
+	Addr     string `json:"addr"`
+	DB       int    `yaml:",omitempty" json:"db,omitempty"`
+	Username string `yaml:",omitempty" json:"username,omitempty"`
+	Password string `yaml:",omitempty" json:"password,omitempty"`
+	Key      string `yaml:",omitempty" json:"key,omitempty"`
+	Type     string `yaml:",omitempty" json:"type,omitempty"`
+}
+
+type RecorderObject struct {
+	Name     string         `json:"name"`
+	Record   string         `json:"record"`
+	Metadata map[string]any `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type LimiterConfig struct {
+	Name   string        `json:"name"`
+	Limits []string      `yaml:",omitempty" json:"limits,omitempty"`
+	Reload time.Duration `yaml:",omitempty" json:"reload,omitempty"`
+	File   *FileLoader   `yaml:",omitempty" json:"file,omitempty"`
+	Redis  *RedisLoader  `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP   *HTTPLoader   `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin *PluginConfig `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type ObserverConfig struct {
+	Name   string        `json:"name"`
+	Plugin *PluginConfig `yaml:",omitempty" json:"plugin,omitempty"`
+}
+
+type ListenerConfig struct {
+	Type       string            `json:"type"`
+	Chain      string            `yaml:",omitempty" json:"chain,omitempty"`
+	ChainGroup *ChainGroupConfig `yaml:"chainGroup,omitempty" json:"chainGroup,omitempty"`
+	Auther     string            `yaml:",omitempty" json:"auther,omitempty"`
+	Authers    []string          `yaml:",omitempty" json:"authers,omitempty"`
+	Auth       *AuthConfig       `yaml:",omitempty" json:"auth,omitempty"`
+	TLS        *TLSConfig        `yaml:",omitempty" json:"tls,omitempty"`
+	Metadata   map[string]any    `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type HandlerConfig struct {
+	Type       string            `json:"type"`
+	Retries    int               `yaml:",omitempty" json:"retries,omitempty"`
+	Chain      string            `yaml:",omitempty" json:"chain,omitempty"`
+	ChainGroup *ChainGroupConfig `yaml:"chainGroup,omitempty" json:"chainGroup,omitempty"`
+	Auther     string            `yaml:",omitempty" json:"auther,omitempty"`
+	Authers    []string          `yaml:",omitempty" json:"authers,omitempty"`
+	Auth       *AuthConfig       `yaml:",omitempty" json:"auth,omitempty"`
+	TLS        *TLSConfig        `yaml:",omitempty" json:"tls,omitempty"`
+	Limiter    string            `yaml:",omitempty" json:"limiter,omitempty"`
+	Observer   string            `yaml:",omitempty" json:"observer,omitempty"`
+	Metadata   map[string]any    `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type ForwarderConfig struct {
+	// Deprecated: use hop instead
+	Name string `yaml:",omitempty" json:"name,omitempty"`
+	// the referenced hop name
+	Hop      string               `yaml:",omitempty" json:"hop,omitempty"`
+	Selector *SelectorConfig      `yaml:",omitempty" json:"selector,omitempty"`
+	Nodes    []*ForwardNodeConfig `json:"nodes"`
+}
+
+type ForwardNodeConfig struct {
+	Name     string   `yaml:",omitempty" json:"name,omitempty"`
+	Addr     string   `yaml:",omitempty" json:"addr,omitempty"`
+	Network  string   `yaml:",omitempty" json:"network,omitempty"`
+	Bypass   string   `yaml:",omitempty" json:"bypass,omitempty"`
+	Bypasses []string `yaml:",omitempty" json:"bypasses,omitempty"`
+	// Deprecated: use matcher instead
+	Protocol string `yaml:",omitempty" json:"protocol,omitempty"`
+	// Deprecated: use matcher instead
+	Host string `yaml:",omitempty" json:"host,omitempty"`
+	// Deprecated: use matcher instead
+	Path string `yaml:",omitempty" json:"path,omitempty"`
+	// Deprecated: use matcher instead
+	Filter  *NodeFilterConfig  `yaml:",omitempty" json:"filter,omitempty"`
+	Matcher *NodeMatcherConfig `yaml:",omitempty" json:"matcher,omitempty"`
+	// Deprecated: use http.auth instead
+	Auth     *AuthConfig     `yaml:",omitempty" json:"auth,omitempty"`
+	HTTP     *HTTPNodeConfig `yaml:",omitempty" json:"http,omitempty"`
+	TLS      *TLSNodeConfig  `yaml:",omitempty" json:"tls,omitempty"`
+	Metadata map[string]any  `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type HTTPURLRewriteConfig struct {
+	Match       string
+	Replacement string
+}
+
+type HTTPBodyRewriteConfig struct {
+	// filter by MIME types
+	Type        string
+	Match       string
+	Replacement string
+}
+
+type NodeFilterConfig struct {
+	Host     string `yaml:",omitempty" json:"host,omitempty"`
+	Protocol string `yaml:",omitempty" json:"protocol,omitempty"`
+	Path     string `yaml:",omitempty" json:"path,omitempty"`
+}
+
+type NodeMatcherConfig struct {
+	Rule     string `yaml:",omitempty" json:"rule,omitempty"`
+	Priority int    `yaml:",omitempty" json:"priority,omitempty"`
+}
+
+type HTTPNodeConfig struct {
+	// rewrite host header
+	Host string `yaml:",omitempty" json:"host,omitempty"`
+	// Deprecated: use requestHeader instead
+	Header map[string]string `yaml:",omitempty" json:"header,omitempty"`
+	// additional request header
+	RequestHeader map[string]string `yaml:"requestHeader,omitempty" json:"requestHeader,omitempty"`
+	// additional response header
+	ResponseHeader map[string]string `yaml:"responseHeader,omitempty" json:"responseHeader,omitempty"`
+	// Deprecated: use rewriteURL instead
+	Rewrite []HTTPURLRewriteConfig `yaml:",omitempty" json:"rewrite,omitempty"`
+	// rewrite URL
+	RewriteURL []HTTPURLRewriteConfig `yaml:"rewriteURL,omitempty" json:"rewriteURL,omitempty"`
+	// rewrite response body
+	RewriteBody []HTTPBodyRewriteConfig `yaml:"rewriteBody,omitempty" json:"rewriteBody,omitempty"`
+	// HTTP basic auth
+	Auth *AuthConfig `yaml:",omitempty" json:"auth,omitempty"`
+}
+
+type TLSNodeConfig struct {
+	ServerName string      `yaml:"serverName,omitempty" json:"serverName,omitempty"`
+	Secure     bool        `yaml:",omitempty" json:"secure,omitempty"`
+	Options    *TLSOptions `yaml:",omitempty" json:"options,omitempty"`
+}
+
+type DialerConfig struct {
+	Type     string         `json:"type"`
+	Auth     *AuthConfig    `yaml:",omitempty" json:"auth,omitempty"`
+	TLS      *TLSConfig     `yaml:",omitempty" json:"tls,omitempty"`
+	Metadata map[string]any `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type ConnectorConfig struct {
+	Type     string         `json:"type"`
+	Auth     *AuthConfig    `yaml:",omitempty" json:"auth,omitempty"`
+	TLS      *TLSConfig     `yaml:",omitempty" json:"tls,omitempty"`
+	Metadata map[string]any `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type SockOptsConfig struct {
+	Mark int `yaml:",omitempty" json:"mark,omitempty"`
+}
+
+type ServiceConfig struct {
+	Name string `json:"name"`
+	Addr string `yaml:",omitempty" json:"addr,omitempty"`
+	// Deprecated: use metadata.interface instead
+	Interface string `yaml:",omitempty" json:"interface,omitempty"`
+	// Deprecated: use metadata.so_mark instead
+	SockOpts   *SockOptsConfig   `yaml:"sockopts,omitempty" json:"sockopts,omitempty"`
+	Admission  string            `yaml:",omitempty" json:"admission,omitempty"`
+	Admissions []string          `yaml:",omitempty" json:"admissions,omitempty"`
+	Bypass     string            `yaml:",omitempty" json:"bypass,omitempty"`
+	Bypasses   []string          `yaml:",omitempty" json:"bypasses,omitempty"`
+	Resolver   string            `yaml:",omitempty" json:"resolver,omitempty"`
+	Hosts      string            `yaml:",omitempty" json:"hosts,omitempty"`
+	Limiter    string            `yaml:",omitempty" json:"limiter,omitempty"`
+	CLimiter   string            `yaml:"climiter,omitempty" json:"climiter,omitempty"`
+	RLimiter   string            `yaml:"rlimiter,omitempty" json:"rlimiter,omitempty"`
+	Logger     string            `yaml:",omitempty" json:"logger,omitempty"`
+	Loggers    []string          `yaml:",omitempty" json:"loggers,omitempty"`
+	Observer   string            `yaml:",omitempty" json:"observer,omitempty"`
+	Recorders  []*RecorderObject `yaml:",omitempty" json:"recorders,omitempty"`
+	Handler    *HandlerConfig    `yaml:",omitempty" json:"handler,omitempty"`
+	Listener   *ListenerConfig   `yaml:",omitempty" json:"listener,omitempty"`
+	Forwarder  *ForwarderConfig  `yaml:",omitempty" json:"forwarder,omitempty"`
+	Metadata   map[string]any    `yaml:",omitempty" json:"metadata,omitempty"`
+	// service status, read-only
+	Status *ServiceStatus `yaml:",omitempty" json:"status,omitempty"`
+}
+
+type ServiceStatus struct {
+	CreateTime int64          `yaml:"createTime" json:"createTime"`
+	State      string         `yaml:"state" json:"state"`
+	Events     []ServiceEvent `yaml:",omitempty" json:"events,omitempty"`
+	Stats      *ServiceStats  `yaml:",omitempty" json:"stats,omitempty"`
+}
+
+type ServiceEvent struct {
+	Time int64  `yaml:"time" json:"time"`
+	Msg  string `yaml:"msg" json:"msg"`
+}
+
+type ServiceStats struct {
+	TotalConns   uint64 `yaml:"totalConns" json:"totalConns"`
+	CurrentConns uint64 `yaml:"currentConns" json:"currentConns"`
+	TotalErrs    uint64 `yaml:"totalErrs" json:"totalErrs"`
+	InputBytes   uint64 `yaml:"inputBytes" json:"inputBytes"`
+	OutputBytes  uint64 `yaml:"outputBytes" json:"outputBytes"`
+}
+
+type ChainConfig struct {
+	Name     string         `json:"name"`
+	Hops     []*HopConfig   `json:"hops"`
+	Metadata map[string]any `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type ChainGroupConfig struct {
+	Chains   []string        `yaml:",omitempty" json:"chains,omitempty"`
+	Selector *SelectorConfig `yaml:",omitempty" json:"selector,omitempty"`
+}
+
+type HopConfig struct {
+	Name      string          `json:"name"`
+	Interface string          `yaml:",omitempty" json:"interface,omitempty"`
+	SockOpts  *SockOptsConfig `yaml:"sockopts,omitempty" json:"sockopts,omitempty"`
+	Selector  *SelectorConfig `yaml:",omitempty" json:"selector,omitempty"`
+	Bypass    string          `yaml:",omitempty" json:"bypass,omitempty"`
+	Bypasses  []string        `yaml:",omitempty" json:"bypasses,omitempty"`
+	Resolver  string          `yaml:",omitempty" json:"resolver,omitempty"`
+	Hosts     string          `yaml:",omitempty" json:"hosts,omitempty"`
+	Nodes     []*NodeConfig   `yaml:",omitempty" json:"nodes,omitempty"`
+	Reload    time.Duration   `yaml:",omitempty" json:"reload,omitempty"`
+	File      *FileLoader     `yaml:",omitempty" json:"file,omitempty"`
+	Redis     *RedisLoader    `yaml:",omitempty" json:"redis,omitempty"`
+	HTTP      *HTTPLoader     `yaml:"http,omitempty" json:"http,omitempty"`
+	Plugin    *PluginConfig   `yaml:",omitempty" json:"plugin,omitempty"`
+	Metadata  map[string]any  `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type NodeConfig struct {
+	Name      string           `json:"name"`
+	Addr      string           `yaml:",omitempty" json:"addr,omitempty"`
+	Network   string           `yaml:",omitempty" json:"network,omitempty"`
+	Bypass    string           `yaml:",omitempty" json:"bypass,omitempty"`
+	Bypasses  []string         `yaml:",omitempty" json:"bypasses,omitempty"`
+	Resolver  string           `yaml:",omitempty" json:"resolver,omitempty"`
+	Hosts     string           `yaml:",omitempty" json:"hosts,omitempty"`
+	Connector *ConnectorConfig `yaml:",omitempty" json:"connector,omitempty"`
+	Dialer    *DialerConfig    `yaml:",omitempty" json:"dialer,omitempty"`
+	Interface string           `yaml:",omitempty" json:"interface,omitempty"`
+	Netns     string           `yaml:",omitempty" json:"netns,omitempty"`
+	SockOpts  *SockOptsConfig  `yaml:"sockopts,omitempty" json:"sockopts,omitempty"`
+	// Deprecated: use matcher instead
+	Filter   *NodeFilterConfig  `yaml:",omitempty" json:"filter,omitempty"`
+	Matcher  *NodeMatcherConfig `yaml:",omitempty" json:"matcher,omitempty"`
+	HTTP     *HTTPNodeConfig    `yaml:",omitempty" json:"http,omitempty"`
+	TLS      *TLSNodeConfig     `yaml:",omitempty" json:"tls,omitempty"`
+	Metadata map[string]any     `yaml:",omitempty" json:"metadata,omitempty"`
+}
+
+type Config struct {
+	Services   []*ServiceConfig   `json:"services"`
+	Chains     []*ChainConfig     `yaml:",omitempty" json:"chains,omitempty"`
+	Hops       []*HopConfig       `yaml:",omitempty" json:"hops,omitempty"`
+	Authers    []*AutherConfig    `yaml:",omitempty" json:"authers,omitempty"`
+	Admissions []*AdmissionConfig `yaml:",omitempty" json:"admissions,omitempty"`
+	Bypasses   []*BypassConfig    `yaml:",omitempty" json:"bypasses,omitempty"`
+	Resolvers  []*ResolverConfig  `yaml:",omitempty" json:"resolvers,omitempty"`
+	Hosts      []*HostsConfig     `yaml:",omitempty" json:"hosts,omitempty"`
+	Ingresses  []*IngressConfig   `yaml:",omitempty" json:"ingresses,omitempty"`
+	Routers    []*RouterConfig    `yaml:",omitempty" json:"routers,omitempty"`
+	SDs        []*SDConfig        `yaml:"sds,omitempty" json:"sds,omitempty"`
+	Recorders  []*RecorderConfig  `yaml:",omitempty" json:"recorders,omitempty"`
+	Limiters   []*LimiterConfig   `yaml:",omitempty" json:"limiters,omitempty"`
+	CLimiters  []*LimiterConfig   `yaml:"climiters,omitempty" json:"climiters,omitempty"`
+	RLimiters  []*LimiterConfig   `yaml:"rlimiters,omitempty" json:"rlimiters,omitempty"`
+	Observers  []*ObserverConfig  `yaml:",omitempty" json:"observers,omitempty"`
+	Loggers    []*LoggerConfig    `yaml:",omitempty" json:"loggers,omitempty"`
+	TLS        *TLSConfig         `yaml:",omitempty" json:"tls,omitempty"`
+	Log        *LogConfig         `yaml:",omitempty" json:"log,omitempty"`
+	Profiling  *ProfilingConfig   `yaml:",omitempty" json:"profiling,omitempty"`
+	API        *APIConfig         `yaml:",omitempty" json:"api,omitempty"`
+	Metrics    *MetricsConfig     `yaml:",omitempty" json:"metrics,omitempty"`
+}
+
+func (c *Config) Load() error {
+	if err := v.ReadInConfig(); err != nil {
+		return err
+	}
+
+	return v.Unmarshal(c)
+}
+
+func (c *Config) Read(r io.Reader) error {
+	if err := v.ReadConfig(r); err != nil {
+		return err
+	}
+
+	return v.Unmarshal(c)
+}
+
+func (c *Config) ReadFile(file string) error {
+	v.SetConfigFile(file)
+	if err := v.ReadInConfig(); err != nil {
+		return err
+	}
+	return v.Unmarshal(c)
+}
+
+func (c *Config) Write(w io.Writer, format string) error {
+	switch format {
+	case "json":
+		enc := json.NewEncoder(w)
+		enc.SetIndent("", "  ")
+		enc.Encode(c)
+		return nil
+	case "yaml":
+		fallthrough
+	default:
+		enc := yaml.NewEncoder(w)
+		defer enc.Close()
+		enc.SetIndent(2)
+
+		return enc.Encode(c)
+	}
+}

go-gost/x/config/loader/loader.go

@@ -0,0 +1,232 @@
+package loader
+
+import (
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/config/parsing"
+	admission_parser "github.com/go-gost/x/config/parsing/admission"
+	auth_parser "github.com/go-gost/x/config/parsing/auth"
+	bypass_parser "github.com/go-gost/x/config/parsing/bypass"
+	chain_parser "github.com/go-gost/x/config/parsing/chain"
+	hop_parser "github.com/go-gost/x/config/parsing/hop"
+	hosts_parser "github.com/go-gost/x/config/parsing/hosts"
+	ingress_parser "github.com/go-gost/x/config/parsing/ingress"
+	limiter_parser "github.com/go-gost/x/config/parsing/limiter"
+	logger_parser "github.com/go-gost/x/config/parsing/logger"
+	observer_parser "github.com/go-gost/x/config/parsing/observer"
+	recorder_parser "github.com/go-gost/x/config/parsing/recorder"
+	resolver_parser "github.com/go-gost/x/config/parsing/resolver"
+	router_parser "github.com/go-gost/x/config/parsing/router"
+	sd_parser "github.com/go-gost/x/config/parsing/sd"
+	service_parser "github.com/go-gost/x/config/parsing/service"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	defaultLoader *loader = &loader{}
+)
+
+func Load(cfg *config.Config) error {
+	return defaultLoader.Load(cfg)
+}
+
+type loader struct{}
+
+func (l *loader) Load(cfg *config.Config) error {
+	logCfg := cfg.Log
+	if logCfg == nil {
+		logCfg = &config.LogConfig{}
+	}
+	logger.SetDefault(logger_parser.ParseLogger(&config.LoggerConfig{Log: logCfg}))
+
+	tlsCfg, err := parsing.BuildDefaultTLSConfig(cfg.TLS)
+	if err != nil {
+		return err
+	}
+	parsing.SetDefaultTLSConfig(tlsCfg)
+
+	if err := register(cfg); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func register(cfg *config.Config) error {
+	if cfg == nil {
+		return nil
+	}
+
+	for name := range registry.LoggerRegistry().GetAll() {
+		registry.LoggerRegistry().Unregister(name)
+	}
+	for _, loggerCfg := range cfg.Loggers {
+		if err := registry.LoggerRegistry().Register(loggerCfg.Name, logger_parser.ParseLogger(loggerCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.AutherRegistry().GetAll() {
+		registry.AutherRegistry().Unregister(name)
+	}
+	for _, autherCfg := range cfg.Authers {
+		if err := registry.AutherRegistry().Register(autherCfg.Name, auth_parser.ParseAuther(autherCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.AdmissionRegistry().GetAll() {
+		registry.AdmissionRegistry().Unregister(name)
+	}
+	for _, admissionCfg := range cfg.Admissions {
+		if err := registry.AdmissionRegistry().Register(admissionCfg.Name, admission_parser.ParseAdmission(admissionCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.BypassRegistry().GetAll() {
+		registry.BypassRegistry().Unregister(name)
+	}
+	for _, bypassCfg := range cfg.Bypasses {
+		if err := registry.BypassRegistry().Register(bypassCfg.Name, bypass_parser.ParseBypass(bypassCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.ResolverRegistry().GetAll() {
+		registry.ResolverRegistry().Unregister(name)
+	}
+	for _, resolverCfg := range cfg.Resolvers {
+		r, err := resolver_parser.ParseResolver(resolverCfg)
+		if err != nil {
+			return err
+		}
+		if err := registry.ResolverRegistry().Register(resolverCfg.Name, r); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.HostsRegistry().GetAll() {
+		registry.HostsRegistry().Unregister(name)
+	}
+	for _, hostsCfg := range cfg.Hosts {
+		if err := registry.HostsRegistry().Register(hostsCfg.Name, hosts_parser.ParseHostMapper(hostsCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.IngressRegistry().GetAll() {
+		registry.IngressRegistry().Unregister(name)
+	}
+	for _, ingressCfg := range cfg.Ingresses {
+		if err := registry.IngressRegistry().Register(ingressCfg.Name, ingress_parser.ParseIngress(ingressCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.RouterRegistry().GetAll() {
+		registry.RouterRegistry().Unregister(name)
+	}
+	for _, routerCfg := range cfg.Routers {
+		if err := registry.RouterRegistry().Register(routerCfg.Name, router_parser.ParseRouter(routerCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.SDRegistry().GetAll() {
+		registry.SDRegistry().Unregister(name)
+	}
+	for _, sdCfg := range cfg.SDs {
+		if err := registry.SDRegistry().Register(sdCfg.Name, sd_parser.ParseSD(sdCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.ObserverRegistry().GetAll() {
+		registry.ObserverRegistry().Unregister(name)
+	}
+	for _, observerCfg := range cfg.Observers {
+		if err := registry.ObserverRegistry().Register(observerCfg.Name, observer_parser.ParseObserver(observerCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.RecorderRegistry().GetAll() {
+		registry.RecorderRegistry().Unregister(name)
+	}
+	for _, recorderCfg := range cfg.Recorders {
+		if err := registry.RecorderRegistry().Register(recorderCfg.Name, recorder_parser.ParseRecorder(recorderCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.TrafficLimiterRegistry().GetAll() {
+		registry.TrafficLimiterRegistry().Unregister(name)
+	}
+	for _, limiterCfg := range cfg.Limiters {
+		if err := registry.TrafficLimiterRegistry().Register(limiterCfg.Name, limiter_parser.ParseTrafficLimiter(limiterCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.ConnLimiterRegistry().GetAll() {
+		registry.ConnLimiterRegistry().Unregister(name)
+	}
+	for _, limiterCfg := range cfg.CLimiters {
+		if err := registry.ConnLimiterRegistry().Register(limiterCfg.Name, limiter_parser.ParseConnLimiter(limiterCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.RateLimiterRegistry().GetAll() {
+		registry.RateLimiterRegistry().Unregister(name)
+	}
+	for _, limiterCfg := range cfg.RLimiters {
+		if err := registry.RateLimiterRegistry().Register(limiterCfg.Name, limiter_parser.ParseRateLimiter(limiterCfg)); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.HopRegistry().GetAll() {
+		registry.HopRegistry().Unregister(name)
+	}
+	for _, hopCfg := range cfg.Hops {
+		hop, err := hop_parser.ParseHop(hopCfg, logger.Default())
+		if err != nil {
+			return err
+		}
+		if err := registry.HopRegistry().Register(hopCfg.Name, hop); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.ChainRegistry().GetAll() {
+		registry.ChainRegistry().Unregister(name)
+	}
+	for _, chainCfg := range cfg.Chains {
+		c, err := chain_parser.ParseChain(chainCfg, logger.Default())
+		if err != nil {
+			return err
+		}
+		if err := registry.ChainRegistry().Register(chainCfg.Name, c); err != nil {
+			return err
+		}
+	}
+
+	for name := range registry.ServiceRegistry().GetAll() {
+		registry.ServiceRegistry().Unregister(name)
+	}
+	for _, svcCfg := range cfg.Services {
+		svc, err := service_parser.ParseService(svcCfg)
+		if err != nil {
+			return err
+		}
+		if svc != nil {
+			if err := registry.ServiceRegistry().Register(svcCfg.Name, svc); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}

go-gost/x/config/parsing/admission/parse.go

@@ -0,0 +1,89 @@
+package admission
+
+import (
+	"crypto/tls"
+	"strings"
+
+	"github.com/go-gost/core/admission"
+	"github.com/go-gost/core/logger"
+	xadmission "github.com/go-gost/x/admission"
+	admission_plugin "github.com/go-gost/x/admission/plugin"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+	"github.com/go-gost/x/registry"
+)
+
+func ParseAdmission(cfg *config.AdmissionConfig) admission.Admission {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return admission_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return admission_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	opts := []xadmission.Option{
+		xadmission.MatchersOption(cfg.Matchers),
+		xadmission.WhitelistOption(cfg.Reverse || cfg.Whitelist),
+		xadmission.ReloadPeriodOption(cfg.Reload),
+		xadmission.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":      "admission",
+			"admission": cfg.Name,
+		})),
+	}
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xadmission.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		opts = append(opts, xadmission.RedisLoaderOption(loader.RedisSetLoader(
+			cfg.Redis.Addr,
+			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+			loader.KeyRedisLoaderOption(cfg.Redis.Key),
+		)))
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xadmission.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+
+	return xadmission.NewAdmission(opts...)
+}
+
+func List(name string, names ...string) []admission.Admission {
+	var admissions []admission.Admission
+	if adm := registry.AdmissionRegistry().Get(name); adm != nil {
+		admissions = append(admissions, adm)
+	}
+	for _, s := range names {
+		if adm := registry.AdmissionRegistry().Get(s); adm != nil {
+			admissions = append(admissions, adm)
+		}
+	}
+
+	return admissions
+}

go-gost/x/config/parsing/auth/parse.go

@@ -0,0 +1,122 @@
+package auth
+
+import (
+	"crypto/tls"
+	"net/url"
+
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/logger"
+	xauth "github.com/go-gost/x/auth"
+	auth_plugin "github.com/go-gost/x/auth/plugin"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+	"github.com/go-gost/x/registry"
+)
+
+func ParseAuther(cfg *config.AutherConfig) auth.Authenticator {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch cfg.Plugin.Type {
+		case "http":
+			return auth_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return auth_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	m := make(map[string]string)
+
+	for _, user := range cfg.Auths {
+		if user.Username == "" {
+			continue
+		}
+		m[user.Username] = user.Password
+	}
+
+	opts := []xauth.Option{
+		xauth.AuthsOption(m),
+		xauth.ReloadPeriodOption(cfg.Reload),
+		xauth.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":   "auther",
+			"auther": cfg.Name,
+		})),
+	}
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xauth.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		opts = append(opts, xauth.RedisLoaderOption(loader.RedisHashLoader(
+			cfg.Redis.Addr,
+			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+			loader.KeyRedisLoaderOption(cfg.Redis.Key),
+		)))
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xauth.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	return xauth.NewAuthenticator(opts...)
+}
+
+func ParseAutherFromAuth(au *config.AuthConfig) auth.Authenticator {
+	if au == nil || au.Username == "" {
+		return nil
+	}
+	return xauth.NewAuthenticator(
+		xauth.AuthsOption(
+			map[string]string{
+				au.Username: au.Password,
+			},
+		),
+		xauth.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind": "auther",
+		})),
+	)
+}
+
+func Info(cfg *config.AuthConfig) *url.Userinfo {
+	if cfg == nil || cfg.Username == "" {
+		return nil
+	}
+
+	if cfg.Password == "" {
+		return url.User(cfg.Username)
+	}
+	return url.UserPassword(cfg.Username, cfg.Password)
+}
+
+func List(name string, names ...string) []auth.Authenticator {
+	var authers []auth.Authenticator
+	if auther := registry.AutherRegistry().Get(name); auther != nil {
+		authers = append(authers, auther)
+	}
+	for _, s := range names {
+		if auther := registry.AutherRegistry().Get(s); auther != nil {
+			authers = append(authers, auther)
+		}
+	}
+	return authers
+}

go-gost/x/config/parsing/bypass/parse.go

@@ -0,0 +1,88 @@
+package bypass
+
+import (
+	"crypto/tls"
+	"strings"
+
+	"github.com/go-gost/core/bypass"
+	"github.com/go-gost/core/logger"
+	xbypass "github.com/go-gost/x/bypass"
+	bypass_plugin "github.com/go-gost/x/bypass/plugin"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+	"github.com/go-gost/x/registry"
+)
+
+func ParseBypass(cfg *config.BypassConfig) bypass.Bypass {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return bypass_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return bypass_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	opts := []xbypass.Option{
+		xbypass.MatchersOption(cfg.Matchers),
+		xbypass.WhitelistOption(cfg.Reverse || cfg.Whitelist),
+		xbypass.ReloadPeriodOption(cfg.Reload),
+		xbypass.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":   "bypass",
+			"bypass": cfg.Name,
+		})),
+	}
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xbypass.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		opts = append(opts, xbypass.RedisLoaderOption(loader.RedisSetLoader(
+			cfg.Redis.Addr,
+			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+			loader.KeyRedisLoaderOption(cfg.Redis.Key),
+		)))
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xbypass.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+
+	return xbypass.NewBypass(opts...)
+}
+
+func List(name string, names ...string) []bypass.Bypass {
+	var bypasses []bypass.Bypass
+	if bp := registry.BypassRegistry().Get(name); bp != nil {
+		bypasses = append(bypasses, bp)
+	}
+	for _, s := range names {
+		if bp := registry.BypassRegistry().Get(s); bp != nil {
+			bypasses = append(bypasses, bp)
+		}
+	}
+	return bypasses
+}

go-gost/x/config/parsing/chain/parse.go

@@ -0,0 +1,52 @@
+package chain
+
+import (
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/metadata"
+	xchain "github.com/go-gost/x/chain"
+	"github.com/go-gost/x/config"
+	hop_parser "github.com/go-gost/x/config/parsing/hop"
+	mdx "github.com/go-gost/x/metadata"
+	"github.com/go-gost/x/registry"
+)
+
+func ParseChain(cfg *config.ChainConfig, log logger.Logger) (chain.Chainer, error) {
+	if cfg == nil {
+		return nil, nil
+	}
+
+	chainLogger := log.WithFields(map[string]any{
+		"kind":  "chain",
+		"chain": cfg.Name,
+	})
+
+	var md metadata.Metadata
+	if cfg.Metadata != nil {
+		md = mdx.NewMetadata(cfg.Metadata)
+	}
+
+	c := xchain.NewChain(cfg.Name,
+		xchain.MetadataChainOption(md),
+		xchain.LoggerChainOption(chainLogger),
+	)
+
+	for _, ch := range cfg.Hops {
+		var hop hop.Hop
+		var err error
+
+		if ch.Nodes != nil || ch.Plugin != nil {
+			if hop, err = hop_parser.ParseHop(ch, log); err != nil {
+				return nil, err
+			}
+		} else {
+			hop = registry.HopRegistry().Get(ch.Name)
+		}
+		if hop != nil {
+			c.AddHop(hop)
+		}
+	}
+
+	return c, nil
+}

go-gost/x/config/parsing/hop/parse.go

@@ -0,0 +1,145 @@
+package hop
+
+import (
+	"crypto/tls"
+	"strings"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/logger"
+	xbypass "github.com/go-gost/x/bypass"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/config/parsing"
+	bypass_parser "github.com/go-gost/x/config/parsing/bypass"
+	node_parser "github.com/go-gost/x/config/parsing/node"
+	selector_parser "github.com/go-gost/x/config/parsing/selector"
+	xhop "github.com/go-gost/x/hop"
+	hop_plugin "github.com/go-gost/x/hop/plugin"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+	"github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+func ParseHop(cfg *config.HopConfig, log logger.Logger) (hop.Hop, error) {
+	if cfg == nil {
+		return nil, nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case plugin.HTTP:
+			return hop_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			), nil
+		default:
+			return hop_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			), nil
+		}
+	}
+
+	ifce := cfg.Interface
+	var netns string
+	if cfg.Metadata != nil {
+		md := metadata.NewMetadata(cfg.Metadata)
+		if v := mdutil.GetString(md, parsing.MDKeyInterface); v != "" {
+			ifce = v
+		}
+		netns = mdutil.GetString(md, "netns")
+	}
+
+	var nodes []*chain.Node
+	for _, v := range cfg.Nodes {
+		if v == nil {
+			continue
+		}
+
+		if v.Resolver == "" {
+			v.Resolver = cfg.Resolver
+		}
+		if v.Hosts == "" {
+			v.Hosts = cfg.Hosts
+		}
+		if v.Interface == "" {
+			v.Interface = ifce
+		}
+		if v.Netns == "" {
+			v.Netns = netns
+		}
+
+		if v.SockOpts == nil {
+			v.SockOpts = cfg.SockOpts
+		}
+
+		if v.Connector == nil {
+			v.Connector = &config.ConnectorConfig{}
+		}
+		if strings.TrimSpace(v.Connector.Type) == "" {
+			v.Connector.Type = "http"
+		}
+
+		if v.Dialer == nil {
+			v.Dialer = &config.DialerConfig{}
+		}
+		if strings.TrimSpace(v.Dialer.Type) == "" {
+			v.Dialer.Type = "tcp"
+		}
+
+		node, err := node_parser.ParseNode(cfg.Name, v, log)
+		if err != nil {
+			return nil, err
+		}
+		if node != nil {
+			nodes = append(nodes, node)
+		}
+	}
+
+	sel := selector_parser.ParseNodeSelector(cfg.Selector)
+	if sel == nil {
+		sel = selector_parser.DefaultNodeSelector()
+	}
+
+	opts := []xhop.Option{
+		xhop.NameOption(cfg.Name),
+		xhop.NodeOption(nodes...),
+		xhop.SelectorOption(sel),
+		xhop.BypassOption(xbypass.BypassGroup(bypass_parser.List(cfg.Bypass, cfg.Bypasses...)...)),
+		xhop.ReloadPeriodOption(cfg.Reload),
+		xhop.LoggerOption(log.WithFields(map[string]any{
+			"kind": "hop",
+			"hop":  cfg.Name,
+		})),
+	}
+
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xhop.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		opts = append(opts, xhop.RedisLoaderOption(loader.RedisStringLoader(
+			cfg.Redis.Addr,
+			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+			loader.KeyRedisLoaderOption(cfg.Redis.Key),
+		)))
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xhop.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	return xhop.NewHop(opts...), nil
+}

go-gost/x/config/parsing/hosts/parse.go

@@ -0,0 +1,99 @@
+package hosts
+
+import (
+	"crypto/tls"
+	"net"
+	"strings"
+
+	"github.com/go-gost/core/hosts"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	xhosts "github.com/go-gost/x/hosts"
+	hosts_plugin "github.com/go-gost/x/hosts/plugin"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+)
+
+func ParseHostMapper(cfg *config.HostsConfig) hosts.HostMapper {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return hosts_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return hosts_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	var mappings []xhosts.Mapping
+	for _, mapping := range cfg.Mappings {
+		if mapping.IP == "" || mapping.Hostname == "" {
+			continue
+		}
+
+		ip := net.ParseIP(mapping.IP)
+		if ip == nil {
+			continue
+		}
+		mappings = append(mappings, xhosts.Mapping{
+			Hostname: mapping.Hostname,
+			IP:       ip,
+		})
+	}
+	opts := []xhosts.Option{
+		xhosts.MappingsOption(mappings),
+		xhosts.ReloadPeriodOption(cfg.Reload),
+		xhosts.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":  "hosts",
+			"hosts": cfg.Name,
+		})),
+	}
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xhosts.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		switch cfg.Redis.Type {
+		case "list": // redis list
+			opts = append(opts, xhosts.RedisLoaderOption(loader.RedisListLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		default: // redis set
+			opts = append(opts, xhosts.RedisLoaderOption(loader.RedisSetLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		}
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xhosts.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	return xhosts.NewHostMapper(opts...)
+}

go-gost/x/config/parsing/ingress/parse.go

@@ -0,0 +1,94 @@
+package ingress
+
+import (
+	"crypto/tls"
+	"strings"
+
+	"github.com/go-gost/core/ingress"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	xingress "github.com/go-gost/x/ingress"
+	ingress_plugin "github.com/go-gost/x/ingress/plugin"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+)
+
+func ParseIngress(cfg *config.IngressConfig) ingress.Ingress {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return ingress_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return ingress_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	var rules []*ingress.Rule
+	for _, rule := range cfg.Rules {
+		if rule.Hostname == "" || rule.Endpoint == "" {
+			continue
+		}
+
+		rules = append(rules, &ingress.Rule{
+			Hostname: rule.Hostname,
+			Endpoint: rule.Endpoint,
+		})
+	}
+	opts := []xingress.Option{
+		xingress.RulesOption(rules),
+		xingress.ReloadPeriodOption(cfg.Reload),
+		xingress.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":    "ingress",
+			"ingress": cfg.Name,
+		})),
+	}
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xingress.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		switch cfg.Redis.Type {
+		case "set": // redis set
+			opts = append(opts, xingress.RedisLoaderOption(loader.RedisSetLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		default: // redis hash
+			opts = append(opts, xingress.RedisLoaderOption(loader.RedisHashLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		}
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xingress.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	return xingress.NewIngress(opts...)
+}

go-gost/x/config/parsing/limiter/parse.go

@@ -0,0 +1,186 @@
+package limiter
+
+import (
+	"crypto/tls"
+	"strings"
+
+	"github.com/go-gost/core/limiter/conn"
+	"github.com/go-gost/core/limiter/rate"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+	xconn "github.com/go-gost/x/limiter/conn"
+	xrate "github.com/go-gost/x/limiter/rate"
+	xtraffic "github.com/go-gost/x/limiter/traffic"
+	traffic_plugin "github.com/go-gost/x/limiter/traffic/plugin"
+)
+
+func ParseTrafficLimiter(cfg *config.LimiterConfig) (lim traffic.TrafficLimiter) {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return traffic_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return traffic_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	var opts []xtraffic.Option
+
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xtraffic.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		switch cfg.Redis.Type {
+		case "list": // redis list
+			opts = append(opts, xtraffic.RedisLoaderOption(loader.RedisListLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		default: // redis set
+			opts = append(opts, xtraffic.RedisLoaderOption(loader.RedisSetLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		}
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xtraffic.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	opts = append(opts,
+		xtraffic.LimitsOption(cfg.Limits...),
+		xtraffic.ReloadPeriodOption(cfg.Reload),
+		xtraffic.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":    "limiter",
+			"limiter": cfg.Name,
+		})),
+	)
+
+	return xtraffic.NewTrafficLimiter(opts...)
+}
+
+func ParseConnLimiter(cfg *config.LimiterConfig) (lim conn.ConnLimiter) {
+	if cfg == nil {
+		return nil
+	}
+
+	var opts []xconn.Option
+
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xconn.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		switch cfg.Redis.Type {
+		case "list": // redis list
+			opts = append(opts, xconn.RedisLoaderOption(loader.RedisListLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		default: // redis set
+			opts = append(opts, xconn.RedisLoaderOption(loader.RedisSetLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		}
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xconn.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	opts = append(opts,
+		xconn.LimitsOption(cfg.Limits...),
+		xconn.ReloadPeriodOption(cfg.Reload),
+		xconn.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":    "limiter",
+			"limiter": cfg.Name,
+		})),
+	)
+
+	return xconn.NewConnLimiter(opts...)
+}
+
+func ParseRateLimiter(cfg *config.LimiterConfig) (lim rate.RateLimiter) {
+	if cfg == nil {
+		return nil
+	}
+
+	var opts []xrate.Option
+
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xrate.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		switch cfg.Redis.Type {
+		case "list": // redis list
+			opts = append(opts, xrate.RedisLoaderOption(loader.RedisListLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		default: // redis set
+			opts = append(opts, xrate.RedisLoaderOption(loader.RedisSetLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		}
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xrate.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	opts = append(opts,
+		xrate.LimitsOption(cfg.Limits...),
+		xrate.ReloadPeriodOption(cfg.Reload),
+		xrate.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":    "limiter",
+			"limiter": cfg.Name,
+		})),
+	)
+
+	return xrate.NewRateLimiter(opts...)
+}

go-gost/x/config/parsing/logger/parse.go

@@ -0,0 +1,70 @@
+package logger
+
+import (
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	xlogger "github.com/go-gost/x/logger"
+	"github.com/go-gost/x/registry"
+	"gopkg.in/natefinch/lumberjack.v2"
+)
+
+func ParseLogger(cfg *config.LoggerConfig) logger.Logger {
+	if cfg == nil || cfg.Log == nil {
+		return nil
+	}
+	opts := []xlogger.Option{
+		xlogger.NameOption(cfg.Name),
+		xlogger.FormatOption(logger.LogFormat(cfg.Log.Format)),
+		xlogger.LevelOption(logger.LogLevel(cfg.Log.Level)),
+	}
+
+	var out io.Writer = os.Stderr
+	switch cfg.Log.Output {
+	case "none", "null":
+		return xlogger.Nop()
+	case "stdout":
+		out = os.Stdout
+	case "stderr", "":
+		out = os.Stderr
+	default:
+		if cfg.Log.Rotation != nil {
+			out = &lumberjack.Logger{
+				Filename:   cfg.Log.Output,
+				MaxSize:    cfg.Log.Rotation.MaxSize,
+				MaxAge:     cfg.Log.Rotation.MaxAge,
+				MaxBackups: cfg.Log.Rotation.MaxBackups,
+				LocalTime:  cfg.Log.Rotation.LocalTime,
+				Compress:   cfg.Log.Rotation.Compress,
+			}
+		} else {
+			os.MkdirAll(filepath.Dir(cfg.Log.Output), 0755)
+			f, err := os.OpenFile(cfg.Log.Output, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
+			if err != nil {
+				logger.Default().Warn(err)
+			} else {
+				out = f
+			}
+		}
+	}
+	opts = append(opts, xlogger.OutputOption(out))
+
+	return xlogger.NewLogger(opts...)
+}
+
+func List(name string, names ...string) []logger.Logger {
+	var loggers []logger.Logger
+	if adm := registry.LoggerRegistry().Get(name); adm != nil {
+		loggers = append(loggers, adm)
+	}
+	for _, s := range names {
+		if lg := registry.LoggerRegistry().Get(s); lg != nil {
+			loggers = append(loggers, lg)
+		}
+	}
+
+	return loggers
+}

go-gost/x/config/parsing/node/parse.go

@@ -0,0 +1,257 @@
+package node
+
+import (
+	"fmt"
+	"net"
+	"regexp"
+	"strings"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/dialer"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/metadata"
+	xauth "github.com/go-gost/x/auth"
+	xbypass "github.com/go-gost/x/bypass"
+	xchain "github.com/go-gost/x/chain"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/config/parsing"
+	auth_parser "github.com/go-gost/x/config/parsing/auth"
+	bypass_parser "github.com/go-gost/x/config/parsing/bypass"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	mdx "github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+	"github.com/go-gost/x/routing"
+)
+
+func ParseNode(hop string, cfg *config.NodeConfig, log logger.Logger) (*chain.Node, error) {
+	if cfg == nil {
+		return nil, nil
+	}
+
+	if cfg.Connector == nil {
+		cfg.Connector = &config.ConnectorConfig{
+			Type: "http",
+		}
+	}
+
+	if cfg.Dialer == nil {
+		cfg.Dialer = &config.DialerConfig{
+			Type: "tcp",
+		}
+	}
+
+	nodeLogger := log.WithFields(map[string]any{
+		"hop":       hop,
+		"kind":      "node",
+		"node":      cfg.Name,
+		"connector": cfg.Connector.Type,
+		"dialer":    cfg.Dialer.Type,
+	})
+
+	serverName, _, _ := net.SplitHostPort(cfg.Addr)
+
+	tlsCfg := cfg.Connector.TLS
+	if tlsCfg == nil {
+		tlsCfg = &config.TLSConfig{}
+	}
+	if tlsCfg.ServerName == "" {
+		tlsCfg.ServerName = serverName
+	}
+	tlsConfig, err := tls_util.LoadClientConfig(tlsCfg)
+	if err != nil {
+		nodeLogger.Error(err)
+		return nil, err
+	}
+
+	var nm metadata.Metadata
+	if cfg.Metadata != nil {
+		nm = mdx.NewMetadata(cfg.Metadata)
+	}
+
+	connectorLogger := nodeLogger.WithFields(map[string]any{
+		"kind": "connector",
+	})
+	var cr connector.Connector
+	if rf := registry.ConnectorRegistry().Get(cfg.Connector.Type); rf != nil {
+		cr = rf(
+			connector.AuthOption(auth_parser.Info(cfg.Connector.Auth)),
+			connector.TLSConfigOption(tlsConfig),
+			connector.LoggerOption(connectorLogger),
+		)
+	} else {
+		return nil, fmt.Errorf("unregistered connector: %s", cfg.Connector.Type)
+	}
+
+	if cfg.Connector.Metadata == nil {
+		cfg.Connector.Metadata = make(map[string]any)
+	}
+	if err := cr.Init(mdx.NewMetadata(cfg.Connector.Metadata)); err != nil {
+		connectorLogger.Error("init: ", err)
+		return nil, err
+	}
+
+	tlsCfg = cfg.Dialer.TLS
+	if tlsCfg == nil {
+		tlsCfg = &config.TLSConfig{}
+	}
+	if tlsCfg.ServerName == "" {
+		tlsCfg.ServerName = serverName
+	}
+	tlsConfig, err = tls_util.LoadClientConfig(tlsCfg)
+	if err != nil {
+		nodeLogger.Error(err)
+		return nil, err
+	}
+
+	var ppv int
+	if nm != nil {
+		ppv = mdutil.GetInt(nm, parsing.MDKeyProxyProtocol)
+	}
+
+	dialerLogger := nodeLogger.WithFields(map[string]any{
+		"kind": "dialer",
+	})
+
+	var d dialer.Dialer
+	if rf := registry.DialerRegistry().Get(cfg.Dialer.Type); rf != nil {
+		d = rf(
+			dialer.AuthOption(auth_parser.Info(cfg.Dialer.Auth)),
+			dialer.TLSConfigOption(tlsConfig),
+			dialer.LoggerOption(dialerLogger),
+			dialer.ProxyProtocolOption(ppv),
+		)
+	} else {
+		return nil, fmt.Errorf("unregistered dialer: %s", cfg.Dialer.Type)
+	}
+
+	if cfg.Dialer.Metadata == nil {
+		cfg.Dialer.Metadata = make(map[string]any)
+	}
+	if err := d.Init(mdx.NewMetadata(cfg.Dialer.Metadata)); err != nil {
+		dialerLogger.Error("init: ", err)
+		return nil, err
+	}
+
+	var sockOpts *chain.SockOpts
+	if cfg.SockOpts != nil {
+		sockOpts = &chain.SockOpts{
+			Mark: cfg.SockOpts.Mark,
+		}
+	}
+
+	tr := xchain.NewTransport(d, cr,
+		chain.AddrTransportOption(cfg.Addr),
+		chain.InterfaceTransportOption(cfg.Interface),
+		chain.NetnsTransportOption(cfg.Netns),
+		chain.SockOptsTransportOption(sockOpts),
+	)
+
+	opts := []chain.NodeOption{
+		chain.TransportNodeOption(tr),
+		chain.BypassNodeOption(xbypass.BypassGroup(bypass_parser.List(cfg.Bypass, cfg.Bypasses...)...)),
+		chain.ResoloverNodeOption(registry.ResolverRegistry().Get(cfg.Resolver)),
+		chain.HostMapperNodeOption(registry.HostsRegistry().Get(cfg.Hosts)),
+		chain.MetadataNodeOption(nm),
+		chain.NetworkNodeOption(cfg.Network),
+	}
+
+	if filter := cfg.Filter; filter != nil {
+		// convert *.example.com to .example.com
+		// convert *example.com to example.com
+		host := filter.Host
+		if strings.HasPrefix(host, "*") {
+			host = host[1:]
+			if !strings.HasPrefix(host, ".") {
+				host = "." + host
+			}
+		}
+
+		settings := &chain.NodeFilterSettings{
+			Protocol: filter.Protocol,
+			Host:     host,
+			Path:     filter.Path,
+		}
+		opts = append(opts, chain.NodeFilterOption(settings))
+	}
+
+	if cfg.Matcher != nil {
+		priority := cfg.Matcher.Priority
+
+		if rule := strings.TrimSpace(cfg.Matcher.Rule); rule != "" {
+			if matcher, err := routing.NewMatcher(rule); err == nil {
+				log.Debugf("new matcher for node %s with rule %s", cfg.Name, cfg.Matcher.Rule)
+				if priority == 0 {
+					priority = len(cfg.Matcher.Rule)
+				}
+				opts = append(opts, chain.MatcherNodeOption(matcher))
+			} else {
+				log.Error(err)
+				priority = -1
+			}
+		}
+
+		opts = append(opts, chain.PriorityNodeOption(priority))
+	}
+
+	if cfg.HTTP != nil {
+		settings := &chain.HTTPNodeSettings{
+			Host:           cfg.HTTP.Host,
+			RequestHeader:  cfg.HTTP.RequestHeader,
+			ResponseHeader: cfg.HTTP.ResponseHeader,
+		}
+		if settings.RequestHeader == nil {
+			settings.RequestHeader = cfg.HTTP.Header
+		}
+
+		if auth := cfg.HTTP.Auth; auth != nil && auth.Username != "" {
+			settings.Auther = xauth.NewAuthenticator(
+				xauth.AuthsOption(map[string]string{auth.Username: auth.Password}),
+				xauth.LoggerOption(log.WithFields(map[string]any{
+					"kind": "node",
+					"node": cfg.Name,
+					"addr": cfg.Addr,
+				})),
+			)
+		}
+
+		rewriteURL := cfg.HTTP.RewriteURL
+		if rewriteURL == nil {
+			rewriteURL = cfg.HTTP.Rewrite
+		} 
+		for _, v := range rewriteURL {
+			if pattern, _ := regexp.Compile(v.Match); pattern != nil {
+				settings.RewriteURL = append(settings.RewriteURL, chain.HTTPURLRewriteSetting{
+					Pattern:     pattern,
+					Replacement: v.Replacement,
+				})
+			}
+		}
+		for _, v := range cfg.HTTP.RewriteBody {
+			if pattern, _ := regexp.Compile(v.Match); pattern != nil {
+				settings.RewriteResponseBody = append(settings.RewriteResponseBody, chain.HTTPBodyRewriteSettings{
+					Type:        v.Type,
+					Pattern:     pattern,
+					Replacement: []byte(v.Replacement),
+				})
+			}
+		}
+		opts = append(opts, chain.HTTPNodeOption(settings))
+	}
+
+	if cfg.TLS != nil {
+		tlsCfg := &chain.TLSNodeSettings{
+			ServerName: cfg.TLS.ServerName,
+			Secure:     cfg.TLS.Secure,
+		}
+		if o := cfg.TLS.Options; o != nil {
+			tlsCfg.Options.MinVersion = o.MinVersion
+			tlsCfg.Options.MaxVersion = o.MaxVersion
+			tlsCfg.Options.CipherSuites = o.CipherSuites
+			tlsCfg.Options.ALPN = o.ALPN
+		}
+		opts = append(opts, chain.TLSNodeOption(tlsCfg))
+	}
+	return chain.NewNode(cfg.Name, cfg.Addr, opts...), nil
+}

go-gost/x/config/parsing/observer/parse.go

@@ -0,0 +1,39 @@
+package observer
+
+import (
+	"crypto/tls"
+	"strings"
+
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/plugin"
+	observer_plugin "github.com/go-gost/x/observer/plugin"
+)
+
+func ParseObserver(cfg *config.ObserverConfig) observer.Observer {
+	if cfg == nil || cfg.Plugin == nil {
+		return nil
+	}
+
+	var tlsCfg *tls.Config
+	if cfg.Plugin.TLS != nil {
+		tlsCfg = &tls.Config{
+			ServerName:         cfg.Plugin.TLS.ServerName,
+			InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+		}
+	}
+	switch strings.ToLower(cfg.Plugin.Type) {
+	case "http":
+		return observer_plugin.NewHTTPPlugin(
+			cfg.Name, cfg.Plugin.Addr,
+			plugin.TLSConfigOption(tlsCfg),
+			plugin.TimeoutOption(cfg.Plugin.Timeout),
+		)
+	default:
+		return observer_plugin.NewGRPCPlugin(
+			cfg.Name, cfg.Plugin.Addr,
+			plugin.TokenOption(cfg.Plugin.Token),
+			plugin.TLSConfigOption(tlsCfg),
+		)
+	}
+}

go-gost/x/config/parsing/parse.go

@@ -0,0 +1,32 @@
+package parsing
+
+const (
+	MDKeyProxyProtocol = "proxyProtocol"
+	MDKeyInterface     = "interface"
+	MDKeySoMark        = "so_mark"
+	MDKeyHash          = "hash"
+	MDKeyPreUp         = "preUp"
+	MDKeyPreDown       = "preDown"
+	MDKeyPostUp        = "postUp"
+	MDKeyPostDown      = "postDown"
+	MDKeyIgnoreChain   = "ignoreChain"
+	MDKeyEnableStats   = "enableStats"
+
+	MDKeyRecorderDirection       = "direction"
+	MDKeyRecorderTimestampFormat = "timeStampFormat"
+	MDKeyRecorderHexdump         = "hexdump"
+	MDKeyRecorderHTTPBody        = "http.body"
+	MDKeyRecorderHTTPMaxBodySize = "http.maxBodySize"
+
+	MDKeyLimiterRefreshInterval = "limiter.refreshInterval"
+	MDKeyLimiterCleanupInterval = "limiter.cleanupInterval"
+	MDKeyLimiterScope           = "limiter.scope"
+
+	MDKeyObserverResetTraffic = "observer.resetTraffic"
+	MDKeyObserverPeriod       = "observer.period"
+
+	MDKeyNetns    = "netns"
+	MDKeyNetnsOut = "netns.out"
+
+	MDKeyDialTimeout = "dialTimeout"
+)

go-gost/x/config/parsing/parser/parser.go

@@ -0,0 +1,206 @@
+package parser
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/config/cmd"
+	xmd "github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+var (
+	defaultParser = &parser{}
+)
+
+func Init(args Args) {
+	defaultParser = &parser{
+		args: args,
+	}
+}
+
+func Parse() (*config.Config, error) {
+	return defaultParser.Parse()
+}
+
+type Args struct {
+	CfgFile     string
+	Services    []string
+	Nodes       []string
+	Debug       bool
+	Trace       bool
+	ApiAddr     string
+	MetricsAddr string
+}
+
+type parser struct {
+	args Args
+}
+
+func (p *parser) Parse() (*config.Config, error) {
+	cfg := &config.Config{}
+
+	cfgFile := p.args.CfgFile
+	if cfgFile != "" {
+		cfgFile = strings.TrimSpace(cfgFile)
+		if strings.HasPrefix(cfgFile, "{") && strings.HasSuffix(cfgFile, "}") {
+			if err := json.Unmarshal([]byte(cfgFile), cfg); err != nil {
+				return nil, err
+			}
+		} else {
+			if err := cfg.ReadFile(cfgFile); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	cmdCfg, err := cmd.BuildConfigFromCmd(p.args.Services, p.args.Nodes)
+	if err != nil {
+		return nil, err
+	}
+	cfg = mergeConfig(cfg, cmdCfg)
+
+	if len(cfg.Services) == 0 && p.args.ApiAddr == "" && cfg.API == nil {
+		if err := cfg.Load(); err != nil {
+			return nil, err
+		}
+	}
+
+	if v := os.Getenv("GOST_LOGGER_LEVEL"); v != "" {
+		cfg.Log = &config.LogConfig{
+			Level: v,
+		}
+	}
+	if v := os.Getenv("GOST_API"); v != "" {
+		cfg.API = &config.APIConfig{
+			Addr: v,
+		}
+	}
+	if v := os.Getenv("GOST_METRICS"); v != "" {
+		cfg.Metrics = &config.MetricsConfig{
+			Addr: v,
+		}
+	}
+	if v := os.Getenv("GOST_PROFILING"); v != "" {
+		cfg.Profiling = &config.ProfilingConfig{
+			Addr: v,
+		}
+	}
+
+	if p.args.Debug || p.args.Trace {
+		if cfg.Log == nil {
+			cfg.Log = &config.LogConfig{}
+		}
+
+		cfg.Log.Level = string(logger.DebugLevel)
+		if p.args.Trace {
+			cfg.Log.Level = string(logger.TraceLevel)
+		}
+	}
+
+	if p.args.ApiAddr != "" {
+		cfg.API = &config.APIConfig{
+			Addr: p.args.ApiAddr,
+		}
+		if url, _ := cmd.Norm(p.args.ApiAddr); url != nil {
+			cfg.API.Addr = url.Host
+			if url.User != nil {
+				username := url.User.Username()
+				password, _ := url.User.Password()
+				cfg.API.Auth = &config.AuthConfig{
+					Username: username,
+					Password: password,
+				}
+			}
+			m := map[string]any{}
+			for k, v := range url.Query() {
+				if len(v) > 0 {
+					m[k] = v[0]
+				}
+			}
+			md := xmd.NewMetadata(m)
+			cfg.API.PathPrefix = mdutil.GetString(md, "pathPrefix")
+			cfg.API.AccessLog = mdutil.GetBool(md, "accesslog")
+		}
+	}
+	if p.args.MetricsAddr != "" {
+		cfg.Metrics = &config.MetricsConfig{
+			Addr: p.args.MetricsAddr,
+		}
+		if url, _ := cmd.Norm(p.args.MetricsAddr); url != nil {
+			cfg.Metrics.Addr = url.Host
+			if url.User != nil {
+				username := url.User.Username()
+				password, _ := url.User.Password()
+				cfg.Metrics.Auth = &config.AuthConfig{
+					Username: username,
+					Password: password,
+				}
+			}
+			m := map[string]any{}
+			for k, v := range url.Query() {
+				if len(v) > 0 {
+					m[k] = v[0]
+				}
+			}
+			md := xmd.NewMetadata(m)
+			cfg.Metrics.Path = mdutil.GetString(md, "path")
+		}
+	}
+
+	return cfg, nil
+}
+
+func mergeConfig(cfg1, cfg2 *config.Config) *config.Config {
+	if cfg1 == nil {
+		return cfg2
+	}
+	if cfg2 == nil {
+		return cfg1
+	}
+
+	cfg := &config.Config{
+		Services:   append(cfg1.Services, cfg2.Services...),
+		Chains:     append(cfg1.Chains, cfg2.Chains...),
+		Hops:       append(cfg1.Hops, cfg2.Hops...),
+		Authers:    append(cfg1.Authers, cfg2.Authers...),
+		Admissions: append(cfg1.Admissions, cfg2.Admissions...),
+		Bypasses:   append(cfg1.Bypasses, cfg2.Bypasses...),
+		Resolvers:  append(cfg1.Resolvers, cfg2.Resolvers...),
+		Hosts:      append(cfg1.Hosts, cfg2.Hosts...),
+		Ingresses:  append(cfg1.Ingresses, cfg2.Ingresses...),
+		SDs:        append(cfg1.SDs, cfg2.SDs...),
+		Recorders:  append(cfg1.Recorders, cfg2.Recorders...),
+		Limiters:   append(cfg1.Limiters, cfg2.Limiters...),
+		CLimiters:  append(cfg1.CLimiters, cfg2.CLimiters...),
+		RLimiters:  append(cfg1.RLimiters, cfg2.RLimiters...),
+		Loggers:    append(cfg1.Loggers, cfg2.Loggers...),
+		Routers:    append(cfg1.Routers, cfg2.Routers...),
+		Observers:  append(cfg1.Observers, cfg2.Observers...),
+		TLS:        cfg1.TLS,
+		Log:        cfg1.Log,
+		API:        cfg1.API,
+		Metrics:    cfg1.Metrics,
+		Profiling:  cfg1.Profiling,
+	}
+	if cfg2.TLS != nil {
+		cfg.TLS = cfg2.TLS
+	}
+	if cfg2.Log != nil {
+		cfg.Log = cfg2.Log
+	}
+	if cfg2.API != nil {
+		cfg.API = cfg2.API
+	}
+	if cfg2.Metrics != nil {
+		cfg.Metrics = cfg2.Metrics
+	}
+	if cfg2.Profiling != nil {
+		cfg.Profiling = cfg2.Profiling
+	}
+
+	return cfg
+}

go-gost/x/config/parsing/recorder/parse.go

@@ -0,0 +1,123 @@
+package recorder
+
+import (
+	"crypto/tls"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/plugin"
+	xrecorder "github.com/go-gost/x/recorder"
+	recorder_plugin "github.com/go-gost/x/recorder/plugin"
+	"gopkg.in/natefinch/lumberjack.v2"
+)
+
+type discardCloser struct{}
+
+func (discardCloser) Write(p []byte) (n int, err error) { return len(p), nil }
+func (discardCloser) Close() error                      { return nil }
+
+func ParseRecorder(cfg *config.RecorderConfig) (r recorder.Recorder) {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return recorder_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return recorder_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	if cfg.File != nil && cfg.File.Path != "" {
+		var out io.WriteCloser = discardCloser{}
+
+		if cfg.File.Rotation != nil {
+			out = &lumberjack.Logger{
+				Filename:   cfg.File.Path,
+				MaxSize:    cfg.File.Rotation.MaxSize,
+				MaxAge:     cfg.File.Rotation.MaxAge,
+				MaxBackups: cfg.File.Rotation.MaxBackups,
+				LocalTime:  cfg.File.Rotation.LocalTime,
+				Compress:   cfg.File.Rotation.Compress,
+			}
+		} else {
+			os.MkdirAll(filepath.Dir(cfg.File.Path), 0755)
+			f, err := os.OpenFile(cfg.File.Path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
+			if err != nil {
+				logger.Default().Warn(err)
+			} else {
+				out = f
+			}
+		}
+
+		return xrecorder.FileRecorder(out, xrecorder.SepRecorderOption(cfg.File.Sep))
+	}
+
+	if cfg.TCP != nil && cfg.TCP.Addr != "" {
+		return xrecorder.TCPRecorder(cfg.TCP.Addr, xrecorder.TimeoutTCPRecorderOption(cfg.TCP.Timeout))
+	}
+
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		h := http.Header{}
+		for k, v := range cfg.HTTP.Header {
+			h.Add(k, v)
+		}
+		return xrecorder.HTTPRecorder(cfg.HTTP.URL,
+			xrecorder.TimeoutHTTPRecorderOption(cfg.HTTP.Timeout),
+			xrecorder.HeaderHTTPRecorderOption(h),
+		)
+	}
+
+	if cfg.Redis != nil &&
+		cfg.Redis.Addr != "" &&
+		cfg.Redis.Key != "" {
+		switch cfg.Redis.Type {
+		case "list": // redis list
+			return xrecorder.RedisListRecorder(cfg.Redis.Addr,
+				xrecorder.DBRedisRecorderOption(cfg.Redis.DB),
+				xrecorder.KeyRedisRecorderOption(cfg.Redis.Key),
+				xrecorder.UsernameRedisRecorderOption(cfg.Redis.Username),
+				xrecorder.PasswordRedisRecorderOption(cfg.Redis.Password),
+			)
+		case "sset": // sorted set
+			return xrecorder.RedisSortedSetRecorder(cfg.Redis.Addr,
+				xrecorder.DBRedisRecorderOption(cfg.Redis.DB),
+				xrecorder.KeyRedisRecorderOption(cfg.Redis.Key),
+				xrecorder.UsernameRedisRecorderOption(cfg.Redis.Username),
+				xrecorder.PasswordRedisRecorderOption(cfg.Redis.Password),
+			)
+		default: // redis set
+			return xrecorder.RedisSetRecorder(cfg.Redis.Addr,
+				xrecorder.DBRedisRecorderOption(cfg.Redis.DB),
+				xrecorder.KeyRedisRecorderOption(cfg.Redis.Key),
+				xrecorder.UsernameRedisRecorderOption(cfg.Redis.Username),
+				xrecorder.PasswordRedisRecorderOption(cfg.Redis.Password),
+			)
+		}
+	}
+
+	return
+}

go-gost/x/config/parsing/resolver/parse.go

@@ -0,0 +1,70 @@
+package resolver
+
+import (
+	"crypto/tls"
+	"net"
+	"strings"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/resolver"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/plugin"
+	"github.com/go-gost/x/registry"
+	xresolver "github.com/go-gost/x/resolver"
+	resolver_plugin "github.com/go-gost/x/resolver/plugin"
+)
+
+func ParseResolver(cfg *config.ResolverConfig) (resolver.Resolver, error) {
+	if cfg == nil {
+		return nil, nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return resolver_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			), nil
+		default:
+			return resolver_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	var nameservers []xresolver.NameServer
+	for _, server := range cfg.Nameservers {
+		nameservers = append(nameservers, xresolver.NameServer{
+			Addr:     server.Addr,
+			Chain:    registry.ChainRegistry().Get(server.Chain),
+			TTL:      server.TTL,
+			Timeout:  server.Timeout,
+			ClientIP: net.ParseIP(server.ClientIP),
+			Prefer:   server.Prefer,
+			Hostname: server.Hostname,
+			Async:    server.Async,
+			Only:     server.Only,
+		})
+	}
+
+	return xresolver.NewResolver(
+		nameservers,
+		xresolver.LoggerOption(
+			logger.Default().WithFields(map[string]any{
+				"kind":     "resolver",
+				"resolver": cfg.Name,
+			}),
+		),
+	)
+}

go-gost/x/config/parsing/router/parse.go

@@ -0,0 +1,117 @@
+package router
+
+import (
+	"crypto/tls"
+	"net"
+	"strings"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/router"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/loader"
+	"github.com/go-gost/x/internal/plugin"
+	xrouter "github.com/go-gost/x/router"
+	router_plugin "github.com/go-gost/x/router/plugin"
+)
+
+func ParseRouter(cfg *config.RouterConfig) router.Router {
+	if cfg == nil {
+		return nil
+	}
+
+	if cfg.Plugin != nil {
+		var tlsCfg *tls.Config
+		if cfg.Plugin.TLS != nil {
+			tlsCfg = &tls.Config{
+				ServerName:         cfg.Plugin.TLS.ServerName,
+				InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+			}
+		}
+		switch strings.ToLower(cfg.Plugin.Type) {
+		case "http":
+			return router_plugin.NewHTTPPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TLSConfigOption(tlsCfg),
+				plugin.TimeoutOption(cfg.Plugin.Timeout),
+			)
+		default:
+			return router_plugin.NewGRPCPlugin(
+				cfg.Name, cfg.Plugin.Addr,
+				plugin.TokenOption(cfg.Plugin.Token),
+				plugin.TLSConfigOption(tlsCfg),
+			)
+		}
+	}
+
+	var routes []*router.Route
+	for _, route := range cfg.Routes {
+		if route == nil {
+			continue
+		}
+		_, ipNet, _ := net.ParseCIDR(route.Net)
+		dst := route.Dst
+		if dst != "" {
+			_, ipNet, _ = net.ParseCIDR(dst)
+		} else {
+			if ipNet != nil {
+				dst = ipNet.String()
+			}
+		}
+
+		if dst == "" || route.Gateway == "" {
+			continue
+		}
+
+		routes = append(routes, &router.Route{
+			Net:     ipNet,
+			Dst:     dst,
+			Gateway: route.Gateway,
+		})
+	}
+	opts := []xrouter.Option{
+		xrouter.RoutesOption(routes),
+		xrouter.ReloadPeriodOption(cfg.Reload),
+		xrouter.LoggerOption(logger.Default().WithFields(map[string]any{
+			"kind":   "router",
+			"router": cfg.Name,
+		})),
+	}
+	if cfg.File != nil && cfg.File.Path != "" {
+		opts = append(opts, xrouter.FileLoaderOption(loader.FileLoader(cfg.File.Path)))
+	}
+	if cfg.Redis != nil && cfg.Redis.Addr != "" {
+		switch cfg.Redis.Type {
+		case "list": // rediss list
+			opts = append(opts, xrouter.RedisLoaderOption(loader.RedisListLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		case "set": // redis set
+			opts = append(opts, xrouter.RedisLoaderOption(loader.RedisSetLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		default: // redis hash
+			opts = append(opts, xrouter.RedisLoaderOption(loader.RedisHashLoader(
+				cfg.Redis.Addr,
+				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
+				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
+				loader.KeyRedisLoaderOption(cfg.Redis.Key),
+			)))
+		}
+	}
+	if cfg.HTTP != nil && cfg.HTTP.URL != "" {
+		opts = append(opts, xrouter.HTTPLoaderOption(loader.HTTPLoader(
+			cfg.HTTP.URL,
+			loader.TimeoutHTTPLoaderOption(cfg.HTTP.Timeout),
+		)))
+	}
+	return xrouter.NewRouter(opts...)
+}

go-gost/x/config/parsing/sd/parse.go

@@ -0,0 +1,39 @@
+package sd
+
+import (
+	"crypto/tls"
+	"strings"
+
+	"github.com/go-gost/core/sd"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/internal/plugin"
+	sd_plugin "github.com/go-gost/x/sd/plugin"
+)
+
+func ParseSD(cfg *config.SDConfig) sd.SD {
+	if cfg == nil || cfg.Plugin == nil {
+		return nil
+	}
+
+	var tlsCfg *tls.Config
+	if cfg.Plugin.TLS != nil {
+		tlsCfg = &tls.Config{
+			ServerName:         cfg.Plugin.TLS.ServerName,
+			InsecureSkipVerify: !cfg.Plugin.TLS.Secure,
+		}
+	}
+	switch strings.ToLower(cfg.Plugin.Type) {
+	case "http":
+		return sd_plugin.NewHTTPPlugin(
+			cfg.Name, cfg.Plugin.Addr,
+			plugin.TLSConfigOption(tlsCfg),
+			plugin.TimeoutOption(cfg.Plugin.Timeout),
+		)
+	default:
+		return sd_plugin.NewGRPCPlugin(
+			cfg.Name, cfg.Plugin.Addr,
+			plugin.TokenOption(cfg.Plugin.Token),
+			plugin.TLSConfigOption(tlsCfg),
+		)
+	}
+}

go-gost/x/config/parsing/selector/parse.go

@@ -0,0 +1,75 @@
+package selector
+
+import (
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/selector"
+	"github.com/go-gost/x/config"
+	xs "github.com/go-gost/x/selector"
+)
+
+func ParseChainSelector(cfg *config.SelectorConfig) selector.Selector[chain.Chainer] {
+	if cfg == nil {
+		return nil
+	}
+
+	var strategy selector.Strategy[chain.Chainer]
+	switch cfg.Strategy {
+	case "round", "rr":
+		strategy = xs.RoundRobinStrategy[chain.Chainer]()
+	case "random", "rand":
+		strategy = xs.RandomStrategy[chain.Chainer]()
+	case "fifo", "ha":
+		strategy = xs.FIFOStrategy[chain.Chainer]()
+	case "hash":
+		strategy = xs.HashStrategy[chain.Chainer]()
+	default:
+		strategy = xs.RoundRobinStrategy[chain.Chainer]()
+	}
+	return xs.NewSelector(
+		strategy,
+		xs.FailFilter[chain.Chainer](cfg.MaxFails, cfg.FailTimeout),
+		xs.BackupFilter[chain.Chainer](),
+	)
+}
+
+func ParseNodeSelector(cfg *config.SelectorConfig) selector.Selector[*chain.Node] {
+	if cfg == nil {
+		return nil
+	}
+
+	var strategy selector.Strategy[*chain.Node]
+	switch cfg.Strategy {
+	case "round", "rr":
+		strategy = xs.RoundRobinStrategy[*chain.Node]()
+	case "random", "rand":
+		strategy = xs.RandomStrategy[*chain.Node]()
+	case "fifo", "ha":
+		strategy = xs.FIFOStrategy[*chain.Node]()
+	case "hash":
+		strategy = xs.HashStrategy[*chain.Node]()
+	default:
+		strategy = xs.RoundRobinStrategy[*chain.Node]()
+	}
+
+	return xs.NewSelector(
+		strategy,
+		xs.FailFilter[*chain.Node](cfg.MaxFails, cfg.FailTimeout),
+		xs.BackupFilter[*chain.Node](),
+	)
+}
+
+func DefaultNodeSelector() selector.Selector[*chain.Node] {
+	return xs.NewSelector(
+		xs.RoundRobinStrategy[*chain.Node](),
+		xs.FailFilter[*chain.Node](xs.DefaultMaxFails, xs.DefaultFailTimeout),
+		xs.BackupFilter[*chain.Node](),
+	)
+}
+
+func DefaultChainSelector() selector.Selector[chain.Chainer] {
+	return xs.NewSelector(
+		xs.RoundRobinStrategy[chain.Chainer](),
+		xs.FailFilter[chain.Chainer](xs.DefaultMaxFails, xs.DefaultFailTimeout),
+		xs.BackupFilter[chain.Chainer](),
+	)
+}

go-gost/x/config/parsing/service/parse.go

@@ -0,0 +1,432 @@
+package service
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/listener"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/core/selector"
+	"github.com/go-gost/core/service"
+	xadmission "github.com/go-gost/x/admission"
+	xauth "github.com/go-gost/x/auth"
+	xbypass "github.com/go-gost/x/bypass"
+	xchain "github.com/go-gost/x/chain"
+	"github.com/go-gost/x/config"
+	"github.com/go-gost/x/config/parsing"
+	admission_parser "github.com/go-gost/x/config/parsing/admission"
+	auth_parser "github.com/go-gost/x/config/parsing/auth"
+	bypass_parser "github.com/go-gost/x/config/parsing/bypass"
+	hop_parser "github.com/go-gost/x/config/parsing/hop"
+	logger_parser "github.com/go-gost/x/config/parsing/logger"
+	selector_parser "github.com/go-gost/x/config/parsing/selector"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	"github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	xstats "github.com/go-gost/x/observer/stats"
+	"github.com/go-gost/x/registry"
+	xservice "github.com/go-gost/x/service"
+	"github.com/vishvananda/netns"
+)
+
+func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
+	if cfg.Listener == nil {
+		cfg.Listener = &config.ListenerConfig{}
+	}
+	if strings.TrimSpace(cfg.Listener.Type) == "" {
+		cfg.Listener.Type = "tcp"
+	}
+
+	if cfg.Handler == nil {
+		cfg.Handler = &config.HandlerConfig{}
+	}
+	if strings.TrimSpace(cfg.Handler.Type) == "" {
+		cfg.Handler.Type = "auto"
+	}
+
+	log := logger.Default()
+	if loggers := logger_parser.List(cfg.Logger, cfg.Loggers...); len(loggers) > 0 {
+		log = logger.LoggerGroup(loggers...)
+	}
+
+	serviceLogger := log.WithFields(map[string]any{
+		"kind":     "service",
+		"service":  cfg.Name,
+		"listener": cfg.Listener.Type,
+		"handler":  cfg.Handler.Type,
+	})
+
+	tlsCfg := cfg.Listener.TLS
+	if tlsCfg == nil {
+		tlsCfg = &config.TLSConfig{}
+	}
+	tlsConfig, err := tls_util.LoadServerConfig(tlsCfg)
+	if err != nil {
+		serviceLogger.Error(err)
+		return nil, err
+	}
+	if tlsConfig == nil {
+		tlsConfig = parsing.DefaultTLSConfig().Clone()
+		tls_util.SetTLSOptions(tlsConfig, tlsCfg.Options)
+	}
+
+	authers := auth_parser.List(cfg.Listener.Auther, cfg.Listener.Authers...)
+	if len(authers) == 0 {
+		if auther := auth_parser.ParseAutherFromAuth(cfg.Listener.Auth); auther != nil {
+			authers = append(authers, auther)
+		}
+	}
+	var auther auth.Authenticator
+	if len(authers) > 0 {
+		auther = xauth.AuthenticatorGroup(authers...)
+	}
+
+	admissions := admission_parser.List(cfg.Admission, cfg.Admissions...)
+
+	var sockOpts *chain.SockOpts
+	if cfg.SockOpts != nil {
+		sockOpts = &chain.SockOpts{
+			Mark: cfg.SockOpts.Mark,
+		}
+	}
+
+	var ppv int
+	ifce := cfg.Interface
+	var preUp, preDown, postUp, postDown []string
+	var ignoreChain bool
+	var pStats stats.Stats
+	var observerPeriod time.Duration
+	var netnsIn, netnsOut string
+	var dialTimeout time.Duration
+
+	var limiterRefreshInterval time.Duration
+	var limiterCleanupInterval time.Duration
+	var limiterScope string
+
+	if cfg.Metadata != nil {
+		md := metadata.NewMetadata(cfg.Metadata)
+		ppv = mdutil.GetInt(md, parsing.MDKeyProxyProtocol)
+		if v := mdutil.GetString(md, parsing.MDKeyInterface); v != "" {
+			ifce = v
+		}
+		if v := mdutil.GetInt(md, parsing.MDKeySoMark); v > 0 {
+			sockOpts = &chain.SockOpts{
+				Mark: v,
+			}
+		}
+		preUp = mdutil.GetStrings(md, parsing.MDKeyPreUp)
+		preDown = mdutil.GetStrings(md, parsing.MDKeyPreDown)
+		postUp = mdutil.GetStrings(md, parsing.MDKeyPostUp)
+		postDown = mdutil.GetStrings(md, parsing.MDKeyPostDown)
+		ignoreChain = mdutil.GetBool(md, parsing.MDKeyIgnoreChain)
+
+		if mdutil.GetBool(md, parsing.MDKeyEnableStats) {
+			pStats = xstats.NewStats(mdutil.GetBool(md, parsing.MDKeyObserverResetTraffic))
+		}
+		observerPeriod = mdutil.GetDuration(md, parsing.MDKeyObserverPeriod, "observePeriod")
+
+		netnsIn = mdutil.GetString(md, parsing.MDKeyNetns)
+		netnsOut = mdutil.GetString(md, parsing.MDKeyNetnsOut)
+
+		dialTimeout = mdutil.GetDuration(md, parsing.MDKeyDialTimeout)
+
+		limiterRefreshInterval = mdutil.GetDuration(md, parsing.MDKeyLimiterRefreshInterval)
+		limiterCleanupInterval = mdutil.GetDuration(md, parsing.MDKeyLimiterCleanupInterval)
+		limiterScope = mdutil.GetString(md, parsing.MDKeyLimiterScope)
+	}
+
+	listenerLogger := serviceLogger.WithFields(map[string]any{
+		"kind": "listener",
+	})
+
+	routerOpts := []chain.RouterOption{
+		chain.TimeoutRouterOption(dialTimeout),
+		chain.InterfaceRouterOption(ifce),
+		chain.NetnsRouterOption(netnsOut),
+		chain.SockOptsRouterOption(sockOpts),
+		chain.ResolverRouterOption(registry.ResolverRegistry().Get(cfg.Resolver)),
+		chain.HostMapperRouterOption(registry.HostsRegistry().Get(cfg.Hosts)),
+		chain.LoggerRouterOption(listenerLogger),
+	}
+	if !ignoreChain {
+		routerOpts = append(routerOpts,
+			chain.ChainRouterOption(chainGroup(cfg.Listener.Chain, cfg.Listener.ChainGroup)),
+		)
+	}
+
+	listenOpts := []listener.Option{
+		listener.AddrOption(cfg.Addr),
+		listener.RouterOption(xchain.NewRouter(routerOpts...)),
+		listener.AutherOption(auther),
+		listener.AuthOption(auth_parser.Info(cfg.Listener.Auth)),
+		listener.TLSConfigOption(tlsConfig),
+		listener.AdmissionOption(xadmission.AdmissionGroup(admissions...)),
+		listener.TrafficLimiterOption(
+			cache_limiter.NewCachedTrafficLimiter(
+				registry.TrafficLimiterRegistry().Get(cfg.Limiter),
+				cache_limiter.RefreshIntervalOption(limiterRefreshInterval),
+				cache_limiter.CleanupIntervalOption(limiterCleanupInterval),
+				cache_limiter.ScopeOption(limiterScope),
+			),
+		),
+		listener.ConnLimiterOption(registry.ConnLimiterRegistry().Get(cfg.CLimiter)),
+		listener.ServiceOption(cfg.Name),
+		listener.ProxyProtocolOption(ppv),
+		listener.StatsOption(pStats),
+		listener.NetnsOption(netnsIn),
+		listener.LoggerOption(listenerLogger),
+	}
+
+	if netnsIn != "" {
+		runtime.LockOSThread()
+		defer runtime.UnlockOSThread()
+
+		originNs, err := netns.Get()
+		if err != nil {
+			return nil, fmt.Errorf("netns.Get(): %v", err)
+		}
+		defer netns.Set(originNs)
+
+		var ns netns.NsHandle
+
+		if strings.HasPrefix(netnsIn, "/") {
+			ns, err = netns.GetFromPath(netnsIn)
+		} else {
+			ns, err = netns.GetFromName(netnsIn)
+		}
+		if err != nil {
+			return nil, fmt.Errorf("netns.Get(%s): %v", netnsIn, err)
+		}
+		defer ns.Close()
+
+		if err := netns.Set(ns); err != nil {
+			return nil, fmt.Errorf("netns.Set(%s): %v", netnsIn, err)
+		}
+	}
+
+	var ln listener.Listener
+	if rf := registry.ListenerRegistry().Get(cfg.Listener.Type); rf != nil {
+		ln = rf(listenOpts...)
+	} else {
+		return nil, fmt.Errorf("unknown listener: %s", cfg.Listener.Type)
+	}
+
+	if cfg.Listener.Metadata == nil {
+		cfg.Listener.Metadata = make(map[string]any)
+	}
+	listenerLogger.Debugf("metadata: %v", cfg.Listener.Metadata)
+	if err := ln.Init(metadata.NewMetadata(cfg.Listener.Metadata)); err != nil {
+		listenerLogger.Error("init: ", err)
+		return nil, err
+	}
+
+	handlerLogger := serviceLogger.WithFields(map[string]any{
+		"kind": "handler",
+	})
+
+	tlsCfg = cfg.Handler.TLS
+	if tlsCfg == nil {
+		tlsCfg = &config.TLSConfig{}
+	}
+	tlsConfig, err = tls_util.LoadServerConfig(tlsCfg)
+	if err != nil {
+		handlerLogger.Error(err)
+		return nil, err
+	}
+	if tlsConfig == nil {
+		tlsConfig = parsing.DefaultTLSConfig().Clone()
+		tls_util.SetTLSOptions(tlsConfig, tlsCfg.Options)
+	}
+
+	authers = auth_parser.List(cfg.Handler.Auther, cfg.Handler.Authers...)
+	if len(authers) == 0 {
+		if auther := auth_parser.ParseAutherFromAuth(cfg.Handler.Auth); auther != nil {
+			authers = append(authers, auther)
+		}
+	}
+
+	auther = nil
+	if len(authers) > 0 {
+		auther = xauth.AuthenticatorGroup(authers...)
+	}
+
+	var recorders []recorder.RecorderObject
+	for _, r := range cfg.Recorders {
+		md := metadata.NewMetadata(r.Metadata)
+		recorders = append(recorders, recorder.RecorderObject{
+			Recorder: registry.RecorderRegistry().Get(r.Name),
+			Record:   r.Record,
+			Options: &recorder.Options{
+				Direction:       mdutil.GetBool(md, parsing.MDKeyRecorderDirection),
+				TimestampFormat: mdutil.GetString(md, parsing.MDKeyRecorderTimestampFormat),
+				Hexdump:         mdutil.GetBool(md, parsing.MDKeyRecorderHexdump),
+				HTTPBody:        mdutil.GetBool(md, parsing.MDKeyRecorderHTTPBody),
+				MaxBodySize:     mdutil.GetInt(md, parsing.MDKeyRecorderHTTPMaxBodySize),
+			},
+		})
+	}
+
+	routerOpts = []chain.RouterOption{
+		chain.RetriesRouterOption(cfg.Handler.Retries),
+		chain.TimeoutRouterOption(dialTimeout),
+		chain.InterfaceRouterOption(ifce),
+		chain.NetnsRouterOption(netnsOut),
+		chain.SockOptsRouterOption(sockOpts),
+		chain.ResolverRouterOption(registry.ResolverRegistry().Get(cfg.Resolver)),
+		chain.HostMapperRouterOption(registry.HostsRegistry().Get(cfg.Hosts)),
+		chain.RecordersRouterOption(recorders...),
+		chain.LoggerRouterOption(handlerLogger),
+	}
+	if !ignoreChain {
+		routerOpts = append(routerOpts,
+			chain.ChainRouterOption(chainGroup(cfg.Handler.Chain, cfg.Handler.ChainGroup)),
+		)
+	}
+
+	var h handler.Handler
+	if rf := registry.HandlerRegistry().Get(cfg.Handler.Type); rf != nil {
+		h = rf(
+			handler.RouterOption(xchain.NewRouter(routerOpts...)),
+			handler.AutherOption(auther),
+			handler.AuthOption(auth_parser.Info(cfg.Handler.Auth)),
+			handler.BypassOption(xbypass.BypassGroup(bypass_parser.List(cfg.Bypass, cfg.Bypasses...)...)),
+			handler.TLSConfigOption(tlsConfig),
+			handler.RateLimiterOption(registry.RateLimiterRegistry().Get(cfg.RLimiter)),
+			handler.TrafficLimiterOption(registry.TrafficLimiterRegistry().Get(cfg.Handler.Limiter)),
+			handler.ObserverOption(registry.ObserverRegistry().Get(cfg.Handler.Observer)),
+			handler.RecordersOption(recorders...),
+			handler.LoggerOption(handlerLogger),
+			handler.ServiceOption(cfg.Name),
+			handler.NetnsOption(netnsIn),
+		)
+	} else {
+		return nil, fmt.Errorf("unknown handler: %s", cfg.Handler.Type)
+	}
+
+	if forwarder, ok := h.(handler.Forwarder); ok {
+		hop, err := parseForwarder(cfg.Forwarder, log)
+		if err != nil {
+			return nil, err
+		}
+		forwarder.Forward(hop)
+	}
+
+	if cfg.Handler.Metadata == nil {
+		cfg.Handler.Metadata = make(map[string]any)
+	}
+	handlerLogger.Debugf("metadata: %v", cfg.Handler.Metadata)
+	if err := h.Init(metadata.NewMetadata(cfg.Handler.Metadata)); err != nil {
+		handlerLogger.Error("init: ", err)
+		return nil, err
+	}
+
+	s := xservice.NewService(cfg.Name, ln, h,
+		xservice.AdmissionOption(xadmission.AdmissionGroup(admissions...)),
+		xservice.PreUpOption(preUp),
+		xservice.PreDownOption(preDown),
+		xservice.PostUpOption(postUp),
+		xservice.PostDownOption(postDown),
+		xservice.RecordersOption(recorders...),
+		xservice.StatsOption(pStats),
+		xservice.ObserverOption(registry.ObserverRegistry().Get(cfg.Observer)),
+		xservice.ObserverPeriodOption(observerPeriod),
+		xservice.LoggerOption(serviceLogger),
+	)
+
+	serviceLogger.Infof("listening on %s/%s", s.Addr().String(), s.Addr().Network())
+	return s, nil
+}
+
+func parseForwarder(cfg *config.ForwarderConfig, log logger.Logger) (hop.Hop, error) {
+	if cfg == nil {
+		return nil, nil
+	}
+
+	hopName := cfg.Hop
+	if hopName == "" {
+		hopName = cfg.Name
+	}
+	if hopName != "" {
+		return registry.HopRegistry().Get(hopName), nil
+	}
+
+	hc := config.HopConfig{
+		Name:     cfg.Name,
+		Selector: cfg.Selector,
+	}
+	for _, node := range cfg.Nodes {
+		if node == nil {
+			continue
+		}
+
+		filter := node.Filter
+		if filter == nil {
+			if node.Protocol != "" || node.Host != "" || node.Path != "" {
+				filter = &config.NodeFilterConfig{
+					Protocol: node.Protocol,
+					Host:     node.Host,
+					Path:     node.Path,
+				}
+			}
+		}
+
+		httpCfg := node.HTTP
+		if node.Auth != nil {
+			if httpCfg == nil {
+				httpCfg = &config.HTTPNodeConfig{}
+			}
+			if httpCfg.Auth == nil {
+				httpCfg.Auth = node.Auth
+			}
+		}
+		hc.Nodes = append(hc.Nodes, &config.NodeConfig{
+			Name:     node.Name,
+			Addr:     node.Addr,
+			Network:  node.Network,
+			Bypass:   node.Bypass,
+			Bypasses: node.Bypasses,
+			Filter:   filter,
+			Matcher:  node.Matcher,
+			HTTP:     httpCfg,
+			TLS:      node.TLS,
+			Metadata: node.Metadata,
+		})
+	}
+	return hop_parser.ParseHop(&hc, log)
+}
+
+func chainGroup(name string, group *config.ChainGroupConfig) chain.Chainer {
+	var chains []chain.Chainer
+	var sel selector.Selector[chain.Chainer]
+
+	if c := registry.ChainRegistry().Get(name); c != nil {
+		chains = append(chains, c)
+	}
+	if group != nil {
+		for _, s := range group.Chains {
+			if c := registry.ChainRegistry().Get(s); c != nil {
+				chains = append(chains, c)
+			}
+		}
+		sel = selector_parser.ParseChainSelector(group.Selector)
+	}
+	if len(chains) == 0 {
+		return nil
+	}
+
+	if sel == nil {
+		sel = selector_parser.DefaultChainSelector()
+	}
+
+	return xchain.NewChainGroup(chains...).
+		WithSelector(sel)
+}

go-gost/x/config/parsing/tls.go

@@ -0,0 +1,149 @@
+package parsing
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"sync/atomic"
+	"time"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/x/config"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+)
+
+var (
+	defaultTLSConfig atomic.Value
+)
+
+func DefaultTLSConfig() *tls.Config {
+	v, _ := defaultTLSConfig.Load().(*tls.Config)
+	return v
+}
+
+func SetDefaultTLSConfig(cfg *tls.Config) {
+	defaultTLSConfig.Store(cfg)
+}
+
+func BuildDefaultTLSConfig(cfg *config.TLSConfig) (*tls.Config, error) {
+	log := logger.Default()
+
+	if cfg == nil {
+		cfg = &config.TLSConfig{
+			CertFile: "cert.pem",
+			KeyFile:  "key.pem",
+			CAFile:   "ca.pem",
+		}
+	}
+
+	tlsConfig, err := tls_util.LoadDefaultConfig(cfg.CertFile, cfg.KeyFile, cfg.CAFile)
+	if err != nil {
+		// generate random self-signed certificate.
+		cert, err := genCertificate(cfg.Validity, cfg.Organization, cfg.CommonName)
+		if err != nil {
+			return nil, err
+		}
+		tlsConfig = &tls.Config{
+			Certificates: []tls.Certificate{cert},
+		}
+		log.Debug("load global TLS certificate files failed, use random generated certificate")
+	} else {
+		log.Debug("load global TLS certificate files OK")
+	}
+
+	return tlsConfig, nil
+}
+
+func genCertificate(validity time.Duration, org string, cn string) (cert tls.Certificate, err error) {
+	rawCert, rawKey, err := generateKeyPair(validity, org, cn)
+	if err != nil {
+		return
+	}
+	return tls.X509KeyPair(rawCert, rawKey)
+}
+
+func generateKeyPair(validity time.Duration, org string, cn string) (rawCert, rawKey []byte, err error) {
+	// Create private key and self-signed certificate
+	// Adapted from https://golang.org/src/crypto/tls/generate_cert.go
+
+	var priv crypto.PrivateKey
+	priv, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return
+	}
+
+	if validity <= 0 {
+		validity = time.Hour * 24 * 365 // one year
+	}
+	if org == "" {
+		org = "GOST"
+	}
+	if cn == "" {
+		cn = "gost.run"
+	}
+
+	validFor := validity
+	notBefore := time.Now()
+	notAfter := notBefore.Add(validFor)
+	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
+	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
+	if err != nil {
+		return
+	}
+
+	template := x509.Certificate{
+		SerialNumber: serialNumber,
+		Subject: pkix.Name{
+			Organization: []string{org},
+			CommonName:   cn,
+		},
+		NotBefore: notBefore,
+		NotAfter:  notAfter,
+
+		KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageClientAuth,
+			x509.ExtKeyUsageServerAuth,
+		},
+		BasicConstraintsValid: true,
+	}
+	if _, isRSA := priv.(*rsa.PrivateKey); isRSA {
+		template.KeyUsage |= x509.KeyUsageKeyEncipherment
+	}
+
+	template.DNSNames = append(template.DNSNames, cn)
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, publicKey(priv), priv)
+	if err != nil {
+		return
+	}
+
+	rawCert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
+	privBytes, err := x509.MarshalPKCS8PrivateKey(priv)
+	if err != nil {
+		return
+	}
+	rawKey = pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privBytes})
+
+	return
+}
+
+func publicKey(priv crypto.PrivateKey) any {
+	switch k := priv.(type) {
+	case *rsa.PrivateKey:
+		return &k.PublicKey
+	case *ecdsa.PrivateKey:
+		return &k.PublicKey
+	case ed25519.PrivateKey:
+		return k.Public().(ed25519.PublicKey)
+	default:
+		return nil
+	}
+}

go-gost/x/connector/direct/conn.go

@@ -0,0 +1,41 @@
+package direct
+
+import (
+	"io"
+	"net"
+	"time"
+)
+
+type conn struct{}
+
+func (c *conn) Close() error {
+	return nil
+}
+
+func (c *conn) Read(b []byte) (n int, err error) {
+	return 0, io.EOF
+}
+
+func (c *conn) Write(b []byte) (n int, err error) {
+	return 0, io.ErrClosedPipe
+}
+
+func (c *conn) LocalAddr() net.Addr {
+	return &net.TCPAddr{}
+}
+
+func (c *conn) RemoteAddr() net.Addr {
+	return &net.TCPAddr{}
+}
+
+func (c *conn) SetDeadline(t time.Time) error {
+	return nil
+}
+
+func (c *conn) SetReadDeadline(t time.Time) error {
+	return nil
+}
+
+func (c *conn) SetWriteDeadline(t time.Time) error {
+	return nil
+}

go-gost/x/connector/direct/connector.go

@@ -0,0 +1,71 @@
+package direct
+
+import (
+	"context"
+	"net"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("direct", NewConnector)
+	registry.ConnectorRegistry().Register("virtual", NewConnector)
+}
+
+type directConnector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &directConnector{
+		options: options,
+	}
+}
+
+func (c *directConnector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *directConnector) Connect(ctx context.Context, _ net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	var cOpts connector.ConnectOptions
+	for _, opt := range opts {
+		opt(&cOpts)
+	}
+
+	if c.md.action == "reject" {
+		return &conn{}, nil
+	}
+
+	conn, err := cOpts.Dialer.Dial(ctx, network, address)
+	if err != nil {
+		return nil, err
+	}
+
+	var localAddr, remoteAddr string
+	if addr := conn.LocalAddr(); addr != nil {
+		localAddr = addr.String()
+	}
+	if addr := conn.RemoteAddr(); addr != nil {
+		remoteAddr = addr.String()
+	}
+
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  remoteAddr,
+		"local":   localAddr,
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	return conn, nil
+}

go-gost/x/connector/direct/metadata.go

@@ -0,0 +1,17 @@
+package direct
+
+import (
+	"strings"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	action string
+}
+
+func (c *directConnector) parseMetadata(md mdata.Metadata) (err error) {
+	c.md.action = strings.ToLower(mdutil.GetString(md, "action"))
+	return
+}

go-gost/x/connector/forward/connector.go

@@ -0,0 +1,47 @@
+package forward
+
+import (
+	"context"
+	"net"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("forward", NewConnector)
+}
+
+type forwardConnector struct {
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &forwardConnector{
+		options: options,
+	}
+}
+
+func (c *forwardConnector) Init(md md.Metadata) (err error) {
+	return nil
+}
+
+func (c *forwardConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	return conn, nil
+}

go-gost/x/connector/http/connector.go

@@ -0,0 +1,131 @@
+package http
+
+import (
+	"bufio"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/socks"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("http", NewConnector)
+}
+
+type httpConnector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &httpConnector{
+		options: options,
+	}
+}
+
+func (c *httpConnector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *httpConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"local":   conn.LocalAddr().String(),
+		"remote":  conn.RemoteAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	req := &http.Request{
+		Method:     http.MethodConnect,
+		URL:        &url.URL{Host: address},
+		Host:       address,
+		ProtoMajor: 1,
+		ProtoMinor: 1,
+		Header:     c.md.header,
+	}
+
+	if req.Header == nil {
+		req.Header = http.Header{}
+	}
+	req.Header.Set("Proxy-Connection", "keep-alive")
+
+	if user := c.options.Auth; user != nil {
+		u := user.Username()
+		p, _ := user.Password()
+		req.Header.Set("Proxy-Authorization",
+			"Basic "+base64.StdEncoding.EncodeToString([]byte(u+":"+p)))
+	}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		if _, ok := conn.(net.PacketConn); ok {
+			err := fmt.Errorf("tcp over udp is unsupported")
+			log.Error(err)
+			return nil, err
+		}
+	case "udp", "udp4", "udp6":
+		req.Header.Set("X-Gost-Protocol", "udp")
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpRequest(req, false)
+		log.Trace(string(dump))
+	}
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	req = req.WithContext(ctx)
+	if err := req.Write(conn); err != nil {
+		return nil, err
+	}
+
+	resp, err := http.ReadResponse(bufio.NewReader(conn), req)
+	if err != nil {
+		return nil, err
+	}
+	// NOTE: the server may return `Transfer-Encoding: chunked` header,
+	// then the Content-Length of response will be unknown (-1),
+	// in this case, close body will be blocked, so we leave it untouched.
+	// defer resp.Body.Close()
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("%s", resp.Status)
+	}
+
+	if network == "udp" {
+		addr, _ := net.ResolveUDPAddr(network, address)
+		return socks.UDPTunClientConn(conn, addr), nil
+	}
+
+	return conn, nil
+}

go-gost/x/connector/http/metadata.go

@@ -0,0 +1,33 @@
+package http
+
+import (
+	"net/http"
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	connectTimeout time.Duration
+	header         http.Header
+}
+
+func (c *httpConnector) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		connectTimeout = "timeout"
+		header         = "header"
+	)
+
+	c.md.connectTimeout = mdutil.GetDuration(md, connectTimeout)
+
+	if mm := mdutil.GetStringMapString(md, header); len(mm) > 0 {
+		hd := http.Header{}
+		for k, v := range mm {
+			hd.Add(k, v)
+		}
+		c.md.header = hd
+	}
+
+	return
+}

go-gost/x/connector/http2/conn.go

@@ -0,0 +1,54 @@
+package http2
+
+import (
+	"errors"
+	"io"
+	"net"
+	"time"
+)
+
+// HTTP2 connection, wrapped up just like a net.Conn.
+type http2Conn struct {
+	r          io.Reader
+	w          io.Writer
+	remoteAddr net.Addr
+	localAddr  net.Addr
+}
+
+func (c *http2Conn) Read(b []byte) (n int, err error) {
+	return c.r.Read(b)
+}
+
+func (c *http2Conn) Write(b []byte) (n int, err error) {
+	return c.w.Write(b)
+}
+
+func (c *http2Conn) Close() (err error) {
+	if r, ok := c.r.(io.Closer); ok {
+		err = r.Close()
+	}
+	if w, ok := c.w.(io.Closer); ok {
+		err = w.Close()
+	}
+	return
+}
+
+func (c *http2Conn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *http2Conn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+func (c *http2Conn) SetDeadline(t time.Time) error {
+	return &net.OpError{Op: "set", Net: "http2", Source: nil, Addr: nil, Err: errors.New("deadline not supported")}
+}
+
+func (c *http2Conn) SetReadDeadline(t time.Time) error {
+	return &net.OpError{Op: "set", Net: "http2", Source: nil, Addr: nil, Err: errors.New("deadline not supported")}
+}
+
+func (c *http2Conn) SetWriteDeadline(t time.Time) error {
+	return &net.OpError{Op: "set", Net: "http2", Source: nil, Addr: nil, Err: errors.New("deadline not supported")}
+}

go-gost/x/connector/http2/connector.go

@@ -0,0 +1,123 @@
+package http2
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("http2", NewConnector)
+}
+
+type http2Connector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &http2Connector{
+		options: options,
+	}
+}
+
+func (c *http2Connector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *http2Connector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"local":   conn.LocalAddr().String(),
+		"remote":  conn.RemoteAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	v, _ := conn.(md.Metadatable)
+	if v == nil {
+		err := errors.New("http2: wrong connection type")
+		log.Error(err)
+		return nil, err
+	}
+
+	pr, pw := io.Pipe()
+	req := &http.Request{
+		Method:     http.MethodConnect,
+		URL:        &url.URL{Scheme: "https", Host: conn.RemoteAddr().String()},
+		Host:       address,
+		ProtoMajor: 2,
+		ProtoMinor: 0,
+		Header:     c.md.header,
+		Body:       pr,
+		// ContentLength: -1,
+	}
+	if req.Header == nil {
+		req.Header = make(http.Header)
+	}
+
+	if user := c.options.Auth; user != nil {
+		u := user.Username()
+		p, _ := user.Password()
+		req.Header.Set("Proxy-Authorization",
+			"Basic "+base64.StdEncoding.EncodeToString([]byte(u+":"+p)))
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpRequest(req, false)
+		log.Trace(string(dump))
+	}
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	client := v.Metadata().Get("client").(*http.Client)
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Error(err)
+		conn.Close()
+		return nil, err
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		err = fmt.Errorf("%s", resp.Status)
+		log.Error(err)
+		return nil, err
+	}
+
+	hc := &http2Conn{
+		r:         resp.Body,
+		w:         pw,
+		localAddr: conn.RemoteAddr(),
+	}
+
+	hc.remoteAddr, _ = net.ResolveTCPAddr(network, address)
+
+	return hc, nil
+}

go-gost/x/connector/http2/metadata.go

@@ -0,0 +1,31 @@
+package http2
+
+import (
+	"net/http"
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	connectTimeout time.Duration
+	header         http.Header
+}
+
+func (c *http2Connector) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		connectTimeout = "timeout"
+		header         = "header"
+	)
+
+	c.md.connectTimeout = mdutil.GetDuration(md, connectTimeout)
+	if mm := mdutil.GetStringMapString(md, header); len(mm) > 0 {
+		hd := http.Header{}
+		for k, v := range mm {
+			hd.Add(k, v)
+		}
+		c.md.header = hd
+	}
+	return
+}

go-gost/x/connector/relay/bind.go

@@ -0,0 +1,145 @@
+package relay
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/relay"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/mux"
+	relay_util "github.com/go-gost/x/internal/util/relay"
+)
+
+// Bind implements connector.Binder.
+func (c *relayConnector) Bind(ctx context.Context, conn net.Conn, network, address string, opts ...connector.BindOption) (net.Listener, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"network": network,
+		"address": address,
+	})
+	log.Debugf("bind on %s/%s", address, network)
+
+	options := connector.BindOptions{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		return c.bindTCP(ctx, conn, network, address, log)
+	case "udp", "udp4", "udp6":
+		return c.bindUDP(ctx, conn, network, address, &options, log)
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+}
+
+func (c *relayConnector) bindTCP(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) (net.Listener, error) {
+	laddr, err := c.bind(conn, relay.CmdBind, network, address)
+	if err != nil {
+		return nil, err
+	}
+	log.Debugf("bind on %s/%s OK", laddr, laddr.Network())
+
+	session, err := mux.ServerSession(conn, c.md.muxCfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &bindListener{
+		addr:    laddr,
+		session: session,
+		logger:  log,
+	}, nil
+}
+
+func (c *relayConnector) bindUDP(ctx context.Context, conn net.Conn, network, address string, opts *connector.BindOptions, log logger.Logger) (net.Listener, error) {
+	laddr, err := c.bind(conn, relay.FUDP|relay.CmdBind, network, address)
+	if err != nil {
+		return nil, err
+	}
+	log.Debugf("bind on %s/%s OK", laddr, laddr.Network())
+
+	ln := udp.NewListener(
+		relay_util.UDPTunClientPacketConn(conn),
+		&udp.ListenConfig{
+			Addr:           laddr,
+			Backlog:        opts.Backlog,
+			ReadQueueSize:  opts.UDPDataQueueSize,
+			ReadBufferSize: opts.UDPDataBufferSize,
+			TTL:            opts.UDPConnTTL,
+			Keepalive:      true,
+			Logger:         log,
+		})
+
+	return ln, nil
+}
+
+func (c *relayConnector) bind(conn net.Conn, cmd relay.CmdType, network, address string) (net.Addr, error) {
+	req := relay.Request{
+		Version: relay.Version1,
+		Cmd:     cmd,
+	}
+
+	if c.options.Auth != nil {
+		pwd, _ := c.options.Auth.Password()
+		req.Features = append(req.Features, &relay.UserAuthFeature{
+			Username: c.options.Auth.Username(),
+			Password: pwd,
+		})
+	}
+
+	nid := relay.NetworkTCP
+	if network == "udp" || network == "udp4" || network == "udp6" {
+		nid = relay.NetworkUDP
+	}
+	req.Features = append(req.Features, &relay.NetworkFeature{
+		Network: nid,
+	})
+	fa := &relay.AddrFeature{}
+	fa.ParseFrom(address)
+	req.Features = append(req.Features, fa)
+	if _, err := req.WriteTo(conn); err != nil {
+		return nil, err
+	}
+
+	// first reply, bind status
+	resp := relay.Response{}
+	if _, err := resp.ReadFrom(conn); err != nil {
+		return nil, err
+	}
+
+	if resp.Status != relay.StatusOK {
+		return nil, fmt.Errorf("bind on %s/%s failed", address, network)
+	}
+
+	var addr string
+	for _, f := range resp.Features {
+		if f.Type() == relay.FeatureAddr {
+			if fa, ok := f.(*relay.AddrFeature); ok {
+				addr = net.JoinHostPort(fa.Host, strconv.Itoa(int(fa.Port)))
+			}
+		}
+	}
+
+	var baddr net.Addr
+	var err error
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		baddr, err = net.ResolveTCPAddr(network, addr)
+	case "udp", "udp4", "udp6":
+		baddr, err = net.ResolveUDPAddr(network, addr)
+	default:
+		err = fmt.Errorf("unknown network %s", network)
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	return baddr, nil
+}

go-gost/x/connector/relay/conn.go

@@ -0,0 +1,225 @@
+package relay
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"sync"
+
+	"github.com/go-gost/core/common/bufpool"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	xrelay "github.com/go-gost/x/internal/util/relay"
+)
+
+type tcpConn struct {
+	net.Conn
+	wbuf *bytes.Buffer
+	once sync.Once
+	mu   sync.Mutex
+}
+
+func (c *tcpConn) Read(b []byte) (n int, err error) {
+	c.once.Do(func() {
+		if c.wbuf != nil {
+			err = readResponse(c.Conn)
+		}
+	})
+
+	if err != nil {
+		return
+	}
+	return c.Conn.Read(b)
+}
+
+func (c *tcpConn) Write(b []byte) (n int, err error) {
+	n = len(b) // force byte length consistent
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.wbuf != nil && c.wbuf.Len() > 0 {
+		c.wbuf.Write(b) // append the data to the cached header
+		_, err = c.Conn.Write(c.wbuf.Bytes())
+		c.wbuf.Reset()
+		return
+	}
+	_, err = c.Conn.Write(b)
+	return
+}
+
+type udpConn struct {
+	net.Conn
+	wbuf *bytes.Buffer
+	once sync.Once
+	mu   sync.Mutex
+}
+
+func (c *udpConn) Read(b []byte) (n int, err error) {
+	c.once.Do(func() {
+		if c.wbuf != nil {
+			err = readResponse(c.Conn)
+		}
+	})
+	if err != nil {
+		return
+	}
+
+	var bb [2]byte
+	_, err = io.ReadFull(c.Conn, bb[:])
+	if err != nil {
+		return
+	}
+
+	dlen := int(binary.BigEndian.Uint16(bb[:]))
+	if len(b) >= dlen {
+		return io.ReadFull(c.Conn, b[:dlen])
+	}
+
+	buf := bufpool.Get(dlen)
+	defer bufpool.Put(buf)
+	_, err = io.ReadFull(c.Conn, buf)
+	n = copy(b, buf)
+
+	return
+}
+
+func (c *udpConn) Write(b []byte) (n int, err error) {
+	if len(b) > math.MaxUint16 {
+		err = errors.New("write: data maximum exceeded")
+		return
+	}
+
+	n = len(b)
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.wbuf != nil && c.wbuf.Len() > 0 {
+		var bb [2]byte
+		binary.BigEndian.PutUint16(bb[:], uint16(len(b)))
+		c.wbuf.Write(bb[:])
+		c.wbuf.Write(b) // append the data to the cached header
+		_, err = c.wbuf.WriteTo(c.Conn)
+		return
+	}
+
+	var bb [2]byte
+	binary.BigEndian.PutUint16(bb[:], uint16(len(b)))
+	_, err = c.Conn.Write(bb[:])
+	if err != nil {
+		return
+	}
+	return c.Conn.Write(b)
+}
+
+func readResponse(r io.Reader) (err error) {
+	resp := relay.Response{}
+	_, err = resp.ReadFrom(r)
+	if err != nil {
+		return
+	}
+
+	if resp.Version != relay.Version1 {
+		err = relay.ErrBadVersion
+		return
+	}
+
+	if resp.Status != relay.StatusOK {
+		err = fmt.Errorf("%d %s", resp.Status, xrelay.StatusText(resp.Status))
+		return
+	}
+	return nil
+}
+
+type bindConn struct {
+	net.Conn
+	localAddr  net.Addr
+	remoteAddr net.Addr
+	md         mdata.Metadata
+}
+
+func (c *bindConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *bindConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+// Metadata implements metadata.Metadatable interface.
+func (c *bindConn) Metadata() mdata.Metadata {
+	return c.md
+}
+
+type bindUDPConn struct {
+	net.Conn
+	localAddr  net.Addr
+	remoteAddr net.Addr
+	md         mdata.Metadata
+}
+
+func (c *bindUDPConn) Read(b []byte) (n int, err error) {
+	// 2-byte data length header
+	var bh [2]byte
+	_, err = io.ReadFull(c.Conn, bh[:])
+	if err != nil {
+		return
+	}
+
+	dlen := int(binary.BigEndian.Uint16(bh[:]))
+	if len(b) >= dlen {
+		n, err = io.ReadFull(c.Conn, b[:dlen])
+		return
+	}
+
+	buf := bufpool.Get(dlen)
+	defer bufpool.Put(buf)
+
+	_, err = io.ReadFull(c.Conn, buf)
+	n = copy(b, buf)
+
+	return
+}
+
+func (c *bindUDPConn) Write(b []byte) (n int, err error) {
+	if len(b) > math.MaxUint16 {
+		err = errors.New("write: data maximum exceeded")
+		return
+	}
+
+	buf := bufpool.Get(len(b) + 2)
+	defer bufpool.Put(buf)
+
+	binary.BigEndian.PutUint16(buf[:2], uint16(len(b)))
+	n = copy(buf[2:], b)
+
+	return c.Conn.Write(buf)
+}
+
+func (c *bindUDPConn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
+	addr = c.remoteAddr
+	n, err = c.Read(b)
+	return
+}
+
+func (c *bindUDPConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
+	return c.Write(b)
+}
+
+func (c *bindUDPConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *bindUDPConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+// Metadata implements metadata.Metadatable interface.
+func (c *bindUDPConn) Metadata() mdata.Metadata {
+	return c.md
+}

go-gost/x/connector/relay/connector.go

@@ -0,0 +1,146 @@
+package relay
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	relay_util "github.com/go-gost/x/internal/util/relay"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("relay", NewConnector)
+}
+
+type relayConnector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &relayConnector{
+		options: options,
+	}
+}
+
+func (c *relayConnector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *relayConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	req := relay.Request{
+		Version: relay.Version1,
+		Cmd:     relay.CmdConnect,
+	}
+
+	switch network {
+	case "udp", "udp4", "udp6":
+		req.Cmd |= relay.FUDP
+		req.Features = append(req.Features, &relay.NetworkFeature{
+			Network: relay.NetworkUDP,
+		})
+
+		// UDP association
+		if address == "" {
+			baddr, err := c.bind(conn, relay.FUDP|relay.CmdBind, network, address)
+			if err != nil {
+				return nil, err
+			}
+			log.Debugf("associate on %s OK", baddr)
+
+			return relay_util.UDPTunClientConn(conn, nil), nil
+		}
+
+	case "unix":
+		req.Features = append(req.Features, &relay.NetworkFeature{
+			Network: relay.NetworkUnix,
+		})
+	case "serial":
+		req.Features = append(req.Features, &relay.NetworkFeature{
+			Network: relay.NetworkSerial,
+		})
+	}
+
+	if c.options.Auth != nil {
+		pwd, _ := c.options.Auth.Password()
+		req.Features = append(req.Features, &relay.UserAuthFeature{
+			Username: c.options.Auth.Username(),
+			Password: pwd,
+		})
+	}
+
+	if address != "" {
+		af := &relay.AddrFeature{}
+		if err := af.ParseFrom(address); err != nil {
+			return nil, err
+		}
+		req.Features = append(req.Features, af)
+	}
+
+	if c.md.noDelay {
+		if _, err := req.WriteTo(conn); err != nil {
+			return nil, err
+		}
+		// drain the response
+		if err := readResponse(conn); err != nil {
+			return nil, err
+		}
+	}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6", "unix", "serial":
+		if !c.md.noDelay {
+			cc := &tcpConn{
+				Conn: conn,
+				wbuf: &bytes.Buffer{},
+			}
+			if _, err := req.WriteTo(cc.wbuf); err != nil {
+				return nil, err
+			}
+			conn = cc
+		}
+	case "udp", "udp4", "udp6":
+		cc := &udpConn{
+			Conn: conn,
+		}
+		if !c.md.noDelay {
+			cc.wbuf = &bytes.Buffer{}
+			if _, err := req.WriteTo(cc.wbuf); err != nil {
+				return nil, err
+			}
+		}
+		conn = cc
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	return conn, nil
+}

go-gost/x/connector/relay/listener.go

@@ -0,0 +1,99 @@
+package relay
+
+import (
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/go-gost/core/logger"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	"github.com/go-gost/x/internal/util/mux"
+	mdx "github.com/go-gost/x/metadata"
+)
+
+type bindListener struct {
+	network string
+	addr    net.Addr
+	session *mux.Session
+	logger  logger.Logger
+}
+
+func (p *bindListener) Accept() (net.Conn, error) {
+	cc, err := p.session.Accept()
+	if err != nil {
+		return nil, err
+	}
+
+	conn, err := p.getPeerConn(cc)
+	if err != nil {
+		cc.Close()
+		p.logger.Errorf("get peer failed: %s", err)
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+func (p *bindListener) getPeerConn(conn net.Conn) (net.Conn, error) {
+	// second reply, peer connected
+	resp := relay.Response{}
+	if _, err := resp.ReadFrom(conn); err != nil {
+		return nil, err
+	}
+
+	if resp.Status != relay.StatusOK {
+		err := fmt.Errorf("peer connect failed")
+		return nil, err
+	}
+
+	var address, host string
+	// the first addr is the client address, the optional second addr is the target host address.
+	for _, f := range resp.Features {
+		if f.Type() == relay.FeatureAddr {
+			if fa, ok := f.(*relay.AddrFeature); ok {
+				v := net.JoinHostPort(fa.Host, strconv.Itoa(int(fa.Port)))
+				if address != "" {
+					host = v
+				} else {
+					address = v
+				}
+			}
+		}
+	}
+
+	raddr, err := net.ResolveTCPAddr("tcp", address)
+	if err != nil {
+		return nil, err
+	}
+
+	var md mdata.Metadata
+	if host != "" {
+		md = mdx.NewMetadata(map[string]any{"host": host})
+	}
+
+	if p.network == "udp" {
+		return &bindUDPConn{
+			Conn:       conn,
+			localAddr:  p.addr,
+			remoteAddr: raddr,
+			md:         md,
+		}, nil
+	}
+
+	cn := &bindConn{
+		Conn:       conn,
+		localAddr:  p.addr,
+		remoteAddr: raddr,
+		md:         md,
+	}
+	return cn, nil
+}
+
+func (p *bindListener) Addr() net.Addr {
+	return p.addr
+}
+
+func (p *bindListener) Close() error {
+	return p.session.Close()
+}

go-gost/x/connector/relay/metadata.go

@@ -0,0 +1,37 @@
+package relay
+
+import (
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/internal/util/mux"
+)
+
+type metadata struct {
+	connectTimeout time.Duration
+	noDelay        bool
+	muxCfg         *mux.Config
+}
+
+func (c *relayConnector) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		connectTimeout = "connectTimeout"
+		noDelay        = "nodelay"
+	)
+
+	c.md.connectTimeout = mdutil.GetDuration(md, connectTimeout)
+	c.md.noDelay = mdutil.GetBool(md, noDelay)
+
+	c.md.muxCfg = &mux.Config{
+		Version:           mdutil.GetInt(md, "mux.version"),
+		KeepAliveInterval: mdutil.GetDuration(md, "mux.keepaliveInterval"),
+		KeepAliveDisabled: mdutil.GetBool(md, "mux.keepaliveDisabled"),
+		KeepAliveTimeout:  mdutil.GetDuration(md, "mux.keepaliveTimeout"),
+		MaxFrameSize:      mdutil.GetInt(md, "mux.maxFrameSize"),
+		MaxReceiveBuffer:  mdutil.GetInt(md, "mux.maxReceiveBuffer"),
+		MaxStreamBuffer:   mdutil.GetInt(md, "mux.maxStreamBuffer"),
+	}
+
+	return
+}

go-gost/x/connector/router/conn.go

@@ -0,0 +1,73 @@
+package tunnel
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+
+	"github.com/go-gost/core/common/bufpool"
+	"github.com/go-gost/relay"
+	xrelay "github.com/go-gost/x/internal/util/relay"
+)
+
+type packetConn struct {
+	net.Conn
+}
+
+func (c *packetConn) Read(b []byte) (n int, err error) {
+	var bb [2]byte
+	_, err = io.ReadFull(c.Conn, bb[:])
+	if err != nil {
+		return
+	}
+
+	dlen := int(binary.BigEndian.Uint16(bb[:]))
+	if len(b) >= dlen {
+		return io.ReadFull(c.Conn, b[:dlen])
+	}
+
+	buf := bufpool.Get(dlen)
+	defer bufpool.Put(buf)
+
+	n, err = io.ReadFull(c.Conn, buf)
+	copy(b, buf[:n])
+
+	return
+}
+
+func (c *packetConn) Write(b []byte) (n int, err error) {
+	if len(b) > math.MaxUint16 {
+		err = errors.New("write: data maximum exceeded")
+		return
+	}
+
+	buf := bufpool.Get(len(b) + 2)
+	defer bufpool.Put(buf)
+
+	binary.BigEndian.PutUint16(buf[:2], uint16(len(b)))
+	n = copy(buf[2:], b)
+
+	return c.Conn.Write(buf)
+}
+
+func readResponse(r io.Reader) (err error) {
+	resp := relay.Response{}
+	_, err = resp.ReadFrom(r)
+	if err != nil {
+		return
+	}
+
+	if resp.Version != relay.Version1 {
+		err = relay.ErrBadVersion
+		return
+	}
+
+	if resp.Status != relay.StatusOK {
+		err = fmt.Errorf("%d %s", resp.Status, xrelay.StatusText(resp.Status))
+		return
+	}
+	return nil
+}

go-gost/x/connector/router/connector.go

@@ -0,0 +1,120 @@
+package tunnel
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("router", NewConnector)
+}
+
+type routerConnector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &routerConnector{
+		options: options,
+	}
+}
+
+func (c *routerConnector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *routerConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	req := relay.Request{
+		Version: relay.Version1,
+		Cmd:     relay.CmdAssociate,
+	}
+
+	if c.options.Auth != nil {
+		pwd, _ := c.options.Auth.Password()
+		req.Features = append(req.Features, &relay.UserAuthFeature{
+			Username: c.options.Auth.Username(),
+			Password: pwd,
+		})
+	}
+
+	switch network {
+	case "udp":
+		req.Features = append(req.Features, &relay.NetworkFeature{
+			Network: relay.NetworkUDP,
+		})
+
+	case "ip":
+		req.Features = append(req.Features, &relay.NetworkFeature{
+			Network: relay.NetworkIP,
+		})
+	}
+
+	srcAddr := conn.LocalAddr().String()
+	if v := ctxvalue.ClientAddrFromContext(ctx); v != "" {
+		srcAddr = string(v)
+	}
+
+	af := &relay.AddrFeature{}
+	af.ParseFrom(srcAddr)
+	req.Features = append(req.Features, af) // src address
+
+	af = &relay.AddrFeature{}
+	af.ParseFrom(address)
+	req.Features = append(req.Features, af) // dst address
+
+	if !c.md.routerID.IsZero() {
+		req.Features = append(req.Features, &relay.TunnelFeature{
+			ID: c.md.routerID,
+		})
+	}
+
+	if _, err := req.WriteTo(conn); err != nil {
+		return nil, err
+	}
+	// drain the response
+	if err := readResponse(conn); err != nil {
+		return nil, err
+	}
+
+	switch network {
+	case "udp", "ip":
+		conn = &packetConn{
+			Conn: conn,
+		}
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	log.Debugf("connect to router %s@%s OK", address, c.md.routerID)
+	return conn, nil
+}

go-gost/x/connector/router/metadata.go

@@ -0,0 +1,34 @@
+package tunnel
+
+import (
+	"errors"
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/google/uuid"
+)
+
+var (
+	ErrInvalidRouterID = errors.New("router: invalid router ID")
+)
+
+type metadata struct {
+	connectTimeout time.Duration
+	routerID       relay.TunnelID
+}
+
+func (c *routerConnector) parseMetadata(md mdata.Metadata) (err error) {
+	c.md.connectTimeout = mdutil.GetDuration(md, "connectTimeout")
+
+	if s := mdutil.GetString(md, "router.id"); s != "" {
+		uuid, err := uuid.Parse(s)
+		if err != nil {
+			return err
+		}
+		c.md.routerID = relay.NewTunnelID(uuid[:])
+	}
+
+	return
+}

go-gost/x/connector/serial/connector.go

@@ -0,0 +1,47 @@
+package serial
+
+import (
+	"context"
+	"net"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("serial", NewConnector)
+}
+
+type serialConnector struct {
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &serialConnector{
+		options: options,
+	}
+}
+
+func (c *serialConnector) Init(md md.Metadata) (err error) {
+	return nil
+}
+
+func (c *serialConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	return conn, nil
+}

go-gost/x/connector/sni/conn.go

@@ -0,0 +1,128 @@
+package sni
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/base64"
+	"encoding/binary"
+	"hash/crc32"
+	"io"
+	"net"
+	"strings"
+
+	dissector "github.com/go-gost/tls-dissector"
+)
+
+type sniClientConn struct {
+	host       string
+	obfuscated bool
+	net.Conn
+}
+
+func (c *sniClientConn) Write(p []byte) (int, error) {
+	b, err := c.obfuscate(p)
+	if err != nil {
+		return 0, err
+	}
+	if _, err = c.Conn.Write(b); err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+func (c *sniClientConn) obfuscate(p []byte) ([]byte, error) {
+	if c.host == "" {
+		return p, nil
+	}
+
+	if c.obfuscated {
+		return p, nil
+	}
+
+	if p[0] == dissector.Handshake {
+		b, err := readClientHelloRecord(bytes.NewReader(p), c.host)
+		if err != nil {
+			return nil, err
+		}
+		c.obfuscated = true
+		return b, nil
+	}
+
+	buf := &bytes.Buffer{}
+	br := bufio.NewReader(bytes.NewReader(p))
+	for {
+		s, err := br.ReadString('\n')
+		if err != nil {
+			if err != io.EOF {
+				return nil, err
+			}
+			if s != "" {
+				buf.Write([]byte(s))
+			}
+			break
+		}
+
+		// end of HTTP header
+		if s == "\r\n" {
+			buf.Write([]byte(s))
+			// drain the remain bytes.
+			io.Copy(buf, br)
+			break
+		}
+
+		if strings.HasPrefix(s, "Host") {
+			s = strings.TrimSpace(strings.TrimSuffix(strings.TrimPrefix(s, "Host:"), "\r\n"))
+			host := encodeServerName(s)
+			buf.WriteString("Host: " + c.host + "\r\n")
+			buf.WriteString("Gost-Target: " + host + "\r\n")
+			// drain the remain bytes.
+			io.Copy(buf, br)
+			break
+		}
+		buf.Write([]byte(s))
+	}
+	c.obfuscated = true
+	return buf.Bytes(), nil
+}
+
+func readClientHelloRecord(r io.Reader, host string) ([]byte, error) {
+	record, err := dissector.ReadRecord(r)
+	if err != nil {
+		return nil, err
+	}
+	clientHello := dissector.ClientHelloMsg{}
+	if err := clientHello.Decode(record.Opaque); err != nil {
+		return nil, err
+	}
+
+	for _, ext := range clientHello.Extensions {
+		if ext.Type() == dissector.ExtServerName {
+			snExtension := ext.(*dissector.ServerNameExtension)
+			if host != "" {
+				e, _ := dissector.NewExtension(0xFFFE, []byte(encodeServerName(snExtension.Name)))
+				clientHello.Extensions = append(clientHello.Extensions, e)
+				snExtension.Name = host
+			}
+
+			break
+		}
+	}
+	record.Opaque, err = clientHello.Encode()
+	if err != nil {
+		return nil, err
+	}
+
+	buf := &bytes.Buffer{}
+	if _, err := record.WriteTo(buf); err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+func encodeServerName(name string) string {
+	buf := &bytes.Buffer{}
+	binary.Write(buf, binary.BigEndian, crc32.ChecksumIEEE([]byte(name)))
+	buf.WriteString(base64.RawURLEncoding.EncodeToString([]byte(name)))
+	return base64.RawURLEncoding.EncodeToString(buf.Bytes())
+}

go-gost/x/connector/sni/connector.go

@@ -0,0 +1,48 @@
+package sni
+
+import (
+	"context"
+	"net"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("sni", NewConnector)
+}
+
+type sniConnector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &sniConnector{
+		options: options,
+	}
+}
+
+func (c *sniConnector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *sniConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	return &sniClientConn{Conn: conn, host: c.md.host}, nil
+}

go-gost/x/connector/sni/metadata.go

@@ -0,0 +1,25 @@
+package sni
+
+import (
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	host           string
+	connectTimeout time.Duration
+}
+
+func (c *sniConnector) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		host           = "host"
+		connectTimeout = "timeout"
+	)
+
+	c.md.host = mdutil.GetString(md, host)
+	c.md.connectTimeout = mdutil.GetDuration(md, connectTimeout)
+
+	return
+}

go-gost/x/connector/socks/v4/connector.go

@@ -0,0 +1,125 @@
+package v4
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/gosocks4"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("socks4", NewConnector)
+	registry.ConnectorRegistry().Register("socks4a", NewConnector)
+}
+
+type socks4Connector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &socks4Connector{
+		options: options,
+	}
+}
+
+func (c *socks4Connector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *socks4Connector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		if _, ok := conn.(net.PacketConn); ok {
+			err := fmt.Errorf("tcp over udp is unsupported")
+			log.Error(err)
+			return nil, err
+		}
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	var addr *gosocks4.Addr
+
+	if c.md.disable4a {
+		taddr, err := net.ResolveTCPAddr("tcp4", address)
+		if err != nil {
+			log.Error("resolve: ", err)
+			return nil, err
+		}
+		if len(taddr.IP) == 0 {
+			taddr.IP = net.IPv4zero
+		}
+		addr = &gosocks4.Addr{
+			Type: gosocks4.AddrIPv4,
+			Host: taddr.IP.String(),
+			Port: uint16(taddr.Port),
+		}
+	} else {
+		host, port, err := net.SplitHostPort(address)
+		if err != nil {
+			return nil, err
+		}
+		p, _ := strconv.Atoi(port)
+		addr = &gosocks4.Addr{
+			Type: gosocks4.AddrDomain,
+			Host: host,
+			Port: uint16(p),
+		}
+	}
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	var userid []byte
+	if c.options.Auth != nil {
+		userid = []byte(c.options.Auth.Username())
+	}
+	req := gosocks4.NewRequest(gosocks4.CmdConnect, addr, userid)
+	log.Trace(req)
+	if err := req.Write(conn); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	reply, err := gosocks4.ReadReply(conn)
+	if err != nil {
+		log.Error(err)
+		return nil, err
+	}
+	log.Trace(reply)
+
+	if reply.Code != gosocks4.Granted {
+		err = errors.New("host unreachable")
+		log.Error(err)
+		return nil, err
+	}
+
+	return conn, nil
+}

go-gost/x/connector/socks/v4/metadata.go

@@ -0,0 +1,25 @@
+package v4
+
+import (
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	connectTimeout time.Duration
+	disable4a      bool
+}
+
+func (c *socks4Connector) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		connectTimeout = "timeout"
+		disable4a      = "disable4a"
+	)
+
+	c.md.connectTimeout = mdutil.GetDuration(md, connectTimeout)
+	c.md.disable4a = mdutil.GetBool(md, disable4a)
+
+	return
+}

go-gost/x/connector/socks/v5/bind.go

@@ -0,0 +1,132 @@
+package v5
+
+import (
+	"context"
+	"fmt"
+	"net"
+
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/gosocks5"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/mux"
+	"github.com/go-gost/x/internal/util/socks"
+)
+
+// Bind implements connector.Binder.
+func (c *socks5Connector) Bind(ctx context.Context, conn net.Conn, network, address string, opts ...connector.BindOption) (net.Listener, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+	})
+	log.Debugf("bind on %s/%s", address, network)
+
+	options := connector.BindOptions{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		if options.Mux {
+			return c.muxBindTCP(ctx, conn, network, address, log)
+		}
+		return c.bindTCP(ctx, conn, network, address, log)
+	case "udp", "udp4", "udp6":
+		return c.bindUDP(ctx, conn, network, address, &options, log)
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+}
+
+func (c *socks5Connector) bindTCP(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) (net.Listener, error) {
+	laddr, err := c.bind(conn, gosocks5.CmdBind, network, address, log)
+	if err != nil {
+		return nil, err
+	}
+
+	return &tcpListener{
+		addr:   laddr,
+		conn:   conn,
+		logger: log,
+	}, nil
+}
+
+func (c *socks5Connector) muxBindTCP(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) (net.Listener, error) {
+	laddr, err := c.bind(conn, socks.CmdMuxBind, network, address, log)
+	if err != nil {
+		return nil, err
+	}
+
+	session, err := mux.ServerSession(conn, c.md.muxCfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &tcpMuxListener{
+		addr:    laddr,
+		session: session,
+		logger:  log,
+	}, nil
+}
+
+func (c *socks5Connector) bindUDP(ctx context.Context, conn net.Conn, network, address string, opts *connector.BindOptions, log logger.Logger) (net.Listener, error) {
+	laddr, err := c.bind(conn, socks.CmdUDPTun, network, address, log)
+	if err != nil {
+		return nil, err
+	}
+
+	ln := udp.NewListener(socks.UDPTunClientPacketConn(conn),
+		&udp.ListenConfig{
+			Addr:           laddr,
+			Backlog:        opts.Backlog,
+			ReadQueueSize:  opts.UDPDataQueueSize,
+			ReadBufferSize: opts.UDPDataBufferSize,
+			TTL:            opts.UDPConnTTL,
+			Keepalive:      true,
+			Logger:         log,
+		})
+
+	return ln, nil
+}
+
+func (l *socks5Connector) bind(conn net.Conn, cmd uint8, network, address string, log logger.Logger) (net.Addr, error) {
+	addr := gosocks5.Addr{}
+	addr.ParseFrom(address)
+	req := gosocks5.NewRequest(cmd, &addr)
+	log.Trace(req)
+	if err := req.Write(conn); err != nil {
+		return nil, err
+	}
+
+	// first reply, bind status
+	reply, err := gosocks5.ReadReply(conn)
+	if err != nil {
+		return nil, err
+	}
+	log.Trace(reply)
+
+	if reply.Rep != gosocks5.Succeeded {
+		return nil, fmt.Errorf("bind on %s/%s failed", address, network)
+	}
+
+	var baddr net.Addr
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		baddr, err = net.ResolveTCPAddr(network, reply.Addr.String())
+	case "udp", "udp4", "udp6":
+		baddr, err = net.ResolveUDPAddr(network, reply.Addr.String())
+	default:
+		err = fmt.Errorf("unknown network %s", network)
+	}
+	if err != nil {
+		return nil, err
+	}
+	log.Debugf("bind on %s/%s OK", baddr, baddr.Network())
+
+	return baddr, nil
+}

go-gost/x/connector/socks/v5/conn.go

@@ -0,0 +1,129 @@
+package v5
+
+import (
+	"bytes"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/common/bufpool"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/gosocks5"
+)
+
+type bindConn struct {
+	net.Conn
+	localAddr  net.Addr
+	remoteAddr net.Addr
+}
+
+func (c *bindConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *bindConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+type udpRelayConn struct {
+	udpConn    *net.UDPConn
+	tcpConn    net.Conn
+	taddr      net.Addr
+	bufferSize int
+	logger     logger.Logger
+}
+
+func (c *udpRelayConn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
+	buf := bufpool.Get(c.bufferSize)
+	defer bufpool.Put(buf)
+
+	nn, err := c.udpConn.Read(buf)
+	if err != nil {
+		return
+	}
+
+	socksAddr := gosocks5.Addr{}
+	header := gosocks5.UDPHeader{
+		Addr: &socksAddr,
+	}
+	dgram := gosocks5.UDPDatagram{
+		Header: &header,
+	}
+	_, err = dgram.ReadFrom(bytes.NewReader(buf[:nn]))
+	if err != nil {
+		return
+	}
+
+	n = copy(b, dgram.Data)
+	addr, err = net.ResolveUDPAddr("udp", header.Addr.String())
+
+	return
+}
+
+func (c *udpRelayConn) Read(b []byte) (n int, err error) {
+	n, _, err = c.ReadFrom(b)
+	return
+}
+
+func (c *udpRelayConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
+	socksAddr := gosocks5.Addr{}
+	if err = socksAddr.ParseFrom(addr.String()); err != nil {
+		return
+	}
+	if socksAddr.Host == "" {
+		socksAddr.Type = gosocks5.AddrIPv4
+		socksAddr.Host = "127.0.0.1"
+	}
+
+	header := gosocks5.UDPHeader{
+		Addr: &socksAddr,
+	}
+	dgram := gosocks5.UDPDatagram{
+		Header: &header,
+		Data:   b,
+	}
+
+	buf := bufpool.Get(c.bufferSize)
+	defer bufpool.Put(buf)
+
+	nn, err := dgram.WriteTo(bytes.NewBuffer(buf[:0]))
+	if err != nil {
+		return
+	}
+	if nn > int64(len(buf)) {
+		nn = int64(len(buf))
+	}
+
+	_, err = c.udpConn.Write(buf[:nn])
+	n = len(b)
+
+	return
+}
+
+func (c *udpRelayConn) Write(b []byte) (n int, err error) {
+	return c.WriteTo(b, c.taddr)
+}
+
+func (c *udpRelayConn) RemoteAddr() net.Addr {
+	return c.taddr
+}
+
+func (c *udpRelayConn) LocalAddr() net.Addr {
+	return c.udpConn.LocalAddr()
+}
+
+func (c *udpRelayConn) Close() error {
+	c.udpConn.Close()
+	return c.tcpConn.Close()
+}
+
+func (c *udpRelayConn) SetDeadline(t time.Time) error {
+	return c.udpConn.SetDeadline(t)
+}
+
+func (c *udpRelayConn) SetReadDeadline(t time.Time) error {
+	return c.udpConn.SetReadDeadline(t)
+}
+
+func (c *udpRelayConn) SetWriteDeadline(t time.Time) error {
+	return c.udpConn.SetWriteDeadline(t)
+}

go-gost/x/connector/socks/v5/connector.go

@@ -0,0 +1,234 @@
+package v5
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/socks"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("socks5", NewConnector)
+	registry.ConnectorRegistry().Register("socks", NewConnector)
+}
+
+type socks5Connector struct {
+	selector gosocks5.Selector
+	md       metadata
+	options  connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &socks5Connector{
+		options: options,
+	}
+}
+
+func (c *socks5Connector) Init(md md.Metadata) (err error) {
+	if err = c.parseMetadata(md); err != nil {
+		return
+	}
+
+	selector := &clientSelector{
+		methods: []uint8{
+			gosocks5.MethodNoAuth,
+		},
+		User:      c.options.Auth,
+		TLSConfig: c.options.TLSConfig,
+		logger:    c.options.Logger,
+	}
+	if selector.User != nil {
+		selector.methods = append(selector.methods, gosocks5.MethodUserPass)
+	}
+	if !c.md.noTLS {
+		selector.methods = append(selector.methods, socks.MethodTLS)
+		if selector.TLSConfig == nil {
+			selector.TLSConfig = &tls.Config{
+				InsecureSkipVerify: true,
+			}
+		}
+		if selector.User != nil {
+			selector.methods = append(selector.methods, socks.MethodTLSAuth)
+		}
+	}
+	c.selector = selector
+
+	return
+}
+
+// Handshake implements connector.Handshaker.
+func (c *socks5Connector) Handshake(ctx context.Context, conn net.Conn) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+	})
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	cc := gosocks5.ClientConn(conn, c.selector)
+	if err := cc.Handleshake(); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	return cc, nil
+}
+
+func (c *socks5Connector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	var cOpts connector.ConnectOptions
+	for _, opt := range opts {
+		opt(&cOpts)
+	}
+
+	switch network {
+	case "udp", "udp4", "udp6":
+		return c.connectUDP(ctx, conn, network, address, log, &cOpts)
+	case "tcp", "tcp4", "tcp6":
+		if _, ok := conn.(net.PacketConn); ok {
+			err := fmt.Errorf("tcp over udp is unsupported")
+			log.Error(err)
+			return nil, err
+		}
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	addr := gosocks5.Addr{}
+	if err := addr.ParseFrom(address); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+	if addr.Host == "" {
+		addr.Type = gosocks5.AddrIPv4
+		addr.Host = "127.0.0.1"
+	}
+
+	req := gosocks5.NewRequest(gosocks5.CmdConnect, &addr)
+	log.Trace(req)
+	if err := req.Write(conn); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	reply, err := gosocks5.ReadReply(conn)
+	if err != nil {
+		log.Error(err)
+		return nil, err
+	}
+	log.Trace(reply)
+
+	if reply.Rep != gosocks5.Succeeded {
+		err = errors.New("host unreachable")
+		log.Error(err)
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+func (c *socks5Connector) connectUDP(ctx context.Context, conn net.Conn, network, address string, log logger.Logger, opts *connector.ConnectOptions) (net.Conn, error) {
+	addr, err := net.ResolveUDPAddr(network, address)
+	if err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	if c.md.relay == "udp" {
+		return c.relayUDP(ctx, conn, addr, log, opts)
+	}
+
+	req := gosocks5.NewRequest(socks.CmdUDPTun, nil)
+	log.Trace(req)
+	if err := req.Write(conn); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	reply, err := gosocks5.ReadReply(conn)
+	if err != nil {
+		log.Error(err)
+		return nil, err
+	}
+	log.Trace(reply)
+
+	if reply.Rep != gosocks5.Succeeded {
+		return nil, errors.New("get socks5 UDP tunnel failure")
+	}
+
+	return socks.UDPTunClientConn(conn, addr), nil
+}
+
+func (c *socks5Connector) relayUDP(ctx context.Context, conn net.Conn, addr net.Addr, log logger.Logger, opts *connector.ConnectOptions) (net.Conn, error) {
+	req := gosocks5.NewRequest(gosocks5.CmdUdp, nil)
+	log.Trace(req)
+	if err := req.Write(conn); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	reply, err := gosocks5.ReadReply(conn)
+	if err != nil {
+		log.Error(err)
+		return nil, err
+	}
+	log.Trace(reply)
+
+	if reply.Rep != gosocks5.Succeeded {
+		return nil, errors.New("get socks5 UDP tunnel failure")
+	}
+
+	log.Debugf("bind on: %v", reply.Addr)
+
+	cc, err := opts.Dialer.Dial(ctx, "udp", reply.Addr.String())
+	if err != nil {
+		c.options.Logger.Error(err)
+		return nil, err
+	}
+	log.Debugf("%s <- %s -> %s", cc.LocalAddr(), cc.RemoteAddr(), addr)
+
+	if c.md.udpTimeout > 0 {
+		cc.SetReadDeadline(time.Now().Add(c.md.udpTimeout))
+	}
+
+	return &udpRelayConn{
+		udpConn:    cc.(*net.UDPConn),
+		tcpConn:    conn,
+		taddr:      addr,
+		bufferSize: c.md.udpBufferSize,
+		logger:     log,
+	}, nil
+}

go-gost/x/connector/socks/v5/listener.go

@@ -0,0 +1,102 @@
+package v5
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/gosocks5"
+	"github.com/go-gost/x/internal/util/mux"
+)
+
+type tcpListener struct {
+	addr   net.Addr
+	conn   net.Conn
+	logger logger.Logger
+}
+
+func (p *tcpListener) Accept() (net.Conn, error) {
+	// second reply, peer connected
+	rep, err := gosocks5.ReadReply(p.conn)
+	if err != nil {
+		return nil, err
+	}
+	p.logger.Trace(rep)
+
+	if rep.Rep != gosocks5.Succeeded {
+		return nil, fmt.Errorf("peer connect failed")
+	}
+
+	raddr, err := net.ResolveTCPAddr("tcp", rep.Addr.String())
+	if err != nil {
+		return nil, err
+	}
+
+	return &bindConn{
+		Conn:       p.conn,
+		localAddr:  p.addr,
+		remoteAddr: raddr,
+	}, nil
+}
+
+func (p *tcpListener) Addr() net.Addr {
+	return p.addr
+}
+
+func (p *tcpListener) Close() error {
+	return p.conn.Close()
+}
+
+type tcpMuxListener struct {
+	addr    net.Addr
+	session *mux.Session
+	logger  logger.Logger
+}
+
+func (p *tcpMuxListener) Accept() (net.Conn, error) {
+	cc, err := p.session.Accept()
+	if err != nil {
+		return nil, err
+	}
+
+	conn, err := p.getPeerConn(cc)
+	if err != nil {
+		cc.Close()
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+func (p *tcpMuxListener) getPeerConn(conn net.Conn) (net.Conn, error) {
+	// second reply, peer connected
+	rep, err := gosocks5.ReadReply(conn)
+	if err != nil {
+		return nil, err
+	}
+	p.logger.Trace(rep)
+
+	if rep.Rep != gosocks5.Succeeded {
+		err = fmt.Errorf("peer connect failed")
+		return nil, err
+	}
+
+	raddr, err := net.ResolveTCPAddr("tcp", rep.Addr.String())
+	if err != nil {
+		return nil, err
+	}
+
+	return &bindConn{
+		Conn:       conn,
+		localAddr:  p.addr,
+		remoteAddr: raddr,
+	}, nil
+}
+
+func (p *tcpMuxListener) Addr() net.Addr {
+	return p.addr
+}
+
+func (p *tcpMuxListener) Close() error {
+	return p.session.Close()
+}

go-gost/x/connector/socks/v5/metadata.go

@@ -0,0 +1,44 @@
+package v5
+
+import (
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/internal/util/mux"
+)
+
+const (
+	defaultUDPBufferSize = 4096
+)
+
+type metadata struct {
+	connectTimeout time.Duration
+	noTLS          bool
+	relay          string
+	udpBufferSize  int
+	udpTimeout     time.Duration
+	muxCfg         *mux.Config
+}
+
+func (c *socks5Connector) parseMetadata(md mdata.Metadata) (err error) {
+	c.md.connectTimeout = mdutil.GetDuration(md, "timeout")
+	c.md.noTLS = mdutil.GetBool(md, "notls")
+	c.md.relay = mdutil.GetString(md, "relay")
+	c.md.udpBufferSize = mdutil.GetInt(md, "udp.bufferSize", "udpBufferSize")
+	if c.md.udpBufferSize <= 0 {
+		c.md.udpBufferSize = defaultUDPBufferSize
+	}
+	c.md.udpTimeout = mdutil.GetDuration(md, "udp.timeout")
+
+	c.md.muxCfg = &mux.Config{
+		Version:           mdutil.GetInt(md, "mux.version"),
+		KeepAliveInterval: mdutil.GetDuration(md, "mux.keepaliveInterval"),
+		KeepAliveDisabled: mdutil.GetBool(md, "mux.keepaliveDisabled"),
+		KeepAliveTimeout:  mdutil.GetDuration(md, "mux.keepaliveTimeout"),
+		MaxFrameSize:      mdutil.GetInt(md, "mux.maxFrameSize"),
+		MaxReceiveBuffer:  mdutil.GetInt(md, "mux.maxReceiveBuffer"),
+		MaxStreamBuffer:   mdutil.GetInt(md, "mux.maxStreamBuffer"),
+	}
+	return
+}

go-gost/x/connector/socks/v5/selector.go

@@ -0,0 +1,77 @@
+package v5
+
+import (
+	"crypto/tls"
+	"net"
+	"net/url"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/gosocks5"
+	"github.com/go-gost/x/internal/util/socks"
+)
+
+type clientSelector struct {
+	methods   []uint8
+	User      *url.Userinfo
+	TLSConfig *tls.Config
+	logger    logger.Logger
+}
+
+func (s *clientSelector) Methods() []uint8 {
+	s.logger.Debug("methods: ", s.methods)
+	return s.methods
+}
+
+func (s *clientSelector) AddMethod(methods ...uint8) {
+	s.methods = append(s.methods, methods...)
+}
+
+func (s *clientSelector) Select(methods ...uint8) (method uint8) {
+	return
+}
+
+func (s *clientSelector) OnSelected(method uint8, conn net.Conn) (string, net.Conn, error) {
+	s.logger.Debug("method selected: ", method)
+
+	switch method {
+	case gosocks5.MethodNoAuth:
+
+	case socks.MethodTLS:
+		conn = tls.Client(conn, s.TLSConfig)
+
+	case gosocks5.MethodUserPass, socks.MethodTLSAuth:
+		if method == socks.MethodTLSAuth {
+			conn = tls.Client(conn, s.TLSConfig)
+		}
+
+		var username, password string
+		if s.User != nil {
+			username = s.User.Username()
+			password, _ = s.User.Password()
+		}
+
+		req := gosocks5.NewUserPassRequest(gosocks5.UserPassVer, username, password)
+		s.logger.Trace(req)
+		if err := req.Write(conn); err != nil {
+			s.logger.Error(err)
+			return "", nil, err
+		}
+
+		resp, err := gosocks5.ReadUserPassResponse(conn)
+		if err != nil {
+			s.logger.Error(err)
+			return "", nil, err
+		}
+		s.logger.Trace(resp)
+
+		if resp.Status != gosocks5.Succeeded {
+			return "", nil, gosocks5.ErrAuthFailure
+		}
+
+	case gosocks5.MethodNoAcceptable:
+		return "", nil, gosocks5.ErrBadMethod
+	default:
+		return "", nil, gosocks5.ErrBadFormat
+	}
+	return "", conn, nil
+}

go-gost/x/connector/ss/connector.go

@@ -0,0 +1,113 @@
+package ss
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/common/bufpool"
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/ss"
+	"github.com/go-gost/x/registry"
+	"github.com/shadowsocks/go-shadowsocks2/core"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("ss", NewConnector)
+}
+
+type ssConnector struct {
+	cipher  core.Cipher
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &ssConnector{
+		options: options,
+	}
+}
+
+func (c *ssConnector) Init(md md.Metadata) (err error) {
+	if err = c.parseMetadata(md); err != nil {
+		return
+	}
+
+	if c.options.Auth != nil {
+		method := c.options.Auth.Username()
+		password, _ := c.options.Auth.Password()
+		c.cipher, err = ss.ShadowCipher(method, password, c.md.key)
+	}
+
+	return
+}
+
+func (c *ssConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+		if _, ok := conn.(net.PacketConn); ok {
+			err := fmt.Errorf("tcp over udp is unsupported")
+			log.Error(err)
+			return nil, err
+		}
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	addr := gosocks5.Addr{}
+	if err := addr.ParseFrom(address); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+	rawaddr := bufpool.Get(512)
+	defer bufpool.Put(rawaddr)
+
+	n, err := addr.Encode(rawaddr)
+	if err != nil {
+		log.Error("encoding addr: ", err)
+		return nil, err
+	}
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	if c.cipher != nil {
+		conn = c.cipher.StreamConn(conn)
+	}
+
+	var sc net.Conn
+	if c.md.noDelay {
+		sc = ss.ShadowConn(conn, nil)
+		// write the addr at once.
+		if _, err := sc.Write(rawaddr[:n]); err != nil {
+			return nil, err
+		}
+	} else {
+		// cache the header
+		sc = ss.ShadowConn(conn, rawaddr[:n])
+	}
+
+	return sc, nil
+}

go-gost/x/connector/ss/metadata.go

@@ -0,0 +1,28 @@
+package ss
+
+import (
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	key            string
+	connectTimeout time.Duration
+	noDelay        bool
+}
+
+func (c *ssConnector) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		key            = "key"
+		connectTimeout = "timeout"
+		noDelay        = "nodelay"
+	)
+
+	c.md.key = mdutil.GetString(md, key)
+	c.md.connectTimeout = mdutil.GetDuration(md, connectTimeout)
+	c.md.noDelay = mdutil.GetBool(md, noDelay)
+
+	return
+}

go-gost/x/connector/ss/udp/connector.go

@@ -0,0 +1,97 @@
+package ss
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/relay"
+	"github.com/go-gost/x/internal/util/ss"
+	"github.com/go-gost/x/registry"
+	"github.com/shadowsocks/go-shadowsocks2/core"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("ssu", NewConnector)
+}
+
+type ssuConnector struct {
+	cipher  core.Cipher
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &ssuConnector{
+		options: options,
+	}
+}
+
+func (c *ssuConnector) Init(md md.Metadata) (err error) {
+	if err = c.parseMetadata(md); err != nil {
+		return
+	}
+
+	if c.options.Auth != nil {
+		method := c.options.Auth.Username()
+		password, _ := c.options.Auth.Password()
+		c.cipher, err = ss.ShadowCipher(method, password, c.md.key)
+	}
+
+	return
+}
+
+func (c *ssuConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	switch network {
+	case "udp", "udp4", "udp6":
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	taddr, _ := net.ResolveUDPAddr(network, address)
+	if taddr == nil {
+		taddr = &net.UDPAddr{}
+	}
+
+	pc, ok := conn.(net.PacketConn)
+	if ok {
+		if c.cipher != nil {
+			pc = c.cipher.PacketConn(pc)
+		}
+
+		// standard UDP relay
+		return ss.UDPClientConn(pc, conn.RemoteAddr(), taddr), nil
+	}
+
+	if c.cipher != nil {
+		conn = ss.ShadowConn(c.cipher.StreamConn(conn), nil)
+	}
+
+	// UDP over TCP
+	return relay.UDPTunClientConn(conn, taddr), nil
+}

go-gost/x/connector/ss/udp/metadata.go

@@ -0,0 +1,25 @@
+package ss
+
+import (
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	key            string
+	connectTimeout time.Duration
+}
+
+func (c *ssuConnector) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		key            = "key"
+		connectTimeout = "timeout"
+	)
+
+	c.md.key = mdutil.GetString(md, key)
+	c.md.connectTimeout = mdutil.GetDuration(md, connectTimeout)
+
+	return
+}

go-gost/x/connector/sshd/connector.go

@@ -0,0 +1,82 @@
+package sshd
+
+import (
+	"context"
+	"errors"
+	"net"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	ssh_util "github.com/go-gost/x/internal/util/ssh"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("sshd", NewConnector)
+}
+
+type sshdConnector struct {
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &sshdConnector{
+		options: options,
+	}
+}
+
+func (c *sshdConnector) Init(md md.Metadata) (err error) {
+	return nil
+}
+
+func (c *sshdConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	cc, ok := conn.(*ssh_util.ClientConn)
+	if !ok {
+		return nil, errors.New("ssh: invalid connection")
+	}
+
+	conn, err := cc.Client().Dial(network, address)
+	if err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+// Bind implements connector.Binder.
+func (c *sshdConnector) Bind(ctx context.Context, conn net.Conn, network, address string, opts ...connector.BindOption) (net.Listener, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+	})
+	log.Debugf("bind on %s/%s", address, network)
+
+	cc, ok := conn.(*ssh_util.ClientConn)
+	if !ok {
+		return nil, errors.New("ssh: invalid connection")
+	}
+
+	if host, port, _ := net.SplitHostPort(address); host == "" {
+		address = net.JoinHostPort("0.0.0.0", port)
+	}
+
+	return cc.Client().Listen(network, address)
+}

go-gost/x/connector/tcp/connector.go

@@ -0,0 +1,47 @@
+package tcp
+
+import (
+	"context"
+	"net"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("tcp", NewConnector)
+}
+
+type tcpConnector struct {
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &tcpConnector{
+		options: options,
+	}
+}
+
+func (c *tcpConnector) Init(md md.Metadata) (err error) {
+	return nil
+}
+
+func (c *tcpConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	return conn, nil
+}

go-gost/x/connector/tunnel/bind.go

@@ -0,0 +1,110 @@
+package tunnel
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/go-gost/core/connector"
+	"github.com/go-gost/relay"
+	"github.com/go-gost/x/internal/util/mux"
+)
+
+// Bind implements connector.Binder.
+func (c *tunnelConnector) Bind(ctx context.Context, conn net.Conn, network, address string, opts ...connector.BindOption) (net.Listener, error) {
+
+	addr, cid, err := c.initTunnel(conn, network, address)
+	if err != nil {
+		return nil, err
+	}
+
+	endpoint := addr.String()
+	if v, _, _ := net.SplitHostPort(addr.String()); v != "" {
+		endpoint = v
+	}
+	log := c.options.Logger.WithFields(map[string]any{
+		"endpoint": endpoint,
+		"tunnel":   c.md.tunnelID.String(),
+	})
+	log.Infof("create tunnel on %s/%s OK, tunnel=%s, connector=%s, weight=%d",
+		addr, network, c.md.tunnelID.String(), cid, cid.Weight())
+
+	session, err := mux.ServerSession(conn, c.md.muxCfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &bindListener{
+		network: network,
+		addr:    addr,
+		session: session,
+		logger:  log,
+	}, nil
+}
+
+func (c *tunnelConnector) initTunnel(conn net.Conn, network, address string) (addr net.Addr, cid relay.ConnectorID, err error) {
+	req := relay.Request{
+		Version: relay.Version1,
+		Cmd:     relay.CmdBind,
+	}
+
+	if network == "udp" {
+		req.Cmd |= relay.FUDP
+		req.Features = append(req.Features, &relay.NetworkFeature{
+			Network: relay.NetworkUDP,
+		})
+	}
+
+	if c.options.Auth != nil {
+		pwd, _ := c.options.Auth.Password()
+		req.Features = append(req.Features, &relay.UserAuthFeature{
+			Username: c.options.Auth.Username(),
+			Password: pwd,
+		})
+	}
+
+	af := &relay.AddrFeature{}
+	af.ParseFrom(conn.LocalAddr().String()) // src address
+	req.Features = append(req.Features, af)
+
+	af = &relay.AddrFeature{}
+	af.ParseFrom(address)
+	req.Features = append(req.Features, af) // dst address
+
+	req.Features = append(req.Features, &relay.TunnelFeature{
+		ID: c.md.tunnelID,
+	})
+	if _, err = req.WriteTo(conn); err != nil {
+		return
+	}
+
+	// first reply, bind status
+	resp := relay.Response{}
+	if _, err = resp.ReadFrom(conn); err != nil {
+		return
+	}
+
+	if resp.Status != relay.StatusOK {
+		err = fmt.Errorf("%d: create tunnel %s failed", resp.Status, c.md.tunnelID.String())
+		return
+	}
+
+	for _, f := range resp.Features {
+		switch f.Type() {
+		case relay.FeatureAddr:
+			if feature, _ := f.(*relay.AddrFeature); feature != nil {
+				addr = &bindAddr{
+					network: network,
+					addr:    net.JoinHostPort(feature.Host, strconv.Itoa(int(feature.Port))),
+				}
+			}
+		case relay.FeatureTunnel:
+			if feature, _ := f.(*relay.TunnelFeature); feature != nil {
+				cid = feature.ID
+			}
+		}
+	}
+
+	return
+}

go-gost/x/connector/tunnel/conn.go

@@ -0,0 +1,176 @@
+package tunnel
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+
+	"github.com/go-gost/core/common/bufpool"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	xrelay "github.com/go-gost/x/internal/util/relay"
+)
+
+type udpConn struct {
+	net.Conn
+}
+
+func (c *udpConn) Read(b []byte) (n int, err error) {
+	var bb [2]byte
+	_, err = io.ReadFull(c.Conn, bb[:])
+	if err != nil {
+		return
+	}
+
+	dlen := int(binary.BigEndian.Uint16(bb[:]))
+	if len(b) >= dlen {
+		return io.ReadFull(c.Conn, b[:dlen])
+	}
+
+	buf := bufpool.Get(dlen)
+	defer bufpool.Put(buf)
+	_, err = io.ReadFull(c.Conn, buf)
+	n = copy(b, buf)
+
+	return
+}
+
+func (c *udpConn) Write(b []byte) (n int, err error) {
+	if len(b) > math.MaxUint16 {
+		err = errors.New("write: data maximum exceeded")
+		return
+	}
+
+	n = len(b)
+
+	var bb [2]byte
+	binary.BigEndian.PutUint16(bb[:], uint16(len(b)))
+	_, err = c.Conn.Write(bb[:])
+	if err != nil {
+		return
+	}
+	return c.Conn.Write(b)
+}
+
+func readResponse(r io.Reader) (err error) {
+	resp := relay.Response{}
+	_, err = resp.ReadFrom(r)
+	if err != nil {
+		return
+	}
+
+	if resp.Version != relay.Version1 {
+		err = relay.ErrBadVersion
+		return
+	}
+
+	if resp.Status != relay.StatusOK {
+		err = fmt.Errorf("%d %s", resp.Status, xrelay.StatusText(resp.Status))
+		return
+	}
+	return nil
+}
+
+type bindConn struct {
+	net.Conn
+	localAddr  net.Addr
+	remoteAddr net.Addr
+	md         mdata.Metadata
+}
+
+func (c *bindConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *bindConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+// Metadata implements metadata.Metadatable interface.
+func (c *bindConn) Metadata() mdata.Metadata {
+	return c.md
+}
+
+type bindUDPConn struct {
+	net.Conn
+	localAddr  net.Addr
+	remoteAddr net.Addr
+	md         mdata.Metadata
+}
+
+func (c *bindUDPConn) Read(b []byte) (n int, err error) {
+	// 2-byte data length header
+	var bh [2]byte
+	_, err = io.ReadFull(c.Conn, bh[:])
+	if err != nil {
+		return
+	}
+
+	dlen := int(binary.BigEndian.Uint16(bh[:]))
+	if len(b) >= dlen {
+		n, err = io.ReadFull(c.Conn, b[:dlen])
+		return
+	}
+
+	buf := bufpool.Get(dlen)
+	defer bufpool.Put(buf)
+
+	_, err = io.ReadFull(c.Conn, buf)
+	n = copy(b, buf)
+
+	return
+}
+
+func (c *bindUDPConn) Write(b []byte) (n int, err error) {
+	if len(b) > math.MaxUint16 {
+		err = errors.New("write: data maximum exceeded")
+		return
+	}
+
+	buf := bufpool.Get(len(b) + 2)
+	defer bufpool.Put(buf)
+
+	binary.BigEndian.PutUint16(buf[:2], uint16(len(b)))
+	n = copy(buf[2:], b)
+
+	return c.Conn.Write(buf)
+}
+
+func (c *bindUDPConn) ReadFrom(b []byte) (n int, addr net.Addr, err error) {
+	addr = c.remoteAddr
+	n, err = c.Read(b)
+	return
+}
+
+func (c *bindUDPConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
+	return c.Write(b)
+}
+
+func (c *bindUDPConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *bindUDPConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+// Metadata implements metadata.Metadatable interface.
+func (c *bindUDPConn) Metadata() mdata.Metadata {
+	return c.md
+}
+
+type bindAddr struct {
+	network string
+	addr    string
+}
+
+func (p *bindAddr) Network() string {
+	return p.network
+}
+
+func (p *bindAddr) String() string {
+	return p.addr
+}

go-gost/x/connector/tunnel/connector.go

@@ -0,0 +1,114 @@
+package tunnel
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/connector"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.ConnectorRegistry().Register("tunnel", NewConnector)
+}
+
+type tunnelConnector struct {
+	md      metadata
+	options connector.Options
+}
+
+func NewConnector(opts ...connector.Option) connector.Connector {
+	options := connector.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &tunnelConnector{
+		options: options,
+	}
+}
+
+func (c *tunnelConnector) Init(md md.Metadata) (err error) {
+	return c.parseMetadata(md)
+}
+
+func (c *tunnelConnector) Connect(ctx context.Context, conn net.Conn, network, address string, opts ...connector.ConnectOption) (net.Conn, error) {
+	log := c.options.Logger.WithFields(map[string]any{
+		"remote":  conn.RemoteAddr().String(),
+		"local":   conn.LocalAddr().String(),
+		"network": network,
+		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
+	})
+	log.Debugf("connect %s/%s", address, network)
+
+	if c.md.connectTimeout > 0 {
+		conn.SetDeadline(time.Now().Add(c.md.connectTimeout))
+		defer conn.SetDeadline(time.Time{})
+	}
+
+	req := relay.Request{
+		Version: relay.Version1,
+		Cmd:     relay.CmdConnect,
+	}
+
+	switch network {
+	case "udp", "udp4", "udp6":
+		req.Cmd |= relay.FUDP
+		req.Features = append(req.Features, &relay.NetworkFeature{
+			Network: relay.NetworkUDP,
+		})
+	}
+
+	if c.options.Auth != nil {
+		pwd, _ := c.options.Auth.Password()
+		req.Features = append(req.Features, &relay.UserAuthFeature{
+			Username: c.options.Auth.Username(),
+			Password: pwd,
+		})
+	}
+
+	srcAddr := conn.LocalAddr().String()
+	if v := ctxvalue.ClientAddrFromContext(ctx); v != "" {
+		srcAddr = string(v)
+	}
+
+	af := &relay.AddrFeature{}
+	af.ParseFrom(srcAddr)
+	req.Features = append(req.Features, af) // src address
+
+	af = &relay.AddrFeature{}
+	af.ParseFrom(address)
+	req.Features = append(req.Features, af) // dst address
+
+	req.Features = append(req.Features, &relay.TunnelFeature{
+		ID: c.md.tunnelID,
+	})
+
+	if _, err := req.WriteTo(conn); err != nil {
+		return nil, err
+	}
+	// drain the response
+	if err := readResponse(conn); err != nil {
+		return nil, err
+	}
+
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+	case "udp", "udp4", "udp6":
+		conn = &udpConn{
+			Conn: conn,
+		}
+	default:
+		err := fmt.Errorf("network %s is unsupported", network)
+		log.Error(err)
+		return nil, err
+	}
+
+	return conn, nil
+}