init

go-gost/x/handler/api/handler.go

@@ -0,0 +1,90 @@
+package api
+
+import (
+	"context"
+	"net"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-gost/core/handler"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/x/api"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("api", NewHandler)
+}
+
+type apiHandler struct {
+	handler http.Handler
+	md      metadata
+	options handler.Options
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &apiHandler{
+		options: options,
+	}
+}
+
+func (h *apiHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	gin.SetMode(gin.ReleaseMode)
+
+	r := gin.New()
+	api.Register(r, &api.Options{
+		AccessLog:  h.md.accesslog,
+		PathPrefix: h.md.pathPrefix,
+		Auther:     h.options.Auther,
+	})
+	h.handler = r
+
+	return
+}
+
+func (h *apiHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	l := &singleConnListener{
+		conn: make(chan net.Conn, 1),
+	}
+	l.send(conn)
+
+	s := http.Server{
+		Handler: h.handler,
+	}
+	s.Serve(l)
+
+	return s.Shutdown(ctx)
+}
+
+type singleConnListener struct {
+	conn chan net.Conn
+}
+
+func (l *singleConnListener) Accept() (net.Conn, error) {
+	if conn, ok := <-l.conn; ok {
+		return conn, nil
+	}
+	return nil, net.ErrClosed
+}
+
+func (l *singleConnListener) Close() error {
+	return nil
+}
+
+func (l *singleConnListener) Addr() net.Addr {
+	return &net.TCPAddr{}
+}
+
+func (l *singleConnListener) send(conn net.Conn) {
+	l.conn <- conn
+	close(l.conn)
+}

go-gost/x/handler/api/metadata.go

@@ -0,0 +1,17 @@
+package api
+
+import (
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	accesslog  bool
+	pathPrefix string
+}
+
+func (h *apiHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.accesslog = mdutil.GetBool(md, "api.accessLog", "accessLog")
+	h.md.pathPrefix = mdutil.GetString(md, "api.pathPrefix", "pathPrefix")
+	return
+}

go-gost/x/handler/auto/handler.go

@@ -0,0 +1,120 @@
+package auto
+
+import (
+	"bufio"
+	"context"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/gosocks4"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("auto", NewHandler)
+}
+
+type autoHandler struct {
+	httpHandler   handler.Handler
+	socks4Handler handler.Handler
+	socks5Handler handler.Handler
+	options       handler.Options
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	h := &autoHandler{
+		options: options,
+	}
+
+	if f := registry.HandlerRegistry().Get("http"); f != nil {
+		v := append(opts,
+			handler.LoggerOption(options.Logger.WithFields(map[string]any{"handler": "http"})))
+		h.httpHandler = f(v...)
+	}
+	if f := registry.HandlerRegistry().Get("socks4"); f != nil {
+		v := append(opts,
+			handler.LoggerOption(options.Logger.WithFields(map[string]any{"handler": "socks4"})))
+		h.socks4Handler = f(v...)
+	}
+	if f := registry.HandlerRegistry().Get("socks5"); f != nil {
+		v := append(opts,
+			handler.LoggerOption(options.Logger.WithFields(map[string]any{"handler": "socks5"})))
+		h.socks5Handler = f(v...)
+	}
+
+	return h
+}
+
+func (h *autoHandler) Init(md md.Metadata) error {
+	if h.httpHandler != nil {
+		if err := h.httpHandler.Init(md); err != nil {
+			return err
+		}
+	}
+	if h.socks4Handler != nil {
+		if err := h.socks4Handler.Init(md); err != nil {
+			return err
+		}
+	}
+	if h.socks5Handler != nil {
+		if err := h.socks5Handler.Init(md); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (h *autoHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	if log.IsLevelEnabled(logger.DebugLevel) {
+		start := time.Now()
+		log.Debugf("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+		defer func() {
+			log.WithFields(map[string]any{
+				"duration": time.Since(start),
+			}).Debugf("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+		}()
+	}
+
+	br := bufio.NewReader(conn)
+	b, err := br.Peek(1)
+	if err != nil {
+		log.Error(err)
+		conn.Close()
+		return err
+	}
+
+	conn = xnet.NewReadWriteConn(br, conn, conn)
+	switch b[0] {
+	case gosocks4.Ver4: // socks4
+		if h.socks4Handler != nil {
+			return h.socks4Handler.Handle(ctx, conn)
+		}
+	case gosocks5.Ver5: // socks5
+		if h.socks5Handler != nil {
+			return h.socks5Handler.Handle(ctx, conn)
+		}
+	default: // http
+		if h.httpHandler != nil {
+			return h.httpHandler.Handle(ctx, conn)
+		}
+	}
+	return nil
+}

go-gost/x/handler/dns/handler.go

@@ -0,0 +1,412 @@
+package dns
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/common/bufpool"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/hosts"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xhop "github.com/go-gost/x/hop"
+	resolver_util "github.com/go-gost/x/internal/util/resolver"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+	"github.com/go-gost/x/resolver/exchanger"
+	"github.com/miekg/dns"
+)
+
+const (
+	defaultNameserver = "udp://127.0.0.1:53"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("dns", NewHandler)
+}
+
+type dnsHandler struct {
+	hop        hop.Hop
+	exchangers map[string]exchanger.Exchanger
+	cache      *resolver_util.Cache
+	hostMapper hosts.HostMapper
+	md         metadata
+	options    handler.Options
+	recorder   recorder.RecorderObject
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &dnsHandler{
+		options:    options,
+		exchangers: make(map[string]exchanger.Exchanger),
+	}
+}
+
+func (h *dnsHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+	log := h.options.Logger
+
+	h.cache = resolver_util.NewCache().WithLogger(log)
+
+	h.hostMapper = h.options.Router.Options().HostMapper
+
+	if h.hop == nil {
+		var nodes []*chain.Node
+		for i, addr := range h.md.dns {
+			nodes = append(nodes, chain.NewNode(fmt.Sprintf("target-%d", i), addr))
+		}
+		h.hop = xhop.NewHop(
+			xhop.NodeOption(nodes...),
+			xhop.LoggerOption(log),
+		)
+	}
+
+	var nodes []*chain.Node
+	if nl, ok := h.hop.(hop.NodeList); ok {
+		nodes = nl.Nodes()
+	}
+	for _, node := range nodes {
+		addr := strings.TrimSpace(node.Addr)
+		if addr == "" {
+			continue
+		}
+		ex, err := exchanger.NewExchanger(
+			addr,
+			exchanger.RouterOption(h.options.Router),
+			exchanger.TimeoutOption(h.md.timeout),
+			exchanger.LoggerOption(log),
+		)
+		if err != nil {
+			log.Warnf("parse %s: %v", addr, err)
+			continue
+		}
+		h.exchangers[node.Name] = ex
+	}
+
+	if len(h.exchangers) == 0 {
+		ex, err := exchanger.NewExchanger(
+			defaultNameserver,
+			exchanger.RouterOption(h.options.Router),
+			exchanger.TimeoutOption(h.md.timeout),
+			exchanger.LoggerOption(log),
+		)
+		log.Warnf("resolver not found, use default %s", defaultNameserver)
+		if err != nil {
+			return err
+		}
+		h.exchangers["default"] = ex
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	return
+}
+
+// Forward implements handler.Forwarder.
+func (h *dnsHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *dnsHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    conn.LocalAddr().Network(),
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Proto:      "dns",
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		ro.Duration = time.Since(start)
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Warnf("recorder: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	b := bufpool.Get(h.md.bufferSize)
+	defer bufpool.Put(b)
+
+	n, err := conn.Read(b)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+
+	reply, err := h.request(ctx, b[:n], ro, log)
+	if err != nil {
+		return err
+	}
+	defer bufpool.Put(reply)
+
+	if _, err = conn.Write(reply); err != nil {
+		log.Error(err)
+		return err
+	}
+	return nil
+}
+
+func (h *dnsHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *dnsHandler) request(ctx context.Context, msg []byte, ro *xrecorder.HandlerRecorderObject, log logger.Logger) ([]byte, error) {
+	mq := dns.Msg{}
+	if err := mq.Unpack(msg); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	if len(mq.Question) == 0 {
+		return nil, errors.New("msg: empty question")
+	}
+
+	ro.DNS = &xrecorder.DNSRecorderObject{
+		ID:       int(mq.Id),
+		Name:     mq.Question[0].Name,
+		Class:    dns.Class(mq.Question[0].Qclass).String(),
+		Type:     dns.Type(mq.Question[0].Qtype).String(),
+		Question: mq.String(),
+	}
+
+	resolver_util.AddSubnetOpt(&mq, h.md.clientIP)
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		log.Trace(mq.String())
+	}
+
+	var mr *dns.Msg
+	defer func() {
+		if mr != nil {
+			if log.IsLevelEnabled(logger.TraceLevel) {
+				log.Trace(mr.String())
+			}
+
+			ro.DNS.Answer = mr.String()
+		}
+	}()
+
+	if h.options.Bypass != nil && mq.Question[0].Qclass == dns.ClassINET {
+		if h.options.Bypass.Contains(context.Background(), "udp", strings.Trim(mq.Question[0].Name, ".")) {
+			log.Debug("bypass: ", mq.Question[0].Name)
+			mr = (&dns.Msg{}).SetReply(&mq)
+			b := bufpool.Get(h.md.bufferSize)
+			return mr.PackBuffer(b)
+		}
+	}
+
+	mr = h.lookupHosts(ctx, &mq, log)
+	if mr != nil {
+		b := bufpool.Get(h.md.bufferSize)
+		return mr.PackBuffer(b)
+	}
+
+	// only cache for single question message.
+	if len(mq.Question) == 1 {
+		var ttl time.Duration
+		mr, ttl = h.cache.Load(ctx, resolver_util.NewCacheKey(&mq.Question[0]))
+		if mr != nil {
+			mr.Id = mq.Id
+			if int32(ttl.Seconds()) > 0 {
+				ro.DNS.Cached = true
+
+				log.Debugf("message %d (cached): %s", mq.Id, mq.Question[0].String())
+				b := bufpool.Get(h.md.bufferSize)
+				return mr.PackBuffer(b)
+			}
+		}
+	}
+
+	ex := h.selectExchanger(ctx, strings.Trim(mq.Question[0].Name, "."))
+	if ex == nil {
+		return nil, fmt.Errorf("exchange not found for %s", mq.Question[0].Name)
+	}
+	ro.Host = ex.String()
+
+	if mr != nil && h.md.async {
+		b := bufpool.Get(h.md.bufferSize)
+		reply, err := mr.PackBuffer(b)
+		if err != nil {
+			return nil, err
+		}
+		h.cache.RefreshTTL(resolver_util.NewCacheKey(&mq.Question[0]))
+
+		log.Debugf("exchange message %d (async): %s", mq.Id, mq.Question[0].String())
+		go h.exchange(ctx, ex, &mq)
+		return reply, nil
+	}
+
+	log.Debugf("exchange message %d: %s", mq.Id, mq.Question[0].String())
+
+	var buf bytes.Buffer
+	mr, err := h.exchange(ctxvalue.ContextWithBuffer(ctx, &buf), ex, &mq)
+	ro.Route = buf.String()
+	if err != nil {
+		return nil, err
+	}
+
+	b := bufpool.Get(h.md.bufferSize)
+	return mr.PackBuffer(b)
+}
+
+func (h *dnsHandler) exchange(ctx context.Context, ex exchanger.Exchanger, mq *dns.Msg) (*dns.Msg, error) {
+	b := bufpool.Get(h.md.bufferSize)
+	defer bufpool.Put(b)
+
+	query, err := mq.PackBuffer(b)
+	if err != nil {
+		return nil, err
+	}
+
+	reply, err := ex.Exchange(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+
+	mr := &dns.Msg{}
+	if err = mr.Unpack(reply); err != nil {
+		return nil, err
+	}
+	if len(mq.Question) == 1 {
+		key := resolver_util.NewCacheKey(&mq.Question[0])
+		h.cache.Store(ctx, key, mr, h.md.ttl)
+	}
+
+	return mr, nil
+}
+
+// lookup host mapper
+func (h *dnsHandler) lookupHosts(ctx context.Context, r *dns.Msg, log logger.Logger) (m *dns.Msg) {
+	if h.hostMapper == nil ||
+		r.Question[0].Qclass != dns.ClassINET ||
+		(r.Question[0].Qtype != dns.TypeA && r.Question[0].Qtype != dns.TypeAAAA) {
+		return nil
+	}
+
+	m = &dns.Msg{}
+	m.SetReply(r)
+
+	host := strings.TrimSuffix(r.Question[0].Name, ".")
+
+	switch r.Question[0].Qtype {
+	case dns.TypeA:
+		ips, _ := h.hostMapper.Lookup(ctx, "ip4", host)
+		if len(ips) == 0 {
+			return nil
+		}
+		log.Debugf("hit host mapper: %s -> %s", host, ips)
+
+		for _, ip := range ips {
+			rr, err := dns.NewRR(fmt.Sprintf("%s IN A %s\n", r.Question[0].Name, ip.String()))
+			if err != nil {
+				log.Error(err)
+				return nil
+			}
+			m.Answer = append(m.Answer, rr)
+		}
+
+	case dns.TypeAAAA:
+		ips, _ := h.hostMapper.Lookup(ctx, "ip6", host)
+		if len(ips) == 0 {
+			return nil
+		}
+		log.Debugf("hit host mapper: %s -> %s", host, ips)
+
+		for _, ip := range ips {
+			rr, err := dns.NewRR(fmt.Sprintf("%s IN AAAA %s\n", r.Question[0].Name, ip.String()))
+			if err != nil {
+				log.Error(err)
+				return nil
+			}
+			m.Answer = append(m.Answer, rr)
+		}
+	}
+
+	return
+}
+
+func (h *dnsHandler) selectExchanger(ctx context.Context, addr string) exchanger.Exchanger {
+	if h.hop == nil {
+		return nil
+	}
+	node := h.hop.Select(ctx, hop.AddrSelectOption(addr))
+	if node == nil {
+		return nil
+	}
+
+	return h.exchangers[node.Name]
+}

go-gost/x/handler/dns/metadata.go

@@ -0,0 +1,64 @@
+package dns
+
+import (
+	"net"
+	"strings"
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+const (
+	defaultTimeout    = 5 * time.Second
+	defaultBufferSize = 1024
+)
+
+type metadata struct {
+	readTimeout time.Duration
+	ttl         time.Duration
+	timeout     time.Duration
+	clientIP    net.IP
+	// nameservers
+	dns        []string
+	bufferSize int
+	async      bool
+}
+
+func (h *dnsHandler) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		readTimeout = "readTimeout"
+		ttl         = "ttl"
+		timeout     = "timeout"
+		clientIP    = "clientIP"
+		dns         = "dns"
+		bufferSize  = "bufferSize"
+		async       = "async"
+	)
+
+	h.md.readTimeout = mdutil.GetDuration(md, readTimeout)
+	h.md.ttl = mdutil.GetDuration(md, ttl)
+	h.md.timeout = mdutil.GetDuration(md, timeout)
+	if h.md.timeout <= 0 {
+		h.md.timeout = defaultTimeout
+	}
+	sip := mdutil.GetString(md, clientIP)
+	if sip != "" {
+		h.md.clientIP = net.ParseIP(sip)
+	}
+	for _, v := range strings.Split(mdutil.GetString(md, dns), ",") {
+		v = strings.TrimSpace(v)
+		if v == "" {
+			continue
+		}
+		h.md.dns = append(h.md.dns, v)
+	}
+
+	h.md.bufferSize = mdutil.GetInt(md, bufferSize)
+	if h.md.bufferSize <= 0 {
+		h.md.bufferSize = defaultBufferSize
+	}
+	h.md.async = mdutil.GetBool(md, async)
+
+	return
+}

go-gost/x/handler/file/handler.go

@@ -0,0 +1,198 @@
+package file
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/recorder"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("file", NewHandler)
+}
+
+type fileHandler struct {
+	handler  http.Handler
+	server   *http.Server
+	ln       *singleConnListener
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &fileHandler{
+		options: options,
+	}
+}
+
+func (h *fileHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	h.handler = http.FileServer(http.Dir(h.md.dir))
+	h.server = &http.Server{
+		Handler: http.HandlerFunc(h.handleFunc),
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	h.ln = &singleConnListener{
+		conn: make(chan net.Conn),
+		done: make(chan struct{}),
+	}
+	go h.server.Serve(h.ln)
+
+	return
+}
+
+func (h *fileHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+	}).Infof("%s - %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	h.ln.send(conn)
+
+	return nil
+}
+
+func (h *fileHandler) Close() error {
+	return h.server.Close()
+}
+
+func (h *fileHandler) handleFunc(w http.ResponseWriter, r *http.Request) {
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: r.RemoteAddr,
+		Network:    "tcp",
+		Host:       r.Host,
+		Proto:      "http",
+		HTTP: &xrecorder.HTTPRecorderObject{
+			Host:   r.Host,
+			Method: r.Method,
+			Proto:  r.Proto,
+			Scheme: r.URL.Scheme,
+			URI:    r.RequestURI,
+			Request: xrecorder.HTTPRequestRecorderObject{
+				ContentLength: r.ContentLength,
+				Header:        r.Header,
+			},
+		},
+		Time: start,
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(r.RemoteAddr)
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": r.RemoteAddr,
+	})
+
+	rw := &responseWriter{ResponseWriter: w, statusCode: http.StatusOK}
+
+	defer func() {
+		ro.Duration = time.Since(start)
+		ro.HTTP.StatusCode = rw.statusCode
+		ro.HTTP.Response = xrecorder.HTTPResponseRecorderObject{
+			ContentLength: rw.contentLength,
+			Header:        rw.Header(),
+		}
+		if err := ro.Record(context.Background(), h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s %s %s %d %d", r.Method, r.RequestURI, r.Proto, rw.statusCode, rw.contentLength)
+	}()
+
+	if auther := h.options.Auther; auther != nil {
+		u, p, _ := r.BasicAuth()
+		ro.ClientID = u
+		if _, ok := auther.Authenticate(r.Context(), u, p); !ok {
+			w.Header().Set("WWW-Authenticate", "Basic")
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+	}
+
+	h.handler.ServeHTTP(rw, r)
+}
+
+type singleConnListener struct {
+	conn chan net.Conn
+	addr net.Addr
+	done chan struct{}
+	mu   sync.Mutex
+}
+
+func (l *singleConnListener) Accept() (net.Conn, error) {
+	select {
+	case conn := <-l.conn:
+		return conn, nil
+
+	case <-l.done:
+		return nil, net.ErrClosed
+	}
+}
+
+func (l *singleConnListener) Close() error {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	select {
+	case <-l.done:
+	default:
+		close(l.done)
+	}
+
+	return nil
+}
+
+func (l *singleConnListener) Addr() net.Addr {
+	return l.addr
+}
+
+func (l *singleConnListener) send(conn net.Conn) {
+	select {
+	case l.conn <- conn:
+	case <-l.done:
+		return
+	}
+}
+
+type responseWriter struct {
+	http.ResponseWriter
+	statusCode    int
+	contentLength int64
+}
+
+func (w *responseWriter) Write(p []byte) (int, error) {
+	n, err := w.ResponseWriter.Write(p)
+	w.contentLength += int64(n)
+	return n, err
+}
+
+func (w *responseWriter) WriteHeader(statusCode int) {
+	w.statusCode = statusCode
+	w.ResponseWriter.WriteHeader(statusCode)
+}

go-gost/x/handler/file/metadata.go

@@ -0,0 +1,15 @@
+package file
+
+import (
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	dir string
+}
+
+func (h *fileHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.dir = mdutil.GetString(md, "file.dir", "dir")
+	return
+}

go-gost/x/handler/forward/local/handler.go

@@ -0,0 +1,264 @@
+package local
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/forwarder"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("tcp", NewHandler)
+	registry.HandlerRegistry().Register("udp", NewHandler)
+	registry.HandlerRegistry().Register("forward", NewHandler)
+}
+
+// TrafficRecorder 流量记录器接口
+type TrafficRecorder interface {
+	RecordTraffic(ctx context.Context, service string, upload, download int64) error
+}
+
+type forwardHandler struct {
+	hop             hop.Hop
+	md              metadata
+	options         handler.Options
+	recorder        recorder.RecorderObject
+	certPool        tls_util.CertPool
+	trafficRecorder TrafficRecorder
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &forwardHandler{
+		options: options,
+	}
+}
+
+func (h *forwardHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	// 获取全局流量记录器
+	h.trafficRecorder = GetGlobalTrafficRecorder()
+
+	return
+}
+
+// Forward implements handler.Forwarder.
+func (h *forwardHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Network:    "tcp",
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	} else {
+		ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(conn.RemoteAddr().String()))
+	}
+
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ro.SID,
+		"client": ro.ClientIP,
+	})
+
+	network := "tcp"
+	if _, ok := conn.(net.PacketConn); ok {
+		network = "udp"
+	}
+	ro.Network = network
+
+	connStats := xstats.Stats{}
+	ccStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &connStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.Duration = time.Since(start)
+
+		if h.trafficRecorder != nil {
+			connOutputBytes := connStats.Get(stats.KindOutputBytes)
+			connInputBytes := connStats.Get(stats.KindInputBytes)
+			ccOutputBytes := ccStats.Get(stats.KindOutputBytes)
+			ccInputBytes := ccStats.Get(stats.KindInputBytes)
+
+			h.trafficRecorder.RecordTraffic(ctx, ro.Service+":conn", int64(connOutputBytes), int64(connInputBytes))
+			h.trafficRecorder.RecordTraffic(ctx, ro.Service+":cc", int64(ccOutputBytes), int64(ccInputBytes))
+		}
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	var proto string
+	if network == "tcp" && h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ = sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			var buf bytes.Buffer
+			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+			ro.Route = buf.String()
+
+			cc = stats_wrapper.WrapConn(cc, &ccStats)
+
+			return cc, err
+		}
+		sniffer := &forwarder.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithHTTPKeepalive(h.md.httpKeepalive),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
+		}
+	}
+
+	target := &chain.Node{}
+	if h.hop != nil {
+		target = h.hop.Select(ctx, hop.ProtocolSelectOption(proto))
+	}
+	if target == nil {
+		err := errors.New("node not available")
+		return err
+	}
+
+	addr := target.Addr
+	if opts := target.Options(); opts != nil {
+		switch opts.Network {
+		case "unix":
+			network = opts.Network
+		default:
+			if _, _, err := net.SplitHostPort(addr); err != nil {
+				addr += ":0"
+			}
+		}
+	}
+
+	ro.Network = network
+	ro.Host = addr
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, addr)
+	ro.Route = buf.String()
+	if err != nil {
+		if marker := target.Marker(); marker != nil {
+			marker.Mark()
+		}
+		return err
+	}
+	if marker := target.Marker(); marker != nil {
+		marker.Reset()
+	}
+
+	cc = stats_wrapper.WrapConn(cc, &ccStats)
+
+	defer cc.Close()
+
+	xnet.Transport(conn, cc)
+
+	return nil
+}
+
+func (h *forwardHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}

go-gost/x/handler/forward/local/metadata.go

@@ -0,0 +1,60 @@
+package local
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout   time.Duration
+	httpKeepalive bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+}
+
+func (h *forwardHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.httpKeepalive = mdutil.GetBool(md, "http.keepalive")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	return
+}

go-gost/x/handler/forward/local/traffic_bridge.go

@@ -0,0 +1,24 @@
+package local
+
+import (
+	"sync"
+)
+
+var (
+	globalTrafficRecorder TrafficRecorder
+	trafficMutex          sync.RWMutex
+)
+
+// SetGlobalTrafficRecorder 设置全局流量记录器
+func SetGlobalTrafficRecorder(recorder TrafficRecorder) {
+	trafficMutex.Lock()
+	defer trafficMutex.Unlock()
+	globalTrafficRecorder = recorder
+}
+
+// GetGlobalTrafficRecorder 获取全局流量记录器
+func GetGlobalTrafficRecorder() TrafficRecorder {
+	trafficMutex.RLock()
+	defer trafficMutex.RUnlock()
+	return globalTrafficRecorder
+}

go-gost/x/handler/forward/remote/handler.go

@@ -0,0 +1,305 @@
+package remote
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/proxyproto"
+	"github.com/go-gost/x/internal/util/forwarder"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	mdutil "github.com/go-gost/x/metadata/util"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("rtcp", NewHandler)
+	registry.HandlerRegistry().Register("rudp", NewHandler)
+}
+
+type forwardHandler struct {
+	hop      hop.Hop
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &forwardHandler{
+		options: options,
+	}
+}
+
+func (h *forwardHandler) Init(md mdata.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return
+}
+
+// Forward implements handler.Forwarder.
+func (h *forwardHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Network:    "tcp",
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	} else {
+		ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(conn.RemoteAddr().String()))
+	}
+
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ro.SID,
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	network := "tcp"
+	if _, ok := conn.(net.PacketConn); ok {
+		network = "udp"
+	}
+	ro.Network = network
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	var host string
+	if md, ok := conn.(mdata.Metadatable); ok {
+		if v := mdutil.GetString(md.Metadata(), "host"); v != "" {
+			host = v
+		}
+	}
+
+	var proto string
+	if network == "tcp" && h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ = sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			var buf bytes.Buffer
+			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+			ro.Route = buf.String()
+			return cc, err
+		}
+		sniffer := &forwarder.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithHTTPKeepalive(h.md.httpKeepalive),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
+		}
+	}
+
+	var target *chain.Node
+	if host != "" {
+		target = &chain.Node{
+			Addr: host,
+		}
+	}
+	if h.hop != nil {
+		target = h.hop.Select(ctx,
+			hop.ProtocolSelectOption(proto),
+		)
+	}
+	if target == nil {
+		err := errors.New("node not available")
+		log.Error(err)
+		return err
+	}
+
+	if opts := target.Options(); opts != nil {
+		switch opts.Network {
+		case "unix":
+			network = opts.Network
+		default:
+		}
+	}
+
+	ro.Network = network
+	ro.Host = target.Addr
+
+	log = log.WithFields(map[string]any{
+		"node": target.Name,
+		"dst":  fmt.Sprintf("%s/%s", target.Addr, network),
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), target.Addr)
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, target.Addr)
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		// TODO: the router itself may be failed due to the failed node in the router,
+		// the dead marker may be a wrong operation.
+		if marker := target.Marker(); marker != nil {
+			marker.Mark()
+		}
+		return err
+	}
+	defer cc.Close()
+	if marker := target.Marker(); marker != nil {
+		marker.Reset()
+	}
+
+	cc = proxyproto.WrapClientConn(h.md.proxyProtocol, conn.RemoteAddr(), convertAddr(conn.LocalAddr()), cc)
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), target.Addr)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), target.Addr)
+
+	return nil
+}
+
+func (h *forwardHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func convertAddr(addr net.Addr) net.Addr {
+	host, sp, _ := net.SplitHostPort(addr.String())
+	ip := net.ParseIP(host)
+	port, _ := strconv.Atoi(sp)
+
+	if ip == nil || ip.Equal(net.IPv6zero) {
+		ip = net.IPv4zero
+	}
+
+	switch addr.Network() {
+	case "tcp", "tcp4", "tcp6":
+		return &net.TCPAddr{
+			IP:   ip,
+			Port: port,
+		}
+
+	default:
+		return &net.UDPAddr{
+			IP:   ip,
+			Port: port,
+		}
+	}
+}

go-gost/x/handler/forward/remote/metadata.go

@@ -0,0 +1,61 @@
+package remote
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout   time.Duration
+	proxyProtocol int
+	httpKeepalive bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+}
+
+func (h *forwardHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+	h.md.proxyProtocol = mdutil.GetInt(md, "proxyProtocol")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	h.md.httpKeepalive = mdutil.GetBool(md, "http.keepalive")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+	return
+}

go-gost/x/handler/http/handler.go

@@ -0,0 +1,984 @@
+package http
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"encoding/base64"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash/crc32"
+	"io"
+	"math"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	xbypass "github.com/go-gost/x/bypass"
+	ctxvalue "github.com/go-gost/x/ctx"
+	ctx_internal "github.com/go-gost/x/internal/ctx"
+	xio "github.com/go-gost/x/internal/io"
+	xnet "github.com/go-gost/x/internal/net"
+	xhttp "github.com/go-gost/x/internal/net/http"
+	"github.com/go-gost/x/internal/util/sniffing"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	ws_util "github.com/go-gost/x/internal/util/ws"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+	"golang.org/x/net/http/httpguts"
+	"golang.org/x/time/rate"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("http", NewHandler)
+}
+
+type httpHandler struct {
+	md        metadata
+	options   handler.Options
+	stats     *stats_util.HandlerStats
+	limiter   traffic.TrafficLimiter
+	cancel    context.CancelFunc
+	recorder  recorder.RecorderObject
+	certPool  tls_util.CertPool
+	transport http.RoundTripper
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &httpHandler{
+		options: options,
+	}
+}
+
+func (h *httpHandler) Init(md md.Metadata) error {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	h.transport = &http.Transport{
+		DialContext:           h.dial,
+		IdleConnTimeout:       30 * time.Second,
+		ResponseHeaderTimeout: h.md.readTimeout,
+		DisableKeepAlives:     !h.md.keepalive,
+		DisableCompression:    !h.md.compression,
+	}
+
+	return nil
+}
+
+func (h *httpHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Proto:      "http",
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Error("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	br := bufio.NewReader(conn)
+	req, err := http.ReadRequest(br)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer req.Body.Close()
+
+	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
+		ro.ClientIP = clientIP.String()
+	}
+
+	conn = xnet.NewReadWriteConn(br, conn, conn)
+
+	return h.handleRequest(ctx, conn, req, ro, log)
+}
+
+func (h *httpHandler) Close() error {
+	if h.cancel != nil {
+		h.cancel()
+	}
+	return nil
+}
+
+func (h *httpHandler) handleRequest(ctx context.Context, conn net.Conn, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	if !req.URL.IsAbs() && govalidator.IsDNSName(req.Host) {
+		req.URL.Scheme = "http"
+	}
+
+	network := req.Header.Get("X-Gost-Protocol")
+	if network != "udp" {
+		network = "tcp"
+	}
+	ro.Network = network
+
+	// Try to get the actual host.
+	// Compatible with GOST 2.x.
+	if v := req.Header.Get("Gost-Target"); v != "" {
+		if h, err := h.decodeServerName(v); err == nil {
+			req.Host = h
+		}
+	}
+	if v := req.Header.Get("X-Gost-Target"); v != "" {
+		if h, err := h.decodeServerName(v); err == nil {
+			req.Host = h
+		}
+	}
+
+	addr := req.Host
+	if _, port, _ := net.SplitHostPort(addr); port == "" {
+		addr = net.JoinHostPort(strings.Trim(addr, "[]"), "80")
+	}
+	ro.Host = addr
+
+	fields := map[string]any{
+		"dst":  addr,
+		"host": addr,
+	}
+
+	if u, _, _ := h.basicProxyAuth(req.Header.Get("Proxy-Authorization")); u != "" {
+		fields["user"] = u
+		ro.ClientID = u
+	}
+	log = log.WithFields(fields)
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpRequest(req, false)
+		log.Trace(string(dump))
+	}
+	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
+
+	resp := &http.Response{
+		ProtoMajor:    1,
+		ProtoMinor:    1,
+		Header:        h.md.header,
+		ContentLength: -1,
+	}
+	if resp.Header == nil {
+		resp.Header = http.Header{}
+	}
+
+	ro.HTTP = &xrecorder.HTTPRecorderObject{
+		Host:   req.Host,
+		Proto:  req.Proto,
+		Scheme: req.URL.Scheme,
+		Method: req.Method,
+		URI:    req.RequestURI,
+		Request: xrecorder.HTTPRequestRecorderObject{
+			ContentLength: req.ContentLength,
+			Header:        req.Header.Clone(),
+		},
+	}
+	defer func() {
+		ro.HTTP.StatusCode = resp.StatusCode
+		ro.HTTP.Response.Header = resp.Header
+	}()
+
+	if req.Method == "PRI" ||
+		(req.Method != http.MethodConnect && req.URL.Scheme != "http") {
+		resp.StatusCode = http.StatusBadRequest
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpResponse(resp, false)
+			log.Trace(string(dump))
+		}
+
+		return resp.Write(conn)
+	}
+
+	clientID, ok := h.authenticate(ctx, conn, req, resp, log)
+	if !ok {
+		return errors.New("authentication failed")
+	}
+
+	if resp.Header.Get("Proxy-Agent") == "" {
+		resp.Header.Set("Proxy-Agent", h.md.proxyAgent)
+	}
+
+	ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, network, addr) {
+		resp.StatusCode = http.StatusForbidden
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpResponse(resp, false)
+			log.Trace(string(dump))
+		}
+		log.Debug("bypass: ", addr)
+		resp.Write(conn)
+		return xbypass.ErrBypass
+	}
+
+	if network == "udp" {
+		return h.handleUDP(ctx, conn, ro, log)
+	}
+
+	{
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			clientID,
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(addr),
+			limiter.ClientOption(clientID),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(clientID)
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if req.Method != http.MethodConnect {
+		return h.handleProxy(ctx, conn, req, ro, log)
+	}
+
+	ctx = ctx_internal.ContextWithRecorderObject(ctx, ro)
+	ctx = ctxvalue.ContextWithLogger(ctx, log)
+	cc, err := h.dial(ctx, "tcp", addr)
+
+	if err != nil {
+		resp.StatusCode = http.StatusServiceUnavailable
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpResponse(resp, false)
+			log.Trace(string(dump))
+		}
+		resp.Write(conn)
+		return err
+	}
+	defer cc.Close()
+
+	resp.StatusCode = http.StatusOK
+	resp.Status = "200 Connection established"
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+	if err = resp.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	start := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), addr)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(start),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), addr)
+
+	return nil
+}
+
+func (h *httpHandler) handleProxy(ctx context.Context, conn net.Conn, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	ro.Time = time.Time{}
+
+	if close, err := h.proxyRoundTrip(ctx, conn, req, ro, &pStats, log); err != nil || close {
+		return err
+	}
+
+	br := bufio.NewReader(conn)
+	for {
+		pStats.Reset()
+
+		req, err := http.ReadRequest(br)
+		if err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
+				return nil
+			}
+			return err
+		}
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpRequest(req, false)
+			log.Trace(string(dump))
+		}
+
+		if close, err := h.proxyRoundTrip(ctx, xio.NewReadWriter(br, conn), req, ro, &pStats, log); err != nil || close {
+			return err
+		}
+	}
+}
+
+func (h *httpHandler) proxyRoundTrip(ctx context.Context, rw io.ReadWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, pStats stats.Stats, log logger.Logger) (close bool, err error) {
+	close = true
+
+	ro2 := &xrecorder.HandlerRecorderObject{}
+	*ro2 = *ro
+	ro = ro2
+
+	host := req.Host
+	if _, port, _ := net.SplitHostPort(host); port == "" {
+		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
+	}
+	ro.Host = host
+	ro.Time = time.Now()
+
+	log = log.WithFields(map[string]any{
+		"host": host,
+	})
+
+	log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(ro.Time)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(ro.Time),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >-< %s", ro.RemoteAddr, req.Host)
+	}()
+
+	ro.HTTP = &xrecorder.HTTPRecorderObject{
+		Host:   req.Host,
+		Proto:  req.Proto,
+		Scheme: req.URL.Scheme,
+		Method: req.Method,
+		URI:    req.RequestURI,
+		Request: xrecorder.HTTPRequestRecorderObject{
+			ContentLength: req.ContentLength,
+			Header:        req.Header.Clone(),
+		},
+	}
+	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
+		ro.ClientIP = clientIP.String()
+	}
+
+	clientAddr := ro.RemoteAddr
+	if ro.ClientIP != "" {
+		if _, port, _ := net.SplitHostPort(ro.RemoteAddr); port != "" {
+			clientAddr = net.JoinHostPort(ro.ClientIP, port)
+		}
+	}
+
+	// HTTP/1.0
+	http10 := req.ProtoMajor == 1 && req.ProtoMinor == 0
+	if http10 {
+		if strings.ToLower(req.Header.Get("Connection")) == "keep-alive" {
+			req.Header.Del("Connection")
+		} else {
+			req.Header.Set("Connection", "close")
+		}
+	}
+
+	req.Header.Del("Proxy-Authorization")
+	req.Header.Del("Proxy-Connection")
+	req.Header.Del("Gost-Target")
+	req.Header.Del("X-Gost-Target")
+
+	res := &http.Response{
+		ProtoMajor: req.ProtoMajor,
+		ProtoMinor: req.ProtoMinor,
+		Header:     http.Header{},
+		StatusCode: http.StatusServiceUnavailable,
+	}
+	ro.HTTP.StatusCode = res.StatusCode
+
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, "tcp", host) {
+		res.StatusCode = http.StatusForbidden
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpResponse(res, false)
+			log.Trace(string(dump))
+		}
+		log.Debug("bypass: ", host)
+		res.Write(rw)
+		err = xbypass.ErrBypass
+		return
+	}
+
+	var reqBody *xhttp.Body
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		if req.Body != nil {
+			bodySize := opts.MaxBodySize
+			if bodySize <= 0 {
+				bodySize = sniffing.DefaultBodySize
+			}
+			if bodySize > sniffing.MaxBodySize {
+				bodySize = sniffing.MaxBodySize
+			}
+			reqBody = xhttp.NewBody(req.Body, bodySize)
+			req.Body = reqBody
+		}
+	}
+
+	ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(clientAddr))
+	ctx = ctx_internal.ContextWithRecorderObject(ctx, ro)
+	ctx = ctxvalue.ContextWithLogger(ctx, log)
+
+	resp, err := h.transport.RoundTrip(req.WithContext(ctx))
+
+	if reqBody != nil {
+		ro.HTTP.Request.Body = reqBody.Content()
+		ro.HTTP.Request.ContentLength = reqBody.Length()
+	}
+
+	if err != nil {
+		res.Write(rw)
+		return
+	}
+	defer resp.Body.Close()
+
+	ro.HTTP.StatusCode = resp.StatusCode
+	ro.HTTP.Response.Header = resp.Header.Clone()
+	ro.HTTP.Response.ContentLength = resp.ContentLength
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+
+	// HTTP/1.0
+	if http10 {
+		if !resp.Close {
+			resp.Header.Set("Connection", "keep-alive")
+		}
+		resp.ProtoMajor = 1
+		resp.ProtoMinor = 0
+	}
+
+	if resp.StatusCode == http.StatusSwitchingProtocols {
+		err = h.handleUpgradeResponse(ctx, rw, req, resp, ro, log)
+		return
+	}
+
+	var respBody *xhttp.Body
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		bodySize := opts.MaxBodySize
+		if bodySize <= 0 {
+			bodySize = sniffing.DefaultBodySize
+		}
+		if bodySize > sniffing.MaxBodySize {
+			bodySize = sniffing.MaxBodySize
+		}
+		respBody = xhttp.NewBody(resp.Body, bodySize)
+		resp.Body = respBody
+	}
+
+	err = resp.Write(rw)
+
+	if respBody != nil {
+		ro.HTTP.Response.Body = respBody.Content()
+		ro.HTTP.Response.ContentLength = respBody.Length()
+	}
+
+	if err != nil {
+		err = fmt.Errorf("write response: %v", err)
+		return
+	}
+
+	if resp.ContentLength >= 0 {
+		close = resp.Close
+	}
+
+	return
+}
+
+func (h *httpHandler) dial(ctx context.Context, network, addr string) (conn net.Conn, err error) {
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
+	}
+
+	if log := ctxvalue.LoggerFromContext(ctx); log != nil {
+		log.Debugf("dial: new connection to host %s", addr)
+	}
+
+	var buf bytes.Buffer
+	conn, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, addr)
+	if ro := ctx_internal.RecorderObjectFromContext(ctx); ro != nil {
+		ro.Route = buf.String()
+	}
+
+	return
+}
+
+func upgradeType(h http.Header) string {
+	if !httpguts.HeaderValuesContainsToken(h["Connection"], "Upgrade") {
+		return ""
+	}
+	return h.Get("Upgrade")
+}
+
+func (h *httpHandler) handleUpgradeResponse(ctx context.Context, rw io.ReadWriter, req *http.Request, res *http.Response, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	reqUpType := upgradeType(req.Header)
+	resUpType := upgradeType(res.Header)
+	if !strings.EqualFold(reqUpType, resUpType) {
+		return fmt.Errorf("backend tried to switch protocol %q when %q was requested", resUpType, reqUpType)
+	}
+
+	backConn, ok := res.Body.(io.ReadWriteCloser)
+	if !ok {
+		return fmt.Errorf("internal error: 101 switching protocols response with non-writable body")
+	}
+
+	res.Body = nil
+	if err := res.Write(rw); err != nil {
+		return fmt.Errorf("response write: %v", err)
+	}
+
+	if reqUpType == "websocket" && h.md.sniffingWebsocket {
+		return h.sniffingWebsocketFrame(ctx, rw, backConn, ro, log)
+	}
+
+	return xnet.Transport(rw, backConn)
+}
+
+func (h *httpHandler) sniffingWebsocketFrame(ctx context.Context, rw, cc io.ReadWriter, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	errc := make(chan error, 1)
+
+	sampleRate := h.md.sniffingWebsocketSampleRate
+	if sampleRate == 0 {
+		sampleRate = sniffing.DefaultSampleRate
+	}
+	if sampleRate < 0 {
+		sampleRate = math.MaxFloat64
+	}
+
+	go func() {
+		ro2 := &xrecorder.HandlerRecorderObject{}
+		*ro2 = *ro
+		ro := ro2
+
+		limiter := rate.NewLimiter(rate.Limit(sampleRate), int(sampleRate))
+
+		buf := &bytes.Buffer{}
+		for {
+			start := time.Now()
+
+			if err := h.copyWebsocketFrame(cc, rw, buf, "client", ro); err != nil {
+				errc <- err
+				return
+			}
+
+			if limiter.Allow() {
+				ro.Duration = time.Since(start)
+				ro.Time = time.Now()
+				if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+					log.Errorf("record: %v", err)
+				}
+			}
+		}
+	}()
+
+	go func() {
+		ro2 := &xrecorder.HandlerRecorderObject{}
+		*ro2 = *ro
+		ro := ro2
+
+		limiter := rate.NewLimiter(rate.Limit(sampleRate), int(sampleRate))
+
+		buf := &bytes.Buffer{}
+		for {
+			start := time.Now()
+
+			if err := h.copyWebsocketFrame(rw, cc, buf, "server", ro); err != nil {
+				errc <- err
+				return
+			}
+
+			if limiter.Allow() {
+				ro.Duration = time.Since(start)
+				ro.Time = time.Now()
+				if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+					log.Errorf("record: %v", err)
+				}
+			}
+		}
+	}()
+
+	<-errc
+	return nil
+}
+
+func (h *httpHandler) copyWebsocketFrame(w io.Writer, r io.Reader, buf *bytes.Buffer, from string, ro *xrecorder.HandlerRecorderObject) (err error) {
+	fr := ws_util.Frame{}
+	if _, err = fr.ReadFrom(r); err != nil {
+		return err
+	}
+
+	ws := &xrecorder.WebsocketRecorderObject{
+		From:    from,
+		Fin:     fr.Header.Fin,
+		Rsv1:    fr.Header.Rsv1,
+		Rsv2:    fr.Header.Rsv2,
+		Rsv3:    fr.Header.Rsv3,
+		OpCode:  int(fr.Header.OpCode),
+		Masked:  fr.Header.Masked,
+		MaskKey: fr.Header.MaskKey,
+		Length:  fr.Header.PayloadLength,
+	}
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		bodySize := opts.MaxBodySize
+		if bodySize <= 0 {
+			bodySize = sniffing.DefaultBodySize
+		}
+		if bodySize > sniffing.MaxBodySize {
+			bodySize = sniffing.MaxBodySize
+		}
+
+		buf.Reset()
+		if _, err := io.Copy(buf, io.LimitReader(fr.Data, int64(bodySize))); err != nil {
+			return err
+		}
+		ws.Payload = buf.Bytes()
+	}
+
+	ro.Websocket = ws
+	length := uint64(fr.Header.Length()) + uint64(fr.Header.PayloadLength)
+	if from == "client" {
+		ro.InputBytes = length
+		ro.OutputBytes = 0
+	} else {
+		ro.InputBytes = 0
+		ro.OutputBytes = length
+	}
+
+	fr.Data = io.MultiReader(bytes.NewReader(buf.Bytes()), fr.Data)
+	if _, err := fr.WriteTo(w); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (h *httpHandler) decodeServerName(s string) (string, error) {
+	b, err := base64.RawURLEncoding.DecodeString(s)
+	if err != nil {
+		return "", err
+	}
+	if len(b) < 4 {
+		return "", errors.New("invalid name")
+	}
+	v, err := base64.RawURLEncoding.DecodeString(string(b[4:]))
+	if err != nil {
+		return "", err
+	}
+	if crc32.ChecksumIEEE(v) != binary.BigEndian.Uint32(b[:4]) {
+		return "", errors.New("invalid name")
+	}
+	return string(v), nil
+}
+
+func (h *httpHandler) basicProxyAuth(proxyAuth string) (username, password string, ok bool) {
+	if proxyAuth == "" {
+		return
+	}
+
+	if !strings.HasPrefix(proxyAuth, "Basic ") {
+		return
+	}
+	c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(proxyAuth, "Basic "))
+	if err != nil {
+		return
+	}
+	cs := string(c)
+	s := strings.IndexByte(cs, ':')
+	if s < 0 {
+		return
+	}
+
+	return cs[:s], cs[s+1:], true
+}
+
+func (h *httpHandler) authenticate(ctx context.Context, conn net.Conn, req *http.Request, resp *http.Response, log logger.Logger) (id string, ok bool) {
+	u, p, _ := h.basicProxyAuth(req.Header.Get("Proxy-Authorization"))
+	if h.options.Auther == nil {
+		return "", true
+	}
+	if id, ok = h.options.Auther.Authenticate(ctx, u, p); ok {
+		return
+	}
+
+	pr := h.md.probeResistance
+	// probing resistance is enabled, and knocking host is mismatch.
+	if pr != nil && (pr.Knock == "" || !strings.EqualFold(req.URL.Hostname(), pr.Knock)) {
+		resp.StatusCode = http.StatusServiceUnavailable // default status code
+
+		switch pr.Type {
+		case "code":
+			resp.StatusCode, _ = strconv.Atoi(pr.Value)
+		case "web":
+			url := pr.Value
+			if !strings.HasPrefix(url, "http") {
+				url = "http://" + url
+			}
+			r, err := http.Get(url)
+			if err != nil {
+				log.Error(err)
+				break
+			}
+			resp = r
+			defer resp.Body.Close()
+		case "host":
+			cc, err := net.Dial("tcp", pr.Value)
+			if err != nil {
+				log.Error(err)
+				break
+			}
+			defer cc.Close()
+
+			req.Write(cc)
+			xnet.Transport(conn, cc)
+			return
+		case "file":
+			f, _ := os.Open(pr.Value)
+			if f != nil {
+				defer f.Close()
+
+				resp.StatusCode = http.StatusOK
+				if finfo, _ := f.Stat(); finfo != nil {
+					resp.ContentLength = finfo.Size()
+				}
+				resp.Header.Set("Content-Type", "text/html")
+				resp.Body = f
+			}
+		}
+	}
+
+	if resp.Header == nil {
+		resp.Header = http.Header{}
+	}
+	if resp.StatusCode == 0 {
+		realm := defaultRealm
+		if h.md.authBasicRealm != "" {
+			realm = h.md.authBasicRealm
+		}
+		resp.StatusCode = http.StatusProxyAuthRequired
+		resp.Header.Add("Proxy-Authenticate", fmt.Sprintf("Basic realm=\"%s\"", realm))
+		if strings.ToLower(req.Header.Get("Proxy-Connection")) == "keep-alive" {
+			// XXX libcurl will keep sending auth request in same conn
+			// which we don't supported yet.
+			resp.Header.Set("Connection", "close")
+			resp.Header.Set("Proxy-Connection", "close")
+		}
+
+		log.Debug("proxy authentication required")
+	} else {
+		// resp.Header.Set("Server", "nginx/1.20.1")
+		// resp.Header.Set("Date", time.Now().Format(http.TimeFormat))
+		if resp.StatusCode == http.StatusOK {
+			resp.Header.Set("Connection", "keep-alive")
+		}
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+
+	resp.Write(conn)
+	return
+}
+
+func (h *httpHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *httpHandler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/http/metadata.go

@@ -0,0 +1,126 @@
+package http
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+const (
+	defaultRealm      = "gost"
+	defaultProxyAgent = "gost/3.0"
+)
+
+type metadata struct {
+	readTimeout     time.Duration
+	keepalive       bool
+	compression     bool
+	probeResistance *probeResistance
+	enableUDP       bool
+	header          http.Header
+	hash            string
+	authBasicRealm  string
+	proxyAgent      string
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *httpHandler) parseMetadata(md mdata.Metadata) error {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	if m := mdutil.GetStringMapString(md, "http.header", "header"); len(m) > 0 {
+		hd := http.Header{}
+		for k, v := range m {
+			hd.Add(k, v)
+		}
+		h.md.header = hd
+	}
+
+	h.md.keepalive = mdutil.GetBool(md, "http.keepalive", "keepalive")
+	h.md.compression = mdutil.GetBool(md, "http.compression", "compression")
+
+	if pr := mdutil.GetString(md, "probeResist", "probe_resist"); pr != "" {
+		if ss := strings.SplitN(pr, ":", 2); len(ss) == 2 {
+			h.md.probeResistance = &probeResistance{
+				Type:  ss[0],
+				Value: ss[1],
+				Knock: mdutil.GetString(md, "knock"),
+			}
+		}
+	}
+	h.md.enableUDP = mdutil.GetBool(md, "udp")
+	h.md.hash = mdutil.GetString(md, "hash")
+	h.md.authBasicRealm = mdutil.GetString(md, "authBasicRealm")
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.proxyAgent = mdutil.GetString(md, "http.proxyAgent", "proxyAgent")
+	if h.md.proxyAgent == "" {
+		h.md.proxyAgent = defaultProxyAgent
+	}
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return nil
+}
+
+type probeResistance struct {
+	Type  string
+	Value string
+	Knock string
+}

go-gost/x/handler/http/udp.go

@@ -0,0 +1,85 @@
+package http
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"time"
+
+	"github.com/go-gost/core/logger"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/socks"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *httpHandler) handleUDP(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"cmd": "udp",
+	})
+
+	resp := &http.Response{
+		ProtoMajor: 1,
+		ProtoMinor: 1,
+		Header:     h.md.header,
+	}
+	if resp.Header == nil {
+		resp.Header = http.Header{}
+	}
+
+	if !h.md.enableUDP {
+		resp.StatusCode = http.StatusForbidden
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpResponse(resp, false)
+			log.Trace(string(dump))
+		}
+
+		log.Error("http: UDP relay is disabled")
+
+		return resp.Write(conn)
+	}
+
+	resp.StatusCode = http.StatusOK
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+	if err := resp.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	// obtain a udp connection
+	var buf bytes.Buffer
+	c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer c.Close()
+
+	pc, ok := c.(net.PacketConn)
+	if !ok {
+		err = errors.New("wrong connection type")
+		log.Error(err)
+		return err
+	}
+
+	relay := udp.NewRelay(socks.UDPTunServerConn(conn), pc).
+		WithBypass(h.options.Bypass).
+		WithLogger(log)
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), pc.LocalAddr())
+	relay.Run(ctx)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), pc.LocalAddr())
+
+	return nil
+}

go-gost/x/handler/http2/conn.go

@@ -0,0 +1,33 @@
+package http2
+
+import (
+	"errors"
+	"io"
+	"net/http"
+)
+
+type flushWriter struct {
+	w io.Writer
+}
+
+func (fw flushWriter) Write(p []byte) (n int, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if s, ok := r.(string); ok {
+				err = errors.New(s)
+				return
+			}
+			err = r.(error)
+		}
+	}()
+
+	n, err = fw.w.Write(p)
+	if err != nil {
+		// log.Log("flush writer:", err)
+		return
+	}
+	if f, ok := fw.w.(http.Flusher); ok {
+		f.Flush()
+	}
+	return
+}

go-gost/x/handler/http2/handler.go

@@ -0,0 +1,515 @@
+package http2
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash/crc32"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	xbypass "github.com/go-gost/x/bypass"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xio "github.com/go-gost/x/internal/io"
+	xnet "github.com/go-gost/x/internal/net"
+	xhttp "github.com/go-gost/x/internal/net/http"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("http2", NewHandler)
+}
+
+type http2Handler struct {
+	md       metadata
+	options  handler.Options
+	stats    *stats_util.HandlerStats
+	limiter  traffic.TrafficLimiter
+	cancel   context.CancelFunc
+	recorder recorder.RecorderObject
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &http2Handler{
+		options: options,
+	}
+}
+
+func (h *http2Handler) Init(md md.Metadata) error {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	return nil
+}
+
+func (h *http2Handler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Network:    "tcp",
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.Duration = time.Since(start)
+		ro.Record(ctx, h.recorder.Recorder)
+
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	v, ok := conn.(md.Metadatable)
+	if !ok || v == nil {
+		err = errors.New("wrong connection type")
+		log.Error(err)
+		return err
+	}
+
+	md := v.Metadata()
+	return h.roundTrip(ctx,
+		md.Get("w").(http.ResponseWriter),
+		md.Get("r").(*http.Request),
+		ro,
+		log,
+	)
+}
+
+func (h *http2Handler) Close() error {
+	if h.cancel != nil {
+		h.cancel()
+	}
+	return nil
+}
+
+// NOTE: there is an issue (golang/go#43989) will cause the client hangs
+// when server returns an non-200 status code,
+// May be fixed in go1.18.
+func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	// Try to get the actual host.
+	// Compatible with GOST 2.x.
+	if v := req.Header.Get("Gost-Target"); v != "" {
+		if h, err := h.decodeServerName(v); err == nil {
+			req.Host = h
+		}
+	}
+	if v := req.Header.Get("X-Gost-Target"); v != "" {
+		if h, err := h.decodeServerName(v); err == nil {
+			req.Host = h
+		}
+	}
+
+	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
+		ro.ClientIP = clientIP.String()
+	}
+
+	host := req.Host
+	if _, port, _ := net.SplitHostPort(host); port == "" {
+		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
+	}
+	ro.Host = host
+
+	fields := map[string]any{
+		"dst":  host,
+		"host": host,
+	}
+	if u, _, _ := h.basicProxyAuth(req.Header.Get("Proxy-Authorization")); u != "" {
+		fields["user"] = u
+		ro.ClientID = u
+	}
+	log = log.WithFields(fields)
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpRequest(req, false)
+		log.Trace(string(dump))
+	}
+	log.Debugf("%s >> %s", req.RemoteAddr, host)
+
+	for k := range h.md.header {
+		w.Header().Set(k, h.md.header.Get(k))
+	}
+
+	resp := &http.Response{
+		ProtoMajor: 2,
+		ProtoMinor: 0,
+		Header:     w.Header(),
+		Body:       io.NopCloser(bytes.NewReader([]byte{})),
+	}
+
+	ro.HTTP = &xrecorder.HTTPRecorderObject{
+		Host:   req.Host,
+		Proto:  req.Proto,
+		Scheme: req.URL.Scheme,
+		Method: req.Method,
+		URI:    req.RequestURI,
+		Request: xrecorder.HTTPRequestRecorderObject{
+			ContentLength: req.ContentLength,
+			Header:        req.Header.Clone(),
+		},
+	}
+	defer func() {
+		ro.HTTP.StatusCode = resp.StatusCode
+		ro.HTTP.Response.Header = resp.Header
+	}()
+
+	clientID, ok := h.authenticate(ctx, w, req, resp, log)
+	if !ok {
+		return errors.New("authentication failed")
+	}
+	ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", host) {
+		resp.StatusCode = http.StatusForbidden
+		w.WriteHeader(resp.StatusCode)
+		log.Debug("bypass: ", host)
+		return xbypass.ErrBypass
+	}
+
+	// delete the proxy related headers.
+	req.Header.Del("Proxy-Authorization")
+	req.Header.Del("Proxy-Connection")
+	req.Header.Del("Gost-Target")
+	req.Header.Del("X-Gost-Target")
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: host})
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", host)
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		resp.StatusCode = http.StatusServiceUnavailable
+		w.WriteHeader(resp.StatusCode)
+		return err
+	}
+	defer cc.Close()
+
+	if req.Method == http.MethodConnect {
+		resp.StatusCode = http.StatusOK
+		w.WriteHeader(http.StatusOK)
+		if fw, ok := w.(http.Flusher); ok {
+			fw.Flush()
+		}
+
+		rw := xio.NewReadWriter(req.Body, flushWriter{w})
+
+		// compatible with HTTP1.x
+		if hj, ok := w.(http.Hijacker); ok && req.ProtoMajor == 1 {
+			// we take over the underly connection
+			conn, _, err := hj.Hijack()
+			if err != nil {
+				log.Error(err)
+				resp.StatusCode = http.StatusInternalServerError
+				w.WriteHeader(http.StatusInternalServerError)
+				return err
+			}
+			defer conn.Close()
+
+			rw = conn
+		}
+
+		rw = traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			rw,
+			clientID,
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption("tcp"),
+			limiter.AddrOption(host),
+			limiter.ClientOption(clientID),
+			limiter.SrcOption(req.RemoteAddr),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(clientID)
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		start := time.Now()
+		log.Infof("%s <-> %s", req.RemoteAddr, host)
+		xnet.Transport(rw, cc)
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >-< %s", req.RemoteAddr, host)
+		return nil
+	}
+
+	// TODO: forward request
+	resp.StatusCode = http.StatusBadRequest
+	w.WriteHeader(resp.StatusCode)
+	return nil
+}
+
+func (h *http2Handler) decodeServerName(s string) (string, error) {
+	b, err := base64.RawURLEncoding.DecodeString(s)
+	if err != nil {
+		return "", err
+	}
+	if len(b) < 4 {
+		return "", errors.New("invalid name")
+	}
+	v, err := base64.RawURLEncoding.DecodeString(string(b[4:]))
+	if err != nil {
+		return "", err
+	}
+	if crc32.ChecksumIEEE(v) != binary.BigEndian.Uint32(b[:4]) {
+		return "", errors.New("invalid name")
+	}
+	return string(v), nil
+}
+
+func (h *http2Handler) basicProxyAuth(proxyAuth string) (username, password string, ok bool) {
+	if proxyAuth == "" {
+		return
+	}
+
+	if !strings.HasPrefix(proxyAuth, "Basic ") {
+		return
+	}
+	c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(proxyAuth, "Basic "))
+	if err != nil {
+		return
+	}
+	cs := string(c)
+	s := strings.IndexByte(cs, ':')
+	if s < 0 {
+		return
+	}
+
+	return cs[:s], cs[s+1:], true
+}
+
+func (h *http2Handler) authenticate(ctx context.Context, w http.ResponseWriter, r *http.Request, resp *http.Response, log logger.Logger) (id string, ok bool) {
+	u, p, _ := h.basicProxyAuth(r.Header.Get("Proxy-Authorization"))
+	if h.options.Auther == nil {
+		return "", true
+	}
+	if id, ok = h.options.Auther.Authenticate(ctx, u, p); ok {
+		return
+	}
+
+	pr := h.md.probeResistance
+	// probing resistance is enabled, and knocking host is mismatch.
+	if pr != nil && (pr.Knock == "" || !strings.EqualFold(r.URL.Hostname(), pr.Knock)) {
+		resp.StatusCode = http.StatusServiceUnavailable // default status code
+		switch pr.Type {
+		case "code":
+			resp.StatusCode, _ = strconv.Atoi(pr.Value)
+		case "web":
+			url := pr.Value
+			if !strings.HasPrefix(url, "http") {
+				url = "http://" + url
+			}
+			r, err := http.Get(url)
+			if err != nil {
+				log.Error(err)
+				break
+			}
+			resp = r
+			defer resp.Body.Close()
+		case "host":
+			cc, err := net.Dial("tcp", pr.Value)
+			if err != nil {
+				log.Error(err)
+				break
+			}
+			defer cc.Close()
+
+			if err := h.forwardRequest(w, r, cc); err != nil {
+				log.Error(err)
+			}
+			return
+		case "file":
+			f, _ := os.Open(pr.Value)
+			if f != nil {
+				defer f.Close()
+
+				resp.StatusCode = http.StatusOK
+				if finfo, _ := f.Stat(); finfo != nil {
+					resp.ContentLength = finfo.Size()
+				}
+				resp.Header.Set("Content-Type", "text/html")
+				resp.Body = f
+			}
+		}
+	}
+
+	if resp.StatusCode == 0 {
+		realm := defaultRealm
+		if h.md.authBasicRealm != "" {
+			realm = h.md.authBasicRealm
+		}
+		resp.StatusCode = http.StatusProxyAuthRequired
+		resp.Header.Add("Proxy-Authenticate", fmt.Sprintf("Basic realm=\"%s\"", realm))
+		if strings.ToLower(r.Header.Get("Proxy-Connection")) == "keep-alive" {
+			// XXX libcurl will keep sending auth request in same conn
+			// which we don't supported yet.
+			resp.Header.Set("Connection", "close")
+			resp.Header.Set("Proxy-Connection", "close")
+		}
+
+		log.Debug("proxy authentication required")
+	} else {
+		resp.Header = http.Header{}
+		// resp.Header.Set("Server", "nginx/1.20.1")
+		// resp.Header.Set("Date", time.Now().Format(http.TimeFormat))
+		if resp.StatusCode == http.StatusOK {
+			resp.Header.Set("Connection", "keep-alive")
+		}
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+
+	h.writeResponse(w, resp)
+
+	return
+}
+func (h *http2Handler) forwardRequest(w http.ResponseWriter, r *http.Request, rw io.ReadWriter) (err error) {
+	if err = r.Write(rw); err != nil {
+		return
+	}
+
+	resp, err := http.ReadResponse(bufio.NewReader(rw), r)
+	if err != nil {
+		return
+	}
+	defer resp.Body.Close()
+
+	return h.writeResponse(w, resp)
+}
+
+func (h *http2Handler) writeResponse(w http.ResponseWriter, resp *http.Response) error {
+	for k, v := range resp.Header {
+		for _, vv := range v {
+			w.Header().Add(k, vv)
+		}
+	}
+	w.WriteHeader(resp.StatusCode)
+	_, err := io.Copy(flushWriter{w}, resp.Body)
+	return err
+}
+
+func (h *http2Handler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *http2Handler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/http2/metadata.go

@@ -0,0 +1,68 @@
+package http2
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+const (
+	defaultRealm = "gost"
+)
+
+type metadata struct {
+	probeResistance      *probeResistance
+	header               http.Header
+	hash                 string
+	authBasicRealm       string
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *http2Handler) parseMetadata(md mdata.Metadata) error {
+	if m := mdutil.GetStringMapString(md, "http.header", "header"); len(m) > 0 {
+		hd := http.Header{}
+		for k, v := range m {
+			hd.Add(k, v)
+		}
+		h.md.header = hd
+	}
+
+	if pr := mdutil.GetString(md, "probeResist", "probe_resist"); pr != "" {
+		if ss := strings.SplitN(pr, ":", 2); len(ss) == 2 {
+			h.md.probeResistance = &probeResistance{
+				Type:  ss[0],
+				Value: ss[1],
+				Knock: mdutil.GetString(md, "knock"),
+			}
+		}
+	}
+	h.md.hash = mdutil.GetString(md, "hash")
+	h.md.authBasicRealm = mdutil.GetString(md, "authBasicRealm")
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return nil
+}
+
+type probeResistance struct {
+	Type  string
+	Value string
+	Knock string
+}

go-gost/x/handler/http3/handler.go

@@ -0,0 +1,176 @@
+package http3
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("http3", NewHandler)
+}
+
+type http3Handler struct {
+	hop     hop.Hop
+	md      metadata
+	options handler.Options
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &http3Handler{
+		options: options,
+	}
+}
+
+func (h *http3Handler) Init(md md.Metadata) error {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Forward implements handler.Forwarder.
+func (h *http3Handler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *http3Handler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	defer conn.Close()
+
+	start := time.Now()
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+	defer func() {
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return nil
+	}
+
+	v, ok := conn.(md.Metadatable)
+	if !ok || v == nil {
+		err := errors.New("wrong connection type")
+		log.Error(err)
+		return err
+	}
+	md := v.Metadata()
+	return h.roundTrip(ctx,
+		md.Get("w").(http.ResponseWriter),
+		md.Get("r").(*http.Request),
+		log,
+	)
+}
+
+func (h *http3Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req *http.Request, log logger.Logger) error {
+	addr := req.Host
+	if _, port, _ := net.SplitHostPort(addr); port == "" {
+		addr = net.JoinHostPort(strings.Trim(addr, "[]"), "80")
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpRequest(req, false)
+		log.Trace(string(dump))
+	}
+
+	for k := range h.md.header {
+		w.Header().Set(k, h.md.header.Get(k))
+	}
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "udp", addr) {
+		w.WriteHeader(http.StatusForbidden)
+		log.Debug("bypass: ", addr)
+		return nil
+	}
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
+	}
+
+	var target *chain.Node
+	if h.hop != nil {
+		target = h.hop.Select(ctx, hop.HostSelectOption(addr))
+	}
+	if target == nil {
+		err := errors.New("target not available")
+		log.Error(err)
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"dst":  fmt.Sprintf("%s/%s", target.Addr, "tcp"),
+		"host": target.Addr,
+	})
+
+	log.Debugf("%s >> %s", req.RemoteAddr, addr)
+
+	rp := &httputil.ReverseProxy{
+		Director: func(r *http.Request) {
+			r.URL.Scheme = "http"
+			r.URL.Host = req.Host
+			dump, _ := httputil.DumpRequest(r, false)
+			log.Debug(string(dump))
+		},
+		Transport: &http.Transport{
+			ForceAttemptHTTP2:     true,
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+				conn, err := h.options.Router.Dial(ctx, network, target.Addr)
+				if err != nil {
+					log.Error(err)
+					// TODO: the router itself may be failed due to the failed node in the router,
+					// the dead marker may be a wrong operation.
+					if marker := target.Marker(); marker != nil {
+						marker.Mark()
+					}
+				}
+				return conn, err
+			},
+		},
+	}
+
+	rp.ServeHTTP(w, req)
+
+	return nil
+}
+
+func (h *http3Handler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}

go-gost/x/handler/http3/metadata.go

@@ -0,0 +1,56 @@
+package http3
+
+import (
+	"net/http"
+	"strings"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+type metadata struct {
+	probeResistance *probeResistance
+	header          http.Header
+	hash            string
+}
+
+func (h *http3Handler) parseMetadata(md mdata.Metadata) error {
+	const (
+		header          = "header"
+		probeResistKey  = "probeResistance"
+		probeResistKeyX = "probe_resist"
+		knock           = "knock"
+		hash            = "hash"
+	)
+
+	if m := mdutil.GetStringMapString(md, header); len(m) > 0 {
+		hd := http.Header{}
+		for k, v := range m {
+			hd.Add(k, v)
+		}
+		h.md.header = hd
+	}
+
+	pr := mdutil.GetString(md, probeResistKey)
+	if pr == "" {
+		pr = mdutil.GetString(md, probeResistKeyX)
+	}
+	if pr != "" {
+		if ss := strings.SplitN(pr, ":", 2); len(ss) == 2 {
+			h.md.probeResistance = &probeResistance{
+				Type:  ss[0],
+				Value: ss[1],
+				Knock: mdutil.GetString(md, knock),
+			}
+		}
+	}
+	h.md.hash = mdutil.GetString(md, hash)
+
+	return nil
+}
+
+type probeResistance struct {
+	Type  string
+	Value string
+	Knock string
+}

go-gost/x/handler/metrics/handler.go

@@ -0,0 +1,115 @@
+package metrics
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	md "github.com/go-gost/core/metadata"
+	xmetrics "github.com/go-gost/x/metrics"
+	"github.com/go-gost/x/registry"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("metrics", NewHandler)
+}
+
+type metricsHandler struct {
+	handler http.Handler
+	mux     *http.ServeMux
+	md      metadata
+	options handler.Options
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &metricsHandler{
+		options: options,
+	}
+}
+
+func (h *metricsHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	xmetrics.Enable(true)
+
+	h.handler = promhttp.Handler()
+
+	mux := http.NewServeMux()
+	mux.Handle(h.md.path, http.HandlerFunc(h.handleFunc))
+	h.mux = mux
+
+	return
+}
+
+func (h *metricsHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	l := &singleConnListener{
+		conn: make(chan net.Conn, 1),
+	}
+	l.send(conn)
+
+	s := http.Server{
+		Handler: h.mux,
+	}
+	s.Serve(l)
+
+	return s.Shutdown(ctx)
+}
+
+func (h *metricsHandler) Close() error {
+	return nil
+}
+
+func (h *metricsHandler) handleFunc(w http.ResponseWriter, r *http.Request) {
+	if auther := h.options.Auther; auther != nil {
+		u, p, _ := r.BasicAuth()
+		if _, ok := auther.Authenticate(r.Context(), u, p); !ok {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+	}
+
+	log := h.options.Logger
+	start := time.Now()
+
+	h.handler.ServeHTTP(w, r)
+
+	log = log.WithFields(map[string]any{
+		"remote":   r.RemoteAddr,
+		"duration": time.Since(start),
+	})
+	log.Infof("%s %s", r.Method, r.RequestURI)
+}
+
+type singleConnListener struct {
+	conn chan net.Conn
+}
+
+func (l *singleConnListener) Accept() (net.Conn, error) {
+	if conn, ok := <-l.conn; ok {
+		return conn, nil
+	}
+	return nil, net.ErrClosed
+}
+
+func (l *singleConnListener) Close() error {
+	return nil
+}
+
+func (l *singleConnListener) Addr() net.Addr {
+	return &net.TCPAddr{}
+}
+
+func (l *singleConnListener) send(conn net.Conn) {
+	l.conn <- conn
+	close(l.conn)
+}

go-gost/x/handler/metrics/metadata.go

@@ -0,0 +1,22 @@
+package metrics
+
+import (
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+const (
+	DefaultPath = "/metrics"
+)
+
+type metadata struct {
+	path string
+}
+
+func (h *metricsHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.path = mdutil.GetString(md, "metrics.path", "path")
+	if h.md.path == "" {
+		h.md.path = DefaultPath
+	}
+	return
+}

go-gost/x/handler/redirect/tcp/handler.go

@@ -0,0 +1,259 @@
+package redirect
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	xbypass "github.com/go-gost/x/bypass"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	xstats "github.com/go-gost/x/observer/stats"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("red", NewHandler)
+	registry.HandlerRegistry().Register("redir", NewHandler)
+	registry.HandlerRegistry().Register("redirect", NewHandler)
+}
+
+type redirectHandler struct {
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &redirectHandler{
+		options: options,
+	}
+}
+
+func (h *redirectHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return
+}
+
+func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "tcp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	var dstAddr net.Addr
+
+	if h.md.tproxy {
+		dstAddr = conn.LocalAddr()
+	} else {
+		dstAddr, err = h.getOriginalDstAddr(conn)
+		if err != nil {
+			log.Error(err)
+			return
+		}
+	}
+
+	ro.Host = dstAddr.String()
+	ro.Dst = dstAddr.String()
+
+	log = log.WithFields(map[string]any{
+		"dst":  fmt.Sprintf("%s/%s", dstAddr, dstAddr.Network()),
+		"host": dstAddr.String(),
+	})
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			var cc net.Conn
+			var err error
+			if address != "" {
+				host, _, _ := net.SplitHostPort(address)
+				if host == "" {
+					host = address
+				}
+				_, port, _ := net.SplitHostPort(dstAddr.String())
+				address = net.JoinHostPort(strings.Trim(host, "[]"), port)
+				ro.Host = address
+
+				var buf bytes.Buffer
+				cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+				ro.Route = buf.String()
+				if err != nil && !h.md.sniffingFallback {
+					return nil, err
+				}
+			}
+
+			if cc == nil {
+				if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", dstAddr.String()) {
+					return nil, xbypass.ErrBypass
+				}
+				var buf bytes.Buffer
+				cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", dstAddr.String())
+				ro.Route = buf.String()
+				ro.Host = dstAddr.String()
+			}
+
+			return cc, err
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return dial(ctx, network, address)
+		}
+
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithBypass(h.options.Bypass),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithBypass(h.options.Bypass),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), dstAddr)
+
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, dstAddr.Network(), dstAddr.String()) {
+		log.Debug("bypass: ", dstAddr)
+		return xbypass.ErrBypass
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), dstAddr.Network(), dstAddr.String())
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer cc.Close()
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), dstAddr)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), dstAddr)
+
+	return nil
+}
+
+func (h *redirectHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}

go-gost/x/handler/redirect/tcp/handler_darwin.go

@@ -0,0 +1,64 @@
+package redirect
+
+import (
+	"fmt"
+	"net"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+func (h *redirectHandler) getOriginalDstAddr(conn net.Conn) (addr net.Addr, err error) {
+	host, port, err := localToRemote(conn)
+	if err != nil {
+		return nil, err
+	}
+	portNumber, _ := strconv.Atoi(port)
+	addr = &net.TCPAddr{
+		IP:   net.ParseIP(host),
+		Port: portNumber,
+	}
+
+	return
+}
+
+func localToRemote(clientConn net.Conn) (string, string, error) {
+	host, port, err := net.SplitHostPort(clientConn.RemoteAddr().String())
+	if err != nil {
+		return "", "", err
+	}
+	out, err := exec.Command("sudo", "-n", "/sbin/pfctl", "-s", "state").Output()
+	if err != nil {
+		return "", "", err
+	}
+	remoteAddr, remotePort, err := translatePfctlOutput(host, port, string(out))
+	if err != nil {
+		return "", "", err
+	}
+	return remoteAddr, remotePort, err
+}
+
+func translatePfctlOutput(address string, port, s string) (string, string, error) {
+	// We may get an ipv4-mapped ipv6 address here, e.g. ::ffff:127.0.0.1.
+	// Those still appear as "127.0.0.1" in the table, so we need to strip the prefix.
+	// re := regexp.MustCompile(`^::ffff:((\d+\.\d+\.\d+\.\d+$))`)
+	// strippedAddress := re.ReplaceAllString(address, "")
+	strippedAddress := address
+
+	// ALL tcp 192.168.1.13:57474 -> 23.205.82.58:443       ESTABLISHED:ESTABLISHED
+	spec := net.JoinHostPort(strippedAddress, port)
+
+	lines := strings.Split(s, "\n")
+	for _, line := range lines {
+		if strings.Contains(line, "ESTABLISHED:ESTABLISHED") {
+			if strings.Contains(line, spec) {
+				fields := strings.Fields(line)
+				if len(fields) > 4 {
+					return net.SplitHostPort(fields[4])
+				}
+			}
+		}
+	}
+
+	return "", "", fmt.Errorf("could not resolve original destination")
+}

go-gost/x/handler/redirect/tcp/handler_linux.go

@@ -0,0 +1,66 @@
+package redirect
+
+import (
+	"encoding/binary"
+	"errors"
+	"net"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func (h *redirectHandler) getOriginalDstAddr(conn net.Conn) (addr net.Addr, err error) {
+	tcpAddr, ok := conn.RemoteAddr().(*net.TCPAddr)
+	if !ok {
+		err = errors.New("wrong connection type, must be TCP Conn")
+		return
+	}
+
+	sc, ok := conn.(syscall.Conn)
+	if !ok {
+		err = errors.New("wrong connection type, must be syscall.Conn")
+		return
+	}
+
+	rc, err := sc.SyscallConn()
+	if err != nil {
+		return
+	}
+
+	var cerr error
+	err = rc.Control(func(fd uintptr) {
+		if tcpAddr.IP.To4() != nil {
+			mreq, err := unix.GetsockoptIPv6Mreq(int(fd), unix.IPPROTO_IP, unix.SO_ORIGINAL_DST)
+			if err != nil {
+				cerr = err
+				return
+			}
+
+			addr = &net.TCPAddr{
+				IP:   net.IP(mreq.Multiaddr[4:8]),
+				Port: int(mreq.Multiaddr[2])<<8 + int(mreq.Multiaddr[3]),
+			}
+		} else {
+			info, err := unix.GetsockoptIPv6MTUInfo(int(fd), unix.IPPROTO_IPV6, unix.SO_ORIGINAL_DST)
+			if err != nil {
+				cerr = err
+				return
+			}
+
+			var buf = make([]byte, 2)
+			binary.BigEndian.PutUint16(buf, info.Addr.Port)
+			addr = &net.TCPAddr{
+				IP:   net.IP(info.Addr.Addr[:]),
+				Port: int(binary.NativeEndian.Uint16(buf)),
+			}
+		}
+	})
+	if err != nil {
+		return
+	}
+	if cerr != nil {
+		return nil, cerr
+	}
+
+	return
+}

go-gost/x/handler/redirect/tcp/handler_other.go

@@ -0,0 +1,13 @@
+//go:build !linux && !darwin
+
+package redirect
+
+import (
+	"errors"
+	"net"
+)
+
+func (h *redirectHandler) getOriginalDstAddr(_ net.Conn) (addr net.Addr, err error) {
+	err = errors.New("TCP redirect is not available on non-linux platform")
+	return
+}

go-gost/x/handler/redirect/tcp/metadata.go

@@ -0,0 +1,61 @@
+package redirect
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout time.Duration
+	tproxy      bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingFallback            bool
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+}
+
+func (h *redirectHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+	h.md.tproxy = mdutil.GetBool(md, "tproxy")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingFallback = mdutil.GetBool(md, "sniffing.fallback")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	return
+}

go-gost/x/handler/redirect/udp/handler.go

@@ -0,0 +1,153 @@
+package redirect
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	xbypass "github.com/go-gost/x/bypass"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("redu", NewHandler)
+}
+
+type redirectHandler struct {
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &redirectHandler{
+		options: options,
+	}
+}
+
+func (h *redirectHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	return
+}
+
+func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.Duration = time.Since(start)
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Error("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	dstAddr := conn.LocalAddr()
+	ro.Network = dstAddr.Network()
+	ro.Host = dstAddr.String()
+
+	log = log.WithFields(map[string]any{
+		"dst":  fmt.Sprintf("%s/%s", dstAddr, dstAddr.Network()),
+		"host": dstAddr.String(),
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), dstAddr)
+
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, dstAddr.Network(), dstAddr.String()) {
+		log.Debug("bypass: ", dstAddr)
+		return xbypass.ErrBypass
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), dstAddr.Network(), dstAddr.String())
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer cc.Close()
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), dstAddr)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), dstAddr)
+
+	return nil
+}
+
+func (h *redirectHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}

go-gost/x/handler/redirect/udp/metadata.go

@@ -0,0 +1,11 @@
+package redirect
+
+import (
+	mdata "github.com/go-gost/core/metadata"
+)
+
+type metadata struct{}
+
+func (h *redirectHandler) parseMetadata(md mdata.Metadata) (err error) {
+	return
+}

go-gost/x/handler/relay/bind.go

@@ -0,0 +1,214 @@
+package relay
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/listener"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/mux"
+	relay_util "github.com/go-gost/x/internal/util/relay"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	metrics "github.com/go-gost/x/metrics/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xservice "github.com/go-gost/x/service"
+)
+
+func (h *relayHandler) handleBind(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst": fmt.Sprintf("%s/%s", address, network),
+		"cmd": "bind",
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	if !h.md.enableBind {
+		resp.Status = relay.StatusForbidden
+		log.Error("relay: BIND is disabled")
+		_, err := resp.WriteTo(conn)
+		return err
+	}
+
+	if network == "tcp" {
+		return h.bindTCP(ctx, conn, network, address, log)
+	} else {
+		return h.bindUDP(ctx, conn, network, address, log)
+	}
+}
+
+func (h *relayHandler) bindTCP(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	ln, err := lc.Listen(ctx, network, address) // strict mode: if the port already in use, it will return error
+	if err != nil {
+		log.Error(err)
+		resp.Status = relay.StatusServiceUnavailable
+		resp.WriteTo(conn)
+		return err
+	}
+	defer ln.Close()
+
+	serviceName := fmt.Sprintf("%s-ep-%s", h.options.Service, ln.Addr())
+	log = log.WithFields(map[string]any{
+		"service":  serviceName,
+		"listener": "tcp",
+		"handler":  "ep-tcp",
+		"bind":     fmt.Sprintf("%s/%s", ln.Addr(), ln.Addr().Network()),
+	})
+
+	af := &relay.AddrFeature{}
+	if err := af.ParseFrom(ln.Addr().String()); err != nil {
+		log.Warn(err)
+	}
+	resp.Features = append(resp.Features, af)
+	if _, err := resp.WriteTo(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	// Upgrade connection to multiplex session.
+	session, err := mux.ClientSession(conn, h.md.muxCfg)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer session.Close()
+
+	epListener := newTCPListener(ln,
+		listener.AddrOption(address),
+		listener.ServiceOption(serviceName),
+		listener.TrafficLimiterOption(h.options.Limiter),
+		listener.LoggerOption(log.WithFields(map[string]any{
+			"kind": "listener",
+		})),
+	)
+	epHandler := newTCPHandler(session,
+		handler.ServiceOption(serviceName),
+		handler.LoggerOption(log.WithFields(map[string]any{
+			"kind": "handler",
+		})),
+	)
+	srv := xservice.NewService(
+		serviceName, epListener, epHandler,
+		xservice.LoggerOption(log.WithFields(map[string]any{
+			"kind": "service",
+		})),
+	)
+
+	log = log.WithFields(map[string]any{})
+	log.Debugf("bind on %s/%s OK", ln.Addr(), ln.Addr().Network())
+
+	go func() {
+		defer srv.Close()
+		for {
+			conn, err := session.Accept()
+			if err != nil {
+				log.Error(err)
+				return
+			}
+			conn.Close() // we do not handle incoming connections.
+		}
+	}()
+
+	return srv.Serve()
+}
+
+func (h *relayHandler) bindUDP(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	pc, err := lc.ListenPacket(ctx, network, address)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+
+	serviceName := fmt.Sprintf("%s-ep-%s", h.options.Service, pc.LocalAddr())
+	log = log.WithFields(map[string]any{
+		"service":  serviceName,
+		"listener": "udp",
+		"handler":  "ep-udp",
+		"bind":     fmt.Sprintf("%s/%s", pc.LocalAddr(), pc.LocalAddr().Network()),
+	})
+	pc = metrics.WrapPacketConn(serviceName, pc)
+	// pc = admission.WrapPacketConn(l.options.Admission, pc)
+	// pc = limiter.WrapPacketConn(l.options.TrafficLimiter, pc)
+
+	defer pc.Close()
+
+	af := &relay.AddrFeature{}
+	if err := af.ParseFrom(pc.LocalAddr().String()); err != nil {
+		log.Warn(err)
+	}
+	resp.Features = append(resp.Features, af)
+	if _, err := resp.WriteTo(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"bind": pc.LocalAddr().String(),
+	})
+	log.Debugf("bind on %s OK", pc.LocalAddr())
+
+	r := udp.NewRelay(relay_util.UDPTunServerConn(conn), pc).
+		WithBypass(h.options.Bypass).
+		WithLogger(log)
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), pc.LocalAddr())
+	r.Run(ctx)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Debugf("%s >-< %s", conn.RemoteAddr(), pc.LocalAddr())
+	return nil
+}

go-gost/x/handler/relay/conn.go

@@ -0,0 +1,78 @@
+package relay
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"io"
+	"math"
+	"net"
+)
+
+type tcpConn struct {
+	net.Conn
+	wbuf bytes.Buffer
+}
+
+func (c *tcpConn) Read(b []byte) (n int, err error) {
+	return c.Conn.Read(b)
+}
+
+func (c *tcpConn) Write(b []byte) (n int, err error) {
+	n = len(b) // force byte length consistent
+	if c.wbuf.Len() > 0 {
+		c.wbuf.Write(b) // append the data to the cached header
+		_, err = c.wbuf.WriteTo(c.Conn)
+		return
+	}
+	_, err = c.Conn.Write(b)
+	return
+}
+
+type udpConn struct {
+	net.Conn
+	wbuf bytes.Buffer
+}
+
+func (c *udpConn) Read(b []byte) (n int, err error) {
+	var bb [2]byte
+	_, err = io.ReadFull(c.Conn, bb[:])
+	if err != nil {
+		return
+	}
+
+	dlen := int(binary.BigEndian.Uint16(bb[:]))
+	if len(b) >= dlen {
+		return io.ReadFull(c.Conn, b[:dlen])
+	}
+	buf := make([]byte, dlen)
+	_, err = io.ReadFull(c.Conn, buf)
+	n = copy(b, buf)
+
+	return
+}
+
+func (c *udpConn) Write(b []byte) (n int, err error) {
+	if len(b) > math.MaxUint16 {
+		err = errors.New("write: data maximum exceeded")
+		return
+	}
+
+	n = len(b)
+	if c.wbuf.Len() > 0 {
+		var bb [2]byte
+		binary.BigEndian.PutUint16(bb[:], uint16(len(b)))
+		c.wbuf.Write(bb[:])
+		c.wbuf.Write(b) // append the data to the cached header
+		_, err = c.wbuf.WriteTo(c.Conn)
+		return
+	}
+
+	var bb [2]byte
+	binary.BigEndian.PutUint16(bb[:], uint16(len(b)))
+	_, err = c.Conn.Write(bb[:])
+	if err != nil {
+		return
+	}
+	return c.Conn.Write(b)
+}

go-gost/x/handler/relay/connect.go

@@ -0,0 +1,249 @@
+package relay
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/relay"
+	xbypass "github.com/go-gost/x/bypass"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	serial "github.com/go-gost/x/internal/util/serial"
+	"github.com/go-gost/x/internal/util/sniffing"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
+	if network == "unix" || network == "serial" {
+		if host, _, _ := net.SplitHostPort(address); host != "" {
+			address = host
+		}
+	}
+
+	log = log.WithFields(map[string]any{
+		"dst":  fmt.Sprintf("%s/%s", address, network),
+		"cmd":  "connect",
+		"host": address,
+	})
+
+	log.Debugf("%s >> %s/%s", conn.RemoteAddr(), address, network)
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	if address == "" {
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		err = errors.New("target not specified")
+		log.Error(err)
+		return
+	}
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, network, address) {
+		log.Debug("bypass: ", address)
+		resp.Status = relay.StatusForbidden
+		resp.WriteTo(conn)
+		return xbypass.ErrBypass
+	}
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: address})
+	}
+
+	var cc net.Conn
+	switch network {
+	case "unix":
+		cc, err = (&net.Dialer{}).DialContext(ctx, "unix", address)
+	case "serial":
+		var port io.ReadWriteCloser
+		port, err = serial.OpenPort(serial.ParseConfigFromAddr(address))
+		if err == nil {
+			cc = &serialConn{
+				ReadWriteCloser: port,
+				port:            address,
+			}
+		}
+	default:
+		var buf bytes.Buffer
+		cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, address)
+		ro.Route = buf.String()
+	}
+	if err != nil {
+		resp.Status = relay.StatusNetworkUnreachable
+		resp.WriteTo(conn)
+		return err
+	}
+	defer cc.Close()
+
+	if h.md.noDelay {
+		if _, err := resp.WriteTo(conn); err != nil {
+			log.Error(err)
+			return err
+		}
+	}
+
+	switch network {
+	case "udp", "udp4", "udp6":
+		rc := &udpConn{
+			Conn: conn,
+		}
+		if !h.md.noDelay {
+			// cache the header
+			if _, err := resp.WriteTo(&rc.wbuf); err != nil {
+				return err
+			}
+		}
+		conn = rc
+	default:
+		if !h.md.noDelay {
+			rc := &tcpConn{
+				Conn: conn,
+			}
+			// cache the header
+			if _, err := resp.WriteTo(&rc.wbuf); err != nil {
+				return err
+			}
+			conn = rc
+		}
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), address)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), address)
+
+	return nil
+}
+
+type serialConn struct {
+	io.ReadWriteCloser
+	port string
+}
+
+func (c *serialConn) LocalAddr() net.Addr {
+	return &serialAddr{
+		port: "@",
+	}
+}
+
+func (c *serialConn) RemoteAddr() net.Addr {
+	return &serialAddr{
+		port: c.port,
+	}
+}
+
+func (c *serialConn) SetDeadline(t time.Time) error {
+	return nil
+}
+
+func (c *serialConn) SetReadDeadline(t time.Time) error {
+	return nil
+}
+
+func (c *serialConn) SetWriteDeadline(t time.Time) error {
+	return nil
+}
+
+type serialAddr struct {
+	port string
+}
+
+func (a *serialAddr) Network() string {
+	return "serial"
+}
+
+func (a *serialAddr) String() string {
+	return a.port
+}

go-gost/x/handler/relay/entrypoint.go

@@ -0,0 +1,120 @@
+package relay
+
+import (
+	"context"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/listener"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/relay"
+	admission "github.com/go-gost/x/admission/wrapper"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/proxyproto"
+	"github.com/go-gost/x/internal/util/mux"
+	metrics "github.com/go-gost/x/metrics/wrapper"
+)
+
+type tcpListener struct {
+	ln      net.Listener
+	options listener.Options
+}
+
+func newTCPListener(ln net.Listener, opts ...listener.Option) listener.Listener {
+	options := listener.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+	return &tcpListener{
+		ln:      ln,
+		options: options,
+	}
+}
+
+func (l *tcpListener) Init(md md.Metadata) (err error) {
+	// l.logger.Debugf("pp: %d", l.options.ProxyProtocol)
+	ln := l.ln
+	ln = proxyproto.WrapListener(l.options.ProxyProtocol, ln, 10*time.Second)
+	ln = metrics.WrapListener(l.options.Service, ln)
+	ln = admission.WrapListener(l.options.Admission, ln)
+	l.ln = ln
+
+	return
+}
+
+func (l *tcpListener) Accept() (conn net.Conn, err error) {
+	return l.ln.Accept()
+}
+
+func (l *tcpListener) Addr() net.Addr {
+	return l.ln.Addr()
+}
+
+func (l *tcpListener) Close() error {
+	return l.ln.Close()
+}
+
+type tcpHandler struct {
+	session *mux.Session
+	options handler.Options
+}
+
+func newTCPHandler(session *mux.Session, opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &tcpHandler{
+		session: session,
+		options: options,
+	}
+}
+
+func (h *tcpHandler) Init(md md.Metadata) (err error) {
+	return
+}
+
+func (h *tcpHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	defer conn.Close()
+
+	start := time.Now()
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+	defer func() {
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	cc, err := h.session.GetConn()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer cc.Close()
+
+	af := &relay.AddrFeature{}
+	af.ParseFrom(conn.RemoteAddr().String())
+	resp := relay.Response{
+		Version:  relay.Version1,
+		Status:   relay.StatusOK,
+		Features: []relay.Feature{af},
+	}
+	if _, err := resp.WriteTo(cc); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), cc.RemoteAddr())
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{"duration": time.Since(t)}).
+		Debugf("%s >-< %s", conn.RemoteAddr(), cc.RemoteAddr())
+	return nil
+}

go-gost/x/handler/relay/forward.go

@@ -0,0 +1,123 @@
+package relay
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+)
+
+func (h *relayHandler) handleForward(ctx context.Context, conn net.Conn, network string, log logger.Logger) error {
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+	target := h.hop.Select(ctx)
+	if target == nil {
+		resp.Status = relay.StatusServiceUnavailable
+		resp.WriteTo(conn)
+		err := errors.New("target not available")
+		log.Error(err)
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"dst": fmt.Sprintf("%s/%s", target.Addr, network),
+		"cmd": "forward",
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), target.Addr)
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(target.Addr),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	cc, err := h.options.Router.Dial(ctx, network, target.Addr)
+	if err != nil {
+		// TODO: the router itself may be failed due to the failed node in the router,
+		// the dead marker may be a wrong operation.
+		if marker := target.Marker(); marker != nil {
+			marker.Mark()
+		}
+
+		resp.Status = relay.StatusHostUnreachable
+		resp.WriteTo(conn)
+		log.Error(err)
+
+		return err
+	}
+	defer cc.Close()
+	if marker := target.Marker(); marker != nil {
+		marker.Reset()
+	}
+
+	if h.md.noDelay {
+		if _, err := resp.WriteTo(conn); err != nil {
+			log.Error(err)
+			return err
+		}
+	}
+
+	switch network {
+	case "udp", "udp4", "udp6":
+		rc := &udpConn{
+			Conn: conn,
+		}
+		if !h.md.noDelay {
+			// cache the header
+			if _, err := resp.WriteTo(&rc.wbuf); err != nil {
+				return err
+			}
+		}
+		conn = rc
+	default:
+		rc := &tcpConn{
+			Conn: conn,
+		}
+		if !h.md.noDelay {
+			// cache the header
+			if _, err := resp.WriteTo(&rc.wbuf); err != nil {
+				return err
+			}
+		}
+		conn = rc
+	}
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), target.Addr)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Debugf("%s >-< %s", conn.RemoteAddr(), target.Addr)
+
+	return nil
+}

go-gost/x/handler/relay/handler.go

@@ -0,0 +1,287 @@
+package relay
+
+import (
+	"context"
+	"errors"
+	"net"
+	"strconv"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	ErrBadVersion   = errors.New("relay: bad version")
+	ErrUnknownCmd   = errors.New("relay: unknown command")
+	ErrUnauthorized = errors.New("relay: unauthorized")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("relay", NewHandler)
+}
+
+type relayHandler struct {
+	hop      hop.Hop
+	md       metadata
+	options  handler.Options
+	stats    *stats_util.HandlerStats
+	limiter  traffic.TrafficLimiter
+	cancel   context.CancelFunc
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &relayHandler{
+		options: options,
+	}
+}
+
+func (h *relayHandler) Init(md md.Metadata) (err error) {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return nil
+}
+
+// Forward implements handler.Forwarder.
+func (h *relayHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *relayHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	if h.md.readTimeout > 0 {
+		conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+	}
+
+	req := relay.Request{}
+	if _, err := req.ReadFrom(conn); err != nil {
+		return err
+	}
+
+	conn.SetReadDeadline(time.Time{})
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	if req.Version != relay.Version1 {
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrBadVersion
+	}
+
+	var user, pass string
+	var address string
+	var networkID relay.NetworkID
+	for _, f := range req.Features {
+		switch f.Type() {
+		case relay.FeatureUserAuth:
+			if feature, _ := f.(*relay.UserAuthFeature); feature != nil {
+				user, pass = feature.Username, feature.Password
+			}
+		case relay.FeatureAddr:
+			if feature, _ := f.(*relay.AddrFeature); feature != nil {
+				address = net.JoinHostPort(feature.Host, strconv.Itoa(int(feature.Port)))
+			}
+		case relay.FeatureNetwork:
+			if feature, _ := f.(*relay.NetworkFeature); feature != nil {
+				networkID = feature.Network
+			}
+		}
+	}
+
+	if user != "" {
+		ro.ClientID = user
+		log = log.WithFields(map[string]any{"user": user})
+	}
+
+	if h.options.Auther != nil {
+		clientID, ok := h.options.Auther.Authenticate(ctx, user, pass)
+		if !ok {
+			resp.Status = relay.StatusUnauthorized
+			resp.WriteTo(conn)
+			return ErrUnauthorized
+		}
+		ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+	}
+
+	network := networkID.String()
+	if (req.Cmd & relay.FUDP) == relay.FUDP {
+		network = "udp"
+	}
+	ro.Network = network
+	ro.Host = address
+
+	if h.hop != nil {
+		// forward mode
+		return h.handleForward(ctx, conn, network, log)
+	}
+
+	switch req.Cmd & relay.CmdMask {
+	case 0, relay.CmdConnect:
+		return h.handleConnect(ctx, conn, network, address, ro, log)
+	case relay.CmdBind:
+		return h.handleBind(ctx, conn, network, address, log)
+	default:
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrUnknownCmd
+	}
+}
+
+// Close implements io.Closer interface.
+func (h *relayHandler) Close() error {
+	if h.cancel != nil {
+		h.cancel()
+	}
+	return nil
+}
+
+func (h *relayHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *relayHandler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/relay/metadata.go

@@ -0,0 +1,95 @@
+package relay
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/x/internal/util/mux"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout time.Duration
+	enableBind  bool
+	noDelay     bool
+	hash        string
+	muxCfg      *mux.Config
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *relayHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.enableBind = mdutil.GetBool(md, "bind")
+	h.md.noDelay = mdutil.GetBool(md, "nodelay")
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.muxCfg = &mux.Config{
+		Version:           mdutil.GetInt(md, "mux.version"),
+		KeepAliveInterval: mdutil.GetDuration(md, "mux.keepaliveInterval"),
+		KeepAliveDisabled: mdutil.GetBool(md, "mux.keepaliveDisabled"),
+		KeepAliveTimeout:  mdutil.GetDuration(md, "mux.keepaliveTimeout"),
+		MaxFrameSize:      mdutil.GetInt(md, "mux.maxFrameSize"),
+		MaxReceiveBuffer:  mdutil.GetInt(md, "mux.maxReceiveBuffer"),
+		MaxStreamBuffer:   mdutil.GetInt(md, "mux.maxStreamBuffer"),
+	}
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return
+}

go-gost/x/handler/router/associate.go

@@ -0,0 +1,345 @@
+package router
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/common/bufpool"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/router"
+	"github.com/go-gost/core/sd"
+	"github.com/go-gost/relay"
+	xip "github.com/go-gost/x/internal/net/ip"
+	"github.com/go-gost/x/internal/util/cache"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	"github.com/go-gost/x/registry"
+	"github.com/google/uuid"
+	"github.com/songgao/water/waterutil"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+)
+
+func (h *routerHandler) handleAssociate(ctx context.Context, conn net.Conn, network, host string, routerID relay.TunnelID, log logger.Logger) (err error) {
+	log = log.WithFields(map[string]any{
+		"dst":    fmt.Sprintf("%s/%s", host, network),
+		"cmd":    "associate",
+		"router": routerID.String(),
+		"host":   host,
+	})
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	if ingress := h.md.ingress; ingress != nil && host != "" {
+		var rid relay.TunnelID
+		if rule := ingress.GetRule(ctx, host); rule != nil {
+			rid = parseRouterID(rule.Endpoint)
+		}
+
+		if !rid.Equal(routerID) {
+			resp.Status = relay.StatusHostUnreachable
+			resp.WriteTo(conn)
+			err := fmt.Errorf("no route to host %s", host)
+			log.Error(err)
+			return err
+		}
+	}
+
+	uuid, err := uuid.NewRandom()
+	if err != nil {
+		resp.Status = relay.StatusInternalServerError
+		resp.WriteTo(conn)
+		return
+	}
+	connectorID := relay.NewConnectorID(uuid[:])
+
+	resp.Features = append(resp.Features,
+		&relay.TunnelFeature{
+			ID: connectorID,
+		},
+	)
+	resp.WriteTo(conn)
+
+	conn = &packetConn{conn}
+
+	clientID := fmt.Sprintf("%s@%s", host, routerID)
+	var stats stats.Stats
+	if h.stats != nil {
+		stats = h.stats.Stats(clientID)
+	}
+	conn = stats_wrapper.WrapConn(conn, stats)
+	conn = traffic_wrapper.WrapConn(
+		conn,
+		h.limiter,
+		clientID,
+		limiter.ScopeOption(limiter.ScopeClient),
+		limiter.ServiceOption(h.options.Service),
+		limiter.ClientOption(clientID),
+		limiter.NetworkOption(network),
+		limiter.SrcOption(conn.RemoteAddr().String()),
+	)
+
+	h.pool.Add(routerID, NewConnector(routerID, connectorID, host, LockWriter(conn), &ConnectorOptions{}))
+	defer h.pool.Del(routerID, host, connectorID)
+
+	if h.md.sd != nil {
+		err := h.md.sd.Register(ctx, &sd.Service{
+			ID:      connectorID.String(),
+			Name:    clientID,
+			Node:    h.id,
+			Network: "udp",
+			Address: h.md.entryPoint,
+		})
+		if err != nil {
+			h.log.Error(err)
+		}
+
+		defer h.md.sd.Deregister(ctx, &sd.Service{
+			ID:   connectorID.String(),
+			Name: clientID,
+			Node: h.id,
+		})
+
+		ctx, cancel := context.WithCancel(ctx)
+		defer cancel()
+
+		go h.sdRenew(ctx, clientID, connectorID.String())
+	}
+
+	log.Debugf("%s/%s: router=%s, connector=%s, weight=%d established", host, network, routerID, connectorID, connectorID.Weight())
+
+	var b [MaxMessageSize]byte
+	for {
+		n, err := conn.Read(b[:])
+		if err != nil {
+			if err == io.EOF {
+				return nil
+			}
+			return err
+		}
+
+		h.handlePacket(ctx, b[:n], routerID, log)
+	}
+}
+
+func (h *routerHandler) sdRenew(ctx context.Context, clientID string, connectorID string) {
+	tc := time.NewTicker(h.md.sdRenewInterval)
+	defer tc.Stop()
+
+	for {
+		select {
+		case <-tc.C:
+			h.md.sd.Renew(ctx, &sd.Service{
+				ID:   connectorID,
+				Name: clientID,
+				Node: h.id,
+			})
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (h *routerHandler) handlePacket(ctx context.Context, data []byte, routerID relay.TunnelID, log logger.Logger) error {
+	var dstIP net.IP
+	if waterutil.IsIPv4(data) {
+		header, err := ipv4.ParseHeader(data)
+		if err != nil {
+			return err
+		}
+
+		dstIP = header.Dst
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			log.Tracef("%s >> %s %-4s %d/%-4d %-4x %d",
+				header.Src, header.Dst, xip.Protocol(waterutil.IPv4Protocol(data)),
+				header.Len, header.TotalLen, header.ID, header.Flags)
+		}
+	} else if waterutil.IsIPv6(data) {
+		header, err := ipv6.ParseHeader(data)
+		if err != nil {
+			return err
+		}
+
+		dstIP = header.Dst
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			log.Tracef("%s >> %s %s %d %d",
+				header.Src, header.Dst,
+				xip.Protocol(waterutil.IPProtocol(header.NextHeader)),
+				header.PayloadLen, header.TrafficClass)
+		}
+	} else {
+		return fmt.Errorf("unknown packet, discarded(%d)", len(data))
+	}
+
+	rid := routerID.String()
+
+	route := h.getRoute(ctx, rid, dstIP.String())
+	if route == nil || route.Gateway == "" {
+		// no route to host, discard
+		return fmt.Errorf("no route to host %s", dstIP)
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		log.Tracef("route for %s: %s -> %s", dstIP, route.Dst, route.Gateway)
+	}
+
+	if c := h.pool.Get(routerID, route.Gateway); c != nil {
+		if w := c.Writer(); w != nil {
+			w.Write(data)
+		}
+		return nil
+	}
+
+	raddr := h.getAddrforRoute(ctx, rid, route.Gateway)
+	if raddr == nil {
+		return nil
+	}
+
+	req := &relay.Request{
+		Version: relay.Version1,
+		Cmd:     relay.CmdAssociate,
+		Features: []relay.Feature{
+			&relay.TunnelFeature{
+				ID: routerID,
+			},
+			&relay.AddrFeature{
+				AType: relay.AddrDomain,
+				Host:  route.Gateway,
+			},
+		},
+	}
+
+	buf := bytes.Buffer{}
+	req.WriteTo(&buf)
+	buf.Write(data)
+
+	h.epConn.WriteTo(buf.Bytes(), raddr)
+
+	return nil
+}
+
+func (h *routerHandler) getRoute(ctx context.Context, rid string, dst string) *router.Route {
+	if h.md.routerCacheEnabled {
+		if item := h.routeCache.Get(dst); item != nil && !item.Expired() {
+			v, _ := item.Value().(*router.Route)
+			return v
+		}
+	}
+
+	var route *router.Route
+	if r := registry.RouterRegistry().Get(rid); r != nil {
+		route = r.GetRoute(ctx, dst, router.IDOption(rid))
+	}
+	if route == nil && h.md.router != nil {
+		route = h.md.router.GetRoute(ctx, dst, router.IDOption(rid))
+	}
+
+	if h.md.routerCacheEnabled {
+		h.routeCache.Set(dst, cache.NewItem(route, h.md.routerCacheExpiration))
+	}
+	return route
+}
+
+func (h *routerHandler) getAddrforRoute(ctx context.Context, routerID, gateway string) net.Addr {
+	if h.md.sd == nil {
+		return nil
+	}
+	clientID := fmt.Sprintf("%s@%s", gateway, routerID)
+
+	if item := h.sdCache.Get(clientID); item != nil && !item.Expired() {
+		addr, _ := item.Value().(net.Addr)
+		return addr
+	}
+
+	ss, _ := h.md.sd.Get(ctx, clientID)
+
+	service := &sd.Service{}
+	for _, s := range ss {
+		if s.Node != h.id {
+			service = s
+			break
+		}
+	}
+	raddr, _ := net.ResolveUDPAddr("udp", service.Address)
+	h.sdCache.Set(clientID, cache.NewItem(raddr, h.md.sdCacheExpiration))
+
+	return raddr
+}
+
+type packetConn struct {
+	net.Conn
+}
+
+func (c *packetConn) Read(b []byte) (n int, err error) {
+	var bb [2]byte
+	_, err = io.ReadFull(c.Conn, bb[:])
+	if err != nil {
+		return
+	}
+
+	dlen := int(binary.BigEndian.Uint16(bb[:]))
+	if len(b) >= dlen {
+		return io.ReadFull(c.Conn, b[:dlen])
+	}
+
+	buf := bufpool.Get(dlen)
+	defer bufpool.Put(buf)
+
+	n, err = io.ReadFull(c.Conn, buf)
+	copy(b, buf[:n])
+
+	return
+}
+
+func (c *packetConn) Write(b []byte) (n int, err error) {
+	if len(b) > math.MaxUint16 {
+		err = errors.New("write: data maximum exceeded")
+		return
+	}
+
+	buf := bufpool.Get(len(b) + 2)
+	defer bufpool.Put(buf)
+
+	binary.BigEndian.PutUint16(buf[:2], uint16(len(b)))
+	n = copy(buf[2:], b)
+
+	return c.Conn.Write(buf)
+}
+
+type lockWriter struct {
+	w  io.Writer
+	mu sync.Mutex
+}
+
+func LockWriter(w io.Writer) io.Writer {
+	return &lockWriter{w: w}
+}
+
+func (w *lockWriter) Write(p []byte) (int, error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	return w.w.Write(p)
+}
+
+func (w *lockWriter) Close() error {
+	if closer, ok := w.w.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}

go-gost/x/handler/router/entrypoint.go

@@ -0,0 +1,60 @@
+package router
+
+import (
+	"bytes"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/relay"
+)
+
+func (h *routerHandler) handleEntrypoint(log logger.Logger) error {
+	var buf [MaxMessageSize]byte
+
+	for {
+		err := func() error {
+			n, addr, err := h.epConn.ReadFrom(buf[:])
+			if err != nil {
+				return err
+			}
+
+			req := relay.Request{}
+			nn, err := req.ReadFrom(bytes.NewReader(buf[:n]))
+			if err != nil {
+				return nil
+			}
+			if req.Cmd != relay.CmdAssociate {
+				return nil
+			}
+
+			var routerID relay.TunnelID
+			var gateway string
+
+			for _, f := range req.Features {
+				switch f.Type() {
+				case relay.FeatureTunnel:
+					if feature, _ := f.(*relay.TunnelFeature); feature != nil {
+						routerID = feature.ID
+					}
+				case relay.FeatureAddr:
+					if feature, _ := f.(*relay.AddrFeature); feature != nil {
+						gateway = feature.Host
+					}
+				}
+			}
+
+			log.Tracef("redirect from %s to %s@%s", addr, gateway, routerID)
+
+			if c := h.pool.Get(routerID, gateway); c != nil {
+				if w := c.Writer(); w != nil {
+					w.Write(buf[nn:])
+				}
+			}
+
+			return nil
+		}()
+
+		if err != nil {
+			return err
+		}
+	}
+}

go-gost/x/handler/router/handler.go

@@ -0,0 +1,290 @@
+package router
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/cache"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	"github.com/go-gost/x/registry"
+	"github.com/google/uuid"
+)
+
+var (
+	ErrBadVersion   = errors.New("bad version")
+	ErrUnknownCmd   = errors.New("unknown command")
+	ErrRouterID     = errors.New("invalid router ID")
+	ErrUnauthorized = errors.New("unauthorized")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("router", NewHandler)
+}
+
+type routerHandler struct {
+	id         string
+	options    handler.Options
+	pool       *ConnectorPool
+	epConn     net.PacketConn
+	md         metadata
+	log        logger.Logger
+	stats      *stats_util.HandlerStats
+	limiter    traffic.TrafficLimiter
+	cancel     context.CancelFunc
+	sdCache    *cache.Cache
+	routeCache *cache.Cache
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &routerHandler{
+		options:    options,
+		sdCache:    cache.NewCache(time.Minute),
+		routeCache: cache.NewCache(time.Minute),
+	}
+}
+
+func (h *routerHandler) Init(md md.Metadata) (err error) {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	uuid, err := uuid.NewRandom()
+	if err != nil {
+		return err
+	}
+	h.id = uuid.String()
+
+	h.log = h.options.Logger.WithFields(map[string]any{
+		"node": h.id,
+	})
+	h.pool = NewConnectorPool(h.id)
+
+	if err = h.initEntrypoint(); err != nil {
+		return
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	return nil
+}
+
+func (h *routerHandler) initEntrypoint() (err error) {
+	if h.md.entryPoint == "" {
+		return
+	}
+
+	network := "udp"
+	if xnet.IsIPv4(h.md.entryPoint) {
+		network = "udp4"
+	}
+
+	pc, err := net.ListenPacket(network, h.md.entryPoint)
+	if err != nil {
+		h.log.Error(err)
+		return
+	}
+	h.epConn = pc
+
+	log := h.log.WithFields(map[string]any{
+		"service":  fmt.Sprintf("%s-ep-%s", h.options.Service, pc.LocalAddr()),
+		"listener": "udp",
+		"handler":  "entrypoint",
+		"kind":     "service",
+	})
+	go h.handleEntrypoint(log)
+	h.log.Infof("entrypoint: %s", pc.LocalAddr())
+
+	return
+}
+
+func (h *routerHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+	log := h.log.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	defer func() {
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	if h.md.readTimeout > 0 {
+		conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+	}
+
+	req := relay.Request{}
+	if _, err := req.ReadFrom(conn); err != nil {
+		return err
+	}
+
+	conn.SetReadDeadline(time.Time{})
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	if req.Version != relay.Version1 {
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrBadVersion
+	}
+
+	var user, pass string
+	var srcAddr, dstAddr string
+	network := "ip"
+	var routerID relay.TunnelID
+	for _, f := range req.Features {
+		switch f.Type() {
+		case relay.FeatureUserAuth:
+			if feature, _ := f.(*relay.UserAuthFeature); feature != nil {
+				user, pass = feature.Username, feature.Password
+			}
+		case relay.FeatureAddr:
+			if feature, _ := f.(*relay.AddrFeature); feature != nil {
+				v := net.JoinHostPort(feature.Host, strconv.Itoa(int(feature.Port)))
+				if srcAddr != "" {
+					dstAddr = v
+				} else {
+					srcAddr = v
+				}
+			}
+		case relay.FeatureTunnel:
+			if feature, _ := f.(*relay.TunnelFeature); feature != nil {
+				routerID = feature.ID
+			}
+		case relay.FeatureNetwork:
+			if feature, _ := f.(*relay.NetworkFeature); feature != nil {
+				network = feature.Network.String()
+			}
+		}
+	}
+
+	if user != "" {
+		log = log.WithFields(map[string]any{"user": user})
+	}
+
+	if h.options.Auther != nil {
+		clientID, ok := h.options.Auther.Authenticate(ctx, user, pass)
+		if !ok {
+			resp.Status = relay.StatusUnauthorized
+			resp.WriteTo(conn)
+			return ErrUnauthorized
+		}
+		ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+	}
+
+	switch req.Cmd & relay.CmdMask {
+	case relay.CmdAssociate:
+		host, _, _ := net.SplitHostPort(dstAddr)
+		log.Debugf("associate %s/%s -> %s", host, network, routerID)
+		return h.handleAssociate(ctx, conn, network, host, routerID, log)
+
+	default:
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrUnknownCmd
+	}
+}
+
+// Close implements io.Closer interface.
+func (h *routerHandler) Close() error {
+	if h.epConn != nil {
+		h.epConn.Close()
+	}
+	h.pool.Close()
+
+	if h.cancel != nil {
+		h.cancel()
+	}
+
+	return nil
+}
+
+func (h *routerHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *routerHandler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/router/metadata.go

@@ -0,0 +1,77 @@
+package router
+
+import (
+	"math"
+	"time"
+
+	"github.com/go-gost/core/ingress"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/router"
+	"github.com/go-gost/core/sd"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+const (
+	MaxMessageSize         = math.MaxUint16
+	defaultTTL             = 15 * time.Second
+	defaultCacheExpiration = time.Second
+)
+
+type metadata struct {
+	readTimeout time.Duration
+
+	entryPoint        string
+	ingress           ingress.Ingress
+	sd                sd.SD
+	sdCacheExpiration time.Duration
+	sdRenewInterval   time.Duration
+
+	router                router.Router
+	routerCacheEnabled    bool
+	routerCacheExpiration time.Duration
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *routerHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+
+	h.md.entryPoint = mdutil.GetString(md, "entrypoint")
+	h.md.ingress = registry.IngressRegistry().Get(mdutil.GetString(md, "ingress"))
+
+	h.md.sd = registry.SDRegistry().Get(mdutil.GetString(md, "sd"))
+	h.md.sdCacheExpiration = mdutil.GetDuration(md, "sd.cache.expiration")
+	if h.md.sdCacheExpiration <= 0 {
+		h.md.sdCacheExpiration = defaultCacheExpiration
+	}
+	h.md.sdRenewInterval = mdutil.GetDuration(md, "sd.renewInterval")
+	if h.md.sdRenewInterval < time.Second {
+		h.md.sdRenewInterval = defaultTTL
+	}
+
+	h.md.router = registry.RouterRegistry().Get(mdutil.GetString(md, "router"))
+	h.md.routerCacheEnabled = mdutil.GetBool(md, "router.cache")
+	h.md.routerCacheExpiration = mdutil.GetDuration(md, "router.cache.expiration")
+	if h.md.routerCacheExpiration <= 0 {
+		h.md.routerCacheExpiration = defaultCacheExpiration
+	}
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return
+}

go-gost/x/handler/router/router.go

@@ -0,0 +1,260 @@
+package router
+
+import (
+	"context"
+	"io"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/relay"
+
+	"github.com/go-gost/x/selector"
+	"github.com/google/uuid"
+)
+
+const (
+	MaxWeight uint8 = 0xff
+)
+
+type ConnectorOptions struct{}
+
+type Connector struct {
+	id   relay.ConnectorID
+	rid  relay.TunnelID
+	host string
+	w    io.Writer
+	opts *ConnectorOptions
+	log  logger.Logger
+}
+
+func NewConnector(rid relay.TunnelID, cid relay.ConnectorID, host string, w io.Writer, opts *ConnectorOptions) *Connector {
+	if opts == nil {
+		opts = &ConnectorOptions{}
+	}
+
+	c := &Connector{
+		rid:  rid,
+		id:   cid,
+		host: host,
+		w:    w,
+		opts: opts,
+		log: logger.Default().WithFields(map[string]any{
+			"router":    rid.String(),
+			"connector": cid.String(),
+			"host":      host,
+		}),
+	}
+
+	return c
+}
+
+func (c *Connector) ID() relay.ConnectorID {
+	return c.id
+}
+
+func (c *Connector) Writer() io.Writer {
+	if c == nil {
+		return nil
+	}
+
+	return c.w
+}
+
+func (c *Connector) Close() error {
+	if c == nil || c.w == nil {
+		return nil
+	}
+
+	if closer, ok := c.w.(io.Closer); ok {
+		return closer.Close()
+	}
+	return nil
+}
+
+type Router struct {
+	node       string
+	id         relay.TunnelID
+	connectors map[string][]*Connector
+	t          time.Time
+	close      chan struct{}
+	mu         sync.RWMutex
+}
+
+func NewRouter(node string, rid relay.TunnelID) *Router {
+	r := &Router{
+		node:       node,
+		id:         rid,
+		connectors: make(map[string][]*Connector),
+		t:          time.Now(),
+		close:      make(chan struct{}),
+	}
+	return r
+}
+
+func (r *Router) ID() relay.TunnelID {
+	return r.id
+}
+
+func (r *Router) AddConnector(c *Connector) {
+	if c == nil {
+		return
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	r.connectors[c.host] = append(r.connectors[c.host], c)
+}
+
+func (r *Router) GetConnector(host string) *Connector {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	connectors := r.connectors[host]
+
+	if len(connectors) == 1 {
+		return connectors[0]
+	}
+
+	rw := selector.NewRandomWeighted[*Connector]()
+
+	found := false
+	for _, c := range connectors {
+		weight := c.ID().Weight()
+		if weight == 0 {
+			weight = 1
+		}
+		if weight == MaxWeight && !found {
+			rw.Reset()
+			found = true
+		}
+
+		if weight == MaxWeight || !found {
+			rw.Add(c, int(weight))
+		}
+	}
+
+	return rw.Next()
+}
+
+func (r *Router) DelConnector(host string, cid relay.ConnectorID) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	connectors := r.connectors[host]
+	for i, c := range connectors {
+		if c.id.Equal(cid) {
+			r.connectors[host] = append(connectors[:i], connectors[i+1:]...)
+		}
+	}
+}
+
+func (r *Router) Close() error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	select {
+	case <-r.close:
+	default:
+		for _, cs := range r.connectors {
+			for _, c := range cs {
+				c.Close()
+			}
+		}
+		close(r.close)
+
+		clear(r.connectors)
+	}
+
+	return nil
+}
+
+type ConnectorPool struct {
+	node    string
+	routers map[relay.TunnelID]*Router
+	mu      sync.RWMutex
+	cancel  context.CancelFunc
+}
+
+func NewConnectorPool(node string) *ConnectorPool {
+	p := &ConnectorPool{
+		node:    node,
+		routers: make(map[relay.TunnelID]*Router),
+	}
+
+	return p
+}
+
+func (p *ConnectorPool) Add(rid relay.TunnelID, c *Connector) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	r := p.routers[rid]
+	if r == nil {
+		r = NewRouter(p.node, rid)
+		p.routers[rid] = r
+	}
+	r.AddConnector(c)
+}
+
+func (p *ConnectorPool) Get(rid relay.TunnelID, host string) *Connector {
+	if p == nil {
+		return nil
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	r := p.routers[rid]
+	if r == nil {
+		return nil
+	}
+
+	return r.GetConnector(host)
+}
+
+func (p *ConnectorPool) Del(rid relay.TunnelID, host string, cid relay.ConnectorID) {
+	if p == nil {
+		return
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	r := p.routers[rid]
+	if r == nil {
+		return
+	}
+
+	r.DelConnector(host, cid)
+}
+
+func (p *ConnectorPool) Close() error {
+	if p == nil {
+		return nil
+	}
+
+	if p.cancel != nil {
+		p.cancel()
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	for _, v := range p.routers {
+		v.Close()
+	}
+	clear(p.routers)
+
+	return nil
+}
+
+func parseRouterID(s string) (rid relay.TunnelID) {
+	if s == "" {
+		return
+	}
+	uuid, _ := uuid.Parse(s)
+
+	return relay.NewTunnelID(uuid[:])
+}

go-gost/x/handler/serial/conn.go

@@ -0,0 +1,63 @@
+package serial
+
+import (
+	"bytes"
+	"context"
+	"encoding/hex"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/recorder"
+)
+
+type recorderConn struct {
+	net.Conn
+	recorder recorder.RecorderObject
+}
+
+func (c *recorderConn) Read(b []byte) (n int, err error) {
+	n, err = c.Conn.Read(b)
+
+	if n > 0 && c.recorder.Recorder != nil {
+		var buf bytes.Buffer
+		if c.recorder.Options != nil && c.recorder.Options.Direction {
+			buf.WriteByte('>')
+		}
+		if c.recorder.Options != nil && c.recorder.Options.TimestampFormat != "" {
+			buf.WriteString(time.Now().Format(c.recorder.Options.TimestampFormat))
+		}
+		if buf.Len() > 0 {
+			buf.WriteByte('\n')
+		}
+		if c.recorder.Options != nil && c.recorder.Options.Hexdump {
+			buf.WriteString(hex.Dump(b[:n]))
+		} else {
+			buf.Write(b[:n])
+		}
+		c.recorder.Recorder.Record(context.Background(), buf.Bytes())
+	}
+
+	return
+}
+
+func (c *recorderConn) Write(b []byte) (int, error) {
+	if c.recorder.Recorder != nil {
+		var buf bytes.Buffer
+		if c.recorder.Options != nil && c.recorder.Options.Direction {
+			buf.WriteByte('<')
+		}
+		if c.recorder.Options != nil && c.recorder.Options.TimestampFormat != "" {
+			buf.WriteString(time.Now().Format(c.recorder.Options.TimestampFormat))
+		}
+		if buf.Len() > 0 {
+			buf.WriteByte('\n')
+		}
+		if c.recorder.Options != nil && c.recorder.Options.Hexdump {
+			buf.WriteString(hex.Dump(b))
+		} else {
+			buf.Write(b)
+		}
+		c.recorder.Recorder.Record(context.Background(), buf.Bytes())
+	}
+	return c.Conn.Write(b)
+}

go-gost/x/handler/serial/handler.go

@@ -0,0 +1,139 @@
+package serial
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	serial "github.com/go-gost/x/internal/util/serial"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("serial", NewHandler)
+}
+
+type serialHandler struct {
+	hop      hop.Hop
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &serialHandler{
+		options: options,
+	}
+}
+
+func (h *serialHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandlerSerial {
+			h.recorder = ro
+			break
+		}
+	}
+
+	return
+}
+
+// Forward implements handler.Forwarder.
+func (h *serialHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *serialHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	defer conn.Close()
+
+	log := h.options.Logger
+
+	log = log.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	conn = &recorderConn{
+		Conn:     conn,
+		recorder: h.recorder,
+	}
+
+	if h.hop != nil {
+		target := h.hop.Select(ctx)
+		if target == nil {
+			err := errors.New("target not available")
+			log.Error(err)
+			return err
+		}
+		log = log.WithFields(map[string]any{
+			"node": target.Name,
+			"dst":  target.Addr,
+		})
+		return h.forwardSerial(ctx, conn, target, log)
+	}
+
+	cc, err := h.options.Router.Dial(ctx, "tcp", "@")
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer cc.Close()
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.LocalAddr(), "@")
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.LocalAddr(), "@")
+
+	return nil
+}
+
+func (h *serialHandler) forwardSerial(ctx context.Context, conn net.Conn, target *chain.Node, log logger.Logger) (err error) {
+	log.Debugf("%s >> %s", conn.LocalAddr(), target.Addr)
+	var port io.ReadWriteCloser
+
+	cfg := serial.ParseConfigFromAddr(conn.LocalAddr().String())
+	cfg.Name = target.Addr
+
+	if opts := h.options.Router.Options(); opts != nil && opts.Chain != nil {
+		port, err = h.options.Router.Dial(ctx, "serial", serial.AddrFromConfig(cfg))
+	} else {
+		cfg.ReadTimeout = h.md.timeout
+		port, err = serial.OpenPort(cfg)
+	}
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer port.Close()
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.LocalAddr(), target.Addr)
+	xnet.Transport(conn, port)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.LocalAddr(), target.Addr)
+
+	return nil
+}

go-gost/x/handler/serial/metadata.go

@@ -0,0 +1,22 @@
+package serial
+
+import (
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+const (
+	defaultPort     = "COM1"
+	defaultBaudRate = 9600
+)
+
+type metadata struct {
+	timeout time.Duration
+}
+
+func (h *serialHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.timeout = mdutil.GetDuration(md, "timeout", "serial.timeout", "handler.serial.timeout")
+	return
+}

go-gost/x/handler/sni/handler.go

@@ -0,0 +1,191 @@
+package sni
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("sni", NewHandler)
+}
+
+type sniHandler struct {
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	h := &sniHandler{
+		options: options,
+	}
+
+	return h
+}
+
+func (h *sniHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return nil
+}
+
+func (h *sniHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Network:    "tcp",
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	br := bufio.NewReader(conn)
+	proto, _ := sniffing.Sniff(ctx, br)
+	ro.Proto = proto
+
+	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+		var buf bytes.Buffer
+		cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+		ro.Route = buf.String()
+		return cc, err
+	}
+	dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+		var buf bytes.Buffer
+		cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+		ro.Route = buf.String()
+		if err != nil {
+			return nil, err
+		}
+		cc = tls.Client(cc, cfg)
+		return cc, nil
+	}
+
+	sniffer := &sniffing.Sniffer{
+		Websocket:           h.md.sniffingWebsocket,
+		WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+		Recorder:            h.recorder.Recorder,
+		RecorderOptions:     h.recorder.Options,
+		Certificate:         h.md.certificate,
+		PrivateKey:          h.md.privateKey,
+		NegotiatedProtocol:  h.md.alpn,
+		CertPool:            h.certPool,
+		MitmBypass:          h.md.mitmBypass,
+		ReadTimeout:         h.md.readTimeout,
+	}
+	conn = xnet.NewReadWriteConn(br, conn, conn)
+	switch proto {
+	case sniffing.ProtoHTTP:
+		return sniffer.HandleHTTP(ctx, conn,
+			sniffing.WithDial(dial),
+			sniffing.WithDialTLS(dialTLS),
+			sniffing.WithBypass(h.options.Bypass),
+			sniffing.WithRecorderObject(ro),
+			sniffing.WithLog(log),
+		)
+	case sniffing.ProtoTLS:
+		return sniffer.HandleTLS(ctx, conn,
+			sniffing.WithDial(dial),
+			sniffing.WithDialTLS(dialTLS),
+			sniffing.WithBypass(h.options.Bypass),
+			sniffing.WithRecorderObject(ro),
+			sniffing.WithLog(log),
+		)
+	default:
+		return errors.New("unknown traffic")
+	}
+}
+
+func (h *sniHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}

go-gost/x/handler/sni/metadata.go

@@ -0,0 +1,55 @@
+package sni
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout time.Duration
+	hash        string
+
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+}
+
+func (h *sniHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	return
+}

go-gost/x/handler/socks/v4/handler.go

@@ -0,0 +1,371 @@
+package v4
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/gosocks4"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	ErrUnknownCmd    = errors.New("socks4: unknown command")
+	ErrUnimplemented = errors.New("socks4: unimplemented")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("socks4", NewHandler)
+	registry.HandlerRegistry().Register("socks4a", NewHandler)
+}
+
+type socks4Handler struct {
+	md       metadata
+	options  handler.Options
+	stats    *stats_util.HandlerStats
+	limiter  traffic.TrafficLimiter
+	cancel   context.CancelFunc
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &socks4Handler{
+		options: options,
+	}
+}
+
+func (h *socks4Handler) Init(md md.Metadata) (err error) {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return nil
+}
+
+func (h *socks4Handler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "tcp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	if h.md.readTimeout > 0 {
+		conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+	}
+
+	req, err := gosocks4.ReadRequest(conn)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+
+	ro.Host = req.Addr.String()
+	log.Trace(req)
+
+	conn.SetReadDeadline(time.Time{})
+
+	if h.options.Auther != nil {
+		clientID, ok := h.options.Auther.Authenticate(ctx, string(req.Userid), "")
+		if !ok {
+			resp := gosocks4.NewReply(gosocks4.RejectedUserid, nil)
+			log.Trace(resp)
+			return resp.Write(conn)
+		}
+		ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+		ro.ClientID = clientID
+	}
+
+	switch req.Cmd {
+	case gosocks4.CmdConnect:
+		return h.handleConnect(ctx, conn, req, ro, log)
+	case gosocks4.CmdBind:
+		return h.handleBind(ctx, conn, req)
+	default:
+		err = ErrUnknownCmd
+		log.Error(err)
+		return err
+	}
+}
+
+func (h *socks4Handler) Close() error {
+	if h.cancel != nil {
+		h.cancel()
+	}
+	return nil
+}
+
+func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *gosocks4.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	addr := req.Addr.String()
+
+	log = log.WithFields(map[string]any{
+		"dst":  addr,
+		"host": addr,
+	})
+	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption("tcp"),
+			limiter.AddrOption(addr),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", addr) {
+		resp := gosocks4.NewReply(gosocks4.Rejected, nil)
+		log.Trace(resp)
+		log.Debug("bypass: ", addr)
+		return resp.Write(conn)
+	}
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", addr)
+	ro.Route = buf.String()
+	if err != nil {
+		resp := gosocks4.NewReply(gosocks4.Failed, nil)
+		log.Trace(resp)
+		resp.Write(conn)
+		return err
+	}
+	defer cc.Close()
+
+	resp := gosocks4.NewReply(gosocks4.Granted, nil)
+	log.Trace(resp)
+	if err := resp.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), ro.Host)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), ro.Host)
+
+	return nil
+}
+
+func (h *socks4Handler) handleBind(ctx context.Context, conn net.Conn, req *gosocks4.Request) error {
+	// TODO: bind
+	return ErrUnimplemented
+}
+
+func (h *socks4Handler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *socks4Handler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/socks/v4/metadata.go

@@ -0,0 +1,79 @@
+package v4
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout            time.Duration
+	hash                   string
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *socks4Handler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return
+}

go-gost/x/handler/socks/v5/bind.go

@@ -0,0 +1,181 @@
+package v5
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+)
+
+func (h *socks5Handler) handleBind(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst": fmt.Sprintf("%s/%s", address, network),
+		"cmd": "bind",
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
+
+	if !h.md.enableBind {
+		reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(reply)
+		log.Error("socks5: BIND is disabled")
+		return reply.Write(conn)
+	}
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	// BIND does not support chain.
+	return h.bindLocal(ctx, conn, network, address, log)
+}
+
+func (h *socks5Handler) bindLocal(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	ln, err := lc.Listen(ctx, network, address) // strict mode: if the port already in use, it will return error
+	if err != nil {
+		log.Error(err)
+		reply := gosocks5.NewReply(gosocks5.Failure, nil)
+		if err := reply.Write(conn); err != nil {
+			log.Error(err)
+		}
+		log.Debug(reply)
+		return err
+	}
+
+	socksAddr := gosocks5.Addr{}
+	if err := socksAddr.ParseFrom(ln.Addr().String()); err != nil {
+		log.Warn(err)
+	}
+
+	// Issue: may not reachable when host has multi-interface
+	socksAddr.Host, _, _ = net.SplitHostPort(conn.LocalAddr().String())
+	socksAddr.Type = 0
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &socksAddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		ln.Close()
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"bind": fmt.Sprintf("%s/%s", ln.Addr(), ln.Addr().Network()),
+	})
+
+	log.Debugf("bind on %s OK", ln.Addr())
+
+	h.serveBind(ctx, conn, ln, log)
+	return nil
+}
+
+func (h *socks5Handler) serveBind(ctx context.Context, conn net.Conn, ln net.Listener, log logger.Logger) {
+	var rc net.Conn
+	accept := func() <-chan error {
+		errc := make(chan error, 1)
+
+		go func() {
+			defer close(errc)
+			defer ln.Close()
+
+			c, err := ln.Accept()
+			if err != nil {
+				errc <- err
+			}
+			rc = c
+		}()
+
+		return errc
+	}
+
+	pc1, pc2 := net.Pipe()
+	pipe := func() <-chan error {
+		errc := make(chan error, 1)
+
+		go func() {
+			defer close(errc)
+			defer pc1.Close()
+
+			errc <- xnet.Transport(conn, pc1)
+		}()
+
+		return errc
+	}
+
+	defer pc2.Close()
+
+	select {
+	case err := <-accept():
+		if err != nil {
+			log.Error(err)
+
+			reply := gosocks5.NewReply(gosocks5.Failure, nil)
+			log.Trace(reply)
+			if err := reply.Write(pc2); err != nil {
+				log.Error(err)
+			}
+
+			return
+		}
+		defer rc.Close()
+
+		log.Debugf("peer %s accepted", rc.RemoteAddr())
+
+		log = log.WithFields(map[string]any{
+			"local":  rc.LocalAddr().String(),
+			"remote": rc.RemoteAddr().String(),
+		})
+
+		raddr := gosocks5.Addr{}
+		raddr.ParseFrom(rc.RemoteAddr().String())
+		reply := gosocks5.NewReply(gosocks5.Succeeded, &raddr)
+		log.Trace(reply)
+		if err := reply.Write(pc2); err != nil {
+			log.Error(err)
+		}
+
+		start := time.Now()
+		log.Debugf("%s <-> %s", rc.LocalAddr(), rc.RemoteAddr())
+		xnet.Transport(pc2, rc)
+		log.WithFields(map[string]any{"duration": time.Since(start)}).
+			Debugf("%s >-< %s", rc.LocalAddr(), rc.RemoteAddr())
+
+	case err := <-pipe():
+		if err != nil {
+			log.Error(err)
+		}
+		ln.Close()
+		return
+	}
+}

go-gost/x/handler/socks/v5/connect.go

@@ -0,0 +1,145 @@
+package v5
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst":  fmt.Sprintf("%s/%s", address, network),
+		"cmd":  "connect",
+		"host": address,
+	})
+	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, network, address) {
+		resp := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(resp)
+		log.Debug("bypass: ", address)
+		return resp.Write(conn)
+	}
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: address})
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, address)
+	ro.Route = buf.String()
+	if err != nil {
+		resp := gosocks5.NewReply(gosocks5.NetUnreachable, nil)
+		log.Trace(resp)
+		resp.Write(conn)
+		return err
+	}
+	defer cc.Close()
+
+	resp := gosocks5.NewReply(gosocks5.Succeeded, nil)
+	log.Trace(resp)
+	if err := resp.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), address)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), address)
+
+	return nil
+}

go-gost/x/handler/socks/v5/handler.go

@@ -0,0 +1,250 @@
+package v5
+
+import (
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/socks"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	ErrUnknownCmd = errors.New("socks5: unknown command")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("socks5", NewHandler)
+	registry.HandlerRegistry().Register("socks", NewHandler)
+}
+
+type socks5Handler struct {
+	selector gosocks5.Selector
+	md       metadata
+	options  handler.Options
+	stats    *stats_util.HandlerStats
+	limiter  traffic.TrafficLimiter
+	cancel   context.CancelFunc
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &socks5Handler{
+		options: options,
+	}
+}
+
+func (h *socks5Handler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	h.selector = &serverSelector{
+		Authenticator: h.options.Auther,
+		TLSConfig:     h.options.TLSConfig,
+		logger:        h.options.Logger,
+		noTLS:         h.md.noTLS,
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return
+}
+
+func (h *socks5Handler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "tcp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes += pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes += pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+
+	sc := gosocks5.ServerConn(conn, h.selector)
+	req, err := gosocks5.ReadRequest(sc)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	log.Trace(req)
+
+	if clientID := sc.ID(); clientID != "" {
+		ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+		log = log.WithFields(map[string]any{"user": clientID})
+		ro.ClientID = clientID
+	}
+
+	conn = sc
+	conn.SetReadDeadline(time.Time{})
+
+	address := req.Addr.String()
+	ro.Host = address
+
+	switch req.Cmd {
+	case gosocks5.CmdConnect:
+		return h.handleConnect(ctx, conn, "tcp", address, ro, log)
+	case gosocks5.CmdBind:
+		return h.handleBind(ctx, conn, "tcp", address, log)
+	case socks.CmdMuxBind:
+		return h.handleMuxBind(ctx, conn, "tcp", address, log)
+	case gosocks5.CmdUdp:
+		ro.Network = "udp"
+		return h.handleUDP(ctx, conn, ro, log)
+	case socks.CmdUDPTun:
+		ro.Network = "udp"
+		return h.handleUDPTun(ctx, conn, "udp", address, ro, log)
+	default:
+		err = ErrUnknownCmd
+		log.Error(err)
+		resp := gosocks5.NewReply(gosocks5.CmdUnsupported, nil)
+		log.Trace(resp)
+		resp.Write(conn)
+		return err
+	}
+}
+
+func (h *socks5Handler) Close() error {
+	if h.cancel != nil {
+		h.cancel()
+	}
+	return nil
+}
+
+func (h *socks5Handler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *socks5Handler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/socks/v5/mbind.go

@@ -0,0 +1,165 @@
+package v5
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/mux"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+)
+
+func (h *socks5Handler) handleMuxBind(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst": fmt.Sprintf("%s/%s", address, network),
+		"cmd": "mbind",
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
+
+	if !h.md.enableBind {
+		reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(reply)
+		log.Error("socks5: BIND is disabled")
+		return reply.Write(conn)
+	}
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	return h.muxBindLocal(ctx, conn, network, address, log)
+}
+
+func (h *socks5Handler) muxBindLocal(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	ln, err := lc.Listen(ctx, network, address) // strict mode: if the port already in use, it will return error
+	if err != nil {
+		log.Error(err)
+		reply := gosocks5.NewReply(gosocks5.Failure, nil)
+		log.Trace(reply)
+		if err := reply.Write(conn); err != nil {
+			log.Error(err)
+		}
+		return err
+	}
+
+	socksAddr := gosocks5.Addr{}
+	err = socksAddr.ParseFrom(ln.Addr().String())
+	if err != nil {
+		log.Warn(err)
+	}
+
+	// Issue: may not reachable when host has multi-interface
+	socksAddr.Host, _, _ = net.SplitHostPort(conn.LocalAddr().String())
+	socksAddr.Type = 0
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &socksAddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		ln.Close()
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"bind": fmt.Sprintf("%s/%s", ln.Addr(), ln.Addr().Network()),
+	})
+
+	log.Debugf("bind on %s OK", ln.Addr())
+
+	return h.serveMuxBind(ctx, conn, ln, log)
+}
+
+func (h *socks5Handler) serveMuxBind(ctx context.Context, conn net.Conn, ln net.Listener, log logger.Logger) error {
+	// Upgrade connection to multiplex stream.
+	session, err := mux.ClientSession(conn, h.md.muxCfg)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer session.Close()
+
+	go func() {
+		defer ln.Close()
+		for {
+			conn, err := session.Accept()
+			if err != nil {
+				log.Error(err)
+				return
+			}
+			conn.Close() // we do not handle incoming connections.
+		}
+	}()
+
+	for {
+		rc, err := ln.Accept()
+		if err != nil {
+			log.Error(err)
+			return err
+		}
+		log.Debugf("peer %s accepted", rc.RemoteAddr())
+
+		go func(c net.Conn) {
+			defer c.Close()
+
+			log = log.WithFields(map[string]any{
+				"local":  rc.LocalAddr().String(),
+				"remote": rc.RemoteAddr().String(),
+			})
+			sc, err := session.GetConn()
+			if err != nil {
+				log.Error(err)
+				return
+			}
+			defer sc.Close()
+
+			// incompatible with GOST v2.x
+			if !h.md.compatibilityMode {
+				addr := gosocks5.Addr{}
+				addr.ParseFrom(c.RemoteAddr().String())
+				reply := gosocks5.NewReply(gosocks5.Succeeded, &addr)
+				log.Trace(reply)
+				if err := reply.Write(sc); err != nil {
+					log.Error(err)
+					return
+				}
+			}
+
+			t := time.Now()
+			log.Debugf("%s <-> %s", c.LocalAddr(), c.RemoteAddr())
+			xnet.Transport(sc, c)
+			log.WithFields(map[string]any{"duration": time.Since(t)}).
+				Debugf("%s >-< %s", c.LocalAddr(), c.RemoteAddr())
+		}(rc)
+	}
+}

go-gost/x/handler/socks/v5/metadata.go

@@ -0,0 +1,99 @@
+package v5
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/x/internal/util/mux"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout       time.Duration
+	noTLS             bool
+	enableBind        bool
+	enableUDP         bool
+	compatibilityMode bool
+	hash              string
+	muxCfg            *mux.Config
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *socks5Handler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.noTLS = mdutil.GetBool(md, "notls")
+	h.md.enableBind = mdutil.GetBool(md, "bind")
+	h.md.enableUDP = mdutil.GetBool(md, "udp")
+
+	h.md.compatibilityMode = mdutil.GetBool(md, "comp")
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.muxCfg = &mux.Config{
+		Version:           mdutil.GetInt(md, "mux.version"),
+		KeepAliveInterval: mdutil.GetDuration(md, "mux.keepaliveInterval"),
+		KeepAliveDisabled: mdutil.GetBool(md, "mux.keepaliveDisabled"),
+		KeepAliveTimeout:  mdutil.GetDuration(md, "mux.keepaliveTimeout"),
+		MaxFrameSize:      mdutil.GetInt(md, "mux.maxFrameSize"),
+		MaxReceiveBuffer:  mdutil.GetInt(md, "mux.maxReceiveBuffer"),
+		MaxStreamBuffer:   mdutil.GetInt(md, "mux.maxStreamBuffer"),
+	}
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return nil
+}

go-gost/x/handler/socks/v5/selector.go

@@ -0,0 +1,101 @@
+package v5
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/socks"
+)
+
+type serverSelector struct {
+	methods       []uint8
+	Authenticator auth.Authenticator
+	TLSConfig     *tls.Config
+	logger        logger.Logger
+	noTLS         bool
+}
+
+func (selector *serverSelector) Methods() []uint8 {
+	return selector.methods
+}
+
+func (s *serverSelector) Select(methods ...uint8) (method uint8) {
+	s.logger.Debugf("%d %d %v", gosocks5.Ver5, len(methods), methods)
+	method = gosocks5.MethodNoAuth
+	for _, m := range methods {
+		if m == socks.MethodTLS && !s.noTLS {
+			method = m
+			break
+		}
+	}
+
+	// when Authenticator is set, auth is mandatory
+	if s.Authenticator != nil {
+		if method == gosocks5.MethodNoAuth {
+			method = gosocks5.MethodUserPass
+		}
+		if method == socks.MethodTLS && !s.noTLS {
+			method = socks.MethodTLSAuth
+		}
+	}
+
+	return
+}
+
+func (s *serverSelector) OnSelected(method uint8, conn net.Conn) (string, net.Conn, error) {
+	s.logger.Debugf("%d %d", gosocks5.Ver5, method)
+	switch method {
+	case gosocks5.MethodNoAuth:
+
+	case socks.MethodTLS:
+		conn = tls.Server(conn, s.TLSConfig)
+
+	case gosocks5.MethodUserPass, socks.MethodTLSAuth:
+		if method == socks.MethodTLSAuth {
+			conn = tls.Server(conn, s.TLSConfig)
+		}
+
+		req, err := gosocks5.ReadUserPassRequest(conn)
+		if err != nil {
+			s.logger.Error(err)
+			return "", nil, err
+		}
+		s.logger.Trace(req)
+
+		var id string
+		if s.Authenticator != nil {
+			var ok bool
+			ctx := ctxvalue.ContextWithClientAddr(context.Background(), ctxvalue.ClientAddr(conn.RemoteAddr().String()))
+			id, ok = s.Authenticator.Authenticate(ctx, req.Username, req.Password)
+			if !ok {
+				resp := gosocks5.NewUserPassResponse(gosocks5.UserPassVer, gosocks5.Failure)
+				if err := resp.Write(conn); err != nil {
+					s.logger.Error(err)
+					return "", nil, err
+				}
+				s.logger.Info(resp)
+
+				return "", nil, gosocks5.ErrAuthFailure
+			}
+		}
+
+		resp := gosocks5.NewUserPassResponse(gosocks5.UserPassVer, gosocks5.Succeeded)
+		s.logger.Trace(resp)
+		if err := resp.Write(conn); err != nil {
+			s.logger.Error(err)
+			return "", nil, err
+		}
+		return id, conn, nil
+
+	case gosocks5.MethodNoAcceptable:
+		return "", nil, gosocks5.ErrBadMethod
+	default:
+		return "", nil, gosocks5.ErrBadFormat
+	}
+	return "", conn, nil
+}

go-gost/x/handler/socks/v5/udp.go

@@ -0,0 +1,125 @@
+package v5
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/socks"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *socks5Handler) handleUDP(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"cmd": "udp",
+	})
+
+	if !h.md.enableUDP {
+		reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(reply)
+		log.Error("socks5: UDP relay is disabled")
+		return reply.Write(conn)
+	}
+
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	laddr := &net.UDPAddr{IP: conn.LocalAddr().(*net.TCPAddr).IP, Port: 0} // use out-going interface's IP
+	cc, err := lc.ListenPacket(ctx, "udp", laddr.String())
+	if err != nil {
+		log.Error(err)
+		reply := gosocks5.NewReply(gosocks5.Failure, nil)
+		log.Trace(reply)
+		reply.Write(conn)
+		return err
+	}
+	defer cc.Close()
+
+	saddr := gosocks5.Addr{}
+	saddr.ParseFrom(cc.LocalAddr().String())
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &saddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"bind": fmt.Sprintf("%s/%s", cc.LocalAddr(), cc.LocalAddr().Network()),
+	})
+	log.Debugf("bind on %s OK", cc.LocalAddr())
+
+	// obtain a udp connection
+	var buf bytes.Buffer
+	c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer c.Close()
+
+	pc, ok := c.(net.PacketConn)
+	if !ok {
+		err := errors.New("socks5: wrong connection type")
+		log.Error(err)
+		return err
+	}
+
+	pStats := xstats.Stats{}
+	cc = stats_wrapper.WrapPacketConn(cc, &pStats)
+
+	defer func() {
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+	}()
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		cc = traffic_wrapper.WrapPacketConn(
+			cc,
+			h.limiter,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption("udp"),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			cc = stats_wrapper.WrapPacketConn(cc, pstats)
+		}
+	}
+
+	r := udp.NewRelay(socks.UDPConn(cc), pc).
+		WithBypass(h.options.Bypass).
+		WithLogger(log)
+
+	go r.Run(ctx)
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), cc.LocalAddr())
+	io.Copy(io.Discard, conn)
+	log.WithFields(map[string]any{"duration": time.Since(t)}).
+		Debugf("%s >-< %s", conn.RemoteAddr(), cc.LocalAddr())
+
+	return nil
+}

go-gost/x/handler/socks/v5/udp_tun.go

@@ -0,0 +1,139 @@
+package v5
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/socks"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *socks5Handler) handleUDPTun(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"cmd": "udp-tun",
+	})
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	bindAddr, _ := net.ResolveUDPAddr(network, address)
+	if bindAddr == nil {
+		bindAddr = &net.UDPAddr{}
+	}
+
+	var pc net.PacketConn
+	// relay mode
+	if bindAddr.Port == 0 {
+		if !h.md.enableUDP {
+			reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+			log.Trace(reply)
+			log.Error("socks5: UDP relay is disabled")
+			return reply.Write(conn)
+		}
+
+		// obtain a udp connection
+		var buf bytes.Buffer
+		c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+		ro.Route = buf.String()
+		if err != nil {
+			log.Error(err)
+			return err
+		}
+		defer c.Close()
+
+		var ok bool
+		pc, ok = c.(net.PacketConn)
+		if !ok {
+			err := errors.New("socks5: wrong connection type")
+			log.Error(err)
+			return err
+		}
+
+	} else { // BIND mode
+		if !h.md.enableBind {
+			reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+			log.Trace(reply)
+			log.Error("socks5: BIND is disabled")
+			return reply.Write(conn)
+		}
+
+		lc := xnet.ListenConfig{
+			Netns: h.options.Netns,
+		}
+		var err error
+		pc, err = lc.ListenPacket(ctx, "udp", bindAddr.String())
+		if err != nil {
+			log.Error(err)
+			reply := gosocks5.NewReply(gosocks5.Failure, nil)
+			log.Trace(reply)
+			reply.Write(conn)
+			return err
+		}
+	}
+	defer pc.Close()
+
+	saddr := gosocks5.Addr{}
+	saddr.ParseFrom(pc.LocalAddr().String())
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &saddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+	log.Debugf("bind on %s OK", pc.LocalAddr())
+
+	clientID := ctxvalue.ClientIDFromContext(ctx)
+	if h.options.Observer != nil {
+		pstats := h.stats.Stats(string(clientID))
+		pstats.Add(stats.KindTotalConns, 1)
+		pstats.Add(stats.KindCurrentConns, 1)
+		defer pstats.Add(stats.KindCurrentConns, -1)
+		conn = stats_wrapper.WrapConn(conn, pstats)
+	}
+
+	r := udp.NewRelay(socks.UDPTunServerConn(conn), pc).
+		WithBypass(h.options.Bypass).
+		WithLogger(log)
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), pc.LocalAddr())
+	r.Run(ctx)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Debugf("%s >-< %s", conn.RemoteAddr(), pc.LocalAddr())
+
+	return nil
+}

go-gost/x/handler/ss/handler.go

@@ -0,0 +1,247 @@
+package ss
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	"github.com/go-gost/x/internal/util/ss"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+	"github.com/shadowsocks/go-shadowsocks2/core"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("ss", NewHandler)
+}
+
+type ssHandler struct {
+	cipher   core.Cipher
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &ssHandler{
+		options: options,
+	}
+}
+
+func (h *ssHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+	if h.options.Auth != nil {
+		method := h.options.Auth.Username()
+		password, _ := h.options.Auth.Password()
+		h.cipher, err = ss.ShadowCipher(method, password, h.md.key)
+		if err != nil {
+			return
+		}
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return
+}
+
+func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "tcp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	if h.cipher != nil {
+		conn = ss.ShadowConn(h.cipher.StreamConn(conn), nil)
+	}
+
+	conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+
+	addr := &gosocks5.Addr{}
+	if _, err := addr.ReadFrom(conn); err != nil {
+		log.Error(err)
+		io.Copy(io.Discard, conn)
+		return err
+	}
+	ro.Host = addr.String()
+
+	conn.SetReadDeadline(time.Time{})
+
+	log = log.WithFields(map[string]any{
+		"dst":  addr.String(),
+		"host": addr.String(),
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", addr.String()) {
+		log.Debug("bypass: ", addr.String())
+		return nil
+	}
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr.String()})
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", addr.String())
+	ro.Route = buf.String()
+	if err != nil {
+		return err
+	}
+	defer cc.Close()
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), ro.Host)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), ro.Host)
+
+	return nil
+}
+
+func (h *ssHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}

go-gost/x/handler/ss/metadata.go

@@ -0,0 +1,62 @@
+package ss
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	key         string
+	hash        string
+	readTimeout time.Duration
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+}
+
+func (h *ssHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.key = mdutil.GetString(md, "key")
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	return
+}

go-gost/x/handler/ss/udp/handler.go

@@ -0,0 +1,228 @@
+package ss
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/relay"
+	"github.com/go-gost/x/internal/util/ss"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+	"github.com/shadowsocks/go-shadowsocks2/core"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("ssu", NewHandler)
+}
+
+type ssuHandler struct {
+	cipher   core.Cipher
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &ssuHandler{
+		options: options,
+	}
+}
+
+func (h *ssuHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	if h.options.Auth != nil {
+		method := h.options.Auth.Username()
+		password, _ := h.options.Auth.Password()
+		h.cipher, err = ss.ShadowCipher(method, password, h.md.key)
+		if err != nil {
+			return
+		}
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	return
+}
+
+func (h *ssuHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "udp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.Duration = time.Since(start)
+		ro.Record(ctx, h.recorder.Recorder)
+
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	pc, ok := conn.(net.PacketConn)
+	if ok {
+		if h.cipher != nil {
+			pc = h.cipher.PacketConn(pc)
+		}
+		// standard UDP relay.
+		pc = ss.UDPServerConn(pc, conn.RemoteAddr())
+	} else {
+		if h.cipher != nil {
+			conn = ss.ShadowConn(h.cipher.StreamConn(conn), nil)
+		}
+		// UDP over TCP
+		pc = relay.UDPTunServerConn(conn)
+	}
+
+	// obtain a udp connection
+	var buf bytes.Buffer
+	c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer c.Close()
+
+	cc, ok := c.(net.PacketConn)
+	if !ok {
+		err := errors.New("ss: wrong connection type")
+		log.Error(err)
+		return err
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.LocalAddr(), cc.LocalAddr())
+	h.relayPacket(ctx, pc, cc, ro, log)
+	log.WithFields(map[string]any{"duration": time.Since(t)}).
+		Infof("%s >-< %s", conn.LocalAddr(), cc.LocalAddr())
+
+	return nil
+}
+
+func (h *ssuHandler) relayPacket(ctx context.Context, pc1, pc2 net.PacketConn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
+	errc := make(chan error, 2)
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, addr, err := pc1.ReadFrom(b[:])
+				if err != nil {
+					return err
+				}
+
+				if ro.Host == "" {
+					ro.Host = addr.String()
+				}
+
+				if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, addr.Network(), addr.String()) {
+					log.Warn("bypass: ", addr)
+					return nil
+				}
+
+				if _, err = pc2.WriteTo(b[:n], addr); err != nil {
+					return err
+				}
+
+				log.Tracef("%s >>> %s data: %d",
+					pc2.LocalAddr(), addr, n)
+				return nil
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, raddr, err := pc2.ReadFrom(b[:])
+				if err != nil {
+					return err
+				}
+
+				if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, raddr.Network(), raddr.String()) {
+					log.Warn("bypass: ", raddr)
+					return nil
+				}
+
+				if _, err = pc1.WriteTo(b[:n], raddr); err != nil {
+					return err
+				}
+
+				log.Tracef("%s <<< %s data: %d",
+					pc2.LocalAddr(), raddr, n)
+				return nil
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	return <-errc
+}
+
+func (h *ssuHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}

go-gost/x/handler/ss/udp/metadata.go

@@ -0,0 +1,30 @@
+package ss
+
+import (
+	"math"
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+const (
+	MaxMessageSize = math.MaxUint16
+)
+
+type metadata struct {
+	key         string
+	readTimeout time.Duration
+}
+
+func (h *ssuHandler) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		key         = "key"
+		readTimeout = "readTimeout"
+	)
+
+	h.md.key = mdutil.GetString(md, key)
+	h.md.readTimeout = mdutil.GetDuration(md, readTimeout)
+
+	return
+}

go-gost/x/handler/sshd/handler.go

@@ -0,0 +1,370 @@
+package ssh
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	xbypass "github.com/go-gost/x/bypass"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	sshd_util "github.com/go-gost/x/internal/util/sshd"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+	"golang.org/x/crypto/ssh"
+)
+
+// Applicable SSH Request types for Port Forwarding - RFC 4254 7.X
+const (
+	ForwardedTCPReturnRequest = "forwarded-tcpip" // RFC 4254 7.2
+)
+
+func init() {
+	registry.HandlerRegistry().Register("sshd", NewHandler)
+}
+
+type forwardHandler struct {
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &forwardHandler{
+		options: options,
+	}
+}
+
+func (h *forwardHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return nil
+}
+
+func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "tcp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	switch cc := conn.(type) {
+	case *sshd_util.DirectForwardConn:
+		return h.handleDirectForward(ctx, cc, ro, log)
+	case *sshd_util.RemoteForwardConn:
+		return h.handleRemoteForward(ctx, cc, ro, log)
+	default:
+		err := errors.New("sshd: wrong connection type")
+		log.Error(err)
+		return err
+	}
+}
+
+func (h *forwardHandler) handleDirectForward(ctx context.Context, conn *sshd_util.DirectForwardConn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	targetAddr := conn.DstAddr()
+
+	ro.Host = targetAddr
+	log = log.WithFields(map[string]any{
+		"dst":  fmt.Sprintf("%s/%s", targetAddr, "tcp"),
+		"cmd":  "connect",
+		"host": targetAddr,
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), targetAddr)
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", targetAddr) {
+		log.Debugf("bypass %s", targetAddr)
+		return xbypass.ErrBypass
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", targetAddr)
+	ro.Route = buf.String()
+	if err != nil {
+		return err
+	}
+	defer cc.Close()
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, xnet.NewReadWriteConn(br, conn, conn),
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, xnet.NewReadWriteConn(br, conn, conn),
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", cc.LocalAddr(), targetAddr)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", cc.LocalAddr(), targetAddr)
+
+	return nil
+}
+
+func (h *forwardHandler) handleRemoteForward(ctx context.Context, conn *sshd_util.RemoteForwardConn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	req := conn.Request()
+
+	t := tcpipForward{}
+	if err := ssh.Unmarshal(req.Payload, &t); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	network := "tcp"
+	addr := net.JoinHostPort(t.Host, strconv.Itoa(int(t.Port)))
+	ro.Host = addr
+
+	log = log.WithFields(map[string]any{
+		"dst": fmt.Sprintf("%s/%s", addr, network),
+		"cmd": "bind",
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
+
+	// tie to the client connection
+	ln, err := net.Listen(network, addr)
+	if err != nil {
+		log.Error(err)
+		req.Reply(false, nil)
+		return err
+	}
+	defer ln.Close()
+
+	log = log.WithFields(map[string]any{
+		"bind": fmt.Sprintf("%s/%s", ln.Addr(), ln.Addr().Network()),
+	})
+	log.Debugf("bind on %s OK", ln.Addr())
+
+	err = func() error {
+		if t.Port == 0 && req.WantReply { // Client sent port 0. let them know which port is actually being used
+			_, port, err := getHostPortFromAddr(ln.Addr())
+			if err != nil {
+				return err
+			}
+			var b [4]byte
+			binary.BigEndian.PutUint32(b[:], uint32(port))
+			t.Port = uint32(port)
+			return req.Reply(true, b[:])
+		}
+		return req.Reply(true, nil)
+	}()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+
+	sshConn := conn.Conn()
+
+	go func() {
+		for {
+			cc, err := ln.Accept()
+			if err != nil { // Unable to accept new connection - listener is likely closed
+				return
+			}
+
+			go func(conn net.Conn) {
+				defer conn.Close()
+
+				log := log.WithFields(map[string]any{
+					"local":  conn.LocalAddr().String(),
+					"remote": conn.RemoteAddr().String(),
+				})
+
+				p := directForward{}
+				var err error
+
+				var portnum int
+				p.Host1 = t.Host
+				p.Port1 = t.Port
+				p.Host2, portnum, err = getHostPortFromAddr(conn.RemoteAddr())
+				if err != nil {
+					return
+				}
+
+				p.Port2 = uint32(portnum)
+				ch, reqs, err := sshConn.OpenChannel(ForwardedTCPReturnRequest, ssh.Marshal(p))
+				if err != nil {
+					log.Error("open forwarded channel: ", err)
+					return
+				}
+				defer ch.Close()
+				go ssh.DiscardRequests(reqs)
+
+				t := time.Now()
+				log.Debugf("%s <-> %s", conn.LocalAddr(), conn.RemoteAddr())
+				xnet.Transport(ch, conn)
+				log.WithFields(map[string]any{
+					"duration": time.Since(t),
+				}).Debugf("%s >-< %s", conn.LocalAddr(), conn.RemoteAddr())
+			}(cc)
+		}
+	}()
+
+	tm := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), addr)
+	<-conn.Done()
+	log.WithFields(map[string]any{
+		"duration": time.Since(tm),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), addr)
+
+	return nil
+}
+
+func (h *forwardHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func getHostPortFromAddr(addr net.Addr) (host string, port int, err error) {
+	host, portString, err := net.SplitHostPort(addr.String())
+	if err != nil {
+		return
+	}
+	port, err = strconv.Atoi(portString)
+	return
+}
+
+// directForward is structure for RFC 4254 7.2 - can be used for "forwarded-tcpip" and "direct-tcpip"
+type directForward struct {
+	Host1 string
+	Port1 uint32
+	Host2 string
+	Port2 uint32
+}
+
+func (p directForward) String() string {
+	return fmt.Sprintf("%s:%d -> %s:%d", p.Host2, p.Port2, p.Host1, p.Port1)
+}
+
+// tcpipForward is structure for RFC 4254 7.1 "tcpip-forward" request
+type tcpipForward struct {
+	Host string
+	Port uint32
+}

go-gost/x/handler/sshd/metadata.go

@@ -0,0 +1,57 @@
+package ssh
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout time.Duration
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+}
+
+func (h *forwardHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	return
+}

go-gost/x/handler/tap/handler.go

@@ -0,0 +1,343 @@
+package tap
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/ss"
+	tap_util "github.com/go-gost/x/internal/util/tap"
+	"github.com/go-gost/x/registry"
+	"github.com/shadowsocks/go-shadowsocks2/core"
+	"github.com/shadowsocks/go-shadowsocks2/shadowaead"
+	"github.com/songgao/water/waterutil"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("tap", NewHandler)
+}
+
+type tapHandler struct {
+	hop     hop.Hop
+	routes  sync.Map
+	exit    chan struct{}
+	cipher  core.Cipher
+	md      metadata
+	options handler.Options
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &tapHandler{
+		exit:    make(chan struct{}, 1),
+		options: options,
+	}
+}
+
+func (h *tapHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	if h.options.Auth != nil {
+		method := h.options.Auth.Username()
+		password, _ := h.options.Auth.Password()
+		h.cipher, err = ss.ShadowCipher(method, password, h.md.key)
+		if err != nil {
+			return
+		}
+	}
+
+	return
+}
+
+// Forward implements handler.Forwarder.
+func (h *tapHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *tapHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	defer os.Exit(0)
+	defer conn.Close()
+
+	log := h.options.Logger
+	v, _ := conn.(md.Metadatable)
+	if v == nil {
+		err := errors.New("tap: wrong connection type")
+		log.Error(err)
+		return err
+	}
+
+	start := time.Now()
+	log = log.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+	defer func() {
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	network := "udp"
+	var raddr net.Addr
+	var err error
+
+	var target *chain.Node
+	if h.hop != nil {
+		target = h.hop.Select(ctx)
+	}
+	if target != nil {
+		raddr, err = net.ResolveUDPAddr(network, target.Addr)
+		if err != nil {
+			log.Error(err)
+			return err
+		}
+		log = log.WithFields(map[string]any{
+			"dst": fmt.Sprintf("%s/%s", raddr.String(), raddr.Network()),
+		})
+		log.Debugf("%s >> %s", conn.RemoteAddr(), target.Addr)
+	}
+
+	config := v.Metadata().Get("config").(*tap_util.Config)
+	h.handleLoop(ctx, conn, raddr, config, log)
+	return nil
+}
+
+func (h *tapHandler) handleLoop(ctx context.Context, conn net.Conn, addr net.Addr, config *tap_util.Config, log logger.Logger) {
+	var tempDelay time.Duration
+	for {
+		err := func() error {
+			var err error
+			var pc net.PacketConn
+
+			if addr != nil {
+				cc, err := h.options.Router.Dial(ctx, addr.Network(), "")
+				if err != nil {
+					return err
+				}
+
+				var ok bool
+				pc, ok = cc.(net.PacketConn)
+				if !ok {
+					return errors.New("wrong connection type")
+				}
+			} else {
+				laddr, _ := net.ResolveUDPAddr("udp", conn.LocalAddr().String())
+				pc, err = net.ListenUDP("udp", laddr)
+			}
+			if err != nil {
+				return err
+			}
+
+			if h.cipher != nil {
+				pc = h.cipher.PacketConn(pc)
+			}
+			defer pc.Close()
+
+			return h.transport(conn, pc, addr, config, log)
+		}()
+		if err != nil {
+			log.Error(err)
+		}
+
+		select {
+		case <-h.exit:
+			return
+		default:
+		}
+
+		if err != nil {
+			if tempDelay == 0 {
+				tempDelay = 1000 * time.Millisecond
+			} else {
+				tempDelay *= 2
+			}
+			if max := 6 * time.Second; tempDelay > max {
+				tempDelay = max
+			}
+			time.Sleep(tempDelay)
+			continue
+		}
+		tempDelay = 0
+	}
+
+}
+
+func (h *tapHandler) transport(tap net.Conn, conn net.PacketConn, raddr net.Addr, config *tap_util.Config, log logger.Logger) error {
+	errc := make(chan error, 1)
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, err := tap.Read(b[:])
+				if err != nil {
+					select {
+					case h.exit <- struct{}{}:
+					default:
+					}
+					return err
+				}
+				if n == 0 {
+					return nil
+				}
+
+				src := waterutil.MACSource(b[:n])
+				dst := waterutil.MACDestination(b[:n])
+				eType := etherType(waterutil.MACEthertype(b[:n]))
+
+				log.Debugf("%s >> %s %s %d", src, dst, eType, n)
+
+				// client side, deliver frame directly.
+				if raddr != nil {
+					_, err := conn.WriteTo(b[:n], raddr)
+					return err
+				}
+
+				// server side, broadcast.
+				if waterutil.IsBroadcast(dst) {
+					go h.routes.Range(func(k, v any) bool {
+						conn.WriteTo(b[:n], v.(net.Addr))
+						return true
+					})
+					return nil
+				}
+
+				var addr net.Addr
+				if v, ok := h.routes.Load(hwAddrToTapRouteKey(dst)); ok {
+					addr = v.(net.Addr)
+				}
+				if addr == nil {
+					log.Debugf("no route for %s -> %s %s %d", src, dst, eType, n)
+					return nil
+				}
+
+				if _, err := conn.WriteTo(b[:n], addr); err != nil {
+					return err
+				}
+
+				return nil
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, addr, err := conn.ReadFrom(b[:])
+				if err != nil &&
+					err != shadowaead.ErrShortPacket {
+					return err
+				}
+				if n == 0 {
+					return nil
+				}
+
+				src := waterutil.MACSource(b[:n])
+				dst := waterutil.MACDestination(b[:n])
+				eType := etherType(waterutil.MACEthertype(b[:n]))
+
+				log.Debugf("%s >> %s %s %d", src, dst, eType, n)
+
+				// client side, deliver frame to tap device.
+				if raddr != nil {
+					_, err := tap.Write(b[:n])
+					return err
+				}
+
+				// server side, record route.
+				rkey := hwAddrToTapRouteKey(src)
+				if actual, loaded := h.routes.LoadOrStore(rkey, addr); loaded {
+					if actual.(net.Addr).String() != addr.String() {
+						log.Debugf("update route: %s -> %s (old %s)",
+							src, addr, actual.(net.Addr))
+						h.routes.Store(rkey, addr)
+					}
+				} else {
+					log.Debugf("new route: %s -> %s", src, addr)
+				}
+
+				if waterutil.IsBroadcast(dst) {
+					go h.routes.Range(func(k, v any) bool {
+						if k.(tapRouteKey) != rkey {
+							conn.WriteTo(b[:n], v.(net.Addr))
+						}
+						return true
+					})
+				}
+
+				if v, ok := h.routes.Load(hwAddrToTapRouteKey(dst)); ok {
+					log.Debugf("find route: %s -> %s", dst, v)
+					_, err := conn.WriteTo(b[:n], v.(net.Addr))
+					return err
+				}
+
+				if _, err := tap.Write(b[:n]); err != nil {
+					select {
+					case h.exit <- struct{}{}:
+					default:
+					}
+					return err
+				}
+				return nil
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	err := <-errc
+	if err != nil && err == io.EOF {
+		err = nil
+	}
+	return err
+}
+
+var mEtherTypes = map[waterutil.Ethertype]string{
+	waterutil.IPv4: "ip",
+	waterutil.ARP:  "arp",
+	waterutil.RARP: "rarp",
+	waterutil.IPv6: "ip6",
+}
+
+func etherType(et waterutil.Ethertype) string {
+	if s, ok := mEtherTypes[et]; ok {
+		return s
+	}
+	return fmt.Sprintf("unknown(%v)", et)
+}
+
+type tapRouteKey [6]byte
+
+func hwAddrToTapRouteKey(addr net.HardwareAddr) (key tapRouteKey) {
+	copy(key[:], addr)
+	return
+}

go-gost/x/handler/tap/metadata.go

@@ -0,0 +1,25 @@
+package tap
+
+import (
+	"math"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+const (
+	MaxMessageSize = math.MaxUint16
+)
+
+type metadata struct {
+	key string
+}
+
+func (h *tapHandler) parseMetadata(md mdata.Metadata) (err error) {
+	const (
+		key = "key"
+	)
+
+	h.md.key = mdutil.GetString(md, key)
+	return
+}

go-gost/x/handler/tun/client.go

@@ -0,0 +1,227 @@
+package tun
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/common/bufpool"
+	"github.com/go-gost/core/logger"
+	xip "github.com/go-gost/x/internal/net/ip"
+	tun_util "github.com/go-gost/x/internal/util/tun"
+	"github.com/songgao/water/waterutil"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+)
+
+const (
+	// 4-byte magic header followed by 16-byte key.
+	keepAliveHeaderLength = 20
+)
+
+var (
+	magicHeader = []byte("GOST")
+)
+
+func (h *tunHandler) handleClient(ctx context.Context, conn net.Conn, network string, raddr string, config *tun_util.Config, log logger.Logger) error {
+	var ips []net.IP
+	for _, net := range config.Net {
+		ips = append(ips, net.IP)
+	}
+	if len(ips) == 0 {
+		return ErrInvalidNet
+	}
+
+	for {
+		err := func() error {
+			cc, err := h.options.Router.Dial(ctx, network, raddr)
+			if err != nil {
+				return err
+			}
+			defer cc.Close()
+
+			if network == "udp" {
+				ctx, cancel := context.WithCancel(ctx)
+				defer cancel()
+
+				go h.keepalive(ctx, cc, ips)
+			}
+
+			return h.transportClient(ctx, conn, cc, log)
+		}()
+		if errors.Is(err, ErrTun) {
+			return err
+		}
+
+		log.Error(err)
+		time.Sleep(time.Second)
+	}
+}
+
+func (h *tunHandler) keepalive(ctx context.Context, conn net.Conn, ips []net.IP) {
+	// handshake
+	keepAliveData := bufpool.Get(keepAliveHeaderLength + len(ips)*net.IPv6len)
+	defer bufpool.Put(keepAliveData)
+
+	copy(keepAliveData[:4], magicHeader) // magic header
+	copy(keepAliveData[4:20], []byte(h.md.passphrase))
+	pos := 20
+	for _, ip := range ips {
+		copy(keepAliveData[pos:pos+net.IPv6len], ip.To16())
+		pos += net.IPv6len
+	}
+	if _, err := conn.Write(keepAliveData); err != nil {
+		return
+	}
+
+	if h.md.keepAlivePeriod <= 0 {
+		return
+	}
+	conn.SetReadDeadline(time.Now().Add(h.md.keepAlivePeriod * 3))
+
+	ticker := time.NewTicker(h.md.keepAlivePeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if _, err := conn.Write(keepAliveData); err != nil {
+				return
+			}
+			h.options.Logger.Debugf("keepalive sended")
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (h *tunHandler) transportClient(ctx context.Context, tun io.ReadWriter, conn net.Conn, log logger.Logger) error {
+	errc := make(chan error, 2)
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, err := tun.Read(b[:])
+				if err != nil {
+					return fmt.Errorf("%w: read: %s", ErrTun, err.Error())
+				}
+
+				if waterutil.IsIPv4(b[:n]) {
+					header, err := ipv4.ParseHeader(b[:n])
+					if err != nil {
+						log.Warn(err)
+						return nil
+					}
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s >> %s %-4s %d/%-4d %-4x %d",
+							header.Src, header.Dst, xip.Protocol(waterutil.IPv4Protocol(b[:n])),
+							header.Len, header.TotalLen, header.ID, header.Flags)
+					}
+				} else if waterutil.IsIPv6(b[:n]) {
+					header, err := ipv6.ParseHeader(b[:n])
+					if err != nil {
+						log.Warn(err)
+						return nil
+					}
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s >> %s %s %d %d",
+							header.Src, header.Dst,
+							xip.Protocol(waterutil.IPProtocol(header.NextHeader)),
+							header.PayloadLen, header.TrafficClass)
+					}
+				} else {
+					log.Warnf("unknown packet, discarded(%d)", n)
+					return nil
+				}
+
+				_, err = conn.Write(b[:n])
+				return err
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, err := conn.Read(b[:])
+				if err != nil {
+					return err
+				}
+
+				if n == keepAliveHeaderLength && bytes.Equal(b[:4], magicHeader) {
+					ip := net.IP(b[4:20])
+					log.Debugf("keepalive received at %v", ip)
+
+					if h.md.keepAlivePeriod > 0 {
+						conn.SetReadDeadline(time.Now().Add(h.md.keepAlivePeriod * 3))
+					}
+					return nil
+				}
+
+				if waterutil.IsIPv4(b[:n]) {
+					header, err := ipv4.ParseHeader(b[:n])
+					if err != nil {
+						log.Warn(err)
+						return nil
+					}
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s >> %s %-4s %d/%-4d %-4x %d",
+							header.Src, header.Dst, xip.Protocol(waterutil.IPv4Protocol(b[:n])),
+							header.Len, header.TotalLen, header.ID, header.Flags)
+					}
+				} else if waterutil.IsIPv6(b[:n]) {
+					header, err := ipv6.ParseHeader(b[:n])
+					if err != nil {
+						log.Warn(err)
+						return nil
+					}
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s > %s %s %d %d",
+							header.Src, header.Dst,
+							xip.Protocol(waterutil.IPProtocol(header.NextHeader)),
+							header.PayloadLen, header.TrafficClass)
+					}
+				} else {
+					log.Warn("unknown packet, discarded")
+					return nil
+				}
+
+				if _, err = tun.Write(b[:n]); err != nil {
+					return fmt.Errorf("%w: write: %s", ErrTun, err.Error())
+				}
+				return nil
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	select {
+	case err := <-errc:
+		if err != nil && err == io.EOF {
+			err = nil
+		}
+		return err
+
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}

go-gost/x/handler/tun/handler.go

@@ -0,0 +1,116 @@
+package tun
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
+	tun_util "github.com/go-gost/x/internal/util/tun"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	ErrTun        = errors.New("tun device error")
+	ErrInvalidNet = errors.New("invalid net IP")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("tun", NewHandler)
+}
+
+type tunHandler struct {
+	hop     hop.Hop
+	routes  sync.Map
+	md      metadata
+	options handler.Options
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &tunHandler{
+		options: options,
+	}
+}
+
+func (h *tunHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	return
+}
+
+// Forward implements handler.Forwarder.
+func (h *tunHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *tunHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	defer conn.Close()
+
+	log := h.options.Logger
+
+	v, _ := conn.(md.Metadatable)
+	if v == nil {
+		err := errors.New("tun: wrong connection type")
+		log.Error(err)
+		return err
+	}
+	config := v.Metadata().Get("config").(*tun_util.Config)
+
+	start := time.Now()
+	log = log.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+	defer func() {
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	var target *chain.Node
+	if h.hop != nil {
+		target = h.hop.Select(ctx)
+	}
+	if target != nil {
+		network := "udp"
+		if _, _, err := net.SplitHostPort(target.Addr); err != nil {
+			network = "ip"
+		}
+
+		log = log.WithFields(map[string]any{
+			"dst": fmt.Sprintf("%s/%s", target.Addr, network),
+		})
+		log.Debugf("%s >> %s", conn.RemoteAddr(), target.Addr)
+
+		if err := h.handleClient(ctx, conn, network, target.Addr, config, log); err != nil {
+			log.Error(err)
+		}
+		return nil
+	}
+
+	return h.handleServer(ctx, conn, config, log)
+}
+
+type tunRouteKey [16]byte
+
+func ipToTunRouteKey(ip net.IP) (key tunRouteKey) {
+	copy(key[:], ip.To16())
+	return
+}

go-gost/x/handler/tun/metadata.go

@@ -0,0 +1,33 @@
+package tun
+
+import (
+	"math"
+	"time"
+
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+)
+
+const (
+	defaultKeepAlivePeriod = 10 * time.Second
+	MaxMessageSize         = math.MaxUint16
+)
+
+type metadata struct {
+	keepAlivePeriod time.Duration
+	passphrase      string
+	p2p             bool
+}
+
+func (h *tunHandler) parseMetadata(md mdata.Metadata) (err error) {
+	if mdutil.GetBool(md, "tun.keepalive", "keepalive") {
+		h.md.keepAlivePeriod = mdutil.GetDuration(md, "tun.ttl", "ttl")
+		if h.md.keepAlivePeriod <= 0 {
+			h.md.keepAlivePeriod = defaultKeepAlivePeriod
+		}
+	}
+
+	h.md.passphrase = mdutil.GetString(md, "tun.token", "token", "passphrase")
+	h.md.p2p = mdutil.GetBool(md, "tun.p2p", "p2p")
+	return
+}

go-gost/x/handler/tun/server.go

@@ -0,0 +1,278 @@
+package tun
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net"
+	"net/netip"
+	"time"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/router"
+	xip "github.com/go-gost/x/internal/net/ip"
+	tun_util "github.com/go-gost/x/internal/util/tun"
+	"github.com/songgao/water/waterutil"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+)
+
+func (h *tunHandler) handleServer(ctx context.Context, conn net.Conn, config *tun_util.Config, log logger.Logger) error {
+	for {
+		err := func() error {
+			pc, err := net.ListenPacket(conn.LocalAddr().Network(), conn.LocalAddr().String())
+			if err != nil {
+				return err
+			}
+			defer pc.Close()
+
+			return h.transportServer(ctx, conn, pc, config, log)
+		}()
+		if err == ErrTun {
+			return err
+		}
+
+		log.Error(err)
+		time.Sleep(time.Second)
+	}
+}
+
+func (h *tunHandler) transportServer(ctx context.Context, tun io.ReadWriter, conn net.PacketConn, config *tun_util.Config, log logger.Logger) error {
+	errc := make(chan error, 1)
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, err := tun.Read(b[:])
+				if err != nil {
+					return ErrTun
+				}
+				if n == 0 {
+					return nil
+				}
+
+				var src, dst net.IP
+				if waterutil.IsIPv4(b[:n]) {
+					header, err := ipv4.ParseHeader(b[:n])
+					if err != nil {
+						log.Warnf("parse ipv4 packet header: %v", err)
+						return nil
+					}
+					src, dst = header.Src, header.Dst
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s >> %s %-4s %d/%-4d %-4x %d",
+							src, dst, xip.Protocol(waterutil.IPv4Protocol(b[:n])),
+							header.Len, header.TotalLen, header.ID, header.Flags)
+					}
+				} else if waterutil.IsIPv6(b[:n]) {
+					header, err := ipv6.ParseHeader(b[:n])
+					if err != nil {
+						log.Warnf("parse ipv6 packet header: %v", err)
+						return nil
+					}
+					src, dst = header.Src, header.Dst
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s >> %s %s %d %d",
+							src, dst,
+							xip.Protocol(waterutil.IPProtocol(header.NextHeader)),
+							header.PayloadLen, header.TrafficClass)
+					}
+				} else {
+					log.Warnf("unknown packet, discarded(%d)", n)
+					return nil
+				}
+
+				addr := h.findRouteFor(ctx, dst, config.Router)
+				if addr == nil {
+					log.Debugf("no route for %s -> %s, packet discarded", src, dst)
+					return nil
+				}
+
+				log.Debugf("find route: %s -> %s", dst, addr)
+
+				if _, err := conn.WriteTo(b[:n], addr); err != nil {
+					return err
+				}
+				return nil
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	go func() {
+		var b [MaxMessageSize]byte
+		for {
+			err := func() error {
+				n, addr, err := conn.ReadFrom(b[:])
+				if err != nil {
+					return err
+				}
+				if n == 0 {
+					return nil
+				}
+				if n > keepAliveHeaderLength && bytes.Equal(b[:4], magicHeader) {
+					var peerIPs []net.IP
+					data := b[keepAliveHeaderLength:n]
+					if len(data)%net.IPv6len == 0 {
+						for len(data) > 0 {
+							peerIPs = append(peerIPs, net.IP(data[:net.IPv6len]))
+							data = data[net.IPv6len:]
+						}
+					}
+					if len(peerIPs) == 0 {
+						return nil
+					}
+
+					for _, net := range config.Net {
+						for _, ip := range peerIPs {
+							if ip.Equal(net.IP.To16()) {
+								return nil
+							}
+						}
+					}
+
+					if auther := h.options.Auther; auther != nil {
+						ok := true
+						key := bytes.TrimRight(b[4:20], "\x00")
+						for _, ip := range peerIPs {
+							if _, ok = auther.Authenticate(ctx, ip.String(), string(key)); !ok {
+								break
+							}
+						}
+						if !ok {
+							log.Debugf("keepalive from %v => %v, auth FAILED", addr, peerIPs)
+							return nil
+						}
+					}
+
+					log.Debugf("keepalive from %v => %v", addr, peerIPs)
+
+					addrPort, err := netip.ParseAddrPort(addr.String())
+					if err != nil {
+						log.Warnf("keepalive from %v: %v", addr, err)
+						return nil
+					}
+					var keepAliveData [keepAliveHeaderLength]byte
+					copy(keepAliveData[:4], magicHeader) // magic header
+					a16 := addrPort.Addr().As16()
+					copy(keepAliveData[4:], a16[:])
+
+					if _, err := conn.WriteTo(keepAliveData[:], addr); err != nil {
+						log.Warnf("keepalive to %v: %v", addr, err)
+						return nil
+					}
+
+					for _, ip := range peerIPs {
+						h.updateRoute(ip, addr, log)
+					}
+					return nil
+				}
+
+				var src, dst net.IP
+				if waterutil.IsIPv4(b[:n]) {
+					header, err := ipv4.ParseHeader(b[:n])
+					if err != nil {
+						log.Warnf("parse ipv4 packet header: %v", err)
+						return nil
+					}
+					src, dst = header.Src, header.Dst
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s >> %s %-4s %d/%-4d %-4x %d",
+							src, dst, xip.Protocol(waterutil.IPv4Protocol(b[:n])),
+							header.Len, header.TotalLen, header.ID, header.Flags)
+					}
+				} else if waterutil.IsIPv6(b[:n]) {
+					header, err := ipv6.ParseHeader(b[:n])
+					if err != nil {
+						log.Warnf("parse ipv6 packet header: %v", err)
+						return nil
+					}
+					src, dst = header.Src, header.Dst
+
+					if log.IsLevelEnabled(logger.TraceLevel) {
+						log.Tracef("%s > %s %s %d %d",
+							src, dst,
+							xip.Protocol(waterutil.IPProtocol(header.NextHeader)),
+							header.PayloadLen, header.TrafficClass)
+					}
+				} else {
+					log.Warnf("unknown packet, discarded(%d): % x", n, b[:n])
+					return nil
+				}
+
+				if !h.md.p2p {
+					if addr := h.findRouteFor(ctx, dst, config.Router); addr != nil {
+						log.Debugf("find route: %s -> %s", dst, addr)
+
+						_, err := conn.WriteTo(b[:n], addr)
+						return err
+					}
+				}
+
+				if _, err := tun.Write(b[:n]); err != nil {
+					return ErrTun
+				}
+				return nil
+			}()
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	err := <-errc
+	if err != nil && err == io.EOF {
+		err = nil
+	}
+	return err
+}
+
+func (h *tunHandler) updateRoute(ip net.IP, addr net.Addr, log logger.Logger) {
+	if h.md.p2p {
+		ip = net.IPv6zero
+	}
+	rkey := ipToTunRouteKey(ip)
+	if actual, loaded := h.routes.LoadOrStore(rkey, addr); loaded {
+		if actual.(net.Addr).String() != addr.String() {
+			h.routes.Store(rkey, addr)
+			log.Debugf("update route: %s -> %s (old %s)",
+				ip, addr, actual.(net.Addr))
+		}
+	} else {
+		log.Debugf("new route: %s -> %s", ip, addr)
+	}
+}
+
+func (h *tunHandler) findRouteFor(ctx context.Context, dst net.IP, router router.Router) net.Addr {
+	if h.md.p2p {
+		dst = net.IPv6zero
+		router = nil
+	}
+
+	if v, ok := h.routes.Load(ipToTunRouteKey(dst)); ok {
+		return v.(net.Addr)
+	}
+
+	if router == nil {
+		return nil
+	}
+
+	if route := router.GetRoute(ctx, dst.String()); route != nil {
+		if gw := net.ParseIP(route.Gateway); gw != nil {
+			if v, ok := h.routes.Load(ipToTunRouteKey(gw)); ok {
+				return v.(net.Addr)
+			}
+		}
+	}
+	return nil
+}

go-gost/x/handler/tunnel/bind.go

@@ -0,0 +1,109 @@
+package tunnel
+
+import (
+	"context"
+	"crypto/md5"
+	"encoding/hex"
+	"net"
+
+	"github.com/go-gost/core/ingress"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/sd"
+	"github.com/go-gost/relay"
+	"github.com/go-gost/x/internal/util/mux"
+	"github.com/google/uuid"
+)
+
+func (h *tunnelHandler) handleBind(ctx context.Context, conn net.Conn, network, address string, tunnelID relay.TunnelID, log logger.Logger) (err error) {
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	uuid, err := uuid.NewRandom()
+	if err != nil {
+		resp.Status = relay.StatusInternalServerError
+		resp.WriteTo(conn)
+		return
+	}
+	connectorID := relay.NewConnectorID(uuid[:])
+	if network == "udp" {
+		connectorID = relay.NewUDPConnectorID(uuid[:])
+	}
+	// copy weight from tunnelID
+	connectorID = connectorID.SetWeight(tunnelID.Weight())
+
+	v := md5.Sum([]byte(tunnelID.String()))
+	endpoint := hex.EncodeToString(v[:8])
+
+	host, port, _ := net.SplitHostPort(address)
+	if host == "" || h.md.ingress == nil {
+		host = endpoint
+	} else if host != endpoint {
+		if rule := h.md.ingress.GetRule(ctx, host); rule != nil && rule.Endpoint != tunnelID.String() {
+			host = endpoint
+		}
+	}
+	addr := net.JoinHostPort(host, port)
+
+	af := &relay.AddrFeature{}
+	err = af.ParseFrom(addr)
+	if err != nil {
+		log.Warn(err)
+	}
+	resp.Features = append(resp.Features, af,
+		&relay.TunnelFeature{
+			ID: connectorID,
+		},
+	)
+	resp.WriteTo(conn)
+
+	// Upgrade connection to multiplex session.
+	session, err := mux.ClientSession(conn, h.md.muxCfg)
+	if err != nil {
+		return
+	}
+
+	var stats stats.Stats
+	if h.stats != nil {
+		stats = h.stats.Stats(tunnelID.String())
+	}
+
+	c := NewConnector(connectorID, tunnelID, h.id, session, &ConnectorOptions{
+		service: h.options.Service,
+		sd:      h.md.sd,
+		stats:   stats,
+		limiter: h.limiter,
+	})
+
+	h.pool.Add(tunnelID, c, h.md.tunnelTTL)
+	if h.md.ingress != nil {
+		h.md.ingress.SetRule(ctx, &ingress.Rule{
+			Hostname: endpoint,
+			Endpoint: tunnelID.String(),
+		})
+		if host != "" {
+			h.md.ingress.SetRule(ctx, &ingress.Rule{
+				Hostname: host,
+				Endpoint: tunnelID.String(),
+			})
+		}
+	}
+	if h.md.sd != nil {
+		err := h.md.sd.Register(ctx, &sd.Service{
+			ID:      connectorID.String(),
+			Name:    tunnelID.String(),
+			Node:    h.id,
+			Network: network,
+			Address: h.md.entryPoint,
+		})
+		if err != nil {
+			h.log.Error(err)
+		}
+	}
+
+	log.Debugf("%s/%s: tunnel=%s, connector=%s, weight=%d established", addr, network, tunnelID, connectorID, connectorID.Weight())
+
+	return
+}

go-gost/x/handler/tunnel/connect.go

@@ -0,0 +1,125 @@
+package tunnel
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/relay"
+	xnet "github.com/go-gost/x/internal/net"
+)
+
+func (h *tunnelHandler) handleConnect(ctx context.Context, req *relay.Request, conn net.Conn, network, srcAddr string, dstAddr string, tunnelID relay.TunnelID, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst":    fmt.Sprintf("%s/%s", dstAddr, network),
+		"cmd":    "connect",
+		"tunnel": tunnelID.String(),
+		"host":   dstAddr,
+	})
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, network, dstAddr) {
+		log.Debug("bypass: ", dstAddr)
+		resp.Status = relay.StatusForbidden
+		_, err := resp.WriteTo(conn)
+		return err
+	}
+
+	host, _, _ := net.SplitHostPort(dstAddr)
+
+	var tid relay.TunnelID
+	if ingress := h.md.ingress; ingress != nil && host != "" {
+		if rule := ingress.GetRule(ctx, host); rule != nil {
+			tid = parseTunnelID(rule.Endpoint)
+		}
+	}
+
+	// visitor is a public entrypoint.
+	if tunnelID.Equal(h.md.entryPointID) {
+		if tid.IsZero() {
+			resp.Status = relay.StatusNetworkUnreachable
+			resp.WriteTo(conn)
+			err := fmt.Errorf("no route to host %s", host)
+			log.Error(err)
+			return err
+		}
+
+		if tid.IsPrivate() {
+			resp.Status = relay.StatusHostUnreachable
+			resp.WriteTo(conn)
+			err := fmt.Errorf("tunnel %s is private for host %s", tid, host)
+			log.Error(err)
+			return err
+		}
+	} else {
+		// direct routing
+		if h.md.directTunnel {
+			tid = tunnelID
+		}
+		if !tid.Equal(tunnelID) {
+			resp.Status = relay.StatusHostUnreachable
+			resp.WriteTo(conn)
+			err := fmt.Errorf("no route to host %s", host)
+			log.Error(err)
+			return err
+		}
+	}
+
+	d := Dialer{
+		node:    h.id,
+		pool:    h.pool,
+		sd:      h.md.sd,
+		retry:   3,
+		timeout: 15 * time.Second,
+		log:     log,
+	}
+	cc, node, cid, err := d.Dial(ctx, network, tid.String())
+	if err != nil {
+		log.Error(err)
+		resp.Status = relay.StatusServiceUnavailable
+		resp.WriteTo(conn)
+		return err
+	}
+	defer cc.Close()
+
+	log.Debugf("connect to node=%s tunnel=%s connector=%s OK", node, tid, cid)
+
+	if node == h.id {
+		if _, err := resp.WriteTo(conn); err != nil {
+			log.Error(err)
+			return err
+		}
+
+		resp = relay.Response{
+			Version: relay.Version1,
+			Status:  relay.StatusOK,
+		}
+
+		af := &relay.AddrFeature{}
+		af.ParseFrom(srcAddr)
+		resp.Features = append(resp.Features, af) // src address
+
+		af = &relay.AddrFeature{}
+		af.ParseFrom(dstAddr)
+		resp.Features = append(resp.Features, af) // dst address
+
+		resp.WriteTo(cc)
+	} else {
+		req.WriteTo(cc)
+	}
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), cc.RemoteAddr())
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Debugf("%s >-< %s", conn.RemoteAddr(), cc.RemoteAddr())
+
+	return nil
+}

go-gost/x/handler/tunnel/dialer.go

@@ -0,0 +1,78 @@
+package tunnel
+
+import (
+	"context"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/sd"
+)
+
+type Dialer struct {
+	node    string
+	pool    *ConnectorPool
+	sd      sd.SD
+	retry   int
+	timeout time.Duration
+	log     logger.Logger
+}
+
+func (d *Dialer) Dial(ctx context.Context, network string, tid string) (conn net.Conn, node string, cid string, err error) {
+	retry := d.retry
+	if retry <= 0 {
+		retry = 1
+	}
+
+	for i := 0; i < retry; i++ {
+		c := d.pool.Get(network, tid)
+		if c == nil {
+			break
+		}
+
+		conn, err = c.GetConn()
+		if err != nil {
+			d.log.Error(err)
+			continue
+		}
+		node = d.node
+		cid = c.id.String()
+
+		break
+	}
+	if conn != nil || err != nil {
+		return
+	}
+
+	if d.sd == nil {
+		err = ErrTunnelNotAvailable
+		return
+	}
+
+	ss, err := d.sd.Get(ctx, tid)
+	if err != nil {
+		return
+	}
+
+	var service *sd.Service
+	for _, s := range ss {
+		d.log.Debugf("%+v", s)
+		if s.Node != d.node && s.Network == network {
+			service = s
+			break
+		}
+	}
+	if service == nil || service.Address == "" {
+		err = ErrTunnelNotAvailable
+		return
+	}
+
+	node = service.Node
+	cid = service.ID
+
+	dialer := net.Dialer{
+		Timeout: d.timeout,
+	}
+	conn, err = dialer.DialContext(ctx, "tcp", service.Address)
+	return
+}

go-gost/x/handler/tunnel/entrypoint.go

@@ -0,0 +1,759 @@
+package tunnel
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/ingress"
+	"github.com/go-gost/core/listener"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/core/sd"
+	"github.com/go-gost/relay"
+	dissector "github.com/go-gost/tls-dissector"
+	admission "github.com/go-gost/x/admission/wrapper"
+	ctxvalue "github.com/go-gost/x/ctx"
+	ctx_internal "github.com/go-gost/x/internal/ctx"
+	xio "github.com/go-gost/x/internal/io"
+	xnet "github.com/go-gost/x/internal/net"
+	xhttp "github.com/go-gost/x/internal/net/http"
+	"github.com/go-gost/x/internal/net/proxyproto"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	ws_util "github.com/go-gost/x/internal/util/ws"
+	climiter "github.com/go-gost/x/limiter/conn/wrapper"
+	metrics "github.com/go-gost/x/metrics/wrapper"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"golang.org/x/net/http/httpguts"
+	"golang.org/x/time/rate"
+)
+
+const (
+	httpHeaderSID           = "Gost-Sid"
+	httpHeaderForwardedNode = "Gost-Forwarded-Node"
+)
+
+type entrypoint struct {
+	node      string
+	service   string
+	pool      *ConnectorPool
+	ingress   ingress.Ingress
+	sd        sd.SD
+	log       logger.Logger
+	recorder  recorder.RecorderObject
+	transport http.RoundTripper
+
+	sniffingWebsocket   bool
+	websocketSampleRate float64
+
+	readTimeout time.Duration
+}
+
+func (ep *entrypoint) Handle(ctx context.Context, conn net.Conn) (err error) {
+	defer conn.Close()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Node:       ep.node,
+		Service:    ep.service,
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Network:    "tcp",
+		Time:       time.Now(),
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	log := ep.log.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ro.SID,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(ro.Time)
+		if err := ro.Record(ctx, ep.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(ro.Time),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	br := bufio.NewReader(conn)
+	v, err := br.Peek(1)
+	if err != nil {
+		return err
+	}
+
+	conn = xnet.NewReadWriteConn(br, conn, conn)
+	if v[0] == relay.Version1 {
+		return ep.handleConnect(ctx, conn, ro, log)
+	}
+	if v[0] == dissector.Handshake {
+		return ep.HandleTLS(ctx, conn, ro, log)
+	}
+	return ep.handleHTTP(ctx, conn, ro, log)
+}
+
+func (ep *entrypoint) dial(ctx context.Context, network, addr string) (conn net.Conn, err error) {
+	var tunnelID relay.TunnelID
+	if ep.ingress != nil {
+		if rule := ep.ingress.GetRule(ctx, addr); rule != nil {
+			tunnelID = parseTunnelID(rule.Endpoint)
+		}
+	}
+
+	log := ctxvalue.LoggerFromContext(ctx)
+	if log == nil {
+		log = ep.log
+	}
+	log.Debugf("dial: new connection to host %s", addr)
+
+	if tunnelID.IsZero() {
+		return nil, fmt.Errorf("%w %s", ErrTunnelRoute, addr)
+	}
+
+	ro := ctx_internal.RecorderObjectFromContext(ctx)
+	ro.ClientID = tunnelID.String()
+
+	if tunnelID.IsPrivate() {
+		return nil, fmt.Errorf("%w: tunnel %s is private for host %s", ErrPrivateTunnel, tunnelID, addr)
+	}
+
+	log = log.WithFields(map[string]any{
+		"tunnel": tunnelID.String(),
+	})
+
+	d := &Dialer{
+		node:    ep.node,
+		pool:    ep.pool,
+		sd:      ep.sd,
+		retry:   3,
+		timeout: 15 * time.Second,
+		log:     log,
+	}
+	conn, node, cid, err := d.Dial(ctx, "tcp", tunnelID.String())
+	if err != nil {
+		return
+	}
+	log.Debugf("dial: connected to host %s, tunnel: %s, connector: %s", addr, tunnelID, cid)
+
+	if node == ep.node {
+		ro.Redirect = ""
+
+		clientAddr := ctxvalue.ClientAddrFromContext(ctx)
+		var features []relay.Feature
+		af := &relay.AddrFeature{}
+		af.ParseFrom(string(clientAddr))
+		features = append(features, af) // src address
+
+		af = &relay.AddrFeature{}
+		af.ParseFrom(addr)
+		features = append(features, af) // dst address
+
+		if _, err = (&relay.Response{
+			Version:  relay.Version1,
+			Status:   relay.StatusOK,
+			Features: features,
+		}).WriteTo(conn); err != nil {
+			conn.Close()
+			return nil, err
+		}
+	} else {
+		ro.Redirect = node
+	}
+
+	return conn, nil
+}
+
+func (ep *entrypoint) handleHTTP(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	br := bufio.NewReader(conn)
+	req, err := http.ReadRequest(br)
+	if err != nil {
+		return err
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpRequest(req, false)
+		log.Trace(string(dump))
+	}
+
+	ro.HTTP = &xrecorder.HTTPRecorderObject{
+		Host:   req.Host,
+		Proto:  req.Proto,
+		Scheme: req.URL.Scheme,
+		Method: req.Method,
+		URI:    req.RequestURI,
+		Request: xrecorder.HTTPRequestRecorderObject{
+			ContentLength: req.ContentLength,
+			Header:        req.Header.Clone(),
+		},
+	}
+
+	ro.Time = time.Time{}
+
+	if err := ep.httpRoundTrip(ctx, xio.NewReadWriter(br, conn), req, ro, &pStats, log); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	for {
+		pStats.Reset()
+
+		req, err := http.ReadRequest(br)
+		if err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
+				return nil
+			}
+			return err
+		}
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpRequest(req, false)
+			log.Trace(string(dump))
+		}
+
+		if err := ep.httpRoundTrip(ctx, xio.NewReadWriter(br, conn), req, ro, &pStats, log); err != nil {
+			return err
+		}
+	}
+}
+
+func (ep *entrypoint) httpRoundTrip(ctx context.Context, rw io.ReadWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, pStats stats.Stats, log logger.Logger) (err error) {
+	ro2 := &xrecorder.HandlerRecorderObject{}
+	*ro2 = *ro
+	ro = ro2
+
+	if sid := req.Header.Get(httpHeaderSID); sid != "" {
+		ro.SID = sid
+	} else {
+		req.Header.Set(httpHeaderSID, ro.SID)
+	}
+	req.Header.Set(httpHeaderForwardedNode, ro.Node)
+
+	host := req.Host
+	if _, port, _ := net.SplitHostPort(host); port == "" {
+		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
+	}
+	ro.Host = host
+	ro.Time = time.Now()
+
+	log = log.WithFields(map[string]any{
+		"host": host,
+	})
+	log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(ro.Time)
+		if err := ro.Record(ctx, ep.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(ro.Time),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >-< %s", ro.RemoteAddr, req.Host)
+	}()
+
+	if req.URL.Scheme == "" {
+		req.URL.Scheme = "http"
+	}
+	if req.URL.Host == "" {
+		req.URL.Host = req.Host
+	}
+
+	ro.HTTP = &xrecorder.HTTPRecorderObject{
+		Host:   req.Host,
+		Proto:  req.Proto,
+		Scheme: req.URL.Scheme,
+		Method: req.Method,
+		URI:    req.RequestURI,
+		Request: xrecorder.HTTPRequestRecorderObject{
+			ContentLength: req.ContentLength,
+			Header:        req.Header.Clone(),
+		},
+	}
+
+	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
+		ro.ClientIP = clientIP.String()
+	}
+
+	clientAddr := ro.RemoteAddr
+	if ro.ClientIP != "" {
+		if _, port, _ := net.SplitHostPort(ro.RemoteAddr); port != "" {
+			clientAddr = net.JoinHostPort(ro.ClientIP, port)
+		}
+	}
+
+	res := &http.Response{
+		ProtoMajor: req.ProtoMajor,
+		ProtoMinor: req.ProtoMinor,
+		Header:     http.Header{},
+		StatusCode: http.StatusServiceUnavailable,
+	}
+	ro.HTTP.StatusCode = res.StatusCode
+
+	var reqBody *xhttp.Body
+	if opts := ep.recorder.Options; opts != nil && opts.HTTPBody {
+		if req.Body != nil {
+			bodySize := opts.MaxBodySize
+			if bodySize <= 0 {
+				bodySize = sniffing.DefaultBodySize
+			}
+			if bodySize > sniffing.MaxBodySize {
+				bodySize = sniffing.MaxBodySize
+			}
+			reqBody = xhttp.NewBody(req.Body, bodySize)
+			req.Body = reqBody
+		}
+	}
+
+	ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(clientAddr))
+	ctx = ctx_internal.ContextWithRecorderObject(ctx, ro)
+	ctx = ctxvalue.ContextWithLogger(ctx, log)
+
+	resp, err := ep.transport.RoundTrip(req.WithContext(ctx))
+
+	if reqBody != nil {
+		ro.HTTP.Request.Body = reqBody.Content()
+		ro.HTTP.Request.ContentLength = reqBody.Length()
+	}
+
+	if err != nil {
+		if errors.Is(err, ErrTunnelRoute) || errors.Is(err, ErrPrivateTunnel) {
+			res.StatusCode = http.StatusBadGateway
+			ro.HTTP.StatusCode = http.StatusBadGateway
+		}
+		res.Write(rw)
+		return
+	}
+	defer resp.Body.Close()
+
+	ro.HTTP.StatusCode = resp.StatusCode
+	ro.HTTP.Response.Header = resp.Header
+	ro.HTTP.Response.ContentLength = resp.ContentLength
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+
+	if resp.StatusCode == http.StatusSwitchingProtocols {
+		return ep.handleUpgradeResponse(ctx, rw, req, resp, ro, log)
+	}
+
+	var respBody *xhttp.Body
+	if opts := ep.recorder.Options; opts != nil && opts.HTTPBody {
+		bodySize := opts.MaxBodySize
+		if bodySize <= 0 {
+			bodySize = sniffing.DefaultBodySize
+		}
+		if bodySize > sniffing.MaxBodySize {
+			bodySize = sniffing.MaxBodySize
+		}
+		respBody = xhttp.NewBody(resp.Body, bodySize)
+		resp.Body = respBody
+	}
+
+	err = resp.Write(rw)
+
+	if respBody != nil {
+		ro.HTTP.Response.Body = respBody.Content()
+		ro.HTTP.Response.ContentLength = respBody.Length()
+	}
+
+	if err != nil {
+		return fmt.Errorf("write response: %v", err)
+	}
+
+	return
+}
+
+func upgradeType(h http.Header) string {
+	if !httpguts.HeaderValuesContainsToken(h["Connection"], "Upgrade") {
+		return ""
+	}
+	return h.Get("Upgrade")
+}
+
+func (ep *entrypoint) handleUpgradeResponse(ctx context.Context, rw io.ReadWriter, req *http.Request, res *http.Response, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	reqUpType := upgradeType(req.Header)
+	resUpType := upgradeType(res.Header)
+	if !strings.EqualFold(reqUpType, resUpType) {
+		return fmt.Errorf("backend tried to switch protocol %q when %q was requested", resUpType, reqUpType)
+	}
+
+	backConn, ok := res.Body.(io.ReadWriteCloser)
+	if !ok {
+		return fmt.Errorf("internal error: 101 switching protocols response with non-writable body")
+	}
+	defer backConn.Close()
+
+	res.Body = nil
+	if err := res.Write(rw); err != nil {
+		return fmt.Errorf("response write: %v", err)
+	}
+
+	if reqUpType == "websocket" && ep.sniffingWebsocket {
+		return ep.sniffingWebsocketFrame(ctx, rw, backConn, ro, log)
+	}
+
+	return xnet.Transport(rw, backConn)
+}
+
+func (ep *entrypoint) sniffingWebsocketFrame(ctx context.Context, rw, cc io.ReadWriter, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	errc := make(chan error, 1)
+
+	sampleRate := ep.websocketSampleRate
+	if sampleRate == 0 {
+		sampleRate = sniffing.DefaultSampleRate
+	}
+	if sampleRate < 0 {
+		sampleRate = math.MaxFloat64
+	}
+
+	go func() {
+		ro2 := &xrecorder.HandlerRecorderObject{}
+		*ro2 = *ro
+		ro := ro2
+
+		limiter := rate.NewLimiter(rate.Limit(sampleRate), int(sampleRate))
+
+		buf := &bytes.Buffer{}
+		for {
+			start := time.Now()
+
+			if err := ep.copyWebsocketFrame(cc, rw, buf, "client", ro); err != nil {
+				errc <- err
+				return
+			}
+
+			if limiter.Allow() {
+				ro.Duration = time.Since(start)
+				ro.Time = time.Now()
+				if err := ro.Record(ctx, ep.recorder.Recorder); err != nil {
+					log.Errorf("record: %v", err)
+				}
+			}
+		}
+	}()
+
+	go func() {
+		ro2 := &xrecorder.HandlerRecorderObject{}
+		*ro2 = *ro
+		ro := ro2
+
+		limiter := rate.NewLimiter(rate.Limit(sampleRate), int(sampleRate))
+
+		buf := &bytes.Buffer{}
+		for {
+			start := time.Now()
+
+			if err := ep.copyWebsocketFrame(rw, cc, buf, "server", ro); err != nil {
+				errc <- err
+				return
+			}
+
+			if limiter.Allow() {
+				ro.Duration = time.Since(start)
+				ro.Time = time.Now()
+				if err := ro.Record(ctx, ep.recorder.Recorder); err != nil {
+					log.Errorf("record: %v", err)
+				}
+			}
+		}
+	}()
+
+	<-errc
+	return nil
+}
+
+func (ep *entrypoint) copyWebsocketFrame(w io.Writer, r io.Reader, buf *bytes.Buffer, from string, ro *xrecorder.HandlerRecorderObject) (err error) {
+	fr := ws_util.Frame{}
+	if _, err = fr.ReadFrom(r); err != nil {
+		return err
+	}
+
+	ws := &xrecorder.WebsocketRecorderObject{
+		From:    from,
+		Fin:     fr.Header.Fin,
+		Rsv1:    fr.Header.Rsv1,
+		Rsv2:    fr.Header.Rsv2,
+		Rsv3:    fr.Header.Rsv3,
+		OpCode:  int(fr.Header.OpCode),
+		Masked:  fr.Header.Masked,
+		MaskKey: fr.Header.MaskKey,
+		Length:  fr.Header.PayloadLength,
+	}
+	if opts := ep.recorder.Options; opts != nil && opts.HTTPBody {
+		bodySize := opts.MaxBodySize
+		if bodySize <= 0 {
+			bodySize = sniffing.DefaultBodySize
+		}
+		if bodySize > sniffing.MaxBodySize {
+			bodySize = sniffing.MaxBodySize
+		}
+
+		buf.Reset()
+		if _, err := io.Copy(buf, io.LimitReader(fr.Data, int64(bodySize))); err != nil {
+			return err
+		}
+		ws.Payload = buf.Bytes()
+	}
+
+	ro.Websocket = ws
+	length := uint64(fr.Header.Length()) + uint64(fr.Header.PayloadLength)
+	if from == "client" {
+		ro.InputBytes = length
+		ro.OutputBytes = 0
+	} else {
+		ro.InputBytes = 0
+		ro.OutputBytes = length
+	}
+
+	fr.Data = io.MultiReader(bytes.NewReader(buf.Bytes()), fr.Data)
+	if _, err := fr.WriteTo(w); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (ep *entrypoint) HandleTLS(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	buf := new(bytes.Buffer)
+	clientHello, err := dissector.ParseClientHello(io.TeeReader(conn, buf))
+	if err != nil {
+		return err
+	}
+
+	ro.TLS = &xrecorder.TLSRecorderObject{
+		ServerName:  clientHello.ServerName,
+		ClientHello: hex.EncodeToString(buf.Bytes()),
+	}
+	if len(clientHello.SupportedProtos) > 0 {
+		ro.TLS.Proto = clientHello.SupportedProtos[0]
+	}
+
+	host := clientHello.ServerName
+	if host != "" {
+		if _, _, err := net.SplitHostPort(host); err != nil {
+			host = net.JoinHostPort(strings.Trim(host, "[]"), "443")
+		}
+		ro.Host = host
+	}
+
+	ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(ro.RemoteAddr))
+	ctx = ctx_internal.ContextWithRecorderObject(ctx, ro)
+	ctx = ctxvalue.ContextWithLogger(ctx, log)
+
+	cc, err := ep.dial(ctx, "tcp", host)
+	if err != nil {
+		return err
+	}
+	defer cc.Close()
+
+	if _, err := buf.WriteTo(cc); err != nil {
+		return err
+	}
+
+	xio.SetReadDeadline(cc, time.Now().Add(ep.readTimeout))
+	serverHello, err := dissector.ParseServerHello(io.TeeReader(cc, buf))
+	xio.SetReadDeadline(cc, time.Time{})
+
+	if serverHello != nil {
+		ro.TLS.CipherSuite = tls_util.CipherSuite(serverHello.CipherSuite).String()
+		ro.TLS.CompressionMethod = serverHello.CompressionMethod
+		if serverHello.Proto != "" {
+			ro.TLS.Proto = serverHello.Proto
+		}
+		if serverHello.Version > 0 {
+			ro.TLS.Version = tls_util.Version(serverHello.Version).String()
+		}
+	}
+
+	if buf.Len() > 0 {
+		ro.TLS.ServerHello = hex.EncodeToString(buf.Bytes())
+	}
+
+	if _, err := buf.WriteTo(conn); err != nil {
+		return err
+	}
+
+	xnet.Transport(conn, cc)
+	return err
+}
+
+func (ep *entrypoint) handleConnect(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
+	req := relay.Request{}
+	if _, err := req.ReadFrom(conn); err != nil {
+		return err
+	}
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	var srcAddr, dstAddr string
+	network := "tcp"
+	var tunnelID relay.TunnelID
+	for _, f := range req.Features {
+		switch f.Type() {
+		case relay.FeatureAddr:
+			if feature, _ := f.(*relay.AddrFeature); feature != nil {
+				v := net.JoinHostPort(feature.Host, strconv.Itoa(int(feature.Port)))
+				if srcAddr != "" {
+					dstAddr = v
+				} else {
+					srcAddr = v
+				}
+			}
+		case relay.FeatureTunnel:
+			if feature, _ := f.(*relay.TunnelFeature); feature != nil {
+				tunnelID = relay.NewTunnelID(feature.ID[:])
+			}
+		case relay.FeatureNetwork:
+			if feature, _ := f.(*relay.NetworkFeature); feature != nil {
+				network = feature.Network.String()
+			}
+		}
+	}
+
+	if tunnelID.IsZero() {
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrTunnelID
+	}
+
+	ro.ClientID = tunnelID.String()
+
+	d := Dialer{
+		pool:    ep.pool,
+		retry:   3,
+		timeout: 15 * time.Second,
+		log:     log,
+	}
+	cc, _, cid, err := d.Dial(ctx, network, tunnelID.String())
+	if err != nil {
+		log.Error(err)
+		resp.Status = relay.StatusServiceUnavailable
+		resp.WriteTo(conn)
+		return err
+	}
+	defer cc.Close()
+
+	log.Debugf("new connection to tunnel: %s, connector: %s", tunnelID, cid)
+
+	if _, err := resp.WriteTo(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	af := &relay.AddrFeature{}
+	af.ParseFrom(srcAddr)
+	resp.Features = append(resp.Features, af) // src address
+
+	af = &relay.AddrFeature{}
+	af.ParseFrom(dstAddr)
+	resp.Features = append(resp.Features, af) // dst address
+
+	resp.WriteTo(cc)
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), cc.RemoteAddr())
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Debugf("%s >-< %s", conn.RemoteAddr(), cc.RemoteAddr())
+
+	return nil
+}
+
+type tcpListener struct {
+	ln      net.Listener
+	options listener.Options
+}
+
+func newTCPListener(ln net.Listener, opts ...listener.Option) listener.Listener {
+	options := listener.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+	return &tcpListener{
+		ln:      ln,
+		options: options,
+	}
+}
+
+func (l *tcpListener) Init(md md.Metadata) (err error) {
+	// l.logger.Debugf("pp: %d", l.options.ProxyProtocol)
+	ln := l.ln
+	ln = proxyproto.WrapListener(l.options.ProxyProtocol, ln, 10*time.Second)
+	ln = metrics.WrapListener(l.options.Service, ln)
+	ln = admission.WrapListener(l.options.Admission, ln)
+	ln = climiter.WrapListener(l.options.ConnLimiter, ln)
+	l.ln = ln
+
+	return
+}
+
+func (l *tcpListener) Accept() (conn net.Conn, err error) {
+	return l.ln.Accept()
+}
+
+func (l *tcpListener) Addr() net.Addr {
+	return l.ln.Addr()
+}
+
+func (l *tcpListener) Close() error {
+	return l.ln.Close()
+}
+
+type entrypointHandler struct {
+	ep *entrypoint
+}
+
+func (h *entrypointHandler) Init(md md.Metadata) (err error) {
+	return
+}
+
+func (h *entrypointHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) error {
+	return h.ep.Handle(ctx, conn)
+}

go-gost/x/handler/tunnel/handler.go

@@ -0,0 +1,354 @@
+package tunnel
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/listener"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/service"
+	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+	xservice "github.com/go-gost/x/service"
+	"github.com/google/uuid"
+)
+
+var (
+	ErrBadVersion         = errors.New("bad version")
+	ErrUnknownCmd         = errors.New("unknown command")
+	ErrTunnelID           = errors.New("invalid tunnel ID")
+	ErrTunnelNotAvailable = errors.New("tunnel not available")
+	ErrUnauthorized       = errors.New("unauthorized")
+	ErrTunnelRoute        = errors.New("no route to host")
+	ErrPrivateTunnel      = errors.New("private tunnel")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("tunnel", NewHandler)
+}
+
+type tunnelHandler struct {
+	id      string
+	options handler.Options
+	pool    *ConnectorPool
+	epSvc   service.Service
+	ep      *entrypoint
+	md      metadata
+	log     logger.Logger
+	stats   *stats_util.HandlerStats
+	limiter traffic.TrafficLimiter
+	cancel  context.CancelFunc
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &tunnelHandler{
+		options: options,
+	}
+}
+
+func (h *tunnelHandler) Init(md md.Metadata) (err error) {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	uuid, err := uuid.NewRandom()
+	if err != nil {
+		return err
+	}
+	h.id = uuid.String()
+
+	h.log = h.options.Logger.WithFields(map[string]any{
+		"node": h.id,
+	})
+	h.pool = NewConnectorPool(h.id)
+
+	h.ep = &entrypoint{
+		node:    h.id,
+		service: h.options.Service,
+		pool:    h.pool,
+		ingress: h.md.ingress,
+		sd:      h.md.sd,
+		log: h.log.WithFields(map[string]any{
+			"kind": "entrypoint",
+		}),
+		sniffingWebsocket:   h.md.sniffingWebsocket,
+		websocketSampleRate: h.md.sniffingWebsocketSampleRate,
+		readTimeout:         h.md.entryPointReadTimeout,
+	}
+	h.ep.transport = &http.Transport{
+		DialContext:           h.ep.dial,
+		IdleConnTimeout:       30 * time.Second,
+		ResponseHeaderTimeout: h.md.entryPointReadTimeout,
+		DisableKeepAlives:     !h.md.entryPointKeepalive,
+		DisableCompression:    !h.md.entryPointCompression,
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.ep.recorder = ro
+			break
+		}
+	}
+	if err = h.initEntrypoint(); err != nil {
+		return
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	return nil
+}
+
+func (h *tunnelHandler) initEntrypoint() (err error) {
+	if h.md.entryPoint == "" {
+		return
+	}
+
+	network := "tcp"
+	if xnet.IsIPv4(h.md.entryPoint) {
+		network = "tcp4"
+	}
+
+	ln, err := net.Listen(network, h.md.entryPoint)
+	if err != nil {
+		h.log.Error(err)
+		return
+	}
+
+	serviceName := fmt.Sprintf("%s-ep-%s", h.options.Service, ln.Addr())
+	log := h.log.WithFields(map[string]any{
+		"service":  serviceName,
+		"listener": "tcp",
+		"handler":  "tunnel-ep",
+		"kind":     "service",
+	})
+	epListener := newTCPListener(ln,
+		listener.AddrOption(h.md.entryPoint),
+		listener.ServiceOption(serviceName),
+		listener.ProxyProtocolOption(h.md.entryPointProxyProtocol),
+		listener.LoggerOption(log.WithFields(map[string]any{
+			"kind": "listener",
+		})),
+	)
+	if err = epListener.Init(nil); err != nil {
+		return
+	}
+	epHandler := &entrypointHandler{
+		ep: h.ep,
+	}
+	if err = epHandler.Init(nil); err != nil {
+		return
+	}
+
+	h.epSvc = xservice.NewService(
+		serviceName, epListener, epHandler,
+		xservice.LoggerOption(log),
+	)
+	go h.epSvc.Serve()
+	log.Infof("entrypoint: %s", h.epSvc.Addr())
+
+	return
+}
+
+func (h *tunnelHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	start := time.Now()
+	log := h.log.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	defer func() {
+		if err != nil {
+			conn.Close()
+		}
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	if h.md.readTimeout > 0 {
+		conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+	}
+
+	req := relay.Request{}
+	if _, err := req.ReadFrom(conn); err != nil {
+		return err
+	}
+
+	conn.SetReadDeadline(time.Time{})
+
+	resp := relay.Response{
+		Version: relay.Version1,
+		Status:  relay.StatusOK,
+	}
+
+	if req.Version != relay.Version1 {
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrBadVersion
+	}
+
+	var user, pass string
+	var srcAddr, dstAddr string
+	network := "tcp"
+	var tunnelID relay.TunnelID
+	for _, f := range req.Features {
+		switch f.Type() {
+		case relay.FeatureUserAuth:
+			if feature, _ := f.(*relay.UserAuthFeature); feature != nil {
+				user, pass = feature.Username, feature.Password
+			}
+		case relay.FeatureAddr:
+			if feature, _ := f.(*relay.AddrFeature); feature != nil {
+				v := net.JoinHostPort(feature.Host, strconv.Itoa(int(feature.Port)))
+				if srcAddr != "" {
+					dstAddr = v
+				} else {
+					srcAddr = v
+				}
+			}
+		case relay.FeatureTunnel:
+			if feature, _ := f.(*relay.TunnelFeature); feature != nil {
+				tunnelID = feature.ID
+			}
+		case relay.FeatureNetwork:
+			if feature, _ := f.(*relay.NetworkFeature); feature != nil {
+				network = feature.Network.String()
+			}
+		}
+	}
+
+	if tunnelID.IsZero() {
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrTunnelID
+	}
+
+	if user != "" {
+		log = log.WithFields(map[string]any{"user": user})
+	}
+
+	if h.options.Auther != nil {
+		clientID, ok := h.options.Auther.Authenticate(ctx, user, pass)
+		if !ok {
+			resp.Status = relay.StatusUnauthorized
+			resp.WriteTo(conn)
+			return ErrUnauthorized
+		}
+		ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+	}
+
+	switch req.Cmd & relay.CmdMask {
+	case relay.CmdConnect:
+		defer conn.Close()
+
+		log.Debugf("connect: %s >> %s/%s", srcAddr, dstAddr, network)
+		return h.handleConnect(ctx, &req, conn, network, srcAddr, dstAddr, tunnelID, log)
+
+	case relay.CmdBind:
+		log.Debugf("bind: %s >> %s/%s", srcAddr, dstAddr, network)
+		return h.handleBind(ctx, conn, network, dstAddr, tunnelID, log)
+	default:
+		resp.Status = relay.StatusBadRequest
+		resp.WriteTo(conn)
+		return ErrUnknownCmd
+	}
+}
+
+// Close implements io.Closer interface.
+func (h *tunnelHandler) Close() error {
+	if h.epSvc != nil {
+		h.epSvc.Close()
+	}
+	h.pool.Close()
+
+	if h.cancel != nil {
+		h.cancel()
+	}
+
+	return nil
+}
+
+func (h *tunnelHandler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *tunnelHandler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/tunnel/metadata.go

@@ -0,0 +1,125 @@
+package tunnel
+
+import (
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/ingress"
+	"github.com/go-gost/core/logger"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/sd"
+	"github.com/go-gost/relay"
+	xingress "github.com/go-gost/x/ingress"
+	"github.com/go-gost/x/internal/util/mux"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+const (
+	defaultTTL = 15 * time.Second
+)
+
+type metadata struct {
+	readTimeout time.Duration
+
+	entryPoint                  string
+	entryPointID                relay.TunnelID
+	entryPointProxyProtocol     int
+	entryPointKeepalive         bool
+	entryPointCompression       bool
+	entryPointReadTimeout       time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	directTunnel           bool
+	tunnelTTL              time.Duration
+	ingress                ingress.Ingress
+	sd                     sd.SD
+	muxCfg                 *mux.Config
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *tunnelHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+
+	h.md.entryPoint = mdutil.GetString(md, "entrypoint")
+	h.md.entryPointID = parseTunnelID(mdutil.GetString(md, "entrypoint.id"))
+	h.md.entryPointProxyProtocol = mdutil.GetInt(md, "entrypoint.ProxyProtocol")
+
+	h.md.entryPointKeepalive = mdutil.GetBool(md, "entrypoint.keepalive")
+	h.md.entryPointCompression = mdutil.GetBool(md, "entrypoint.compression")
+
+	h.md.entryPointReadTimeout = mdutil.GetDuration(md, "entrypoint.readTimeout")
+	if h.md.entryPointReadTimeout <= 0 {
+		h.md.entryPointReadTimeout = 15 * time.Second
+	}
+
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	h.md.tunnelTTL = mdutil.GetDuration(md, "tunnel.ttl")
+	if h.md.tunnelTTL <= 0 {
+		h.md.tunnelTTL = defaultTTL
+	}
+	h.md.directTunnel = mdutil.GetBool(md, "tunnel.direct")
+
+	h.md.ingress = registry.IngressRegistry().Get(mdutil.GetString(md, "ingress"))
+	if h.md.ingress == nil {
+		var rules []*ingress.Rule
+		for _, s := range strings.Split(mdutil.GetString(md, "tunnel"), ",") {
+			ss := strings.SplitN(s, ":", 2)
+			if len(ss) != 2 {
+				continue
+			}
+			rules = append(rules, &ingress.Rule{
+				Hostname: ss[0],
+				Endpoint: ss[1],
+			})
+		}
+		if len(rules) > 0 {
+			h.md.ingress = xingress.NewIngress(
+				xingress.RulesOption(rules),
+				xingress.LoggerOption(logger.Default().WithFields(map[string]any{
+					"kind":    "ingress",
+					"ingress": "@internal",
+				})),
+			)
+		}
+	}
+	h.md.sd = registry.SDRegistry().Get(mdutil.GetString(md, "sd"))
+
+	h.md.muxCfg = &mux.Config{
+		Version:           mdutil.GetInt(md, "mux.version"),
+		KeepAliveInterval: mdutil.GetDuration(md, "mux.keepaliveInterval"),
+		KeepAliveDisabled: mdutil.GetBool(md, "mux.keepaliveDisabled"),
+		KeepAliveTimeout:  mdutil.GetDuration(md, "mux.keepaliveTimeout"),
+		MaxFrameSize:      mdutil.GetInt(md, "mux.maxFrameSize"),
+		MaxReceiveBuffer:  mdutil.GetInt(md, "mux.maxReceiveBuffer"),
+		MaxStreamBuffer:   mdutil.GetInt(md, "mux.maxStreamBuffer"),
+	}
+	if h.md.muxCfg.Version == 0 {
+		h.md.muxCfg.Version = 2
+	}
+	if h.md.muxCfg.MaxStreamBuffer == 0 {
+		h.md.muxCfg.MaxStreamBuffer = 1048576
+	}
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return
+}

go-gost/x/handler/tunnel/tunnel.go

@@ -0,0 +1,394 @@
+package tunnel
+
+import (
+	"context"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/sd"
+	"github.com/go-gost/relay"
+	"github.com/go-gost/x/internal/util/mux"
+
+	"github.com/go-gost/core/observer/stats"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	"github.com/go-gost/x/selector"
+	"github.com/google/uuid"
+)
+
+const (
+	MaxWeight uint8 = 0xff
+)
+
+type ConnectorOptions struct {
+	service string
+	sd      sd.SD
+	stats   stats.Stats
+	limiter traffic.TrafficLimiter
+}
+
+type Connector struct {
+	id   relay.ConnectorID
+	tid  relay.TunnelID
+	node string
+	s    *mux.Session
+	t    time.Time
+	opts *ConnectorOptions
+	log  logger.Logger
+}
+
+func NewConnector(id relay.ConnectorID, tid relay.TunnelID, node string, s *mux.Session, opts *ConnectorOptions) *Connector {
+	if opts == nil {
+		opts = &ConnectorOptions{}
+	}
+
+	c := &Connector{
+		id:   id,
+		tid:  tid,
+		node: node,
+		s:    s,
+		t:    time.Now(),
+		opts: opts,
+		log: logger.Default().WithFields(map[string]any{
+			"node":      node,
+			"tunnel":    tid.String(),
+			"connector": id.String(),
+		}),
+	}
+
+	go c.waitClose()
+	return c
+}
+
+func (c *Connector) waitClose() {
+	for {
+		conn, err := c.s.Accept()
+		if err != nil {
+			c.log.Errorf("connector %s: %v", c.id, err)
+			c.Close()
+			if c.opts.sd != nil {
+				c.opts.sd.Deregister(context.Background(), &sd.Service{
+					ID:   c.id.String(),
+					Name: c.tid.String(),
+					Node: c.node,
+				})
+				c.log.Debugf("deregister connector %s from sd", c.id.String())
+			}
+			return
+		}
+		conn.Close()
+	}
+}
+
+func (c *Connector) ID() relay.ConnectorID {
+	return c.id
+}
+
+func (c *Connector) GetConn() (net.Conn, error) {
+	if c == nil || c.s == nil {
+		return nil, nil
+	}
+
+	conn, err := c.s.GetConn()
+	if err != nil {
+		return nil, err
+	}
+
+	conn = stats_wrapper.WrapConn(conn, c.opts.stats)
+
+	network := "tcp"
+	if c.id.IsUDP() {
+		network = "udp"
+	}
+	conn = traffic_wrapper.WrapConn(
+		conn,
+		c.opts.limiter,
+		c.tid.String(),
+		limiter.ScopeOption(limiter.ScopeClient),
+		limiter.ServiceOption(c.opts.service),
+		limiter.ClientOption(c.tid.String()),
+		limiter.NetworkOption(network),
+		limiter.SrcOption(conn.RemoteAddr().String()),
+	)
+	return conn, nil
+}
+
+func (c *Connector) Close() error {
+	if c == nil || c.s == nil {
+		return nil
+	}
+
+	return c.s.Close()
+}
+
+func (c *Connector) IsClosed() bool {
+	if c == nil || c.s == nil {
+		return true
+	}
+
+	return c.s.IsClosed()
+}
+
+type Tunnel struct {
+	node       string
+	id         relay.TunnelID
+	connectors []*Connector
+	t          time.Time
+	close      chan struct{}
+	mu         sync.RWMutex
+	ttl        time.Duration
+}
+
+func NewTunnel(node string, tid relay.TunnelID, ttl time.Duration) *Tunnel {
+	t := &Tunnel{
+		node:  node,
+		id:    tid,
+		t:     time.Now(),
+		close: make(chan struct{}),
+		ttl:   ttl,
+	}
+	if t.ttl <= 0 {
+		t.ttl = defaultTTL
+	}
+	go t.clean()
+	return t
+}
+
+func (t *Tunnel) ID() relay.TunnelID {
+	return t.id
+}
+
+func (t *Tunnel) AddConnector(c *Connector) {
+	if c == nil {
+		return
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	t.connectors = append(t.connectors, c)
+}
+
+func (t *Tunnel) GetConnector(network string) *Connector {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+
+	if len(t.connectors) == 1 {
+		if t.connectors[0].IsClosed() {
+			return nil
+		}
+		return t.connectors[0]
+	}
+
+	rw := selector.NewRandomWeighted[*Connector]()
+
+	found := false
+	for _, c := range t.connectors {
+		if c.IsClosed() {
+			continue
+		}
+
+		weight := c.ID().Weight()
+		if weight == 0 {
+			weight = 1
+		}
+
+		if network == "udp" && c.id.IsUDP() ||
+			network != "udp" && !c.id.IsUDP() {
+			if weight == MaxWeight && !found {
+				rw.Reset()
+				found = true
+			}
+
+			if weight == MaxWeight || !found {
+				rw.Add(c, int(weight))
+			}
+		}
+	}
+
+	return rw.Next()
+}
+
+func (t *Tunnel) Close() error {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	select {
+	case <-t.close:
+	default:
+		for _, c := range t.connectors {
+			c.Close()
+		}
+		close(t.close)
+	}
+
+	return nil
+}
+
+func (t *Tunnel) CloseOnIdle() bool {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+
+	select {
+	case <-t.close:
+	default:
+		if len(t.connectors) == 0 {
+			close(t.close)
+			return true
+		}
+	}
+	return false
+}
+
+func (t *Tunnel) clean() {
+	ticker := time.NewTicker(t.ttl)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			t.mu.Lock()
+			if len(t.connectors) == 0 {
+				t.mu.Unlock()
+				break
+			}
+
+			var connectors []*Connector
+			for _, c := range t.connectors {
+				if c.IsClosed() {
+					c.log.Debugf("remove connector: %s %s", t.id, c.id)
+					continue
+				}
+
+				connectors = append(connectors, c)
+				if c.opts.sd != nil {
+					c.opts.sd.Renew(context.Background(), &sd.Service{
+						ID:   c.id.String(),
+						Name: t.id.String(),
+						Node: t.node,
+					})
+				}
+			}
+			if len(connectors) != len(t.connectors) {
+				t.connectors = connectors
+			}
+			t.mu.Unlock()
+
+		case <-t.close:
+			return
+		}
+	}
+}
+
+type ConnectorPool struct {
+	node    string
+	tunnels map[string]*Tunnel
+	mu      sync.RWMutex
+	cancel  context.CancelFunc
+}
+
+func NewConnectorPool(node string) *ConnectorPool {
+	ctx, cancel := context.WithCancel(context.Background())
+
+	p := &ConnectorPool{
+		node:    node,
+		tunnels: make(map[string]*Tunnel),
+		cancel:  cancel,
+	}
+
+	go p.closeIdles(ctx)
+	return p
+}
+
+func (p *ConnectorPool) Add(tid relay.TunnelID, c *Connector, ttl time.Duration) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	s := tid.String()
+
+	t := p.tunnels[s]
+	if t == nil {
+		t = NewTunnel(p.node, tid, ttl)
+		p.tunnels[s] = t
+	}
+	t.AddConnector(c)
+}
+
+func (p *ConnectorPool) Get(network string, tid string) *Connector {
+	if p == nil {
+		return nil
+	}
+
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+
+	t := p.tunnels[tid]
+	if t == nil {
+		return nil
+	}
+
+	return t.GetConnector(network)
+}
+
+func (p *ConnectorPool) Close() error {
+	if p == nil {
+		return nil
+	}
+
+	if p.cancel != nil {
+		p.cancel()
+	}
+
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	for k, v := range p.tunnels {
+		v.Close()
+		delete(p.tunnels, k)
+	}
+
+	return nil
+}
+
+func (p *ConnectorPool) closeIdles(ctx context.Context) {
+	ticker := time.NewTicker(15 * time.Minute)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			p.mu.Lock()
+			for k, v := range p.tunnels {
+				if v.CloseOnIdle() {
+					delete(p.tunnels, k)
+					logger.Default().Debugf("remove idle tunnel: %s", k)
+				}
+			}
+			p.mu.Unlock()
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func parseTunnelID(s string) (tid relay.TunnelID) {
+	if s == "" {
+		return
+	}
+	private := false
+	if s[0] == '$' {
+		private = true
+		s = s[1:]
+	}
+	uuid, _ := uuid.Parse(s)
+
+	if private {
+		return relay.NewPrivateTunnelID(uuid[:])
+	}
+	return relay.NewTunnelID(uuid[:])
+}

go-gost/x/handler/unix/handler.go

@@ -0,0 +1,252 @@
+package unix
+
+import (
+	"bufio"
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/chain"
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/hop"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xio "github.com/go-gost/x/internal/io"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+func init() {
+	registry.HandlerRegistry().Register("unix", NewHandler)
+}
+
+type unixHandler struct {
+	hop      hop.Hop
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &unixHandler{
+		options: options,
+	}
+}
+
+func (h *unixHandler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return
+}
+
+// Forward implements handler.Forwarder.
+func (h *unixHandler) Forward(hop hop.Hop) {
+	h.hop = hop
+}
+
+func (h *unixHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "unix",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if h.hop != nil {
+		target := h.hop.Select(ctx)
+		if target == nil {
+			err = errors.New("target not available")
+			log.Error(err)
+			return err
+		}
+		log = log.WithFields(map[string]any{
+			"node": target.Name,
+			"dst":  target.Addr,
+			"host": target.Addr,
+		})
+		ro.Host = target.Addr
+
+		return h.forwardUnix(ctx, conn, target, ro, log)
+	}
+
+	cc, err := h.options.Router.Dial(ctx, "tcp", "@")
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer cc.Close()
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Recorder:           h.recorder.Recorder,
+			RecorderOptions:    h.recorder.Options,
+			Certificate:        h.md.certificate,
+			PrivateKey:         h.md.privateKey,
+			NegotiatedProtocol: h.md.alpn,
+			CertPool:           h.certPool,
+			MitmBypass:         h.md.mitmBypass,
+			ReadTimeout:        h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.LocalAddr(), "@")
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.LocalAddr(), "@")
+
+	return nil
+}
+
+func (h *unixHandler) forwardUnix(ctx context.Context, conn net.Conn, target *chain.Node, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
+	log.Debugf("%s >> %s", conn.LocalAddr(), target.Addr)
+	var cc io.ReadWriteCloser
+
+	if opts := h.options.Router.Options(); opts != nil && opts.Chain != nil {
+		cc, err = h.options.Router.Dial(ctx, "unix", target.Addr)
+	} else {
+		cc, err = (&net.Dialer{}).DialContext(ctx, "unix", target.Addr)
+	}
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer cc.Close()
+
+	var rw io.ReadWriter = conn
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		rw = xio.NewReadWriter(br, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			ro2 := &xrecorder.HandlerRecorderObject{}
+			*ro2 = *ro
+			ro.Time = time.Time{}
+			return h.handleHTTP(ctx, rw, cc, ro2, log)
+		case sniffing.ProtoTLS:
+			return h.handleTLS(ctx, rw, cc, ro, log)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.LocalAddr(), target.Addr)
+	xnet.Transport(rw, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.LocalAddr(), target.Addr)
+
+	return nil
+}

go-gost/x/handler/unix/metadata.go

@@ -0,0 +1,52 @@
+package unix
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout time.Duration
+
+	sniffing        bool
+	sniffingTimeout time.Duration
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+}
+
+func (h *unixHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+	return
+}

go-gost/x/handler/unix/sniffing.go

@@ -0,0 +1,259 @@
+package unix
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/hex"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"strings"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	"github.com/go-gost/core/logger"
+	dissector "github.com/go-gost/tls-dissector"
+	xbypass "github.com/go-gost/x/bypass"
+	xio "github.com/go-gost/x/internal/io"
+	netpkg "github.com/go-gost/x/internal/net"
+	xhttp "github.com/go-gost/x/internal/net/http"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+const (
+	defaultBodySize = 1024 * 1024 // 1MB
+)
+
+func (h *unixHandler) handleHTTP(ctx context.Context, rw, cc io.ReadWriter, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	br := bufio.NewReader(rw)
+	req, err := http.ReadRequest(br)
+	if err != nil {
+		return err
+	}
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpRequest(req, false)
+		log.Trace(string(dump))
+	}
+
+	host := req.Host
+	if _, _, err := net.SplitHostPort(host); err != nil {
+		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
+	}
+	ro.Host = host
+
+	log = log.WithFields(map[string]any{
+		"host": host,
+	})
+
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, "tcp", host, bypass.WithPathOption(req.RequestURI)) {
+		log.Debugf("bypass: %s %s", host, req.RequestURI)
+		return xbypass.ErrBypass
+	}
+
+	shouldClose, err := h.httpRoundTrip(ctx, rw, cc, req, ro, log)
+	if err != nil || shouldClose {
+		return err
+	}
+
+	for {
+		req, err := http.ReadRequest(br)
+		if err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
+				return nil
+			}
+			return err
+		}
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpRequest(req, false)
+			log.Trace(string(dump))
+		}
+
+		if shouldClose, err := h.httpRoundTrip(ctx, rw, cc, req, ro, log); err != nil || shouldClose {
+			return err
+		}
+	}
+}
+
+func (h *unixHandler) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (close bool, err error) {
+	close = true
+
+	if req == nil {
+		return
+	}
+
+	start := time.Now()
+	ro.Time = start
+
+	log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
+	defer func() {
+		ro.Duration = time.Since(start)
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s >-< %s", ro.RemoteAddr, req.Host)
+	}()
+
+	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
+		ro.ClientIP = clientIP.String()
+	}
+	ro.HTTP = &xrecorder.HTTPRecorderObject{
+		Host:   req.Host,
+		Proto:  req.Proto,
+		Scheme: req.URL.Scheme,
+		Method: req.Method,
+		URI:    req.RequestURI,
+		Request: xrecorder.HTTPRequestRecorderObject{
+			ContentLength: req.ContentLength,
+			Header:        req.Header.Clone(),
+		},
+	}
+
+	// HTTP/1.0
+	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
+		if strings.ToLower(req.Header.Get("Connection")) == "keep-alive" {
+			req.Header.Del("Connection")
+		} else {
+			req.Header.Set("Connection", "close")
+		}
+	}
+
+	var reqBody *xhttp.Body
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		if req.Body != nil {
+			maxSize := opts.MaxBodySize
+			if maxSize <= 0 {
+				maxSize = defaultBodySize
+			}
+			reqBody = xhttp.NewBody(req.Body, maxSize)
+			req.Body = reqBody
+		}
+	}
+
+	if err = req.Write(cc); err != nil {
+		return
+	}
+
+	if reqBody != nil {
+		ro.HTTP.Request.Body = reqBody.Content()
+		ro.HTTP.Request.ContentLength = reqBody.Length()
+	}
+
+	xio.SetReadDeadline(cc, time.Now().Add(h.md.readTimeout))
+	resp, err := http.ReadResponse(bufio.NewReader(cc), req)
+	if err != nil {
+		log.Errorf("read response: %v", err)
+		return
+	}
+	defer resp.Body.Close()
+	xio.SetReadDeadline(cc, time.Time{})
+
+	ro.HTTP.StatusCode = resp.StatusCode
+	ro.HTTP.Response.Header = resp.Header
+	ro.HTTP.Response.ContentLength = resp.ContentLength
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+
+	// HTTP/1.0
+	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
+		if !resp.Close {
+			resp.Header.Set("Connection", "keep-alive")
+		}
+		resp.ProtoMajor = req.ProtoMajor
+		resp.ProtoMinor = req.ProtoMinor
+	}
+
+	var respBody *xhttp.Body
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		maxSize := opts.MaxBodySize
+		if maxSize <= 0 {
+			maxSize = defaultBodySize
+		}
+		respBody = xhttp.NewBody(resp.Body, maxSize)
+		resp.Body = respBody
+	}
+
+	if err = resp.Write(rw); err != nil {
+		log.Errorf("write response: %v", err)
+		return
+	}
+
+	if respBody != nil {
+		ro.HTTP.Response.Body = respBody.Content()
+		ro.HTTP.Response.ContentLength = respBody.Length()
+	}
+
+	if req.Header.Get("Upgrade") == "websocket" {
+		netpkg.Transport(rw, cc)
+	}
+
+	return resp.Close, nil
+}
+
+func (h *unixHandler) handleTLS(_ context.Context, rw, cc io.ReadWriter, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	buf := new(bytes.Buffer)
+
+	clientHello, err := dissector.ParseClientHello(io.TeeReader(rw, buf))
+	if err != nil {
+		return err
+	}
+
+	ro.TLS = &xrecorder.TLSRecorderObject{
+		ServerName:  clientHello.ServerName,
+		ClientHello: hex.EncodeToString(buf.Bytes()),
+	}
+	if len(clientHello.SupportedProtos) > 0 {
+		ro.TLS.Proto = clientHello.SupportedProtos[0]
+	}
+
+	if _, err := buf.WriteTo(cc); err != nil {
+		return err
+	}
+
+	xio.SetReadDeadline(cc, time.Now().Add(h.md.readTimeout))
+	serverHello, err := dissector.ParseServerHello(io.TeeReader(cc, buf))
+	xio.SetReadDeadline(cc, time.Time{})
+
+	if serverHello != nil {
+		ro.TLS.CipherSuite = tls_util.CipherSuite(serverHello.CipherSuite).String()
+		ro.TLS.CompressionMethod = serverHello.CompressionMethod
+		if serverHello.Proto != "" {
+			ro.TLS.Proto = serverHello.Proto
+		}
+		if serverHello.Version > 0 {
+			ro.TLS.Version = tls_util.Version(serverHello.Version).String()
+		}
+	}
+
+	if buf.Len() > 0 {
+		ro.TLS.ServerHello = hex.EncodeToString(buf.Bytes())
+	}
+
+	if _, err := buf.WriteTo(rw); err != nil {
+		return err
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", ro.RemoteAddr, ro.Host)
+	netpkg.Transport(rw, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", ro.RemoteAddr, ro.Host)
+
+	return err
+}