init

go-gost/x/handler/socks/v4/handler.go

@@ -0,0 +1,371 @@
+package v4
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	"github.com/go-gost/core/logger"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/gosocks4"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	ErrUnknownCmd    = errors.New("socks4: unknown command")
+	ErrUnimplemented = errors.New("socks4: unimplemented")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("socks4", NewHandler)
+	registry.HandlerRegistry().Register("socks4a", NewHandler)
+}
+
+type socks4Handler struct {
+	md       metadata
+	options  handler.Options
+	stats    *stats_util.HandlerStats
+	limiter  traffic.TrafficLimiter
+	cancel   context.CancelFunc
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &socks4Handler{
+		options: options,
+	}
+}
+
+func (h *socks4Handler) Init(md md.Metadata) (err error) {
+	if err := h.parseMetadata(md); err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return nil
+}
+
+func (h *socks4Handler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "tcp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	if h.md.readTimeout > 0 {
+		conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+	}
+
+	req, err := gosocks4.ReadRequest(conn)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+
+	ro.Host = req.Addr.String()
+	log.Trace(req)
+
+	conn.SetReadDeadline(time.Time{})
+
+	if h.options.Auther != nil {
+		clientID, ok := h.options.Auther.Authenticate(ctx, string(req.Userid), "")
+		if !ok {
+			resp := gosocks4.NewReply(gosocks4.RejectedUserid, nil)
+			log.Trace(resp)
+			return resp.Write(conn)
+		}
+		ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+		ro.ClientID = clientID
+	}
+
+	switch req.Cmd {
+	case gosocks4.CmdConnect:
+		return h.handleConnect(ctx, conn, req, ro, log)
+	case gosocks4.CmdBind:
+		return h.handleBind(ctx, conn, req)
+	default:
+		err = ErrUnknownCmd
+		log.Error(err)
+		return err
+	}
+}
+
+func (h *socks4Handler) Close() error {
+	if h.cancel != nil {
+		h.cancel()
+	}
+	return nil
+}
+
+func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *gosocks4.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	addr := req.Addr.String()
+
+	log = log.WithFields(map[string]any{
+		"dst":  addr,
+		"host": addr,
+	})
+	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption("tcp"),
+			limiter.AddrOption(addr),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", addr) {
+		resp := gosocks4.NewReply(gosocks4.Rejected, nil)
+		log.Trace(resp)
+		log.Debug("bypass: ", addr)
+		return resp.Write(conn)
+	}
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", addr)
+	ro.Route = buf.String()
+	if err != nil {
+		resp := gosocks4.NewReply(gosocks4.Failed, nil)
+		log.Trace(resp)
+		resp.Write(conn)
+		return err
+	}
+	defer cc.Close()
+
+	resp := gosocks4.NewReply(gosocks4.Granted, nil)
+	log.Trace(resp)
+	if err := resp.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), ro.Host)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), ro.Host)
+
+	return nil
+}
+
+func (h *socks4Handler) handleBind(ctx context.Context, conn net.Conn, req *gosocks4.Request) error {
+	// TODO: bind
+	return ErrUnimplemented
+}
+
+func (h *socks4Handler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *socks4Handler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/socks/v4/metadata.go

@@ -0,0 +1,79 @@
+package v4
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout            time.Duration
+	hash                   string
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *socks4Handler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return
+}

go-gost/x/handler/socks/v5/bind.go

@@ -0,0 +1,181 @@
+package v5
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+)
+
+func (h *socks5Handler) handleBind(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst": fmt.Sprintf("%s/%s", address, network),
+		"cmd": "bind",
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
+
+	if !h.md.enableBind {
+		reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(reply)
+		log.Error("socks5: BIND is disabled")
+		return reply.Write(conn)
+	}
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	// BIND does not support chain.
+	return h.bindLocal(ctx, conn, network, address, log)
+}
+
+func (h *socks5Handler) bindLocal(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	ln, err := lc.Listen(ctx, network, address) // strict mode: if the port already in use, it will return error
+	if err != nil {
+		log.Error(err)
+		reply := gosocks5.NewReply(gosocks5.Failure, nil)
+		if err := reply.Write(conn); err != nil {
+			log.Error(err)
+		}
+		log.Debug(reply)
+		return err
+	}
+
+	socksAddr := gosocks5.Addr{}
+	if err := socksAddr.ParseFrom(ln.Addr().String()); err != nil {
+		log.Warn(err)
+	}
+
+	// Issue: may not reachable when host has multi-interface
+	socksAddr.Host, _, _ = net.SplitHostPort(conn.LocalAddr().String())
+	socksAddr.Type = 0
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &socksAddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		ln.Close()
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"bind": fmt.Sprintf("%s/%s", ln.Addr(), ln.Addr().Network()),
+	})
+
+	log.Debugf("bind on %s OK", ln.Addr())
+
+	h.serveBind(ctx, conn, ln, log)
+	return nil
+}
+
+func (h *socks5Handler) serveBind(ctx context.Context, conn net.Conn, ln net.Listener, log logger.Logger) {
+	var rc net.Conn
+	accept := func() <-chan error {
+		errc := make(chan error, 1)
+
+		go func() {
+			defer close(errc)
+			defer ln.Close()
+
+			c, err := ln.Accept()
+			if err != nil {
+				errc <- err
+			}
+			rc = c
+		}()
+
+		return errc
+	}
+
+	pc1, pc2 := net.Pipe()
+	pipe := func() <-chan error {
+		errc := make(chan error, 1)
+
+		go func() {
+			defer close(errc)
+			defer pc1.Close()
+
+			errc <- xnet.Transport(conn, pc1)
+		}()
+
+		return errc
+	}
+
+	defer pc2.Close()
+
+	select {
+	case err := <-accept():
+		if err != nil {
+			log.Error(err)
+
+			reply := gosocks5.NewReply(gosocks5.Failure, nil)
+			log.Trace(reply)
+			if err := reply.Write(pc2); err != nil {
+				log.Error(err)
+			}
+
+			return
+		}
+		defer rc.Close()
+
+		log.Debugf("peer %s accepted", rc.RemoteAddr())
+
+		log = log.WithFields(map[string]any{
+			"local":  rc.LocalAddr().String(),
+			"remote": rc.RemoteAddr().String(),
+		})
+
+		raddr := gosocks5.Addr{}
+		raddr.ParseFrom(rc.RemoteAddr().String())
+		reply := gosocks5.NewReply(gosocks5.Succeeded, &raddr)
+		log.Trace(reply)
+		if err := reply.Write(pc2); err != nil {
+			log.Error(err)
+		}
+
+		start := time.Now()
+		log.Debugf("%s <-> %s", rc.LocalAddr(), rc.RemoteAddr())
+		xnet.Transport(pc2, rc)
+		log.WithFields(map[string]any{"duration": time.Since(start)}).
+			Debugf("%s >-< %s", rc.LocalAddr(), rc.RemoteAddr())
+
+	case err := <-pipe():
+		if err != nil {
+			log.Error(err)
+		}
+		ln.Close()
+		return
+	}
+}

go-gost/x/handler/socks/v5/connect.go

@@ -0,0 +1,145 @@
+package v5
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst":  fmt.Sprintf("%s/%s", address, network),
+		"cmd":  "connect",
+		"host": address,
+	})
+	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, network, address) {
+		resp := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(resp)
+		log.Debug("bypass: ", address)
+		return resp.Write(conn)
+	}
+
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: address})
+	}
+
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, address)
+	ro.Route = buf.String()
+	if err != nil {
+		resp := gosocks5.NewReply(gosocks5.NetUnreachable, nil)
+		log.Trace(resp)
+		resp.Write(conn)
+		return err
+	}
+	defer cc.Close()
+
+	resp := gosocks5.NewReply(gosocks5.Succeeded, nil)
+	log.Trace(resp)
+	if err := resp.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
+	t := time.Now()
+	log.Infof("%s <-> %s", conn.RemoteAddr(), address)
+	xnet.Transport(conn, cc)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Infof("%s >-< %s", conn.RemoteAddr(), address)
+
+	return nil
+}

go-gost/x/handler/socks/v5/handler.go

@@ -0,0 +1,250 @@
+package v5
+
+import (
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/handler"
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/limiter/traffic"
+	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/core/recorder"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/socks"
+	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	rate_limiter "github.com/go-gost/x/limiter/rate"
+	cache_limiter "github.com/go-gost/x/limiter/traffic/cache"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+	"github.com/go-gost/x/registry"
+)
+
+var (
+	ErrUnknownCmd = errors.New("socks5: unknown command")
+)
+
+func init() {
+	registry.HandlerRegistry().Register("socks5", NewHandler)
+	registry.HandlerRegistry().Register("socks", NewHandler)
+}
+
+type socks5Handler struct {
+	selector gosocks5.Selector
+	md       metadata
+	options  handler.Options
+	stats    *stats_util.HandlerStats
+	limiter  traffic.TrafficLimiter
+	cancel   context.CancelFunc
+	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
+}
+
+func NewHandler(opts ...handler.Option) handler.Handler {
+	options := handler.Options{}
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	return &socks5Handler{
+		options: options,
+	}
+}
+
+func (h *socks5Handler) Init(md md.Metadata) (err error) {
+	if err = h.parseMetadata(md); err != nil {
+		return
+	}
+
+	h.selector = &serverSelector{
+		Authenticator: h.options.Auther,
+		TLSConfig:     h.options.TLSConfig,
+		logger:        h.options.Logger,
+		noTLS:         h.md.noTLS,
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	h.cancel = cancel
+
+	if h.options.Observer != nil {
+		h.stats = stats_util.NewHandlerStats(h.options.Service, h.md.observerResetTraffic)
+		go h.observeStats(ctx)
+	}
+
+	if h.options.Limiter != nil {
+		h.limiter = cache_limiter.NewCachedTrafficLimiter(h.options.Limiter,
+			cache_limiter.RefreshIntervalOption(h.md.limiterRefreshInterval),
+			cache_limiter.CleanupIntervalOption(h.md.limiterCleanupInterval),
+			cache_limiter.ScopeOption(limiter.ScopeClient),
+		)
+	}
+
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	return
+}
+
+func (h *socks5Handler) Handle(ctx context.Context, conn net.Conn, opts ...handler.HandleOption) (err error) {
+	defer conn.Close()
+
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		Network:    "tcp",
+		RemoteAddr: conn.RemoteAddr().String(),
+		LocalAddr:  conn.LocalAddr().String(),
+		Time:       start,
+		SID:        string(ctxvalue.SidFromContext(ctx)),
+	}
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": conn.RemoteAddr().String(),
+		"local":  conn.LocalAddr().String(),
+		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
+	})
+	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := xstats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes += pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes += pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
+	}()
+
+	if !h.checkRateLimit(conn.RemoteAddr()) {
+		return rate_limiter.ErrRateLimit
+	}
+
+	conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
+
+	sc := gosocks5.ServerConn(conn, h.selector)
+	req, err := gosocks5.ReadRequest(sc)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	log.Trace(req)
+
+	if clientID := sc.ID(); clientID != "" {
+		ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+		log = log.WithFields(map[string]any{"user": clientID})
+		ro.ClientID = clientID
+	}
+
+	conn = sc
+	conn.SetReadDeadline(time.Time{})
+
+	address := req.Addr.String()
+	ro.Host = address
+
+	switch req.Cmd {
+	case gosocks5.CmdConnect:
+		return h.handleConnect(ctx, conn, "tcp", address, ro, log)
+	case gosocks5.CmdBind:
+		return h.handleBind(ctx, conn, "tcp", address, log)
+	case socks.CmdMuxBind:
+		return h.handleMuxBind(ctx, conn, "tcp", address, log)
+	case gosocks5.CmdUdp:
+		ro.Network = "udp"
+		return h.handleUDP(ctx, conn, ro, log)
+	case socks.CmdUDPTun:
+		ro.Network = "udp"
+		return h.handleUDPTun(ctx, conn, "udp", address, ro, log)
+	default:
+		err = ErrUnknownCmd
+		log.Error(err)
+		resp := gosocks5.NewReply(gosocks5.CmdUnsupported, nil)
+		log.Trace(resp)
+		resp.Write(conn)
+		return err
+	}
+}
+
+func (h *socks5Handler) Close() error {
+	if h.cancel != nil {
+		h.cancel()
+	}
+	return nil
+}
+
+func (h *socks5Handler) checkRateLimit(addr net.Addr) bool {
+	if h.options.RateLimiter == nil {
+		return true
+	}
+	host, _, _ := net.SplitHostPort(addr.String())
+	if limiter := h.options.RateLimiter.Limiter(host); limiter != nil {
+		return limiter.Allow(1)
+	}
+
+	return true
+}
+
+func (h *socks5Handler) observeStats(ctx context.Context) {
+	if h.options.Observer == nil {
+		return
+	}
+
+	var events []observer.Event
+
+	ticker := time.NewTicker(h.md.observerPeriod)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if len(events) > 0 {
+				if err := h.options.Observer.Observe(ctx, events); err == nil {
+					events = nil
+				}
+				break
+			}
+
+			evs := h.stats.Events()
+			if err := h.options.Observer.Observe(ctx, evs); err != nil {
+				events = evs
+			}
+
+		case <-ctx.Done():
+			return
+		}
+	}
+}

go-gost/x/handler/socks/v5/mbind.go

@@ -0,0 +1,165 @@
+package v5
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/mux"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+)
+
+func (h *socks5Handler) handleMuxBind(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"dst": fmt.Sprintf("%s/%s", address, network),
+		"cmd": "mbind",
+	})
+
+	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
+
+	if !h.md.enableBind {
+		reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(reply)
+		log.Error("socks5: BIND is disabled")
+		return reply.Write(conn)
+	}
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	return h.muxBindLocal(ctx, conn, network, address, log)
+}
+
+func (h *socks5Handler) muxBindLocal(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	ln, err := lc.Listen(ctx, network, address) // strict mode: if the port already in use, it will return error
+	if err != nil {
+		log.Error(err)
+		reply := gosocks5.NewReply(gosocks5.Failure, nil)
+		log.Trace(reply)
+		if err := reply.Write(conn); err != nil {
+			log.Error(err)
+		}
+		return err
+	}
+
+	socksAddr := gosocks5.Addr{}
+	err = socksAddr.ParseFrom(ln.Addr().String())
+	if err != nil {
+		log.Warn(err)
+	}
+
+	// Issue: may not reachable when host has multi-interface
+	socksAddr.Host, _, _ = net.SplitHostPort(conn.LocalAddr().String())
+	socksAddr.Type = 0
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &socksAddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		ln.Close()
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"bind": fmt.Sprintf("%s/%s", ln.Addr(), ln.Addr().Network()),
+	})
+
+	log.Debugf("bind on %s OK", ln.Addr())
+
+	return h.serveMuxBind(ctx, conn, ln, log)
+}
+
+func (h *socks5Handler) serveMuxBind(ctx context.Context, conn net.Conn, ln net.Listener, log logger.Logger) error {
+	// Upgrade connection to multiplex stream.
+	session, err := mux.ClientSession(conn, h.md.muxCfg)
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer session.Close()
+
+	go func() {
+		defer ln.Close()
+		for {
+			conn, err := session.Accept()
+			if err != nil {
+				log.Error(err)
+				return
+			}
+			conn.Close() // we do not handle incoming connections.
+		}
+	}()
+
+	for {
+		rc, err := ln.Accept()
+		if err != nil {
+			log.Error(err)
+			return err
+		}
+		log.Debugf("peer %s accepted", rc.RemoteAddr())
+
+		go func(c net.Conn) {
+			defer c.Close()
+
+			log = log.WithFields(map[string]any{
+				"local":  rc.LocalAddr().String(),
+				"remote": rc.RemoteAddr().String(),
+			})
+			sc, err := session.GetConn()
+			if err != nil {
+				log.Error(err)
+				return
+			}
+			defer sc.Close()
+
+			// incompatible with GOST v2.x
+			if !h.md.compatibilityMode {
+				addr := gosocks5.Addr{}
+				addr.ParseFrom(c.RemoteAddr().String())
+				reply := gosocks5.NewReply(gosocks5.Succeeded, &addr)
+				log.Trace(reply)
+				if err := reply.Write(sc); err != nil {
+					log.Error(err)
+					return
+				}
+			}
+
+			t := time.Now()
+			log.Debugf("%s <-> %s", c.LocalAddr(), c.RemoteAddr())
+			xnet.Transport(sc, c)
+			log.WithFields(map[string]any{"duration": time.Since(t)}).
+				Debugf("%s >-< %s", c.LocalAddr(), c.RemoteAddr())
+		}(rc)
+	}
+}

go-gost/x/handler/socks/v5/metadata.go

@@ -0,0 +1,99 @@
+package v5
+
+import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
+	"time"
+
+	"github.com/go-gost/core/bypass"
+	mdata "github.com/go-gost/core/metadata"
+	"github.com/go-gost/x/internal/util/mux"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
+)
+
+type metadata struct {
+	readTimeout       time.Duration
+	noTLS             bool
+	enableBind        bool
+	enableUDP         bool
+	compatibilityMode bool
+	hash              string
+	muxCfg            *mux.Config
+
+	observerPeriod       time.Duration
+	observerResetTraffic bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
+
+	limiterRefreshInterval time.Duration
+	limiterCleanupInterval time.Duration
+}
+
+func (h *socks5Handler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
+	h.md.noTLS = mdutil.GetBool(md, "notls")
+	h.md.enableBind = mdutil.GetBool(md, "bind")
+	h.md.enableUDP = mdutil.GetBool(md, "udp")
+
+	h.md.compatibilityMode = mdutil.GetBool(md, "comp")
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.muxCfg = &mux.Config{
+		Version:           mdutil.GetInt(md, "mux.version"),
+		KeepAliveInterval: mdutil.GetDuration(md, "mux.keepaliveInterval"),
+		KeepAliveDisabled: mdutil.GetBool(md, "mux.keepaliveDisabled"),
+		KeepAliveTimeout:  mdutil.GetDuration(md, "mux.keepaliveTimeout"),
+		MaxFrameSize:      mdutil.GetInt(md, "mux.maxFrameSize"),
+		MaxReceiveBuffer:  mdutil.GetInt(md, "mux.maxReceiveBuffer"),
+		MaxStreamBuffer:   mdutil.GetInt(md, "mux.maxStreamBuffer"),
+	}
+
+	h.md.observerPeriod = mdutil.GetDuration(md, "observePeriod", "observer.period", "observer.observePeriod")
+	if h.md.observerPeriod == 0 {
+		h.md.observerPeriod = 5 * time.Second
+	}
+	if h.md.observerPeriod < time.Second {
+		h.md.observerPeriod = time.Second
+	}
+	h.md.observerResetTraffic = mdutil.GetBool(md, "observer.resetTraffic")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
+	h.md.limiterRefreshInterval = mdutil.GetDuration(md, "limiter.refreshInterval")
+	h.md.limiterCleanupInterval = mdutil.GetDuration(md, "limiter.cleanupInterval")
+
+	return nil
+}

go-gost/x/handler/socks/v5/selector.go

@@ -0,0 +1,101 @@
+package v5
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+
+	"github.com/go-gost/core/auth"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	"github.com/go-gost/x/internal/util/socks"
+)
+
+type serverSelector struct {
+	methods       []uint8
+	Authenticator auth.Authenticator
+	TLSConfig     *tls.Config
+	logger        logger.Logger
+	noTLS         bool
+}
+
+func (selector *serverSelector) Methods() []uint8 {
+	return selector.methods
+}
+
+func (s *serverSelector) Select(methods ...uint8) (method uint8) {
+	s.logger.Debugf("%d %d %v", gosocks5.Ver5, len(methods), methods)
+	method = gosocks5.MethodNoAuth
+	for _, m := range methods {
+		if m == socks.MethodTLS && !s.noTLS {
+			method = m
+			break
+		}
+	}
+
+	// when Authenticator is set, auth is mandatory
+	if s.Authenticator != nil {
+		if method == gosocks5.MethodNoAuth {
+			method = gosocks5.MethodUserPass
+		}
+		if method == socks.MethodTLS && !s.noTLS {
+			method = socks.MethodTLSAuth
+		}
+	}
+
+	return
+}
+
+func (s *serverSelector) OnSelected(method uint8, conn net.Conn) (string, net.Conn, error) {
+	s.logger.Debugf("%d %d", gosocks5.Ver5, method)
+	switch method {
+	case gosocks5.MethodNoAuth:
+
+	case socks.MethodTLS:
+		conn = tls.Server(conn, s.TLSConfig)
+
+	case gosocks5.MethodUserPass, socks.MethodTLSAuth:
+		if method == socks.MethodTLSAuth {
+			conn = tls.Server(conn, s.TLSConfig)
+		}
+
+		req, err := gosocks5.ReadUserPassRequest(conn)
+		if err != nil {
+			s.logger.Error(err)
+			return "", nil, err
+		}
+		s.logger.Trace(req)
+
+		var id string
+		if s.Authenticator != nil {
+			var ok bool
+			ctx := ctxvalue.ContextWithClientAddr(context.Background(), ctxvalue.ClientAddr(conn.RemoteAddr().String()))
+			id, ok = s.Authenticator.Authenticate(ctx, req.Username, req.Password)
+			if !ok {
+				resp := gosocks5.NewUserPassResponse(gosocks5.UserPassVer, gosocks5.Failure)
+				if err := resp.Write(conn); err != nil {
+					s.logger.Error(err)
+					return "", nil, err
+				}
+				s.logger.Info(resp)
+
+				return "", nil, gosocks5.ErrAuthFailure
+			}
+		}
+
+		resp := gosocks5.NewUserPassResponse(gosocks5.UserPassVer, gosocks5.Succeeded)
+		s.logger.Trace(resp)
+		if err := resp.Write(conn); err != nil {
+			s.logger.Error(err)
+			return "", nil, err
+		}
+		return id, conn, nil
+
+	case gosocks5.MethodNoAcceptable:
+		return "", nil, gosocks5.ErrBadMethod
+	default:
+		return "", nil, gosocks5.ErrBadFormat
+	}
+	return "", conn, nil
+}

go-gost/x/handler/socks/v5/udp.go

@@ -0,0 +1,125 @@
+package v5
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/socks"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	xstats "github.com/go-gost/x/observer/stats"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *socks5Handler) handleUDP(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"cmd": "udp",
+	})
+
+	if !h.md.enableUDP {
+		reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+		log.Trace(reply)
+		log.Error("socks5: UDP relay is disabled")
+		return reply.Write(conn)
+	}
+
+	lc := xnet.ListenConfig{
+		Netns: h.options.Netns,
+	}
+	laddr := &net.UDPAddr{IP: conn.LocalAddr().(*net.TCPAddr).IP, Port: 0} // use out-going interface's IP
+	cc, err := lc.ListenPacket(ctx, "udp", laddr.String())
+	if err != nil {
+		log.Error(err)
+		reply := gosocks5.NewReply(gosocks5.Failure, nil)
+		log.Trace(reply)
+		reply.Write(conn)
+		return err
+	}
+	defer cc.Close()
+
+	saddr := gosocks5.Addr{}
+	saddr.ParseFrom(cc.LocalAddr().String())
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &saddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+
+	log = log.WithFields(map[string]any{
+		"bind": fmt.Sprintf("%s/%s", cc.LocalAddr(), cc.LocalAddr().Network()),
+	})
+	log.Debugf("bind on %s OK", cc.LocalAddr())
+
+	// obtain a udp connection
+	var buf bytes.Buffer
+	c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+	ro.Route = buf.String()
+	if err != nil {
+		log.Error(err)
+		return err
+	}
+	defer c.Close()
+
+	pc, ok := c.(net.PacketConn)
+	if !ok {
+		err := errors.New("socks5: wrong connection type")
+		log.Error(err)
+		return err
+	}
+
+	pStats := xstats.Stats{}
+	cc = stats_wrapper.WrapPacketConn(cc, &pStats)
+
+	defer func() {
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+	}()
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		cc = traffic_wrapper.WrapPacketConn(
+			cc,
+			h.limiter,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption("udp"),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			cc = stats_wrapper.WrapPacketConn(cc, pstats)
+		}
+	}
+
+	r := udp.NewRelay(socks.UDPConn(cc), pc).
+		WithBypass(h.options.Bypass).
+		WithLogger(log)
+
+	go r.Run(ctx)
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), cc.LocalAddr())
+	io.Copy(io.Discard, conn)
+	log.WithFields(map[string]any{"duration": time.Since(t)}).
+		Debugf("%s >-< %s", conn.RemoteAddr(), cc.LocalAddr())
+
+	return nil
+}

go-gost/x/handler/socks/v5/udp_tun.go

@@ -0,0 +1,139 @@
+package v5
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/go-gost/core/limiter"
+	"github.com/go-gost/core/logger"
+	"github.com/go-gost/core/observer/stats"
+	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/net/udp"
+	"github.com/go-gost/x/internal/util/socks"
+	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
+)
+
+func (h *socks5Handler) handleUDPTun(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	log = log.WithFields(map[string]any{
+		"cmd": "udp-tun",
+	})
+
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	bindAddr, _ := net.ResolveUDPAddr(network, address)
+	if bindAddr == nil {
+		bindAddr = &net.UDPAddr{}
+	}
+
+	var pc net.PacketConn
+	// relay mode
+	if bindAddr.Port == 0 {
+		if !h.md.enableUDP {
+			reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+			log.Trace(reply)
+			log.Error("socks5: UDP relay is disabled")
+			return reply.Write(conn)
+		}
+
+		// obtain a udp connection
+		var buf bytes.Buffer
+		c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+		ro.Route = buf.String()
+		if err != nil {
+			log.Error(err)
+			return err
+		}
+		defer c.Close()
+
+		var ok bool
+		pc, ok = c.(net.PacketConn)
+		if !ok {
+			err := errors.New("socks5: wrong connection type")
+			log.Error(err)
+			return err
+		}
+
+	} else { // BIND mode
+		if !h.md.enableBind {
+			reply := gosocks5.NewReply(gosocks5.NotAllowed, nil)
+			log.Trace(reply)
+			log.Error("socks5: BIND is disabled")
+			return reply.Write(conn)
+		}
+
+		lc := xnet.ListenConfig{
+			Netns: h.options.Netns,
+		}
+		var err error
+		pc, err = lc.ListenPacket(ctx, "udp", bindAddr.String())
+		if err != nil {
+			log.Error(err)
+			reply := gosocks5.NewReply(gosocks5.Failure, nil)
+			log.Trace(reply)
+			reply.Write(conn)
+			return err
+		}
+	}
+	defer pc.Close()
+
+	saddr := gosocks5.Addr{}
+	saddr.ParseFrom(pc.LocalAddr().String())
+	reply := gosocks5.NewReply(gosocks5.Succeeded, &saddr)
+	log.Trace(reply)
+	if err := reply.Write(conn); err != nil {
+		log.Error(err)
+		return err
+	}
+	log.Debugf("bind on %s OK", pc.LocalAddr())
+
+	clientID := ctxvalue.ClientIDFromContext(ctx)
+	if h.options.Observer != nil {
+		pstats := h.stats.Stats(string(clientID))
+		pstats.Add(stats.KindTotalConns, 1)
+		pstats.Add(stats.KindCurrentConns, 1)
+		defer pstats.Add(stats.KindCurrentConns, -1)
+		conn = stats_wrapper.WrapConn(conn, pstats)
+	}
+
+	r := udp.NewRelay(socks.UDPTunServerConn(conn), pc).
+		WithBypass(h.options.Bypass).
+		WithLogger(log)
+
+	t := time.Now()
+	log.Debugf("%s <-> %s", conn.RemoteAddr(), pc.LocalAddr())
+	r.Run(ctx)
+	log.WithFields(map[string]any{
+		"duration": time.Since(t),
+	}).Debugf("%s >-< %s", conn.RemoteAddr(), pc.LocalAddr())
+
+	return nil
+}