|
| 1 | +package inbound |
| 2 | + |
| 3 | +import ( |
| 4 | + "bytes" |
| 5 | + "context" |
| 6 | + "encoding/binary" |
| 7 | + "io" |
| 8 | + "net" |
| 9 | + |
| 10 | + "github.com/sagernet/sing-box/adapter" |
| 11 | + "github.com/sagernet/sing-box/common/dialer" |
| 12 | + C "github.com/sagernet/sing-box/constant" |
| 13 | + "github.com/sagernet/sing-box/log" |
| 14 | + "github.com/sagernet/sing-box/option" |
| 15 | + E "github.com/sagernet/sing/common/exceptions" |
| 16 | + M "github.com/sagernet/sing/common/metadata" |
| 17 | + N "github.com/sagernet/sing/common/network" |
| 18 | + "github.com/sagernet/sing/common/task" |
| 19 | +) |
| 20 | + |
| 21 | +type ShadowTLS struct { |
| 22 | + myInboundAdapter |
| 23 | + handshakeDialer N.Dialer |
| 24 | + handshakeAddr M.Socksaddr |
| 25 | +} |
| 26 | + |
| 27 | +func NewShadowTLS(ctx context.Context, router adapter.Router, logger log.ContextLogger, tag string, options option.ShadowTLSInboundOptions) (*ShadowTLS, error) { |
| 28 | + inbound := &ShadowTLS{ |
| 29 | + myInboundAdapter: myInboundAdapter{ |
| 30 | + protocol: C.TypeShadowTLS, |
| 31 | + network: []string{N.NetworkTCP}, |
| 32 | + ctx: ctx, |
| 33 | + router: router, |
| 34 | + logger: logger, |
| 35 | + tag: tag, |
| 36 | + listenOptions: options.ListenOptions, |
| 37 | + }, |
| 38 | + handshakeDialer: dialer.New(router, options.Handshake.DialerOptions), |
| 39 | + handshakeAddr: options.Handshake.ServerOptions.Build(), |
| 40 | + } |
| 41 | + inbound.connHandler = inbound |
| 42 | + return inbound, nil |
| 43 | +} |
| 44 | + |
| 45 | +func (s *ShadowTLS) NewConnection(ctx context.Context, conn net.Conn, metadata adapter.InboundContext) error { |
| 46 | + handshakeConn, err := s.handshakeDialer.DialContext(ctx, N.NetworkTCP, s.handshakeAddr) |
| 47 | + if err != nil { |
| 48 | + return err |
| 49 | + } |
| 50 | + var handshake task.Group |
| 51 | + handshake.Append("client handshake", func(ctx context.Context) error { |
| 52 | + return s.copyUntilHandshakeFinished(handshakeConn, conn) |
| 53 | + }) |
| 54 | + handshake.Append("server handshake", func(ctx context.Context) error { |
| 55 | + return s.copyUntilHandshakeFinished(conn, handshakeConn) |
| 56 | + }) |
| 57 | + handshake.FastFail() |
| 58 | + err = handshake.Run(ctx) |
| 59 | + if err != nil { |
| 60 | + return err |
| 61 | + } |
| 62 | + return s.newConnection(ctx, conn, metadata) |
| 63 | +} |
| 64 | + |
| 65 | +func (s *ShadowTLS) copyUntilHandshakeFinished(dst io.Writer, src io.Reader) error { |
| 66 | + const handshake = 0x16 |
| 67 | + const changeCipherSpec = 0x14 |
| 68 | + var hasSeenChangeCipherSpec bool |
| 69 | + var tlsHdr [5]byte |
| 70 | + for { |
| 71 | + _, err := io.ReadFull(src, tlsHdr[:]) |
| 72 | + if err != nil { |
| 73 | + return err |
| 74 | + } |
| 75 | + length := binary.BigEndian.Uint16(tlsHdr[3:]) |
| 76 | + _, err = io.Copy(dst, io.MultiReader(bytes.NewReader(tlsHdr[:]), io.LimitReader(src, int64(length)))) |
| 77 | + if err != nil { |
| 78 | + return err |
| 79 | + } |
| 80 | + if tlsHdr[0] != handshake { |
| 81 | + if tlsHdr[0] != changeCipherSpec { |
| 82 | + return E.New("unexpected tls frame type: ", tlsHdr[0]) |
| 83 | + } |
| 84 | + if !hasSeenChangeCipherSpec { |
| 85 | + hasSeenChangeCipherSpec = true |
| 86 | + continue |
| 87 | + } |
| 88 | + } |
| 89 | + if hasSeenChangeCipherSpec { |
| 90 | + return nil |
| 91 | + } |
| 92 | + } |
| 93 | +} |
0 commit comments