mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-09-07 18:57:14 +00:00
Kuzz007
58671533bb
New internal/amneziawgnet package: builds a real amneziawg-go Device over a gVisor netstack from an existing amneziawg.Instance, with a TCP/UDP forwarder that recovers each tunnel connection's real destination and a peer-identity index keyed by AllowedIPs. This is the foundation for migrating AmneziaWG off the kernel-module+TPROXY path (see the AmneziaWG-go vs kernel-module decision) -- nothing wires into live traffic yet, that's Phase 2 (relay into Xray's own SOCKS5 inbound). Covered by three real end-to-end tests: a genuine handshake + TCP forwarder + identity resolution, the same for UDP (including a reply routed back through the tunnel), and the manager's reconfigure-in-place vs. rebuild lifecycle. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
44 lines
1.5 KiB
Go
44 lines
1.5 KiB
Go
package amneziawgnet
|
|
|
|
import (
|
|
"net/netip"
|
|
|
|
"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
|
|
"gvisor.dev/gvisor/pkg/tcpip/stack"
|
|
"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
|
|
"gvisor.dev/gvisor/pkg/waiter"
|
|
)
|
|
|
|
// AttachTCPForwarder attaches a TCP forwarder to gstack in promiscuous +
|
|
// spoofing mode, so it accepts connections addressed to any destination --
|
|
// not just the stack's own configured local address -- and hands the
|
|
// handler both the accepted connection and the tunnel client's real,
|
|
// dynamically-arbitrary destination (recovered from the connection's own
|
|
// TransportEndpointID, not from any preconfigured routing table). This is
|
|
// the mechanism the whole embedded-AmneziaWG design depends on: what the
|
|
// handler does with that destination (dial it directly, relay it into
|
|
// Xray's SOCKS5 inbound, ...) is entirely up to the caller.
|
|
//
|
|
// Adapted from xtls/xray-core's proxy/wireguard/tun.go createForwarder (MIT).
|
|
func AttachTCPForwarder(gstack *stack.Stack, handler func(conn *gonet.TCPConn, dest netip.AddrPort)) {
|
|
enablePromiscuousRouting(gstack)
|
|
|
|
fwd := tcp.NewForwarder(gstack, 0, 65535, func(r *tcp.ForwarderRequest) {
|
|
go func(r *tcp.ForwarderRequest) {
|
|
var wq waiter.Queue
|
|
id := r.ID()
|
|
|
|
ep, err := r.CreateEndpoint(&wq)
|
|
if err != nil {
|
|
r.Complete(true)
|
|
return
|
|
}
|
|
dest := netip.AddrPortFrom(addrFromTcpip(id.LocalAddress), id.LocalPort)
|
|
handler(gonet.NewTCPConn(&wq, ep), dest)
|
|
ep.Close()
|
|
r.Complete(false)
|
|
}(r)
|
|
})
|
|
gstack.SetTransportProtocolHandler(tcp.ProtocolNumber, fwd.HandlePacket)
|
|
}
|