From dbdb8ef472b78b4d23b57eb3e3b16ce77db390a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E4=B8=96=E7=95=8C?= Date: Mon, 3 Apr 2023 07:26:16 +0800 Subject: [PATCH] draft --- adapter/mitm.go | 5 -- mitm/engine.go | 13 ++++ mitm/http.go | 135 +++++++++++++++++++++++++++++++++ mitm/http_surge_url_rewrite.go | 74 ++++++++++++++++++ mitm/service.go | 46 +++++++---- option/mitm.go | 18 +++-- 6 files changed, 264 insertions(+), 27 deletions(-) create mode 100644 mitm/engine.go create mode 100644 mitm/http.go create mode 100644 mitm/http_surge_url_rewrite.go diff --git a/adapter/mitm.go b/adapter/mitm.go index b0181739..d3219ca4 100644 --- a/adapter/mitm.go +++ b/adapter/mitm.go @@ -2,7 +2,6 @@ package adapter import ( "context" - "crypto/tls" "net" N "github.com/sagernet/sing/common/network" @@ -12,7 +11,3 @@ type MITMService interface { Service ProcessConnection(ctx context.Context, conn net.Conn, dialer N.Dialer, metadata InboundContext) (net.Conn, error) } - -type TLSOutbound interface { - NewTLSConnection(ctx context.Context, conn net.Conn, tlsConfig *tls.Config, metadata InboundContext) error -} diff --git a/mitm/engine.go b/mitm/engine.go new file mode 100644 index 00000000..75c27195 --- /dev/null +++ b/mitm/engine.go @@ -0,0 +1,13 @@ +package mitm + +import ( + "context" + "crypto/tls" + "net" + + "github.com/sagernet/sing-box/adapter" +) + +type Engine interface { + ProcessConnection(ctx context.Context, clientConn net.Conn, serverConn *tls.Conn, metadata adapter.InboundContext) (net.Conn, error) +} diff --git a/mitm/http.go b/mitm/http.go new file mode 100644 index 00000000..400724a9 --- /dev/null +++ b/mitm/http.go @@ -0,0 +1,135 @@ +package mitm + +import ( + std_bufio "bufio" + "context" + "crypto/tls" + "github.com/sagernet/sing-box/adapter" + C "github.com/sagernet/sing-box/constant" + "github.com/sagernet/sing-box/option" + "github.com/sagernet/sing/common/buf" + "github.com/sagernet/sing/common/bufio" + E "github.com/sagernet/sing/common/exceptions" + "github.com/sagernet/sing/common/logger" + M "github.com/sagernet/sing/common/metadata" + "golang.org/x/net/http2" + "golang.org/x/net/http2/h2c" + "io" + "net" + "net/http" + "os" +) + +var _ Engine = (*HTTPEngine)(nil) + +type HTTPEngine struct { + logger logger.ContextLogger + urlRewriteRules []HTTPHandlerFunc +} + +func NewHTTPEngine(logger logger.ContextLogger, options option.MITMHTTPOptions) (*HTTPEngine, error) { + engine := &HTTPEngine{ + logger: logger, + } + for i, urlRewritePath := range options.URLRewritePath { + urlRewriteFile, err := os.Open(C.BasePath(urlRewritePath)) + if err != nil { + return nil, E.Cause(err, "read url rewrite configuration[", i, "]") + } + urlRewriteRules, err := readSurgeURLRewriteRules(urlRewriteFile) + if err != nil { + return nil, E.Cause(err, "read url rewrite configuration[", i, "] at ", urlRewritePath) + } + engine.urlRewriteRules = append(engine.urlRewriteRules, urlRewriteRules...) + } + return engine, nil +} + +func (e *HTTPEngine) ProcessConnection(ctx context.Context, clientConn net.Conn, serverConn *tls.Conn, metadata adapter.InboundContext) (net.Conn, error) { + buffer := buf.NewPacket() + httpRequest, err := http.ReadRequest(std_bufio.NewReader(io.TeeReader(clientConn, buffer))) + if err != nil { + return nil, err + } + e.logger.DebugContext(ctx, "HTTP ", httpRequest.Method, " ", httpRequest.URL.String(), " ", httpRequest.Proto) + var httpServer http.Server + var handled bool + httpConn := &httpMITMConn{Conn: bufio.NewCachedConn(clientConn, buffer.ToOwned()), readOnly: true} + processCtx, cancel := context.WithCancel(ctx) + httpServer.Handler = http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) { + if request.Method == "PRI" && len(request.Header) == 0 && request.URL.Path == "*" && request.Proto == "HTTP/2.0" { + httpConn.readOnly = false + h2c.NewHandler(httpServer.Handler, new(http2.Server)).ServeHTTP(writer, request) + return + } + defer cancel() + httpConn.readOnly = false + url := *request.URL + url.Scheme = "https" + url.Host = request.Host + urlString := url.String() + for _, rule := range e.urlRewriteRules { + if rule(writer, request, urlString) { + handled = true + break + } + } + if !handled { + httpConn.readOnly = true + } + }) + _ = httpServer.Serve(&fixedListener{conn: httpConn}) + <-processCtx.Done() + if !handled { + if !httpConn.readOnly { + return nil, E.New("http2 description failed") + } + return bufio.NewCachedConn(clientConn, buffer), nil + } + serverConn.Close() + buffer.Release() + return nil, nil +} + +type httpMITMConn struct { + net.Conn + readOnly bool + closed bool +} + +func (c *httpMITMConn) Write(p []byte) (n int, err error) { + if c.readOnly { + return 0, os.ErrInvalid + } + return c.Conn.Write(p) +} + +func (c *httpMITMConn) Close() error { + c.closed = true + return nil +} + +func (c *httpMITMConn) Upstream() any { + return c.Conn +} + +type fixedListener struct { + conn net.Conn +} + +func (l *fixedListener) Accept() (net.Conn, error) { + conn := l.conn + l.conn = nil + if conn != nil { + return conn, nil + } + return nil, os.ErrClosed +} + +func (l *fixedListener) Addr() net.Addr { + return M.Socksaddr{} +} + +func (l *fixedListener) Close() error { + return nil +} diff --git a/mitm/http_surge_url_rewrite.go b/mitm/http_surge_url_rewrite.go new file mode 100644 index 00000000..32b3859c --- /dev/null +++ b/mitm/http_surge_url_rewrite.go @@ -0,0 +1,74 @@ +package mitm + +import ( + "bufio" + "errors" + "io" + "net/http" + "os" + "regexp" + "strings" + + E "github.com/sagernet/sing/common/exceptions" +) + +type HTTPHandlerFunc func(writer http.ResponseWriter, request *http.Request, urlString string) bool + +func readSurgeURLRewriteRules(file *os.File) ([]HTTPHandlerFunc, error) { + defer file.Close() + reader := bufio.NewReader(file) + var handlers []HTTPHandlerFunc + for { + lineBytes, _, err := reader.ReadLine() + if errors.Is(err, io.EOF) { + break + } else if err != nil { + return nil, err + } + ruleLine := strings.TrimSpace(string(lineBytes)) + if ruleLine == "" || ruleLine[0] == '#' { + continue + } + ruleParts := strings.Split(ruleLine, " ") + if len(ruleParts) != 3 { + return nil, E.New("invalid surge url rewrite line: ", ruleLine) + } + urlRegex, err := regexp.Compile(ruleParts[0]) + if err != nil { + return nil, E.Cause(err, "invalid surge url rewrite line (bad regex): ", ruleLine) + } + switch ruleParts[2] { + case "reject": + handlers = append(handlers, surgeURLRewriteReject(urlRegex)) + case "header": + // TODO: support header redirect + fallthrough + case "302": + handlers = append(handlers, surgeURLRewrite302(urlRegex, ruleParts[1])) + default: + return nil, E.Cause(err, "invalid surge url rewrite line (unknown acton): ", ruleLine) + } + } + return handlers, nil +} + +func surgeURLRewriteReject(urlRegex *regexp.Regexp) HTTPHandlerFunc { + return func(writer http.ResponseWriter, request *http.Request, urlString string) bool { + if !urlRegex.MatchString(urlString) { + return false + } + writer.WriteHeader(404) + return true + } +} + +func surgeURLRewrite302(urlRegex *regexp.Regexp, rewriteURL string) HTTPHandlerFunc { + return func(writer http.ResponseWriter, request *http.Request, urlString string) bool { + if !urlRegex.MatchString(urlString) { + return false + } + // use 307 to keep method + http.RedirectHandler(rewriteURL, http.StatusTemporaryRedirect).ServeHTTP(writer, request) + return true + } +} diff --git a/mitm/service.go b/mitm/service.go index aff49d32..06b955a2 100644 --- a/mitm/service.go +++ b/mitm/service.go @@ -32,6 +32,7 @@ type Service struct { keyPath string watcher *fsnotify.Watcher insecure bool + engines []Engine } func NewService(router adapter.Router, logger logger.ContextLogger, options option.MITMServiceOptions) (*Service, error) { @@ -80,6 +81,14 @@ func NewService(router adapter.Router, logger logger.ContextLogger, options opti insecure: options.Insecure, } + if options.HTTP != nil && options.HTTP.Enabled { + engine, err := NewHTTPEngine(logger, common.PtrValueOrDefault(options.HTTP)) + if err != nil { + return nil, err + } + service.engines = append(service.engines, engine) + } + return service, nil } @@ -119,25 +128,30 @@ func (s *Service) ProcessConnection(ctx context.Context, conn net.Conn, dialer N if err != nil { return nil, N.HandshakeFailure(conn, err) } - clientConn := tls.Server(bufio.NewCachedConn(conn, buffer), &tls.Config{ - GetConfigForClient: func(info *tls.ClientHelloInfo) (*tls.Config, error) { - var serverConfig tls.Config - serverConfig.Time = s.router.TimeFunc() - if serverConn.ConnectionState().NegotiatedProtocol != "" { - serverConfig.NextProtos = []string{serverConn.ConnectionState().NegotiatedProtocol} - } - serverConfig.ServerName = clientHello.ServerName - serverConfig.MinVersion = tls.VersionTLS10 - serverConfig.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) { - return sTLS.GenerateKeyPair(nil, serverConfig.ServerName, s.tlsCertificate) - } - return &serverConfig, nil - }, - }) - err = clientConn.HandshakeContext(ctx) + var serverConfig tls.Config + serverConfig.Time = s.router.TimeFunc() + if serverConn.ConnectionState().NegotiatedProtocol != "" { + serverConfig.NextProtos = []string{serverConn.ConnectionState().NegotiatedProtocol} + } + serverConfig.ServerName = clientHello.ServerName + serverConfig.MinVersion = tls.VersionTLS10 + serverConfig.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) { + return sTLS.GenerateKeyPair(nil, serverConfig.ServerName, s.tlsCertificate) + } + + clientTLSConn := tls.Server(bufio.NewCachedConn(conn, buffer), &serverConfig) + err = clientTLSConn.HandshakeContext(ctx) if err != nil { return nil, E.Cause(err, "mitm TLS handshake") } + + var clientConn net.Conn = clientTLSConn + for _, engine := range s.engines { + clientConn, err = engine.ProcessConnection(ctx, clientTLSConn, serverConn, metadata) + if conn == nil { + return nil, err + } + } s.logger.DebugContext(ctx, "mitm TLS handshake success") return nil, bufio.CopyConn(ctx, clientConn, serverConn) } diff --git a/option/mitm.go b/option/mitm.go index ff3db2db..2159da18 100644 --- a/option/mitm.go +++ b/option/mitm.go @@ -1,10 +1,16 @@ package option type MITMServiceOptions struct { - Enabled bool `json:"enabled,omitempty"` - Insecure bool `json:"insecure,omitempty"` - Certificate string `json:"certificate,omitempty"` - CertificatePath string `json:"certificate_path,omitempty"` - Key string `json:"key,omitempty"` - KeyPath string `json:"key_path,omitempty"` + Enabled bool `json:"enabled,omitempty"` + Insecure bool `json:"insecure,omitempty"` + Certificate string `json:"certificate,omitempty"` + CertificatePath string `json:"certificate_path,omitempty"` + Key string `json:"key,omitempty"` + KeyPath string `json:"key_path,omitempty"` + HTTP *MITMHTTPOptions `json:"http,omitempty"` +} + +type MITMHTTPOptions struct { + Enabled bool `json:"enabled,omitempty"` + URLRewritePath []string `json:"url_rewrite_path,omitempty"` }