Skip to content

G
gost
Commit 037a79a0 authored by rui.zheng's avatar rui.zheng
Browse files
Options

gost v2.0 init

parent 82e624d8
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 864 additions and 1500 deletions
LICENSE deleted 100644 → 0
View file @ 82e624d8
The MIT License (MIT)
Copyright (c) 2014 郑锐
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
README.md deleted 100644 → 0
View file @ 82e624d8
gost - GO Simple Tunnel
====
### GO语言实现的安全隧道
#### 特性
1. 支持设置上层代理(客户端，服务器端均可)，支持上层代理认证。
2. 客户端可用作http(s), socks5代理。
3. 服务器端兼容标准的socks5协议, 可直接用作socks5代理, 并额外增加协商加密功能。
4. Tunnel UDP over TCP, UDP数据包使用TCP通道传输，以解决防火墙的限制。
5. 多种加密方式(tls,aes-256-cfb,des-cfb,rc4-md5等)。
6. 客户端兼容shadowsocks协议，可作为shadowsocks服务器。
二进制文件下载：https://github.com/ginuerzh/gost/releases
Google讨论组: https://groups.google.com/d/forum/go-gost
#### 版本更新
##### v1.8
* 支持tls tunnel(-tls参数)，直接使用tls进行加密传输
##### v1.7
* 支持认证功能，当作为http(s)代理时使用Basic Auth认证方式，当作为标准socks5代理时使用Username/Password认证方式
###### Bug fix:
* 修正当作为http代理时，POST请求出错问题
##### v1.6
* 增加tls-auth加密方式，此方式必须设置认证密码(-p参数)，原tls加密方式与v1.3版以前兼容
###### Bug fix:
* 修正当不设置上层代理时，连接出错问题
##### v1.5
* 支持设置上层socks5代理(注: http tunnel不支持)
* 支持上层代理认证
##### V1.4
* 支持http tunnel(-http参数)，使用http协议来传输数据(注: 效率低，非特殊情况下，不推荐使用)。
##### v1.3
* tls加密方式增加密码认证功能(与旧版本不兼容)
* 增加版本查看(-v参数)
* -p参数的默认值修改为空
##### v1.2
* websocket tunnel增加加密功能。
##### v1.1
* 支持websocket tunnel(-ws参数)，使用websocket协议来传输数据。
#### 参数说明
> -L=":8080": listen address
> -P="": proxy for forward
> -S="": the server that connect to
> -cert="": tls cert file
> -key="": tls key file
> -m="": tunnel cipher method
> -p="": tunnel cipher password
> -sm="rc4-md5": shadowsocks cipher method
> -sp="ginuerzh@gmail.com": shadowsocks cipher password
> -ss=false: run as shadowsocks server
> -tls=false: use ssl/tls tunnel
> -ws=false: use websocket tunnel
> -http=false: use http tunnel
> -v=false: print version
#### 使用方法
##### 基本用法
* 客户端: `gost -L=:8899 -S=server_ip:8080`
* 服务器: `gost -L=:8080`
##### 设置认证信息
* 客户端: `gost -L=admin:123456@:8899 -S=server_ip:8080`
* 服务器: `gost -L=admin:123456@:8080`
注：当服务器端设置了认证，默认的无加密模式(-m为空)不可用，
即客户端或者使用认证方式(标准socks5模式)，或者设置加密方式(gost兼容模式)。
##### 设置加密
* 客户端: `gost -L=:8899 -S=server_ip:8080 -m=rc4-md5 -p=123456`
* 服务器: `gost -L=:8080 -m=rc4-md5 -p=123456`
##### 设置上层代理
* http代理: `gost -L=:8899 -P=http://127.0.0.1:8080`
* http代理(需认证): `gost -L=:8899 -P=http://admin:123456@127.0.0.1:8080`
* socks5代理: `gost -L=:8899 -P=socks://127.0.0.1:1080`
* socks5代理(需认证): `gost -L=:8899 -P=socks://admin:123456@127.0.0.1:1080`
##### 使用tls tunnel (推荐)
* 客户端: `gost -L=:8899 -S=server_ip:8080 -tls`
* 服务器: `gost -L=:8080 -tls`
注: 可通过-key, -cert参数手动指定自己的公钥与私钥文件。
##### 使用websocket tunnel
* 客户端: `gost -L=:8899 -S=server_ip:8080 -ws`
* 服务器: `gost -L=:8080 -ws`
##### 使用http tunnel
* 客户端: `gost -L=:8899 -S=server_ip:8080 -http`
* 服务器: `gost -L=:8080 -http`
注：websocket方式优先级高于http方式，即当-ws与-http参数同时存在时，-http参数无效。
##### 作为shadowsocks服务器
gost支持作为shadowsocks服务器运行(-ss参数)，这样就可以让android手机通过shadowsocks客户端(影梭)使用代理了。
###### 相关参数
> -ss 开启shadowsocks模式
> -sm 设置shadowsocks加密方式(默认为rc4-md5)
> -sp 设置shadowsocks加密密码(默认为ginuerzh@gmail.com)
当无-ss参数时，-sm, -sp参数无效。以上三个参数对服务端无效。
###### 相关命令
* 客户端: `gost -L :8899 -S server_ip:port -sm=rc4-md5 -sp=ginuerzh@gmail.com -ss`
* 服务器: 无需特殊设置，shadowsocks模式只与客户端有关，与服务端无关。
在手机的shadowsocks软件中设置好服务器IP(运行gost客户端电脑的IP)，端口(8899)，加密方法和密码就可以使用了。
注：shadowsocks模式与正常模式是不兼容的，当作为shadowsocks模式使用时(有-ss参数)，浏览器不能使用。
#### tunnel加密说明
##### 目前支持的加密方法
tls, tls-auth, aes-128-cfb, aes-192-cfb, aes-256-cfb, des-cfb, bf-cfb, cast5-cfb, rc4-md5, rc4, table
##### Client
Client端通过-m参数设置加密方式，默认为不加密(-m参数为空)。
如果设置的加密方式不被支持，则默认为不加密。
当设置的加密方式为tls时，-p参数无效。
当设置的加密方式为非tls时，通过-p参数设置加密密码，且不能为空；-p参数必须与Server端的-p参数相同。
##### Server
Server端通过-m参数设置加密方式，默认为不加密(-m参数为空)。
如果设置的加密方式不被支持，默认为不处理。
如果没有设置加密方式(-m参数为空)，则由client端控制加密方式，即client端可通过-m参数指定Server端使用哪种加密方式。
如果设置了加密方式(-m参数不为空)，client端必须使用与Server端相同的加密方式。
当设置的加密方式为tls，tls-auth时，-key参数可手动指定公钥文件，-cert参数可手动指定私钥文件，如果未指定，则使用默认的公钥与私钥。
当设置的加密方式为tls时，-p参数无效；为tls-auth时，通过-p参数设置认证密码，且不能为空。
当设置的加密方式为非tls，tls-auth时，-key，-cert参数无效；通过-p参数设置加密密码，且不能为空。
cert2.pem 0 → 100644
View file @ 037a79a0
-----BEGIN CERTIFICATE-----
MIIC5jCCAdCgAwIBAgIBADALBgkqhkiG9w0BAQUwEjEQMA4GA1UEChMHQWNtZSBD
bzAeFw0xNDAzMTcwNjIwNTFaFw0xNTAzMTcwNjIwNTFaMBIxEDAOBgNVBAoTB0Fj
bWUgQ28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDccNO1xmd4lWSf
d/0/QS3E93cYIWHw831i/IKxigdRD/XMZonLdEHywW6lOiXazaP8e6CqPGSmnl0x
5k/3dvGCMj2JCVxM6+z7NpL+AiwvXmvkj/TOciCgwqssCwYS2CiVwjfazRjx1ZUJ
VDC5qiyRsfktQ2fVHrpnJGVSRagmiQgwGWBilVG9B8QvRtpQKN/GQGq17oIQm8aK
kOdPt93g93ojMIg7YJpgDgOirvVz/hDn7YD4ryrtPos9CMafFkJprymKpRHyvz7P
8a3+OkuPjFjPnwOHQ5u1U3+8vC44vfb1ExWzDLoT8Xp8Gndx39k0f7MVOol3GnYu
MN/dvNUdAgMBAAGjSzBJMA4GA1UdDwEB/wQEAwIAoDATBgNVHSUEDDAKBggrBgEF
BQcDATAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDALBgkqhkiG
9w0BAQUDggEBAIG8CJqvTIgJnNOK+i5/IUc/3yF/mSCWuG8qP+Fmo2t6T0PVOtc0
8wiWH5iWtCAhjn0MRY9l/hIjWm6gUZGHCGuEgsOPpJDYGoNLjH9Xwokm4y3LFNRK
UBrrrDbKRNibApBHCapPf6gC5sXcjOwx7P2/kiHDgY7YH47jfcRhtAPNsM4gjsEO
RmwENY+hRUFHIRfQTyalqND+x6PWhRo3K6hpHs4DQEYPq4P2kFPqUqSBymH+Ny5/
BcQ3wdMNmC6Bm/oiL1QV0M+/InOsAgQk/EDd0kmoU1ZT2lYHQduGmP099bOlHNpS
uqO3vXF3q8SPPr/A9TqSs7BKkBQbe0+cdsA=
-----END CERTIFICATE-----
client.go deleted 100644 → 0
View file @ 82e624d8
This diff is collapsed.
conn.go 0 → 100644
View file @ 037a79a0
package main
import (
"bufio"
"crypto/tls"
"github.com/ginuerzh/gosocks5"
"github.com/golang/glog"
"io"
"net"
"net/http"
)
func listenAndServe(arg Args) error {
var ln net.Listener
var err error
switch arg.Transport {
case "ws": // websocket connection
err = NewWs(arg).ListenAndServe()
if err != nil {
if glog.V(LFATAL) {
glog.Errorln(err)
}
}
return err
case "tls": // tls connection
ln, err = tls.Listen("tcp", arg.Addr,
&tls.Config{Certificates: []tls.Certificate{arg.Cert}})
default:
ln, err = net.Listen("tcp", arg.Addr)
}
if err != nil {
if glog.V(LFATAL) {
glog.Errorln(err)
}
return err
}
defer ln.Close()
for {
conn, err := ln.Accept()
if err != nil {
if glog.V(LWARNING) {
glog.Warningln(err)
}
continue
}
if glog.V(LINFO) {
glog.Infoln("accept", conn.RemoteAddr())
}
go handleConn(conn, arg)
}
return nil
}
func handleConn(conn net.Conn, arg Args) {
defer conn.Close()
selector := &serverSelector{
methods: []uint8{
gosocks5.MethodNoAuth, gosocks5.MethodUserPass,
MethodTLS, MethodTLSAuth,
},
arg: arg,
}
switch arg.Protocol {
case "ss": // shadowsocks
return
case "http":
req, err := http.ReadRequest(bufio.NewReader(conn))
if err != nil {
if glog.V(LWARNING) {
glog.Warningln(err)
}
return
}
handleHttpRequest(req, conn, arg)
return
case "socks", "socks5":
conn = gosocks5.ServerConn(conn, selector)
req, err := gosocks5.ReadRequest(conn)
if err != nil {
if glog.V(LWARNING) {
glog.Warningln("socks5:", err)
}
return
}
handleSocks5Request(req, conn, arg)
return
}
// http + socks5
b := make([]byte, 16*1024)
n, err := io.ReadAtLeast(conn, b, 2)
if err != nil {
if glog.V(LWARNING) {
glog.Warningln(err)
}
return
}
if b[0] == gosocks5.Ver5 {
mn := int(b[1]) // methods count
length := 2 + mn
if n < length {
if _, err := io.ReadFull(conn, b[n:length]); err != nil {
if glog.V(LWARNING) {
glog.Warningln("socks5:", err)
}
return
}
}
methods := b[2 : 2+mn]
method := selector.Select(methods...)
if _, err := conn.Write([]byte{gosocks5.Ver5, method}); err != nil {
if glog.V(LWARNING) {
glog.Warningln("socks5:", err)
}
return
}
c, err := selector.OnSelected(method, conn)
if err != nil {
if glog.V(LWARNING) {
glog.Warningln("socks5:", err)
}
return
}
conn = c
req, err := gosocks5.ReadRequest(conn)
if err != nil {
if glog.V(LWARNING) {
glog.Warningln("socks5:", err)
}
return
}
handleSocks5Request(req, conn, arg)
return
}
req, err := http.ReadRequest(bufio.NewReader(newReqReader(b[:n], conn)))
if err != nil {
if glog.V(LWARNING) {
glog.Warningln(err)
}
return
}
handleHttpRequest(req, conn, arg)
}
type reqReader struct {
b []byte
r io.Reader
}
func newReqReader(b []byte, r io.Reader) *reqReader {
return &reqReader{
b: b,
r: r,
}
}
func (r *reqReader) Read(p []byte) (n int, err error) {
if len(r.b) == 0 {
return r.r.Read(p)
}
n = copy(p, r.b)
r.b = r.b[n:]
return
}
http.go
View file @ 037a79a0
package main package main
import ( import (
"bufio" "encoding/base64"
"bytes" "github.com/golang/glog"
"code.google.com/p/go-uuid/uuid"
"errors"
"github.com/ginuerzh/gosocks5"
"io"
"io/ioutil"
"log"
"net" "net"
"net/http" "net/http"
"net/url" "net/http/httputil"
"time" "strings"
) )
const ( func handleHttpRequest(req *http.Request, conn net.Conn, arg Args) {
s2cUri = "/s2c" if glog.V(LDEBUG) {
c2sUri = "/c2s" dump, err := httputil.DumpRequest(req, false)
) if err != nil {
glog.Infoln(err)
type HttpClientConn struct { } else {
c net.Conn glog.Infoln(string(dump))
token string
r io.ReadCloser
}
func NewHttpClientConn(conn net.Conn) *HttpClientConn {
return &HttpClientConn{
c: conn,
}
}
func (conn *HttpClientConn) Handshake() (err error) {
//log.Println("remote", conn.c.RemoteAddr().String())
req := &http.Request{
Method: "GET",
URL: &url.URL{
Host: Saddr,
Scheme: "http",
Path: s2cUri,
},
Header: make(http.Header),
}
if proxyURL == nil {
err = req.Write(conn.c)
} else {
setBasicAuth(req)
err = req.WriteProxy(conn.c)
}
if err != nil {
return err
}
resp, err := http.ReadResponse(bufio.NewReader(conn.c), req)
if err != nil {
return err
}
if resp.StatusCode != http.StatusOK {
return errors.New(resp.Status)
}
b := make([]byte, 36)
if _, err = io.ReadFull(resp.Body, b); err != nil {
return err
}
if uuid.Parse(string(b)) == nil {
return errors.New("Handshake: wrong token")
}
conn.token = string(b)
conn.r = resp.Body
//log.Println(conn.token, "connected")
return nil
}
func (conn *HttpClientConn) Read(b []byte) (n int, err error) {
n, err = conn.r.Read(b)
//log.Println("http r:", n)
return
}
func (conn *HttpClientConn) Write(b []byte) (n int, err error) {
q := url.Values{}
q.Set("token", conn.token)
req := &http.Request{
Method: "POST",
Body: ioutil.NopCloser(bytes.NewReader(b)),
ContentLength: int64(len(b)),
URL: &url.URL{
Host: Saddr,
Scheme: "http",
Path: c2sUri,
RawQuery: q.Encode(),
},
Header: make(http.Header),
}
resp, err := doRequest(req)
if err != nil {
log.Println(err)
return
}
resp.Body.Close()
if resp.StatusCode != http.StatusOK {
//log.Println(resp.Status)
return 0, errors.New(resp.Status)
}
//log.Println("http w:", len(b))
return len(b), nil
}
func (conn *HttpClientConn) Close() error {
conn.Write(nil)
return conn.r.Close()
}
func (conn *HttpClientConn) LocalAddr() net.Addr {
return conn.c.LocalAddr()
}
func (conn *HttpClientConn) RemoteAddr() net.Addr {
return conn.c.RemoteAddr()
}
func (conn *HttpClientConn) SetDeadline(t time.Time) error {
return conn.c.SetDeadline(t)
}
func (conn *HttpClientConn) SetReadDeadline(t time.Time) error {
return conn.c.SetReadDeadline(t)
}
func (conn *HttpClientConn) SetWriteDeadline(t time.Time) error {
return conn.c.SetWriteDeadline(t)
}
type HttpServerConn struct {
w http.ResponseWriter
c chan []byte
closed bool
rb []byte
}
func NewHttpServerConn(w http.ResponseWriter, c chan []byte) *HttpServerConn {
return &HttpServerConn{
w: w,
c: c,
}
}
func (conn *HttpServerConn) Read(b []byte) (n int, err error) {
if len(conn.rb) == 0 {
var ok bool
if conn.rb, ok = <-conn.c; !ok {
return 0, io.EOF
} }
} }
n = copy(b, conn.rb)
conn.rb = conn.rb[n:]
//log.Println("http r:", n)
return
}
func (conn *HttpServerConn) Write(b []byte) (n int, err error) {
n, err = conn.w.Write(b)
if f, ok := conn.w.(http.Flusher); ok {
f.Flush()
}
//log.Println("http w:", n)
return
}
func (conn *HttpServerConn) Close() error { var username, password string
if !conn.closed { if arg.User != nil {
close(conn.c) username = arg.User.Username()
conn.closed = true password, _ = arg.User.Password()
} }
return nil
}
func (conn *HttpServerConn) LocalAddr() net.Addr {
return nil
}
func (conn *HttpServerConn) RemoteAddr() net.Addr { u, p, _ := proxyBasicAuth(req.Header.Get("Proxy-Authorization"))
return nil req.Header.Del("Proxy-Authorization")
}
func (conn *HttpServerConn) SetDeadline(t time.Time) error { if (username != "" && u != username) || (password != "" && p != password) {
return nil resp := "HTTP/1.1 407 Proxy Authentication Required\r\n" +
} "Proxy-Authenticate: Basic realm=\"gost\"\r\n" +
"Proxy-Agent: gost/" + Version + "\r\n\r\n"
func (conn *HttpServerConn) SetReadDeadline(t time.Time) error { if _, err := conn.Write([]byte(resp)); err != nil {
return nil if glog.V(LWARNING) {
} glog.Warningln(err)
}
func (conn *HttpServerConn) SetWriteDeadline(t time.Time) error { }
return nil if glog.V(LDEBUG) {
} glog.Infoln(resp)
}
type HttpServer struct { if glog.V(LWARNING) {
Addr string glog.Warningln("http: proxy authentication required")
conns map[string]*HttpServerConn }
}
func (s *HttpServer) s2c(w http.ResponseWriter, r *http.Request) {
token := uuid.New()
ch := make(chan []byte, 8)
conn := NewHttpServerConn(w, ch)
if _, err := conn.Write([]byte(token)); err != nil {
return return
} }
s.conns[token] = conn
defer delete(s.conns, token)
serveSocks5(gosocks5.ServerConn(conn, serverConfig))
} }
func (s *HttpServer) c2s(w http.ResponseWriter, r *http.Request) { func proxyBasicAuth(authInfo string) (username, password string, ok bool) {
defer func() { if authInfo == "" {
if err := recover(); err != nil {
log.Println(err)
}
}()
if r.Method != "POST" {
w.WriteHeader(http.StatusMethodNotAllowed)
return return
} }
token := r.FormValue("token") if !strings.HasPrefix(authInfo, "Basic ") {
conn := s.conns[token]
if conn == nil {
w.WriteHeader(http.StatusBadRequest)
return return
} }
b, err := ioutil.ReadAll(r.Body) c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(authInfo, "Basic "))
if err != nil || len(b) == 0 { if err != nil {
conn.Close()
delete(s.conns, token)
//log.Println(token, "disconnected")
return return
} }
conn.c <- b cs := string(c)
} s := strings.IndexByte(cs, ':')
if s < 0 {
func (s *HttpServer) ListenAndServe() error { return
s.conns = make(map[string]*HttpServerConn)
http.HandleFunc(s2cUri, s.s2c)
http.HandleFunc(c2sUri, s.c2s)
return http.ListenAndServe(s.Addr, nil)
}
func doRequest(req *http.Request) (*http.Response, error) {
if proxyURL != nil {
c, err := dial(proxyURL.Host)
if err != nil {
log.Println(err)
return nil, err
}
defer c.Close()
setBasicAuth(req)
if err := req.WriteProxy(c); err != nil {
log.Println(err)
return nil, err
}
/*
b, err := ioutil.ReadAll(c)
if err != nil {
log.Println(err)
return nil, err
}
*/
return http.ReadResponse(bufio.NewReader(c), req)
} }
return http.DefaultClient.Do(req) return cs[:s], cs[s+1:], true
} }
key.pem 0 → 100644
View file @ 037a79a0
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA3HDTtcZneJVkn3f9P0EtxPd3GCFh8PN9YvyCsYoHUQ/1zGaJ
y3RB8sFupTol2s2j/Hugqjxkpp5dMeZP93bxgjI9iQlcTOvs+zaS/gIsL15r5I/0
znIgoMKrLAsGEtgolcI32s0Y8dWVCVQwuaoskbH5LUNn1R66ZyRlUkWoJokIMBlg
YpVRvQfEL0baUCjfxkBqte6CEJvGipDnT7fd4Pd6IzCIO2CaYA4Doq71c/4Q5+2A
+K8q7T6LPQjGnxZCaa8piqUR8r8+z/Gt/jpLj4xYz58Dh0ObtVN/vLwuOL329RMV
swy6E/F6fBp3cd/ZNH+zFTqJdxp2LjDf3bzVHQIDAQABAoIBAHal26147nQ+pHwY
jxwers3XDCjWvup7g79lfcqlKi79UiUEA6KYHm7UogMYewt7p4nb2KwH+XycvDiB
aAUf5flXpTs+6IkWauUDiLZi4PlV7uiEexUq5FjirlL0U/6MjbudX4bK4WQ4uxDc
WaV07Kw2iJFOOHLDKT0en9JaX5jtJNc4ZnE9efFoQ5jfypPWtRw65G1rULEg6nvc
GDh+1ce+4foCkpLRC9c24xAwJONZG6x3UqrSS9qfAsb73nWRQrTfUcO3nhoN8VvL
kL9skn1+S06NyUN0KoEtyRBp+RcpXSsBWAo6qZmo/WqhB/gjzWrxVwn20+yJSm35
ZsMc6QECgYEA8GS+Mp9xfB2szWHz6YTOO1Uu4lHM1ccZMwS1G+dL0KO3uGAiPdvp
woVot6v6w88t7onXsLo5pgz7SYug0CpkF3K/MRd1Ar4lH7PK7IBQ6rFr9ppVxDbx
AEWRswUoPbKCr7W6HU8LbQHDavsDlEIwc6+DiwnL4BzlKjb7RpgQEz0CgYEA6sB5
uHvx3Y5FDcGk1n73leQSAcq14l3ZLNpjrs8msoREDil/j5WmuSN58/7PGMiMgHEi
1vLm3H796JmvGr9OBvspOjHyk07ui2/We/j9Hoxm1VWhyi8HkLNDj70HKalTTFMz
RHO4O+0xCva+h9mKZrRMVktXr2jjdFn/0MYIZ2ECgYAIIsC1IeRLWQ3CHbCNlKsO
IwHlMvOFwKk/qsceXKOaOhA7szU1dr3gkXdL0Aw6mEZrrkqYdpUA46uVf54/rU+Z
445I8QxKvXiwK/uQKX+TkdGflPWWIG3jnnch4ejMvb/ihnn4B/bRB6A/fKNQXzUY
lTYUfI5j1VaEKTwz1W2l2QKBgByFCcSp+jZqhGUpc3dDsZyaOr3Q/Mvlju7uEVI5
hIAHpaT60a6GBd1UPAqymEJwivFHzW3D0NxU6VAK68UaHMaoWNfjHY9b9YsnKS2i
kE3XzN56Ks+/avHfdYPO+UHMenw5V28nh+hv5pdoZrlmanQTz3pkaOC8o3WNQZEB
nh/BAoGBAMY5z2f1pmMhrvtPDSlEVjgjELbaInxFaxPLR4Pdyzn83gtIIU14+R8X
2LPs6PPwrNjWnIgrUSVXncIFL3pa45B+Mx1pYCpOAB1+nCZjIBQmpeo4Y0dwA/XH
85EthKPvoszm+OPbyI16OcePV5ocX7lupRYuAo0pek7bomhmHWHz
-----END RSA PRIVATE KEY-----
main.go
View file @ 037a79a0
...@@ -3,75 +3,57 @@ package main ...@@ -3,75 +3,57 @@ package main
import ( import (
"flag" "flag"
"log" "github.com/golang/glog"
"net/url" "sync"
"time" )
const (
LFATAL = iota
LERROR
LWARNING
LINFO
LDEBUG
) )
var ( var (
Laddr, Saddr, Proxy string listenUrl, proxyUrl, forwardUrl string
UseWebsocket, UseHttp, UseTLS bool
Shadows bool
SMethod, SPassword string
Method, Password string
CertFile, KeyFile string
PrintVersion bool
proxyURL *url.URL listenArgs []Args
listenUrl *url.URL proxyArgs []Args
forwardArgs []Args
) )
func init() { func init() {
flag.StringVar(&Proxy, "P", "", "proxy for forward") flag.StringVar(&listenUrl, "L", ":http", "local address")
flag.StringVar(&Saddr, "S", "", "the server that connect to") flag.StringVar(&forwardUrl, "S", "", "remote address")
flag.StringVar(&Laddr, "L", ":8080", "listen address") flag.StringVar(&proxyUrl, "P", "", "proxy address")
flag.StringVar(&Method, "m", "", "tunnel cipher method")
flag.StringVar(&Password, "p", "", "tunnel cipher password")
flag.StringVar(&CertFile, "cert", "", "tls cert file")
flag.StringVar(&KeyFile, "key", "", "tls key file")
flag.BoolVar(&Shadows, "ss", false, "run as shadowsocks server")
flag.BoolVar(&UseTLS, "tls", false, "use ssl/tls tunnel")
flag.BoolVar(&UseWebsocket, "ws", false, "use websocket tunnel")
flag.BoolVar(&UseHttp, "http", false, "use http tunnel")
flag.StringVar(&SMethod, "sm", "rc4-md5", "shadowsocks cipher method")
flag.StringVar(&SPassword, "sp", "ginuerzh@gmail.com", "shadowsocks cipher password")
flag.BoolVar(&PrintVersion, "v", false, "print version")
flag.Parse()
log.SetFlags(log.LstdFlags | log.Lshortfile) flag.Parse()
proxyURL, _ = parseURL(Proxy) listenArgs = parseArgs(listenUrl)
listenUrl, _ = parseURL(Laddr) proxyArgs = parseArgs(proxyUrl)
forwardArgs = parseArgs(forwardUrl)
} }
var (
spool = NewMemPool(1024, 120*time.Minute, 1024) // 1k size buffer pool
mpool = NewMemPool(16*1024, 60*time.Minute, 512) // 16k size buffer pool
lpool = NewMemPool(32*1024, 30*time.Minute, 256) // 32k size buffer pool
)
func main() { func main() {
if PrintVersion { defer glog.Flush()
printVersion()
return
}
laddr := listenUrl.Host if len(listenArgs) == 0 {
glog.Fatalln("no listen addr")
if len(Saddr) == 0 {
var server Server
if UseTLS {
server = &TlsServer{Addr: laddr, CertFile: CertFile, KeyFile: KeyFile}
} else if UseWebsocket {
server = &WSServer{Addr: laddr}
} else if UseHttp {
server = &HttpServer{Addr: laddr}
} else {
server = &Socks5Server{Addr: laddr}
}
log.Fatal(server.ListenAndServe())
return
} }
log.Fatal(listenAndServe(laddr, cliHandle)) var wg sync.WaitGroup
for _, arg := range listenArgs {
wg.Add(1)
go func() {
defer wg.Done()
if err := listenAndServe(arg); err != nil {
if glog.V(LFATAL) {
glog.Errorln(err)
}
}
}()
}
wg.Wait()
} }
pool.go deleted 100644 → 0
View file @ 82e624d8
// pool for buffer
package main
import (
"container/list"
//"log"
"time"
)
type poolItem struct {
when time.Time
item interface{}
}
type pool struct {
quque *list.List
takeChan, putChan chan interface{}
age time.Duration
max int
}
func (p *pool) run() {
for {
if p.size() == 0 {
select {
case b := <-p.putChan:
p.put(b)
}
continue
}
i := p.quque.Front()
timeout := time.NewTimer(p.age)
select {
case b := <-p.putChan:
timeout.Stop()
p.put(b)
case p.takeChan <- i.Value.(*poolItem).item:
timeout.Stop()
p.quque.Remove(i)
case <-timeout.C:
i = p.quque.Back()
for i != nil {
if time.Since(i.Value.(*poolItem).when) < p.age {
break
}
e := i.Prev()
p.quque.Remove(i)
i = e
}
}
}
}
func (p *pool) size() int {
return p.quque.Len()
}
func (p *pool) put(v interface{}) {
if p.size() < p.max {
p.quque.PushFront(&poolItem{when: time.Now(), item: v})
return
}
}
type MemPool struct {
pool
bs int
}
func NewMemPool(bs int, age time.Duration, max int) *MemPool {
if bs <= 0 {
bs = 8192
}
if age == 0 {
age = 1 * time.Minute
}
p := &MemPool{
pool: pool{
quque: list.New(),
takeChan: make(chan interface{}),
putChan: make(chan interface{}),
age: age,
max: max,
},
bs: bs,
}
go p.run()
return p
}
func (p *MemPool) Take() []byte {
select {
case v := <-p.takeChan:
return v.([]byte)
default:
return make([]byte, p.bs)
}
}
func (p *MemPool) Put(b []byte) {
p.putChan <- b
}
server.go deleted 100644 → 0
View file @ 82e624d8
package main
type Server interface {
ListenAndServe() error
}
socks5.go → socks.go
View file @ 037a79a0
This diff is collapsed.
tls.go deleted 100644 → 0
View file @ 82e624d8
package main
import (
"crypto/tls"
"github.com/ginuerzh/gosocks5"
"net"
)
type TlsServer struct {
Addr string
CertFile, KeyFile string
}
func (s *TlsServer) ListenAndServe() error {
return s.listenAndServeTLS()
}
func (s *TlsServer) listenAndServeTLS() error {
var cert tls.Certificate
var err error
if len(s.CertFile) == 0 || len(s.KeyFile) == 0 {
cert, err = tls.X509KeyPair([]byte(rawCert), []byte(rawKey))
} else {
cert, err = tls.LoadX509KeyPair(s.CertFile, s.KeyFile)
}
if err != nil {
return err
}
config := &tls.Config{Certificates: []tls.Certificate{cert}}
l, err := tls.Listen("tcp", s.Addr, config)
if err != nil {
return err
}
defer l.Close()
for {
conn, err := l.Accept()
if err != nil {
return err
}
go func(c net.Conn) {
c = gosocks5.ServerConn(c, serverConfig)
serveSocks5(c)
}(conn)
}
return nil
}
util.go
View file @ 037a79a0
package main package main
import ( import (
"bufio" "crypto/tls"
//"bytes"
"encoding/base64"
"errors" "errors"
"github.com/ginuerzh/gosocks5" "fmt"
"github.com/golang/glog"
"io" "io"
//"log"
"net" "net"
"net/http"
"net/url" "net/url"
"strconv"
"strings" "strings"
) )
const ( // socks://admin:123456@localhost:8080
MethodTLS uint8 = 0x80 + iota type Args struct {
MethodAES128 Addr string // host:port
MethodAES192 Protocol string // protocol: hs/http/socks/socks5/ss, default is hs(http+socks5)
MethodAES256 Transport string // transport: tcp/ws/tls, default is tcp(raw tcp)
MethodDES User *url.Userinfo
MethodBF EncMeth string // data encryption method
MethodCAST5 EncPass string // data encryption password
MethodRC4MD5 Cert tls.Certificate // tls certificate
MethodRC4
MethodTable
MethodTLSAuth
)
var ErrEmptyAuth = errors.New("empty auth")
var Methods = map[uint8]string{
//gosocks5.MethodNoAuth: "", // 0x00
gosocks5.MethodUserPass: "userpass", // 0x02
MethodTLS: "tls", // 0x80
MethodAES128: "aes-128-cfb", // 0x81
MethodAES192: "aes-192-cfb", // 0x82
MethodAES256: "aes-256-cfb", // 0x83
MethodDES: "des-cfb", // 0x84
MethodBF: "bf-cfb", // 0x85
MethodCAST5: "cast5-cfb", // 0x86
MethodRC4MD5: "rc4-md5", // 8x87
MethodRC4: "rc4", // 0x88
MethodTable: "table", // 0x89
MethodTLSAuth: "tls-auth", // 0x90
}
func parseURL(rawurl string) (*url.URL, error) {
if len(rawurl) == 0 {
return nil, nil
}
if !strings.HasPrefix(rawurl, "http://") &&
!strings.HasPrefix(rawurl, "socks://") {
rawurl = "http://" + rawurl
}
return url.Parse(rawurl)
} }
func parseUserPass(key string) (username string, password string) { func (args Args) String() string {
sep := ":" var authUser, authPass string
i := strings.Index(key, sep) if args.User != nil {
if i < 0 { authUser = args.User.Username()
return key, "" authPass, _ = args.User.Password()
} }
return key[0:i], key[i+len(sep):] return fmt.Sprintf("host: %s, proto: %s, trans: %s, auth: %s:%s, enc: %s:%s",
args.Addr, args.Protocol, args.Transport, authUser, authPass,
args.EncMeth, args.EncPass)
} }
func ToSocksAddr(addr net.Addr) *gosocks5.Addr { func parseArgs(rawurl string) (args []Args) {
host, port, _ := net.SplitHostPort(addr.String()) ss := strings.Split(rawurl, ",")
p, _ := strconv.Atoi(port) if rawurl == "" || len(ss) == 0 {
return nil
return &gosocks5.Addr{
Type: gosocks5.AddrIPv4,
Host: host,
Port: uint16(p),
} }
}
func dial(addr string) (net.Conn, error) { for _, s := range ss {
taddr, err := net.ResolveTCPAddr("tcp", addr) if !strings.Contains(s, "://") {
if err != nil { s = "hs://" + s
return nil, err }
} u, err := url.Parse(s)
return net.DialTCP("tcp", nil, taddr) if err != nil {
} if glog.V(LWARNING) {
glog.Warningln(err)
func connect(addr string) (net.Conn, error) { }
if !strings.Contains(addr, ":") { continue
addr += ":80" }
}
if proxyURL == nil {
return dial(addr)
}
switch proxyURL.Scheme {
case "socks": // socks5 proxy
return connectSocks5Proxy(addr)
case "http": // http proxy
fallthrough
default:
return connectHTTPProxy(addr)
}
}
func connectHTTPProxy(addr string) (conn net.Conn, err error) {
conn, err = dial(proxyURL.Host)
if err != nil {
return
}
req := &http.Request{
Method: "CONNECT",
URL: &url.URL{Host: addr},
Host: addr,
Header: make(http.Header),
}
req.Header.Set("Proxy-Connection", "keep-alive")
setBasicAuth(req)
if err = req.Write(conn); err != nil {
conn.Close()
return
}
resp, err := http.ReadResponse(bufio.NewReader(conn), req)
if err != nil {
conn.Close()
return
}
if resp.StatusCode != http.StatusOK {
conn.Close()
//log.Println(resp.Status)
return nil, errors.New(resp.Status)
}
return
}
func connectSocks5Proxy(addr string) (conn net.Conn, err error) {
conn, err = dial(proxyURL.Host)
if err != nil {
return
}
conf := &gosocks5.Config{
// Methods: []uint8{gosocks5.MethodNoAuth, gosocks5.MethodUserPass},
MethodSelected: proxyMethodSelected,
}
if proxyURL.User != nil {
conf.Methods = []uint8{gosocks5.MethodUserPass}
}
c := gosocks5.ClientConn(conn, conf)
if err := c.Handleshake(); err != nil {
conn.Close()
return nil, err
}
conn = c
s := strings.Split(addr, ":")
host := s[0]
port := 80
if len(s) == 2 {
n, _ := strconv.ParseUint(s[1], 10, 16)
port = int(n)
}
a := &gosocks5.Addr{
Type: gosocks5.AddrDomain,
Host: host,
Port: uint16(port),
}
if err := gosocks5.NewRequest(gosocks5.CmdConnect, a).Write(conn); err != nil {
conn.Close()
return nil, err
}
rep, err := gosocks5.ReadReply(conn)
if err != nil {
conn.Close()
return nil, err
}
if rep.Rep != gosocks5.Succeeded {
conn.Close()
return nil, errors.New("Socks Failture")
}
return conn, nil
}
func proxyMethodSelected(method uint8, conn net.Conn) (net.Conn, error) { arg := Args{
switch method { Addr: u.Host,
case gosocks5.MethodUserPass: User: u.User,
var user, pass string }
if proxyURL != nil && proxyURL.User != nil { schemes := strings.Split(u.Scheme, "+")
user = proxyURL.User.Username() if len(schemes) == 1 {
pass, _ = proxyURL.User.Password() switch schemes[0] {
case "http", "socks", "socks5", "ss":
arg.Protocol = schemes[0]
case "ws", "tls", "tcp":
arg.Transport = schemes[0]
}
} }
if err := clientSocksAuth(conn, user, pass); err != nil { if len(schemes) == 2 {
return nil, err arg.Protocol = schemes[0]
arg.Transport = schemes[1]
} }
case gosocks5.MethodNoAcceptable:
return nil, gosocks5.ErrBadMethod
}
return conn, nil arg.Cert, err = tls.LoadX509KeyPair("cert.pem", "key.pem")
} if err != nil {
if glog.V(LFATAL) {
glog.Errorln(err, ", tls will not be supported")
}
}
func clientSocksAuth(conn net.Conn, username, password string) error { mp := strings.Split(strings.Trim(u.Path, "/"), ":")
if err := gosocks5.NewUserPassRequest( if len(mp) == 1 {
gosocks5.UserPassVer, username, password).Write(conn); err != nil { arg.EncMeth = mp[0]
return err }
} if len(mp) == 2 {
res, err := gosocks5.ReadUserPassResponse(conn) arg.EncMeth = mp[0]
if err != nil { arg.EncPass = mp[1]
return err }
} if glog.V(LINFO) {
if res.Status != gosocks5.Succeeded { glog.Infoln(arg)
return gosocks5.ErrAuthFailure }
args = append(args, arg)
} }
return nil return
} }
func serverSocksAuth(conn net.Conn, username, password string) error { func connect(addr string) (net.Conn, error) {
req, err := gosocks5.ReadUserPassRequest(conn) if !strings.Contains(addr, ":") {
if err != nil { addr += ":80"
return err
} }
/*
if (len(username) > 0 && req.Username != username) || if proxyURL == nil {
(len(password) > 0 && req.Password != password) { return dial(addr)
if err := gosocks5.NewUserPassResponse(
gosocks5.UserPassVer, gosocks5.Failure).Write(conn); err != nil {
return err
} }
return gosocks5.ErrAuthFailure
}
if err := gosocks5.NewUserPassResponse(
gosocks5.UserPassVer, gosocks5.Succeeded).Write(conn); err != nil {
return err
}
return nil switch proxyURL.Scheme {
} case "socks": // socks5 proxy
return connectSocks5Proxy(addr)
func setBasicAuth(r *http.Request) { case "http": // http proxy
if proxyURL != nil && proxyURL.User != nil { fallthrough
r.Header.Set("Proxy-Authorization", default:
"Basic "+base64.StdEncoding.EncodeToString([]byte(proxyURL.User.String()))) return connectHTTPProxy(addr)
} }
*/
return nil, errors.New("not implemented")
} }
// based on io.Copy // based on io.Copy
func Copy(dst io.Writer, src io.Reader) (written int64, err error) { func Copy(dst io.Writer, src io.Reader) (written int64, err error) {
buf := lpool.Take() buf := make([]byte, 32*1024)
defer lpool.put(buf)
for { for {
nr, er := src.Read(buf) nr, er := src.Read(buf)
......
version.go
View file @ 037a79a0
...@@ -5,7 +5,7 @@ import ( ...@@ -5,7 +5,7 @@ import (
) )
const ( const (
Version = "1.8" Version = "2.0"
) )
func printVersion() { func printVersion() {
......
ws.go
View file @ 037a79a0
package main package main
import ( import (
"github.com/ginuerzh/gosocks5" //"github.com/ginuerzh/gosocks5"
"github.com/golang/glog"
"github.com/gorilla/websocket" "github.com/gorilla/websocket"
"log" "net"
"net/http" "net/http"
"net/http/httputil"
"net/url"
"time" "time"
) )
type WSConn struct { type wsConn struct {
*websocket.Conn conn *websocket.Conn
rb []byte rb []byte
} }
func NewWSConn(conn *websocket.Conn) *WSConn { func wsClient(conn net.Conn, host string) (*wsConn, error) {
c := &WSConn{ c, resp, err := websocket.NewClient(conn, &url.URL{Host: host, Path: "/ws"}, nil, 1024, 1024)
Conn: conn, if err != nil {
return nil, err
} }
resp.Body.Close()
return c return &wsConn{conn: c}, nil
} }
func (conn *WSConn) Read(b []byte) (n int, err error) { func wsServer(conn *websocket.Conn) *wsConn {
if len(conn.rb) == 0 { return &wsConn{
_, conn.rb, err = conn.ReadMessage() conn: conn,
} }
n = copy(b, conn.rb) }
conn.rb = conn.rb[n:]
func (c *wsConn) Read(b []byte) (n int, err error) {
if len(c.rb) == 0 {
_, c.rb, err = c.conn.ReadMessage()
}
n = copy(b, c.rb)
c.rb = c.rb[n:]
//log.Println("ws r:", n) //log.Println("ws r:", n)
return return
} }
func (conn *WSConn) Write(b []byte) (n int, err error) { func (c *wsConn) Write(b []byte) (n int, err error) {
err = conn.WriteMessage(websocket.BinaryMessage, b) err = c.conn.WriteMessage(websocket.BinaryMessage, b)
n = len(b) n = len(b)
//log.Println("ws w:", n) //log.Println("ws w:", n)
return return
} }
func (conn *WSConn) SetDeadline(t time.Time) error { func (c *wsConn) Close() error {
return c.conn.Close()
}
func (c *wsConn) LocalAddr() net.Addr {
return c.conn.LocalAddr()
}
func (c *wsConn) RemoteAddr() net.Addr {
return c.conn.RemoteAddr()
}
func (conn *wsConn) SetDeadline(t time.Time) error {
if err := conn.SetReadDeadline(t); err != nil { if err := conn.SetReadDeadline(t); err != nil {
return err return err
} }
return conn.SetWriteDeadline(t) return conn.SetWriteDeadline(t)
} }
func (c *wsConn) SetReadDeadline(t time.Time) error {
return c.conn.SetReadDeadline(t)
}
type WSServer struct { func (c *wsConn) SetWriteDeadline(t time.Time) error {
Addr string return c.conn.SetWriteDeadline(t)
} }
var upgrader = websocket.Upgrader{ type ws struct {
ReadBufferSize: 8192, upgrader websocket.Upgrader
WriteBufferSize: 8192, arg Args
CheckOrigin: func(r *http.Request) bool { return true },
} }
func (s *WSServer) handle(w http.ResponseWriter, r *http.Request) { func NewWs(arg Args) *ws {
conn, err := upgrader.Upgrade(w, r, nil) return &ws{
if err != nil { arg: arg,
log.Println(err) upgrader: websocket.Upgrader{
return ReadBufferSize: 1024,
WriteBufferSize: 1024,
CheckOrigin: func(r *http.Request) bool { return true },
},
} }
//defer conn.Close() }
c := gosocks5.ServerConn(NewWSConn(conn), serverConfig) func (s *ws) handle(w http.ResponseWriter, r *http.Request) {
/* if glog.V(LDEBUG) {
if err := c.Handleshake(); err != nil { dump, err := httputil.DumpRequest(r, false)
log.Println(err) if err != nil {
return glog.Infoln(err)
} else {
glog.Infoln(string(dump))
} }
*/ }
serveSocks5(c) conn, err := s.upgrader.Upgrade(w, r, nil)
if err != nil {
if glog.V(LERROR) {
glog.Errorln(err)
}
return
}
handleConn(wsServer(conn), s.arg)
} }
func (s *WSServer) ListenAndServe() error { func (s *ws) ListenAndServe() error {
http.HandleFunc("/", s.handle) http.HandleFunc("/ws", s.handle)
return http.ListenAndServe(s.Addr, nil) return http.ListenAndServe(s.arg.Addr, nil)
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment