Skip to content

G
gost
Commit 74eb52dc authored by rui.zheng's avatar rui.zheng
Browse files
Options

update file structure

parent 6613df99
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 3623 additions and 9702 deletions
.gitignore
View file @ 74eb52dc
...@@ -25,3 +25,5 @@ _testmain.go ...@@ -25,3 +25,5 @@ _testmain.go
*.test *.test
*.bak *.bak
cmd/gost
\ No newline at end of file
.travis.yml deleted 100644 → 0
View file @ 6613df99
language: go
go:
1.6
1.7
\ No newline at end of file
LICENSE deleted 100644 → 0
View file @ 6613df99
MIT License
Copyright (c) 2016 ginuerzh
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
README.md deleted 100644 → 0
View file @ 6613df99
gost - GO Simple Tunnel
======
### GO语言实现的安全隧道
[English README](README_en.md)
特性
------
* 可同时监听多端口
* 可设置转发代理，支持多级转发(代理链)
* 支持标准HTTP/HTTPS/SOCKS4(A)/SOCKS5代理协议
* SOCKS5代理支持TLS协商加密
* Tunnel UDP over TCP
* 支持Shadowsocks协议 (OTA: 2.2+，UDP: 2.4+)
* 支持本地/远程端口转发 (2.1+)
* 支持HTTP 2.0 (2.2+)
* 实验性支持QUIC (2.3+)
* 支持KCP协议 (2.3+)
* 透明代理 (2.3+)
* SSH隧道 (2.4+)
二进制文件下载：https://github.com/ginuerzh/gost/releases
Google讨论组: https://groups.google.com/d/forum/go-gost
在gost中，gost与其他代理服务都被看作是代理节点，gost可以自己处理请求，或者将请求转发给任意一个或多个代理节点。
参数说明
------
#### 代理及代理链
适用于-L和-F参数
```bash
[scheme://][user:pass@host]:port
```
scheme分为两部分: protocol+transport
protocol: 代理协议类型(http, socks4(a), socks5, shadowsocks), transport: 数据传输方式(ws, wss, tls, http2, quic, kcp, pht), 二者可以任意组合，或单独使用:
> http - HTTP代理: http://:8080
> http+tls - HTTPS代理(可能需要提供受信任的证书): http+tls://:443或https://:443
> http2 - HTTP2代理并向下兼容HTTPS代理: http2://:443
> socks4(a) - 标准SOCKS4(A)代理: socks4://:1080或socks4a://:1080
> socks - 标准SOCKS5代理(支持TLS协商加密): socks://:1080
> socks+wss - SOCKS5代理，使用websocket传输数据: socks+wss://:1080
> tls - HTTPS/SOCKS5代理，使用TLS传输数据: tls://:443
> ss - Shadowsocks代理，ss://chacha20:123456@:8338
> ssu - Shadowsocks UDP relay，ssu://chacha20:123456@:8338
> quic - QUIC代理，quic://:6121
> kcp - KCP通道，kcp://:8388或kcp://aes:123456@:8388
> pht - 普通HTTP通道，pht://:8080
> redirect - 透明代理，redirect://:12345
> ssh - SSH转发隧道，ssh://admin:123456@:2222
#### 端口转发
适用于-L参数
```bash
scheme://[bind_address]:port/[host]:hostport
```
> scheme - 端口转发模式, 本地端口转发: tcp, udp; 远程端口转发: rtcp, rudp
> bind_address:port - 本地/远程绑定地址
> host:hostport - 目标访问地址
#### 配置文件
> -C : 指定配置文件路径
配置文件为标准json格式：
```json
{
"ServeNodes": [
":8080",
"ss://chacha20:12345678@:8338"
],
"ChainNodes": [
"http://192.168.1.1:8080",
"https://10.0.2.1:443"
]
}
```
ServeNodes等同于-L参数，ChainNodes等同于-F参数
#### 开启日志
> -logtostderr : 输出到控制台
> -v=3 : 日志级别(1-5)，级别越高，日志越详细(级别5将开启http2 debug)
> -log_dir=/log/dir/path : 输出到目录/log/dir/path
使用方法
------
#### 不设置转发代理
<img src="https://ginuerzh.github.io/images/gost_01.png" />
* 作为标准HTTP/SOCKS5代理
```bash
gost -L=:8080
```
* 设置代理认证信息
```bash
gost -L=admin:123456@localhost:8080
```
* 多组认证信息
```bash
gost -L=localhost:8080?secrets=secrets.txt
```
通过secrets参数可以为HTTP/SOCKS5代理设置多组认证信息，格式为：
```plain
# username password
test001 123456
test002 12345678
```
* 多端口监听
```bash
gost -L=http2://:443 -L=socks://:1080 -L=ss://aes-128-cfb:123456@:8338
```
#### 设置转发代理
<img src="https://ginuerzh.github.io/images/gost_02.png" />
```bash
gost -L=:8080 -F=192.168.1.1:8081
```
* 转发代理认证
```bash
gost -L=:8080 -F=http://admin:123456@192.168.1.1:8081
```
#### 设置多级转发代理(代理链)
<img src="https://ginuerzh.github.io/images/gost_03.png" />
```bash
gost -L=:8080 -F=http+tls://192.168.1.1:443 -F=socks+ws://192.168.1.2:1080 -F=ss://aes-128-cfb:123456@192.168.1.3:8338 -F=a.b.c.d:NNNN
```
gost按照-F设置的顺序通过代理链将请求最终转发给a.b.c.d:NNNN处理，每一个转发代理可以是任意HTTP/HTTPS/HTTP2/SOCKS5/Shadowsocks类型代理。
#### 本地端口转发(TCP)
```bash
gost -L=tcp://:2222/192.168.1.1:22 -F=...
```
将本地TCP端口2222上的数据(通过代理链)转发到192.168.1.1:22上。当代理链末端(最后一个-F参数)为SSH类型时，gost会直接使用SSH的本地端口转发功能。
#### 本地端口转发(UDP)
```bash
gost -L=udp://:5353/192.168.1.1:53?ttl=60 -F=...
```
将本地UDP端口5353上的数据(通过代理链)转发到192.168.1.1:53上。
每条转发通道都有超时时间，当超过此时间，且在此时间段内无任何数据交互，则此通道将关闭。可以通过`ttl`参数来设置超时时间，默认值为60秒。
**注:** 转发UDP数据时，如果有代理链，则代理链的末端(最后一个-F参数)必须是gost SOCKS5类型代理。
#### 远程端口转发(TCP)
```bash
gost -L=rtcp://:2222/192.168.1.1:22 -F=... -F=socks://172.24.10.1:1080
```
将172.24.10.1:2222上的数据(通过代理链)转发到192.168.1.1:22上。当代理链末端(最后一个-F参数)为SSH类型时，gost会直接使用SSH的远程端口转发功能。
#### 远程端口转发(UDP)
```bash
gost -L=rudp://:5353/192.168.1.1:53 -F=... -F=socks://172.24.10.1:1080
```
将172.24.10.1:5353上的数据(通过代理链)转发到192.168.1.1:53上。
**注：** 若要使用远程端口转发功能，代理链不能为空(至少要设置一个-F参数)，且代理链的末端(最后一个-F参数)必须是gost SOCKS5类型代理。
#### HTTP2
gost的HTTP2支持两种模式并自适应：
* 作为标准的HTTP2代理，并向下兼容HTTPS代理。
* 作为transport(类似于wss)，传输其他协议。
服务端:
```bash
gost -L=http2://:443
```
客户端:
```bash
gost -L=:8080 -F=http2://server_ip:443?ping=30
```
客户端支持`ping`参数开启心跳检测(默认不开启)，参数值代表心跳间隔秒数。
**注：** gost的代理链仅支持一个HTTP2代理节点，采用就近原则，会将第一个遇到的HTTP2代理节点视为HTTP2代理，其他HTTP2代理节点则被视为HTTPS代理。
#### QUIC
gost对QUIC的支持是基于[quic-go](https://github.com/lucas-clemente/quic-go)库。
服务端:
```bash
gost -L=quic://:6121
```
客户端(Chrome):
```bash
chrome --enable-quic --proxy-server=quic://server_ip:6121
```
**注：** 由于Chrome自身的限制，目前只能通过QUIC访问HTTP网站，无法访问HTTPS网站。
#### KCP
gost对KCP的支持是基于[kcp-go](https://github.com/xtaci/kcp-go)和[kcptun](https://github.com/xtaci/kcptun)库。
服务端:
```bash
gost -L=kcp://:8388
```
客户端:
```bash
gost -L=:8080 -F=kcp://server_ip:8388
```
或者手动指定加密方法和密码(手动指定的加密方法和密码会覆盖配置文件中的相应值)
服务端:
```bash
gost -L=kcp://aes:123456@:8388
```
客户端:
```bash
gost -L=:8080 -F=kcp://aes:123456@server_ip:8388
```
gost会自动加载当前工作目录中的kcp.json(如果存在)配置文件，或者可以手动通过参数指定配置文件路径：
```bash
gost -L=kcp://:8388?c=/path/to/conf/file
```
**注：** 客户端若要开启KCP转发，当且仅当代理链不为空且首个代理节点(第一个-F参数)为kcp类型。
#### 透明代理
基于iptables的透明代理。
```bash
gost -L=redirect://:12345 -F=http2://server_ip:443
```
加密机制
------
#### HTTP
对于HTTP可以使用TLS加密整个通讯过程，即HTTPS代理：
服务端:
```bash
gost -L=http+tls://:443
```
客户端:
```bash
gost -L=:8080 -F=http+tls://server_ip:443
```
#### HTTP2
gost仅支持使用TLS加密的HTTP2协议，不支持明文HTTP2传输。
#### SOCKS5
gost支持标准SOCKS5协议的no-auth(0x00)和user/pass(0x02)方法，并在此基础上扩展了两个：tls(0x80)和tls-auth(0x82)，用于数据加密。
服务端:
```bash
gost -L=socks://:1080
```
客户端:
```bash
gost -L=:8080 -F=socks://server_ip:1080
```
如果两端都是gost(如上)则数据传输会被加密(协商使用tls或tls-auth方法)，否则使用标准SOCKS5进行通讯(no-auth或user/pass方法)。
**注：** 如果transport已经支持加密(wss, tls, http2, kcp)，则SOCKS5不会再使用加密方法，防止不必要的双重加密。
#### Shadowsocks
gost对shadowsocks的支持是基于[shadowsocks-go](https://github.com/shadowsocks/shadowsocks-go)库。
服务端(可以通过ota参数开启OTA强制模式，开启后客户端必须使用OTA模式):
```bash
gost -L=ss://aes-128-cfb:123456@:8338?ota=1
```
客户端(可以通过ota参数开启OTA模式):
```bash
gost -L=:8080 -F=ss://aes-128-cfb:123456@server_ip:8338?ota=1
```
##### Shadowsocks UDP relay
目前仅服务端支持UDP，且仅支持OTA模式。
服务端:
```bash
gost -L=ssu://aes-128-cfb:123456@:8338
```
#### TLS
gost内置了TLS证书，如果需要使用其他TLS证书，有两种方法：
* 在gost运行目录放置cert.pem(公钥)和key.pem(私钥)两个文件即可，gost会自动加载运行目录下的cert.pem和key.pem文件。
* 使用参数指定证书文件路径：
```bash
gost -L="http2://:443?cert=/path/to/my/cert/file&key=/path/to/my/key/file"
```
SOCKS5 UDP数据处理
------
#### 不设置转发代理
<img src="https://ginuerzh.github.io/images/udp01.png" height=100 />
gost作为标准SOCKS5代理处理UDP数据
#### 设置转发代理
<img src="https://ginuerzh.github.io/images/udp02.png" height=100 />
#### 设置多个转发代理(代理链)
<img src="https://ginuerzh.github.io/images/udp03.png" height=200 />
当设置转发代理时，gost会使用UDP-over-TCP方式转发UDP数据。proxy1 - proxyN可以为任意HTTP/HTTPS/HTTP2/SOCKS5/Shadowsocks类型代理。
限制条件
------
代理链中的HTTP代理节点必须支持CONNECT方法。
如果要转发SOCKS5的BIND和UDP请求，代理链的末端(最后一个-F参数)必须支持gost SOCKS5类型代理。
README_en.md deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
chain.go
View file @ 74eb52dc
This diff is collapsed.
cmd/gost/main.go
View file @ 74eb52dc
This diff is collapsed.
conn.go deleted 100644 → 0
View file @ 6613df99
package gost
import (
"bufio"
"crypto/tls"
"encoding/base64"
"errors"
"fmt"
"net"
"net/http"
"net/http/httputil"
"net/url"
"strconv"
"strings"
"sync"
"time"
"github.com/ginuerzh/gosocks4"
"github.com/ginuerzh/gosocks5"
"github.com/golang/glog"
ss "github.com/shadowsocks/shadowsocks-go/shadowsocks"
)
type ProxyConn struct {
conn net.Conn
Node ProxyNode
handshaked bool
handshakeMutex sync.Mutex
handshakeErr error
}
func NewProxyConn(conn net.Conn, node ProxyNode) *ProxyConn {
return &ProxyConn{
conn: conn,
Node: node,
}
}
// Handshake handshake with this proxy node based on the proxy node info: transport, protocol, authentication, etc.
//
// NOTE: any HTTP2 scheme will be treated as http (for protocol) or tls (for transport).
func (c *ProxyConn) Handshake() error {
c.handshakeMutex.Lock()
defer c.handshakeMutex.Unlock()
if err := c.handshakeErr; err != nil {
return err
}
if c.handshaked {
return nil
}
c.handshakeErr = c.handshake()
return c.handshakeErr
}
func (c *ProxyConn) handshake() error {
var tlsUsed bool
switch c.Node.Transport {
case "ws": // websocket connection
rbuf, _ := strconv.Atoi(c.Node.Get("rbuf"))
wbuf, _ := strconv.Atoi(c.Node.Get("wbuf"))
comp := c.Node.getBool("compression")
opt := WSOptions{
ReadBufferSize: rbuf,
WriteBufferSize: wbuf,
HandshakeTimeout: DialTimeout,
EnableCompression: comp,
}
u := url.URL{Scheme: "ws", Host: c.Node.Addr, Path: "/ws"}
conn, err := WebsocketClientConn(u.String(), c.conn, &opt)
if err != nil {
return err
}
c.conn = conn
case "wss": // websocket security
tlsUsed = true
rbuf, _ := strconv.Atoi(c.Node.Get("rbuf"))
wbuf, _ := strconv.Atoi(c.Node.Get("wbuf"))
comp := c.Node.getBool("compression")
opt := WSOptions{
ReadBufferSize: rbuf,
WriteBufferSize: wbuf,
HandshakeTimeout: DialTimeout,
EnableCompression: comp,
TLSConfig: &tls.Config{
InsecureSkipVerify: c.Node.insecureSkipVerify(),
ServerName: c.Node.serverName,
},
}
u := url.URL{Scheme: "wss", Host: c.Node.Addr, Path: "/ws"}
conn, err := WebsocketClientConn(u.String(), c.conn, &opt)
if err != nil {
return err
}
c.conn = conn
case "tls", "http2": // tls connection
tlsUsed = true
cfg := &tls.Config{
InsecureSkipVerify: c.Node.insecureSkipVerify(),
ServerName: c.Node.serverName,
}
c.conn = tls.Client(c.conn, cfg)
case "h2": // same as http2, but just set a flag for later using.
tlsUsed = true
case "kcp": // kcp connection
tlsUsed = true
default:
}
switch c.Node.Protocol {
case "socks", "socks5": // socks5 handshake with auth and tls supported
selector := &ClientSelector{
methods: []uint8{
gosocks5.MethodNoAuth,
gosocks5.MethodUserPass,
//MethodTLS,
},
}
if len(c.Node.Users) > 0 {
selector.User = c.Node.Users[0]
}
if !tlsUsed { // if transport is not security, enable security socks5
selector.methods = append(selector.methods, MethodTLS)
selector.TLSConfig = &tls.Config{
InsecureSkipVerify: c.Node.insecureSkipVerify(),
ServerName: c.Node.serverName,
}
}
conn := gosocks5.ClientConn(c.conn, selector)
if err := conn.Handleshake(); err != nil {
return err
}
c.conn = conn
case "ss": // shadowsocks
// nothing to do
case "http", "http2":
fallthrough
default:
}
c.handshaked = true
return nil
}
// Connect connect to addr through this proxy node
func (c *ProxyConn) Connect(addr string) error {
switch c.Node.Protocol {
case "ss": // shadowsocks
rawaddr, err := ss.RawAddr(addr)
if err != nil {
return err
}
var method, password string
if len(c.Node.Users) > 0 {
method = c.Node.Users[0].Username()
password, _ = c.Node.Users[0].Password()
}
if c.Node.getBool("ota") && !strings.HasSuffix(method, "-auth") {
method += "-auth"
}
cipher, err := ss.NewCipher(method, password)
if err != nil {
return err
}
ssc, err := ss.DialWithRawAddrConn(rawaddr, c.conn, cipher)
if err != nil {
return err
}
c.conn = &shadowConn{conn: ssc}
return nil
case "socks", "socks5":
host, port, err := net.SplitHostPort(addr)
if err != nil {
return err
}
p, _ := strconv.Atoi(port)
req := gosocks5.NewRequest(gosocks5.CmdConnect, &gosocks5.Addr{
Type: gosocks5.AddrDomain,
Host: host,
Port: uint16(p),
})
if err := req.Write(c); err != nil {
return err
}
glog.V(LDEBUG).Infoln("[socks5]", req)
reply, err := gosocks5.ReadReply(c)
if err != nil {
return err
}
glog.V(LDEBUG).Infoln("[socks5]", reply)
if reply.Rep != gosocks5.Succeeded {
return errors.New("Service unavailable")
}
case "socks4", "socks4a":
atype := gosocks4.AddrDomain
host, port, err := net.SplitHostPort(addr)
if err != nil {
return err
}
p, _ := strconv.Atoi(port)
if c.Node.Protocol == "socks4" {
taddr, err := net.ResolveTCPAddr("tcp4", addr)
if err != nil {
return err
}
host = taddr.IP.String()
p = taddr.Port
atype = gosocks4.AddrIPv4
}
req := gosocks4.NewRequest(gosocks4.CmdConnect,
&gosocks4.Addr{Type: atype, Host: host, Port: uint16(p)}, nil)
if err := req.Write(c); err != nil {
return err
}
glog.V(LDEBUG).Infof("[%s] %s", c.Node.Protocol, req)
reply, err := gosocks4.ReadReply(c)
if err != nil {
return err
}
glog.V(LDEBUG).Infof("[%s] %s", c.Node.Protocol, reply)
if reply.Code != gosocks4.Granted {
return errors.New(fmt.Sprintf("%s: code=%d", c.Node.Protocol, reply.Code))
}
case "http":
fallthrough
default:
req := &http.Request{
Method: http.MethodConnect,
URL: &url.URL{Host: addr},
Host: addr,
ProtoMajor: 1,
ProtoMinor: 1,
Header: make(http.Header),
}
req.Header.Set("Proxy-Connection", "keep-alive")
if len(c.Node.Users) > 0 {
user := c.Node.Users[0]
s := user.String()
if _, set := user.Password(); !set {
s += ":"
}
req.Header.Set("Proxy-Authorization",
"Basic "+base64.StdEncoding.EncodeToString([]byte(s)))
}
if err := req.Write(c); err != nil {
return err
}
if glog.V(LDEBUG) {
dump, _ := httputil.DumpRequest(req, false)
glog.Infoln(string(dump))
}
resp, err := http.ReadResponse(bufio.NewReader(c), req)
if err != nil {
return err
}
if glog.V(LDEBUG) {
dump, _ := httputil.DumpResponse(resp, false)
glog.Infoln(string(dump))
}
if resp.StatusCode != http.StatusOK {
return errors.New(resp.Status)
}
}
return nil
}
func (c *ProxyConn) Read(b []byte) (n int, err error) {
return c.conn.Read(b)
}
func (c *ProxyConn) Write(b []byte) (n int, err error) {
return c.conn.Write(b)
}
func (c *ProxyConn) Close() error {
return c.conn.Close()
}
func (c *ProxyConn) LocalAddr() net.Addr {
return c.conn.LocalAddr()
}
func (c *ProxyConn) RemoteAddr() net.Addr {
return c.conn.RemoteAddr()
}
func (c *ProxyConn) SetDeadline(t time.Time) error {
return c.conn.SetDeadline(t)
}
func (c *ProxyConn) SetReadDeadline(t time.Time) error {
return c.conn.SetReadDeadline(t)
}
func (c *ProxyConn) SetWriteDeadline(t time.Time) error {
return c.conn.SetWriteDeadline(t)
}
gost/examples/bench/cli.go → examples/bench/cli.go
View file @ 74eb52dc
...@@ -10,7 +10,7 @@ import ( ...@@ -10,7 +10,7 @@ import (
"sync" "sync"
"time" "time"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
"golang.org/x/net/http2" "golang.org/x/net/http2"
) )
......
gost/examples/bench/srv.go → examples/bench/srv.go
View file @ 74eb52dc
...@@ -9,7 +9,7 @@ import ( ...@@ -9,7 +9,7 @@ import (
"net/url" "net/url"
"time" "time"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
"golang.org/x/net/http2" "golang.org/x/net/http2"
) )
......
gost/examples/forward/direct/client.go → examples/forward/direct/client.go
View file @ 74eb52dc
...@@ -3,7 +3,7 @@ package main ...@@ -3,7 +3,7 @@ package main
import ( import (
"log" "log"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
func main() { func main() {
......
gost/examples/forward/direct/server.go → examples/forward/direct/server.go
View file @ 74eb52dc
...@@ -4,7 +4,7 @@ import ( ...@@ -4,7 +4,7 @@ import (
"crypto/tls" "crypto/tls"
"log" "log"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
func main() { func main() {
......
gost/examples/forward/remote/client.go → examples/forward/remote/client.go
View file @ 74eb52dc
...@@ -3,7 +3,7 @@ package main ...@@ -3,7 +3,7 @@ package main
import ( import (
"log" "log"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
func main() { func main() {
......
gost/examples/forward/remote/server.go → examples/forward/remote/server.go
View file @ 74eb52dc
...@@ -4,7 +4,7 @@ import ( ...@@ -4,7 +4,7 @@ import (
"crypto/tls" "crypto/tls"
"log" "log"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
func main() { func main() {
......
gost/examples/forward/udp/direct.go → examples/forward/udp/direct.go
View file @ 74eb52dc
...@@ -5,7 +5,7 @@ import ( ...@@ -5,7 +5,7 @@ import (
"log" "log"
"time" "time"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
var ( var (
......
gost/examples/forward/udp/remote.go → examples/forward/udp/remote.go
View file @ 74eb52dc
...@@ -5,7 +5,7 @@ import ( ...@@ -5,7 +5,7 @@ import (
"log" "log"
"time" "time"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
var ( var (
......
gost/examples/http2/http2.go → examples/http2/http2.go
View file @ 74eb52dc
...@@ -8,7 +8,7 @@ import ( ...@@ -8,7 +8,7 @@ import (
"golang.org/x/net/http2" "golang.org/x/net/http2"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
var ( var (
......
gost/examples/quic/quicc.go → examples/quic/quicc.go
View file @ 74eb52dc
...@@ -6,7 +6,7 @@ import ( ...@@ -6,7 +6,7 @@ import (
"log" "log"
"time" "time"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
var ( var (
......
gost/examples/quic/quics.go → examples/quic/quics.go
View file @ 74eb52dc
...@@ -5,7 +5,7 @@ import ( ...@@ -5,7 +5,7 @@ import (
"flag" "flag"
"log" "log"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
var ( var (
......
gost/examples/ssh/sshc.go → examples/ssh/sshc.go
View file @ 74eb52dc
...@@ -4,8 +4,9 @@ import ( ...@@ -4,8 +4,9 @@ import (
"crypto/tls" "crypto/tls"
"flag" "flag"
"log" "log"
"time"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
var ( var (
...@@ -33,6 +34,9 @@ func main() { ...@@ -33,6 +34,9 @@ func main() {
Protocol: "socks5", Protocol: "socks5",
Transport: "ssh", Transport: "ssh",
Addr: faddr, Addr: faddr,
HandshakeOptions: []gost.HandshakeOption{
gost.IntervalHandshakeOption(30 * time.Second),
},
Client: &gost.Client{ Client: &gost.Client{
Connector: gost.SOCKS5Connector(nil), Connector: gost.SOCKS5Connector(nil),
Transporter: gost.SSHTunnelTransporter(), Transporter: gost.SSHTunnelTransporter(),
......
gost/examples/ssh/sshd.go → examples/ssh/sshd.go
View file @ 74eb52dc
...@@ -5,7 +5,7 @@ import ( ...@@ -5,7 +5,7 @@ import (
"flag" "flag"
"log" "log"
"github.com/ginuerzh/gost/gost" "github.com/ginuerzh/gost"
) )
var ( var (
......
forward.go
View file @ 74eb52dc
This diff is collapsed.
gost.go
View file @ 74eb52dc
...@@ -6,88 +6,76 @@ import ( ...@@ -6,88 +6,76 @@ import (
"crypto/tls" "crypto/tls"
"crypto/x509" "crypto/x509"
"crypto/x509/pkix" "crypto/x509/pkix"
"encoding/base64"
"encoding/pem" "encoding/pem"
"errors"
"io"
"math/big" "math/big"
"net"
"strings"
"time" "time"
"github.com/golang/glog" "github.com/go-log/log"
) )
const ( // Version is the gost version.
Version = "2.4-dev20170711" const Version = "2.4-dev20170803"
)
// Log level for glog
const (
LFATAL = iota
LERROR
LWARNING
LINFO
LDEBUG
)
// Debug is a flag that enables the debug log.
var Debug bool var Debug bool
var ( var (
KeepAliveTime = 180 * time.Second tinyBufferSize = 128
DialTimeout = 30 * time.Second smallBufferSize = 1 * 1024 // 1KB small buffer
ReadTimeout = 90 * time.Second mediumBufferSize = 8 * 1024 // 8KB medium buffer
WriteTimeout = 90 * time.Second largeBufferSize = 32 * 1024 // 32KB large buffer
DefaultTTL = 60 // default udp node TTL in second for udp port forwarding
) )
var ( var (
SmallBufferSize = 1 * 1024 // 1KB small buffer // KeepAliveTime is the keep alive time period for TCP connection.
MediumBufferSize = 8 * 1024 // 8KB medium buffer KeepAliveTime = 180 * time.Second
LargeBufferSize = 32 * 1024 // 32KB large buffer // DialTimeout is the timeout of dial.
) DialTimeout = 30 * time.Second
// ReadTimeout is the timeout for reading.
var ( ReadTimeout = 30 * time.Second
DefaultCertFile = "cert.pem" // WriteTimeout is the timeout for writing.
DefaultKeyFile = "key.pem" WriteTimeout = 60 * time.Second
// PingTimeout is the timeout for pinging.
// This is the default cert and key data for convenience, providing your own cert is recommended. PingTimeout = 30 * time.Second
defaultRawCert []byte // PingRetries is the reties of ping.
defaultRawKey []byte PingRetries = 3
// default udp node TTL in second for udp port forwarding.
defaultTTL = 60 * time.Second
) )
var ( var (
ErrEmptyChain = errors.New("empty chain") DefaultTLSConfig *tls.Config
) )
func setKeepAlive(conn net.Conn, d time.Duration) error { func init() {
c, ok := conn.(*net.TCPConn) rawCert, rawKey, err := generateKeyPair()
if !ok { if err != nil {
return errors.New("Not a TCP connection") panic(err)
} }
if err := c.SetKeepAlive(true); err != nil { cert, err := tls.X509KeyPair(rawCert, rawKey)
return err if err != nil {
panic(err)
} }
if err := c.SetKeepAlivePeriod(d); err != nil { DefaultTLSConfig = &tls.Config{
return err Certificates: []tls.Certificate{cert},
} }
return nil
log.DefaultLogger = &LogLogger{}
} }
func generateKeyPair() (rawCert, rawKey []byte) { func SetLogger(logger log.Logger) {
if defaultRawCert != nil && defaultRawKey != nil { log.DefaultLogger = logger
return defaultRawCert, defaultRawKey }
}
func generateKeyPair() (rawCert, rawKey []byte, err error) {
// Create private key and self-signed certificate // Create private key and self-signed certificate
// Adapted from https://golang.org/src/crypto/tls/generate_cert.go // Adapted from https://golang.org/src/crypto/tls/generate_cert.go
priv, err := rsa.GenerateKey(rand.Reader, 2048) priv, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil { if err != nil {
glog.Fatal(err) return
} }
validFor := time.Hour * 24 * 365 * 10 validFor := time.Hour * 24 * 365 * 10 // ten years
notBefore := time.Now() notBefore := time.Now()
notAfter := notBefore.Add(validFor) notAfter := notBefore.Add(validFor)
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
...@@ -106,68 +94,11 @@ func generateKeyPair() (rawCert, rawKey []byte) { ...@@ -106,68 +94,11 @@ func generateKeyPair() (rawCert, rawKey []byte) {
} }
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv) derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
if err != nil { if err != nil {
glog.Fatal(err) return
} }
rawCert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) rawCert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
rawKey = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)}) rawKey = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
return rawCert, rawKey return
}
// Load the certificate from cert and key files, will use the default certificate if the provided info are invalid.
func LoadCertificate(certFile, keyFile string) (tls.Certificate, error) {
tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
if err == nil {
return tlsCert, nil
}
glog.V(LWARNING).Infoln(err)
rawCert, rawKey := defaultRawCert, defaultRawKey
if defaultRawCert == nil || defaultRawKey == nil {
rawCert, rawKey = generateKeyPair()
}
return tls.X509KeyPair(rawCert, rawKey)
}
// Replace the default certificate by your own
func SetDefaultCertificate(rawCert, rawKey []byte) {
defaultRawCert = rawCert
defaultRawKey = rawKey
}
func basicProxyAuth(proxyAuth string) (username, password string, ok bool) {
if proxyAuth == "" {
return
}
if !strings.HasPrefix(proxyAuth, "Basic ") {
return
}
c, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(proxyAuth, "Basic "))
if err != nil {
return
}
cs := string(c)
s := strings.IndexByte(cs, ':')
if s < 0 {
return
}
return cs[:s], cs[s+1:], true
}
func Transport(rw1, rw2 io.ReadWriter) error {
errc := make(chan error, 1)
go func() {
_, err := io.Copy(rw1, rw2)
errc <- err
}()
go func() {
_, err := io.Copy(rw2, rw1)
errc <- err
}()
return <-errc
} }
gost/chain.go deleted 100644 → 0
View file @ 6613df99
package gost
import (
"errors"
"net"
)
var (
// ErrEmptyChain is an error that implies the chain is empty.
ErrEmptyChain = errors.New("empty chain")
)
// Chain is a proxy chain that holds a list of proxy nodes.
type Chain struct {
nodes []Node
}
// NewChain creates a proxy chain with proxy nodes nodes.
func NewChain(nodes ...Node) *Chain {
return &Chain{
nodes: nodes,
}
}
// Nodes returns the proxy nodes that the chain holds.
func (c *Chain) Nodes() []Node {
return c.nodes
}
// LastNode returns the last node of the node list.
// If the chain is empty, an empty node is returns.
func (c *Chain) LastNode() Node {
if c.IsEmpty() {
return Node{}
}
return c.nodes[len(c.nodes)-1]
}
// AddNode appends the node(s) to the chain.
func (c *Chain) AddNode(nodes ...Node) {
if c == nil {
return
}
c.nodes = append(c.nodes, nodes...)
}
// IsEmpty checks if the chain is empty.
// An empty chain means that there is no proxy node in the chain.
func (c *Chain) IsEmpty() bool {
return c == nil || len(c.nodes) == 0
}
// Dial connects to the target address addr through the chain.
// If the chain is empty, it will use the net.Dial directly.
func (c *Chain) Dial(addr string) (net.Conn, error) {
if c.IsEmpty() {
return net.Dial("tcp", addr)
}
conn, err := c.Conn()
if err != nil {
return nil, err
}
cc, err := c.LastNode().Client.Connect(conn, addr)
if err != nil {
conn.Close()
return nil, err
}
return cc, nil
}
// Conn obtains a handshaked connection to the last node of the chain.
// If the chain is empty, it returns an ErrEmptyChain error.
func (c *Chain) Conn() (net.Conn, error) {
if c.IsEmpty() {
return nil, ErrEmptyChain
}
nodes := c.nodes
conn, err := nodes[0].Client.Dial(nodes[0].Addr, nodes[0].DialOptions...)
if err != nil {
return nil, err
}
conn, err = nodes[0].Client.Handshake(conn, nodes[0].HandshakeOptions...)
if err != nil {
return nil, err
}
for i, node := range nodes {
if i == len(nodes)-1 {
break
}
next := nodes[i+1]
cc, err := node.Client.Connect(conn, next.Addr)
if err != nil {
conn.Close()
return nil, err
}
cc, err = next.Client.Handshake(cc, next.HandshakeOptions...)
if err != nil {
conn.Close()
return nil, err
}
conn = cc
}
return conn, nil
}
gost/cmd/gost/main.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/forward.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/gost.go deleted 100644 → 0
View file @ 6613df99
package gost
import (
"crypto/rand"
"crypto/rsa"
"crypto/x509"
"crypto/x509/pkix"
"encoding/pem"
"math/big"
"time"
"github.com/go-log/log"
)
// Version is the gost version.
const Version = "2.4-dev20170803"
// Debug is a flag that enables the debug log.
var Debug bool
var (
tinyBufferSize = 128
smallBufferSize = 1 * 1024 // 1KB small buffer
mediumBufferSize = 8 * 1024 // 8KB medium buffer
largeBufferSize = 32 * 1024 // 32KB large buffer
)
var (
// KeepAliveTime is the keep alive time period for TCP connection.
KeepAliveTime = 180 * time.Second
// DialTimeout is the timeout of dial.
DialTimeout = 30 * time.Second
// ReadTimeout is the timeout for reading.
ReadTimeout = 30 * time.Second
// WriteTimeout is the timeout for writing.
WriteTimeout = 60 * time.Second
// PingTimeout is the timeout for pinging.
PingTimeout = 30 * time.Second
// PingRetries is the reties of ping.
PingRetries = 3
// default udp node TTL in second for udp port forwarding.
defaultTTL = 60 * time.Second
)
var (
defaultRawCert []byte
defaultRawKey []byte
)
func init() {
rawCert, rawKey, err := generateKeyPair()
if err != nil {
panic(err)
}
defaultRawCert, defaultRawKey = rawCert, rawKey
log.DefaultLogger = &LogLogger{}
}
func SetLogger(logger log.Logger) {
log.DefaultLogger = logger
}
func generateKeyPair() (rawCert, rawKey []byte, err error) {
if defaultRawCert != nil && defaultRawKey != nil {
return defaultRawCert, defaultRawKey, nil
}
// Create private key and self-signed certificate
// Adapted from https://golang.org/src/crypto/tls/generate_cert.go
priv, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
return
}
validFor := time.Hour * 24 * 365 * 10 // ten years
notBefore := time.Now()
notAfter := notBefore.Add(validFor)
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
template := x509.Certificate{
SerialNumber: serialNumber,
Subject: pkix.Name{
Organization: []string{"gost"},
},
NotBefore: notBefore,
NotAfter: notAfter,
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
BasicConstraintsValid: true,
}
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
if err != nil {
return
}
rawCert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
rawKey = pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
return
}
// SetDefaultCertificate replaces the default certificate by your own
func SetDefaultCertificate(rawCert, rawKey []byte) {
defaultRawCert = rawCert
defaultRawKey = rawKey
}
gost/handler.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/http.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/kcp.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/node.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/permissions.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/permissions_test.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/quic.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/redirect.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/redirect_win.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/server.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/signal.go deleted 100644 → 0
View file @ 6613df99
// +build windows
package gost
func kcpSigHandler() {}
gost/signal_unix.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/socks.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/ss.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/ssh.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
gost/ws.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
handler.go
View file @ 74eb52dc
This diff is collapsed.
http.go
View file @ 74eb52dc
This diff is collapsed.
gost/http2.go → http2.go
View file @ 74eb52dc
This diff is collapsed.
kcp.go
View file @ 74eb52dc
This diff is collapsed.
node.go
View file @ 74eb52dc
This diff is collapsed.
node_test.go deleted 100644 → 0
View file @ 6613df99
This diff is collapsed.
permissions.go
View file @ 74eb52dc
This diff is collapsed.
quic.go
View file @ 74eb52dc
This diff is collapsed.
redirect.go
View file @ 74eb52dc
This diff is collapsed.
redirect_win.go
View file @ 74eb52dc
This diff is collapsed.
server.go
View file @ 74eb52dc
This diff is collapsed.
signal_unix.go
View file @ 74eb52dc
This diff is collapsed.
socks.go
View file @ 74eb52dc
This diff is collapsed.
ss.go
View file @ 74eb52dc
This diff is collapsed.
ssh.go
View file @ 74eb52dc
This diff is collapsed.
gost/tls.go → tls.go
View file @ 74eb52dc
This diff is collapsed.
ws.go
View file @ 74eb52dc
This diff is collapsed.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment