package vmess import ( "bufio" "bytes" "context" "crypto/sha1" "crypto/tls" "encoding/base64" "encoding/binary" "errors" "fmt" "io" "net" "net/http" "net/url" "strconv" "strings" "time" "github.com/metacubex/mihomo/common/buf" N "github.com/metacubex/mihomo/common/net" tlsC "github.com/metacubex/mihomo/component/tls" "github.com/metacubex/mihomo/log" "github.com/gobwas/ws" "github.com/gobwas/ws/wsutil" "github.com/zhangyunhao116/fastrand" ) type websocketConn struct { net.Conn state ws.State reader *wsutil.Reader controlHandler wsutil.FrameHandlerFunc rawWriter N.ExtendedWriter } type websocketWithEarlyDataConn struct { net.Conn wsWriter N.ExtendedWriter underlay net.Conn closed bool dialed chan bool cancel context.CancelFunc ctx context.Context config *WebsocketConfig } type WebsocketConfig struct { Host string Port string Path string Headers http.Header TLS bool TLSConfig *tls.Config MaxEarlyData int EarlyDataHeaderName string ClientFingerprint string V2rayHttpUpgrade bool V2rayHttpUpgradeFastOpen bool } // Read implements net.Conn.Read() // modify from gobwas/ws/wsutil.readData func (wsc *websocketConn) Read(b []byte) (n int, err error) { defer func() { // avoid gobwas/ws pbytes.GetLen panic if value := recover(); value != nil { err = fmt.Errorf("websocket error: %s", value) } }() var header ws.Header for { n, err = wsc.reader.Read(b) // in gobwas/ws: "The error is io.EOF only if all of message bytes were read." // but maybe next frame still have data, so drop it if errors.Is(err, io.EOF) { err = nil } if !errors.Is(err, wsutil.ErrNoFrameAdvance) { return } header, err = wsc.reader.NextFrame() if err != nil { return } if header.OpCode.IsControl() { err = wsc.controlHandler(header, wsc.reader) if err != nil { return } continue } if header.OpCode&(ws.OpBinary|ws.OpText) == 0 { err = wsc.reader.Discard() if err != nil { return } continue } } } // Write implements io.Writer. func (wsc *websocketConn) Write(b []byte) (n int, err error) { err = wsutil.WriteMessage(wsc.Conn, wsc.state, ws.OpBinary, b) if err != nil { return } n = len(b) return } func (wsc *websocketConn) WriteBuffer(buffer *buf.Buffer) error { var payloadBitLength int dataLen := buffer.Len() data := buffer.Bytes() if dataLen < 126 { payloadBitLength = 1 } else if dataLen < 65536 { payloadBitLength = 3 } else { payloadBitLength = 9 } var headerLen int headerLen += 1 // FIN / RSV / OPCODE headerLen += payloadBitLength if wsc.state.ClientSide() { headerLen += 4 // MASK KEY } header := buffer.ExtendHeader(headerLen) header[0] = byte(ws.OpBinary) | 0x80 if wsc.state.ClientSide() { header[1] = 1 << 7 } else { header[1] = 0 } if dataLen < 126 { header[1] |= byte(dataLen) } else if dataLen < 65536 { header[1] |= 126 binary.BigEndian.PutUint16(header[2:], uint16(dataLen)) } else { header[1] |= 127 binary.BigEndian.PutUint64(header[2:], uint64(dataLen)) } if wsc.state.ClientSide() { maskKey := fastrand.Uint32() binary.LittleEndian.PutUint32(header[1+payloadBitLength:], maskKey) N.MaskWebSocket(maskKey, data) } return wsc.rawWriter.WriteBuffer(buffer) } func (wsc *websocketConn) FrontHeadroom() int { return 14 } func (wsc *websocketConn) Upstream() any { return wsc.Conn } func (wsc *websocketConn) Close() error { _ = wsc.Conn.SetWriteDeadline(time.Now().Add(time.Second * 5)) _ = wsutil.WriteMessage(wsc.Conn, wsc.state, ws.OpClose, ws.NewCloseFrameBody(ws.StatusNormalClosure, "")) _ = wsc.Conn.Close() return nil } func (wsedc *websocketWithEarlyDataConn) Dial(earlyData []byte) error { base64DataBuf := &bytes.Buffer{} base64EarlyDataEncoder := base64.NewEncoder(base64.RawURLEncoding, base64DataBuf) earlyDataBuf := bytes.NewBuffer(earlyData) if _, err := base64EarlyDataEncoder.Write(earlyDataBuf.Next(wsedc.config.MaxEarlyData)); err != nil { return fmt.Errorf("failed to encode early data: %w", err) } if errc := base64EarlyDataEncoder.Close(); errc != nil { return fmt.Errorf("failed to encode early data tail: %w", errc) } var err error if wsedc.Conn, err = streamWebsocketConn(wsedc.ctx, wsedc.underlay, wsedc.config, base64DataBuf); err != nil { wsedc.Close() return fmt.Errorf("failed to dial WebSocket: %w", err) } wsedc.dialed <- true wsedc.wsWriter = N.NewExtendedWriter(wsedc.Conn) if earlyDataBuf.Len() != 0 { _, err = wsedc.Conn.Write(earlyDataBuf.Bytes()) } return err } func (wsedc *websocketWithEarlyDataConn) Write(b []byte) (int, error) { if wsedc.closed { return 0, io.ErrClosedPipe } if wsedc.Conn == nil { if err := wsedc.Dial(b); err != nil { return 0, err } return len(b), nil } return wsedc.Conn.Write(b) } func (wsedc *websocketWithEarlyDataConn) WriteBuffer(buffer *buf.Buffer) error { if wsedc.closed { return io.ErrClosedPipe } if wsedc.Conn == nil { if err := wsedc.Dial(buffer.Bytes()); err != nil { return err } return nil } return wsedc.wsWriter.WriteBuffer(buffer) } func (wsedc *websocketWithEarlyDataConn) Read(b []byte) (int, error) { if wsedc.closed { return 0, io.ErrClosedPipe } if wsedc.Conn == nil { select { case <-wsedc.ctx.Done(): return 0, io.ErrUnexpectedEOF case <-wsedc.dialed: } } return wsedc.Conn.Read(b) } func (wsedc *websocketWithEarlyDataConn) Close() error { wsedc.closed = true wsedc.cancel() if wsedc.Conn == nil { return nil } return wsedc.Conn.Close() } func (wsedc *websocketWithEarlyDataConn) LocalAddr() net.Addr { if wsedc.Conn == nil { return wsedc.underlay.LocalAddr() } return wsedc.Conn.LocalAddr() } func (wsedc *websocketWithEarlyDataConn) RemoteAddr() net.Addr { if wsedc.Conn == nil { return wsedc.underlay.RemoteAddr() } return wsedc.Conn.RemoteAddr() } func (wsedc *websocketWithEarlyDataConn) SetDeadline(t time.Time) error { if err := wsedc.SetReadDeadline(t); err != nil { return err } return wsedc.SetWriteDeadline(t) } func (wsedc *websocketWithEarlyDataConn) SetReadDeadline(t time.Time) error { if wsedc.Conn == nil { return nil } return wsedc.Conn.SetReadDeadline(t) } func (wsedc *websocketWithEarlyDataConn) SetWriteDeadline(t time.Time) error { if wsedc.Conn == nil { return nil } return wsedc.Conn.SetWriteDeadline(t) } func (wsedc *websocketWithEarlyDataConn) FrontHeadroom() int { return 14 } func (wsedc *websocketWithEarlyDataConn) Upstream() any { return wsedc.underlay } //func (wsedc *websocketWithEarlyDataConn) LazyHeadroom() bool { // return wsedc.Conn == nil //} // //func (wsedc *websocketWithEarlyDataConn) Upstream() any { // if wsedc.Conn == nil { // ensure return a nil interface not an interface with nil value // return nil // } // return wsedc.Conn //} func (wsedc *websocketWithEarlyDataConn) NeedHandshake() bool { return wsedc.Conn == nil } func streamWebsocketWithEarlyDataConn(conn net.Conn, c *WebsocketConfig) (net.Conn, error) { ctx, cancel := context.WithCancel(context.Background()) conn = &websocketWithEarlyDataConn{ dialed: make(chan bool, 1), cancel: cancel, ctx: ctx, underlay: conn, config: c, } // websocketWithEarlyDataConn can't correct handle Deadline // it will not apply the already set Deadline after Dial() // so call N.NewDeadlineConn to add a safe wrapper return N.NewDeadlineConn(conn), nil } func streamWebsocketConn(ctx context.Context, conn net.Conn, c *WebsocketConfig, earlyData *bytes.Buffer) (net.Conn, error) { u, err := url.Parse(c.Path) if err != nil { return nil, fmt.Errorf("parse url %s error: %w", c.Path, err) } uri := url.URL{ Scheme: "ws", Host: net.JoinHostPort(c.Host, c.Port), Path: u.Path, RawQuery: u.RawQuery, } if !strings.HasPrefix(uri.Path, "/") { uri.Path = "/" + uri.Path } if c.TLS { uri.Scheme = "wss" config := c.TLSConfig if config == nil { // The config cannot be nil config = &tls.Config{NextProtos: []string{"http/1.1"}} } if config.ServerName == "" && !config.InsecureSkipVerify { // users must set either ServerName or InsecureSkipVerify in the config. config = config.Clone() config.ServerName = uri.Host } if len(c.ClientFingerprint) != 0 { if fingerprint, exists := tlsC.GetFingerprint(c.ClientFingerprint); exists { utlsConn := tlsC.UClient(conn, config, fingerprint) if err = utlsConn.BuildWebsocketHandshakeState(); err != nil { return nil, fmt.Errorf("parse url %s error: %w", c.Path, err) } conn = utlsConn } } else { conn = tls.Client(conn, config) } if tlsConn, ok := conn.(interface { HandshakeContext(ctx context.Context) error }); ok { if err = tlsConn.HandshakeContext(ctx); err != nil { return nil, err } } } request := &http.Request{ Method: http.MethodGet, URL: &uri, Header: c.Headers.Clone(), Host: c.Host, } request.Header.Set("Connection", "Upgrade") request.Header.Set("Upgrade", "websocket") if host := request.Header.Get("Host"); host != "" { // For client requests, Host optionally overrides the Host // header to send. If empty, the Request.Write method uses // the value of URL.Host. Host may contain an international // domain name. request.Host = host } request.Header.Del("Host") var secKey string if !c.V2rayHttpUpgrade { const nonceKeySize = 16 // NOTE: bts does not escape. bts := make([]byte, nonceKeySize) if _, err = fastrand.Read(bts); err != nil { return nil, fmt.Errorf("rand read error: %w", err) } secKey = base64.StdEncoding.EncodeToString(bts) request.Header.Set("Sec-WebSocket-Version", "13") request.Header.Set("Sec-WebSocket-Key", secKey) } if earlyData != nil { earlyDataString := earlyData.String() if c.EarlyDataHeaderName == "" { uri.Path += earlyDataString } else { request.Header.Set(c.EarlyDataHeaderName, earlyDataString) } } if ctx.Done() != nil { done := N.SetupContextForConn(ctx, conn) defer done(&err) } err = request.Write(conn) if err != nil { return nil, err } bufferedConn := N.NewBufferedConn(conn) if c.V2rayHttpUpgrade && c.V2rayHttpUpgradeFastOpen { return N.NewEarlyConn(bufferedConn, func() error { response, err := http.ReadResponse(bufferedConn.Reader(), request) if err != nil { return err } if response.StatusCode != http.StatusSwitchingProtocols || !strings.EqualFold(response.Header.Get("Connection"), "upgrade") || !strings.EqualFold(response.Header.Get("Upgrade"), "websocket") { return fmt.Errorf("unexpected status: %s", response.Status) } return nil }), nil } response, err := http.ReadResponse(bufferedConn.Reader(), request) if err != nil { return nil, err } if response.StatusCode != http.StatusSwitchingProtocols || !strings.EqualFold(response.Header.Get("Connection"), "upgrade") || !strings.EqualFold(response.Header.Get("Upgrade"), "websocket") { return nil, fmt.Errorf("unexpected status: %s", response.Status) } if c.V2rayHttpUpgrade { return bufferedConn, nil } if log.Level() == log.DEBUG { // we might not check this for performance secAccept := response.Header.Get("Sec-Websocket-Accept") const acceptSize = 28 // base64.StdEncoding.EncodedLen(sha1.Size) if lenSecAccept := len(secAccept); lenSecAccept != acceptSize { return nil, fmt.Errorf("unexpected Sec-Websocket-Accept length: %d", lenSecAccept) } if getSecAccept(secKey) != secAccept { return nil, errors.New("unexpected Sec-Websocket-Accept") } } conn = newWebsocketConn(conn, ws.StateClientSide) // websocketConn can't correct handle ReadDeadline // so call N.NewDeadlineConn to add a safe wrapper return N.NewDeadlineConn(conn), nil } func getSecAccept(secKey string) string { const magic = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" const nonceSize = 24 // base64.StdEncoding.EncodedLen(nonceKeySize) p := make([]byte, nonceSize+len(magic)) copy(p[:nonceSize], secKey) copy(p[nonceSize:], magic) sum := sha1.Sum(p) return base64.StdEncoding.EncodeToString(sum[:]) } func StreamWebsocketConn(ctx context.Context, conn net.Conn, c *WebsocketConfig) (net.Conn, error) { if u, err := url.Parse(c.Path); err == nil { if q := u.Query(); q.Get("ed") != "" { if ed, err := strconv.Atoi(q.Get("ed")); err == nil { c.MaxEarlyData = ed c.EarlyDataHeaderName = "Sec-WebSocket-Protocol" q.Del("ed") u.RawQuery = q.Encode() c.Path = u.String() } } } if c.MaxEarlyData > 0 { return streamWebsocketWithEarlyDataConn(conn, c) } return streamWebsocketConn(ctx, conn, c, nil) } func newWebsocketConn(conn net.Conn, state ws.State) *websocketConn { controlHandler := wsutil.ControlFrameHandler(conn, state) return &websocketConn{ Conn: conn, state: state, reader: &wsutil.Reader{ Source: conn, State: state, SkipHeaderCheck: true, CheckUTF8: false, OnIntermediate: controlHandler, }, controlHandler: controlHandler, rawWriter: N.NewExtendedWriter(conn), } } var replacer = strings.NewReplacer("+", "-", "/", "_", "=", "") func decodeEd(s string) ([]byte, error) { return base64.RawURLEncoding.DecodeString(replacer.Replace(s)) } func decodeXray0rtt(requestHeader http.Header) []byte { // read inHeader's `Sec-WebSocket-Protocol` for Xray's 0rtt ws if secProtocol := requestHeader.Get("Sec-WebSocket-Protocol"); len(secProtocol) > 0 { if edBuf, err := decodeEd(secProtocol); err == nil { // sure could base64 decode return edBuf } } return nil } func IsWebSocketUpgrade(r *http.Request) bool { return r.Header.Get("Upgrade") == "websocket" } func IsV2rayHttpUpdate(r *http.Request) bool { return IsWebSocketUpgrade(r) && r.Header.Get("Sec-WebSocket-Key") == "" } func StreamUpgradedWebsocketConn(w http.ResponseWriter, r *http.Request) (net.Conn, error) { var conn net.Conn var rw *bufio.ReadWriter var err error isRaw := IsV2rayHttpUpdate(r) w.Header().Set("Connection", "upgrade") w.Header().Set("Upgrade", "websocket") if !isRaw { w.Header().Set("Sec-Websocket-Accept", getSecAccept(r.Header.Get("Sec-WebSocket-Key"))) } w.WriteHeader(http.StatusSwitchingProtocols) if flusher, isFlusher := w.(interface{ FlushError() error }); isFlusher { err = flusher.FlushError() if err != nil { return nil, fmt.Errorf("flush response: %w", err) } } hijacker, canHijack := w.(http.Hijacker) if !canHijack { return nil, errors.New("invalid connection, maybe HTTP/2") } conn, rw, err = hijacker.Hijack() if err != nil { return nil, fmt.Errorf("hijack failed: %w", err) } // rw.Writer was flushed, so we only need warp rw.Reader conn = N.WarpConnWithBioReader(conn, rw.Reader) if !isRaw { conn = newWebsocketConn(conn, ws.StateServerSide) // websocketConn can't correct handle ReadDeadline // so call N.NewDeadlineConn to add a safe wrapper conn = N.NewDeadlineConn(conn) } if edBuf := decodeXray0rtt(r.Header); len(edBuf) > 0 { appendOk := false if bufConn, ok := conn.(*N.BufferedConn); ok { appendOk = bufConn.AppendData(edBuf) } if !appendOk { conn = N.NewCachedConn(conn, edBuf) } } return conn, nil }