Add SSH inbound, log level. Update MTPROXY. Fixes

transport/masque/device.go

@@ -18,16 +18,23 @@ type Device interface {
 }
 
 type DeviceOptions struct {
-	Context      context.Context
-	Logger       logger.ContextLogger
-	Handler      tun.Handler
-	UDPTimeout   time.Duration
-	CreateDialer func(interfaceName string) N.Dialer
-	Name         string
-	MTU          uint32
-	Address      []netip.Prefix
+	Context        context.Context
+	Logger         logger.ContextLogger
+	System         bool
+	UDPTimeout     time.Duration
+	CreateDialer   func(interfaceName string) N.Dialer
+	Name           string
+	MTU            uint32
+	Address        []netip.Prefix
+	AllowedAddress []netip.Prefix
 }
 
 func NewDevice(options DeviceOptions) (Device, error) {
-	return newStackDevice(options)
+	if !options.System {
+		return newStackDevice(options)
+	} else if !tun.WithGVisor {
+		return newSystemDevice(options)
+	} else {
+		return newSystemStackDevice(options)
+	}
 }

transport/masque/device_stack.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/netip"
 	"os"
+	"sync"
 
 	"github.com/sagernet/gvisor/pkg/buffer"
 	"github.com/sagernet/gvisor/pkg/tcpip"
@@ -15,9 +16,6 @@ import (
 	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv4"
 	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv6"
 	"github.com/sagernet/gvisor/pkg/tcpip/stack"
-	"github.com/sagernet/gvisor/pkg/tcpip/transport/icmp"
-	"github.com/sagernet/gvisor/pkg/tcpip/transport/tcp"
-	"github.com/sagernet/gvisor/pkg/tcpip/transport/udp"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/transport/wireguard"
 	"github.com/sagernet/sing-tun"
@@ -29,15 +27,15 @@ import (
 )
 
 type stackDevice struct {
-	ctx    context.Context
-	logger log.ContextLogger
-	stack  *stack.Stack
-	mtu    uint32
-	events chan wgTun.Event
-	wgTun.Device
+	ctx            context.Context
+	logger         log.ContextLogger
+	stack          *stack.Stack
+	mtu            uint32
+	events         chan wgTun.Event
 	outbound       chan *stack.PacketBuffer
 	packetOutbound chan *buf.Buffer
 	done           chan struct{}
+	closeOnce      sync.Once
 	dispatcher     stack.NetworkDispatcher
 	inet4Address   netip.Addr
 	inet6Address   netip.Addr
@@ -84,13 +82,6 @@ func newStackDevice(options DeviceOptions) (*stackDevice, error) {
 		}
 	}
 	tunDevice.stack = ipStack
-	if options.Handler != nil {
-		ipStack.SetTransportProtocolHandler(tcp.ProtocolNumber, tun.NewTCPForwarder(options.Context, ipStack, options.Handler).HandlePacket)
-		ipStack.SetTransportProtocolHandler(udp.ProtocolNumber, tun.NewUDPForwarder(options.Context, ipStack, options.Handler, options.UDPTimeout).HandlePacket)
-		icmpForwarder := tun.NewICMPForwarder(options.Context, ipStack, options.Handler, options.UDPTimeout)
-		ipStack.SetTransportProtocolHandler(icmp.ProtocolNumber4, icmpForwarder.HandlePacket)
-		ipStack.SetTransportProtocolHandler(icmp.ProtocolNumber6, icmpForwarder.HandlePacket)
-	}
 	return tunDevice, nil
 }
 
@@ -141,11 +132,17 @@ func (w *stackDevice) ListenPacket(ctx context.Context, destination M.Socksaddr)
 	}
 	var networkProtocol tcpip.NetworkProtocolNumber
 	if destination.IsIPv4() {
+		if !w.inet4Address.IsValid() {
+			return nil, E.New("missing IPv4 local address")
+		}
 		networkProtocol = header.IPv4ProtocolNumber
 		bind.Addr = tun.AddressFromAddr(w.inet4Address)
 	} else {
+		if !w.inet6Address.IsValid() {
+			return nil, E.New("missing IPv6 local address")
+		}
 		networkProtocol = header.IPv6ProtocolNumber
-		bind.Addr = tun.AddressFromAddr(w.inet4Address)
+		bind.Addr = tun.AddressFromAddr(w.inet6Address)
 	}
 	udpConn, err := gonet.DialUDP(w.stack, &bind, nil, networkProtocol)
 	if err != nil {
@@ -228,13 +225,15 @@ func (w *stackDevice) Events() <-chan wgTun.Event {
 }
 
 func (w *stackDevice) Close() error {
-	close(w.done)
-	close(w.events)
-	w.stack.Close()
-	for _, endpoint := range w.stack.CleanupEndpoints() {
-		endpoint.Abort()
-	}
-	w.stack.Wait()
+	w.closeOnce.Do(func() {
+		close(w.done)
+		close(w.events)
+		w.stack.Close()
+		for _, endpoint := range w.stack.CleanupEndpoints() {
+			endpoint.Abort()
+		}
+		w.stack.Wait()
+	})
 	return nil
 }
 

transport/masque/device_system.go

@@ -0,0 +1,191 @@
+package masque
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/netip"
+	"os"
+	"runtime"
+	"sync"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-tun"
+	"github.com/sagernet/sing/common"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/service"
+	wgTun "github.com/sagernet/wireguard-go/tun"
+)
+
+var _ Device = (*systemDevice)(nil)
+
+type systemDevice struct {
+	options      DeviceOptions
+	dialer       N.Dialer
+	device       tun.Tun
+	batchDevice  tun.LinuxTUN
+	events       chan wgTun.Event
+	closeOnce    sync.Once
+	inet4Address netip.Addr
+	inet6Address netip.Addr
+}
+
+func newSystemDevice(options DeviceOptions) (*systemDevice, error) {
+	if options.Name == "" {
+		options.Name = tun.CalculateInterfaceName("masque")
+	}
+	var inet4Address netip.Addr
+	var inet6Address netip.Addr
+	if len(options.Address) > 0 {
+		if prefix := common.Find(options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is4()
+		}); prefix.IsValid() {
+			inet4Address = prefix.Addr()
+		}
+	}
+	if len(options.Address) > 0 {
+		if prefix := common.Find(options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is6()
+		}); prefix.IsValid() {
+			inet6Address = prefix.Addr()
+		}
+	}
+	return &systemDevice{
+		options:      options,
+		dialer:       options.CreateDialer(options.Name),
+		events:       make(chan wgTun.Event, 1),
+		inet4Address: inet4Address,
+		inet6Address: inet6Address,
+	}, nil
+}
+
+func (w *systemDevice) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	return w.dialer.DialContext(ctx, network, destination)
+}
+
+func (w *systemDevice) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return w.dialer.ListenPacket(ctx, destination)
+}
+
+func (w *systemDevice) Inet4Address() netip.Addr {
+	return w.inet4Address
+}
+
+func (w *systemDevice) Inet6Address() netip.Addr {
+	return w.inet6Address
+}
+
+func (w *systemDevice) Start() error {
+	networkManager := service.FromContext[adapter.NetworkManager](w.options.Context)
+	tunOptions := tun.Options{
+		Name: w.options.Name,
+		Inet4Address: common.Filter(w.options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is4()
+		}),
+		Inet6Address: common.Filter(w.options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is6()
+		}),
+		MTU:            w.options.MTU,
+		GSO:            true,
+		InterfaceScope: true,
+		Inet4RouteAddress: common.Filter(w.options.AllowedAddress, func(it netip.Prefix) bool {
+			return it.Addr().Is4()
+		}),
+		Inet6RouteAddress: common.Filter(w.options.AllowedAddress, func(it netip.Prefix) bool {
+			return it.Addr().Is6()
+		}),
+		InterfaceMonitor: networkManager.InterfaceMonitor(),
+		InterfaceFinder:  networkManager.InterfaceFinder(),
+		Logger:           w.options.Logger,
+	}
+	if runtime.GOOS == "darwin" {
+		tunOptions.AutoRoute = true
+	}
+	tunInterface, err := tun.New(tunOptions)
+	if err != nil {
+		return err
+	}
+	err = tunInterface.Start()
+	if err != nil {
+		tunInterface.Close()
+		return err
+	}
+	w.options.Logger.Notice("started at ", w.options.Name)
+	w.device = tunInterface
+	batchTUN, isBatchTUN := tunInterface.(tun.LinuxTUN)
+	if isBatchTUN && batchTUN.BatchSize() > 1 {
+		w.batchDevice = batchTUN
+	}
+	w.events <- wgTun.EventUp
+	return nil
+}
+
+func (w *systemDevice) File() *os.File {
+	return nil
+}
+
+func (w *systemDevice) Read(bufs [][]byte, sizes []int, offset int) (count int, err error) {
+	if w.batchDevice != nil {
+		count, err = w.batchDevice.BatchRead(bufs, offset-tun.PacketOffset, sizes)
+	} else {
+		sizes[0], err = w.device.Read(bufs[0][offset-tun.PacketOffset:])
+		if err == nil {
+			count = 1
+		} else if errors.Is(err, tun.ErrTooManySegments) {
+			err = wgTun.ErrTooManySegments
+		}
+	}
+	return
+}
+
+func (w *systemDevice) Write(bufs [][]byte, offset int) (count int, err error) {
+	if w.batchDevice != nil {
+		return w.batchDevice.BatchWrite(bufs, offset)
+	}
+	for _, packet := range bufs {
+		if tun.PacketOffset > 0 {
+			clear(packet[offset-tun.PacketOffset : offset])
+			tun.PacketFillHeader(packet[offset-tun.PacketOffset:], tun.PacketIPVersion(packet[offset:]))
+		}
+		_, err = w.device.Write(packet[offset-tun.PacketOffset:])
+		if err != nil {
+			return
+		}
+	}
+	return
+}
+
+func (w *systemDevice) Flush() error {
+	return nil
+}
+
+func (w *systemDevice) MTU() (int, error) {
+	return int(w.options.MTU), nil
+}
+
+func (w *systemDevice) Name() (string, error) {
+	return w.options.Name, nil
+}
+
+func (w *systemDevice) Events() <-chan wgTun.Event {
+	return w.events
+}
+
+func (w *systemDevice) Close() error {
+	var err error
+	w.closeOnce.Do(func() {
+		close(w.events)
+		if w.device != nil {
+			err = w.device.Close()
+		}
+	})
+	return err
+}
+
+func (w *systemDevice) BatchSize() int {
+	if w.batchDevice != nil {
+		return w.batchDevice.BatchSize()
+	}
+	return 1
+}

transport/masque/device_system_stack.go

@@ -0,0 +1,200 @@
+//go:build with_gvisor
+
+package masque
+
+import (
+	"net/netip"
+	"sync"
+
+	"github.com/sagernet/gvisor/pkg/buffer"
+	"github.com/sagernet/gvisor/pkg/tcpip"
+	"github.com/sagernet/gvisor/pkg/tcpip/header"
+	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv4"
+	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv6"
+	"github.com/sagernet/gvisor/pkg/tcpip/stack"
+	"github.com/sagernet/sing-tun"
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+var _ Device = (*systemStackDevice)(nil)
+
+type systemStackDevice struct {
+	*systemDevice
+	stack     *stack.Stack
+	endpoint  *systemStackEndpoint
+	writeBufs [][]byte
+	closeOnce sync.Once
+}
+
+func newSystemStackDevice(options DeviceOptions) (*systemStackDevice, error) {
+	system, err := newSystemDevice(options)
+	if err != nil {
+		return nil, err
+	}
+	endpoint := &systemStackEndpoint{
+		mtu:  options.MTU,
+		done: make(chan struct{}),
+	}
+	ipStack, err := tun.NewGVisorStackWithOptions(endpoint, stack.NICOptions{}, true)
+	if err != nil {
+		return nil, err
+	}
+	for _, prefix := range options.Address {
+		addr := tun.AddressFromAddr(prefix.Addr())
+		protoAddr := tcpip.ProtocolAddress{
+			AddressWithPrefix: tcpip.AddressWithPrefix{
+				Address:   addr,
+				PrefixLen: prefix.Bits(),
+			},
+		}
+		if prefix.Addr().Is4() {
+			protoAddr.Protocol = ipv4.ProtocolNumber
+		} else {
+			protoAddr.Protocol = ipv6.ProtocolNumber
+		}
+		gErr := ipStack.AddProtocolAddress(tun.DefaultNIC, protoAddr, stack.AddressProperties{})
+		if gErr != nil {
+			return nil, E.New("parse local address ", protoAddr.AddressWithPrefix, ": ", gErr.String())
+		}
+	}
+	sd := &systemStackDevice{
+		systemDevice: system,
+		stack:        ipStack,
+		endpoint:     endpoint,
+	}
+	endpoint.device = sd
+	return sd, nil
+}
+
+func (w *systemStackDevice) Write(bufs [][]byte, offset int) (count int, err error) {
+	if w.batchDevice != nil {
+		w.writeBufs = w.writeBufs[:0]
+		for _, packet := range bufs {
+			if !w.writeStack(packet[offset:]) {
+				w.writeBufs = append(w.writeBufs, packet)
+			}
+		}
+		if len(w.writeBufs) > 0 {
+			return w.batchDevice.BatchWrite(w.writeBufs, offset)
+		}
+	} else {
+		for _, packet := range bufs {
+			if !w.writeStack(packet[offset:]) {
+				if tun.PacketOffset > 0 {
+					clear(packet[offset-tun.PacketOffset : offset])
+					tun.PacketFillHeader(packet[offset-tun.PacketOffset:], tun.PacketIPVersion(packet[offset:]))
+				}
+				_, err = w.device.Write(packet[offset-tun.PacketOffset:])
+			}
+			if err != nil {
+				return
+			}
+		}
+	}
+	return
+}
+
+func (w *systemStackDevice) Close() error {
+	var err error
+	w.closeOnce.Do(func() {
+		close(w.endpoint.done)
+		w.stack.Close()
+		for _, endpoint := range w.stack.CleanupEndpoints() {
+			endpoint.Abort()
+		}
+		w.stack.Wait()
+		err = w.systemDevice.Close()
+	})
+	return err
+}
+
+func (w *systemStackDevice) writeStack(packet []byte) bool {
+	var (
+		networkProtocol tcpip.NetworkProtocolNumber
+		destination     netip.Addr
+	)
+	switch header.IPVersion(packet) {
+	case header.IPv4Version:
+		networkProtocol = header.IPv4ProtocolNumber
+		destination = netip.AddrFrom4(header.IPv4(packet).DestinationAddress().As4())
+	case header.IPv6Version:
+		networkProtocol = header.IPv6ProtocolNumber
+		destination = netip.AddrFrom16(header.IPv6(packet).DestinationAddress().As16())
+	}
+	for _, prefix := range w.options.Address {
+		if prefix.Contains(destination) {
+			return false
+		}
+	}
+	packetBuffer := stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Payload: buffer.MakeWithData(packet),
+	})
+	w.endpoint.dispatcher.DeliverNetworkPacket(networkProtocol, packetBuffer)
+	packetBuffer.DecRef()
+	return true
+}
+
+type systemStackEndpoint struct {
+	mtu        uint32
+	done       chan struct{}
+	device     Device
+	dispatcher stack.NetworkDispatcher
+}
+
+func (ep *systemStackEndpoint) MTU() uint32 {
+	return ep.mtu
+}
+
+func (ep *systemStackEndpoint) SetMTU(mtu uint32) {
+}
+
+func (ep *systemStackEndpoint) MaxHeaderLength() uint16 {
+	return 0
+}
+
+func (ep *systemStackEndpoint) LinkAddress() tcpip.LinkAddress {
+	return ""
+}
+
+func (ep *systemStackEndpoint) SetLinkAddress(addr tcpip.LinkAddress) {
+}
+
+func (ep *systemStackEndpoint) Capabilities() stack.LinkEndpointCapabilities {
+	return stack.CapabilityRXChecksumOffload
+}
+
+func (ep *systemStackEndpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	ep.dispatcher = dispatcher
+}
+
+func (ep *systemStackEndpoint) IsAttached() bool {
+	return ep.dispatcher != nil
+}
+
+func (ep *systemStackEndpoint) Wait() {
+}
+
+func (ep *systemStackEndpoint) ARPHardwareType() header.ARPHardwareType {
+	return header.ARPHardwareNone
+}
+
+func (ep *systemStackEndpoint) AddHeader(buffer *stack.PacketBuffer) {
+}
+
+func (ep *systemStackEndpoint) ParseHeader(ptr *stack.PacketBuffer) bool {
+	return true
+}
+
+func (ep *systemStackEndpoint) WritePackets(list stack.PacketBufferList) (int, tcpip.Error) {
+	for _, packetBuffer := range list.AsSlice() {
+		packet := packetBuffer.ToView().AsSlice()
+		ep.device.Write([][]byte{packet}, 0)
+	}
+	return list.Len(), nil
+}
+
+func (ep *systemStackEndpoint) Close() {
+}
+
+func (ep *systemStackEndpoint) SetOnCloseAction(f func()) {
+}

transport/masque/options.go

@@ -5,15 +5,17 @@ import (
 	"net/netip"
 	"time"
 
-	tun "github.com/sagernet/sing-tun"
 	N "github.com/sagernet/sing/common/network"
 	"github.com/sagernet/sing/common/tls"
 )
 
 type TunnelOptions struct {
-	Handler              tun.Handler
+	System               bool
+	Name                 string
+	CreateDialer         func(interfaceName string) N.Dialer
 	Dialer               N.Dialer
 	Address              []netip.Prefix
+	AllowedAddress       []netip.Prefix
 	Endpoint             net.Addr
 	TLSConfig            tls.Config
 	UseHTTP2             bool

transport/masque/tunnel.go

@@ -31,12 +31,15 @@ type Tunnel struct {
 
 func NewTunnel(ctx context.Context, logger logger.ContextLogger, options TunnelOptions) (*Tunnel, error) {
 	deviceOptions := DeviceOptions{
-		Context:    ctx,
-		Logger:     logger,
-		Handler:    options.Handler,
-		UDPTimeout: options.UDPTimeout,
-		MTU:        1280,
-		Address:    options.Address,
+		Context:        ctx,
+		Logger:         logger,
+		System:         options.System,
+		UDPTimeout:     options.UDPTimeout,
+		CreateDialer:   options.CreateDialer,
+		Name:           options.Name,
+		MTU:            1280,
+		Address:        options.Address,
+		AllowedAddress: options.AllowedAddress,
 	}
 	tunDevice, err := NewDevice(deviceOptions)
 	if err != nil {
@@ -102,11 +105,24 @@ func (e *Tunnel) maintainTunnel() {
 				e.logger.ErrorContext(e.ctx, fmt.Errorf("failed to read from TUN device: %v", err))
 				continue
 			}
+			packet := bufs[0][:sizes[0]]
+			if len(packet) > 0 {
+				switch packet[0] >> 4 {
+				case 4:
+					if len(packet) >= 9 && packet[8] <= 1 {
+						continue
+					}
+				case 6:
+					if len(packet) >= 8 && packet[7] <= 1 {
+						continue
+					}
+				}
+			}
 			ipConn, err := e.getIpConn()
 			if err != nil {
 				return
 			}
-			icmp, err := ipConn.WritePacket(bufs[0][:sizes[0]])
+			icmp, err := ipConn.WritePacket(packet)
 			if err != nil {
 				if errors.As(err, new(*connectip.CloseError)) {
 					if ok := e.closeIpConn(ipConn); ok {
@@ -163,11 +179,11 @@ func (e *Tunnel) getIpConn() (*connectip.Conn, error) {
 	if e.ipConn != nil {
 		return e.ipConn, nil
 	}
-	e.logger.InfoContext(e.ctx, "Establishing MASQUE connection to ", e.options.Endpoint)
+	e.logger.NoticeContext(e.ctx, "Establishing MASQUE connection to ", e.options.Endpoint)
 	timer := time.NewTimer(0)
 	defer timer.Stop()
 	for {
-		e.logger.InfoContext(e.ctx, fmt.Errorf("Establishing MASQUE connection to %s", e.options.Endpoint))
+		e.logger.NoticeContext(e.ctx, fmt.Errorf("Establishing MASQUE connection to %s", e.options.Endpoint))
 		udpConn, tr, ipConn, rsp, err := ConnectTunnel(
 			e.ctx,
 			e.options.Dialer,
@@ -207,7 +223,7 @@ func (e *Tunnel) getIpConn() (*connectip.Conn, error) {
 		e.udpConn = udpConn
 		e.tr = tr
 		e.ipConn = ipConn
-		e.logger.InfoContext(e.ctx, "Connected to MASQUE server", e.options.Endpoint)
+		e.logger.NoticeContext(e.ctx, "Connected to MASQUE server ", e.options.Endpoint)
 		return ipConn, nil
 	}
 }

transport/openvpn/control.go

@@ -38,8 +38,8 @@ type ControlChannel struct {
 
 func NewControlChannel(io PacketIO, crypt ControlCrypt, local SessionID) *ControlChannel {
 	ch := &ControlChannel{
-		io:      io,
-		
+		io: io,
+
 		clock:   time.Now,
 		local:   local,
 		pending: make(map[uint32]*ControlPacket),

transport/openvpn/data.go

@@ -11,10 +11,10 @@ const (
 )
 
 type DataChannel struct {
-	cipher  DataCipher
-	keyID   uint8
-	peerID  uint32
-	compLZO bool
+	cipher       DataCipher
+	keyID        uint8
+	peerID       uint32
+	compLZO      bool
 	mu           sync.Mutex
 	sendPacketID uint32
 }

transport/openvpn/device.go

@@ -18,16 +18,23 @@ type Device interface {
 }
 
 type DeviceOptions struct {
-	Context      context.Context
-	Logger       logger.ContextLogger
-	Handler      tun.Handler
-	UDPTimeout   time.Duration
-	CreateDialer func(interfaceName string) N.Dialer
-	Name         string
-	MTU          uint32
-	Address      []netip.Prefix
+	Context        context.Context
+	Logger         logger.ContextLogger
+	System         bool
+	UDPTimeout     time.Duration
+	CreateDialer   func(interfaceName string) N.Dialer
+	Name           string
+	MTU            uint32
+	Address        []netip.Prefix
+	AllowedAddress []netip.Prefix
 }
 
 func NewDevice(options DeviceOptions) (Device, error) {
-	return newStackDevice(options)
+	if !options.System {
+		return newStackDevice(options)
+	} else if !tun.WithGVisor {
+		return newSystemDevice(options)
+	} else {
+		return newSystemStackDevice(options)
+	}
 }

transport/openvpn/device_stack.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/netip"
 	"os"
+	"sync"
 
 	"github.com/sagernet/gvisor/pkg/buffer"
 	"github.com/sagernet/gvisor/pkg/tcpip"
@@ -15,9 +16,6 @@ import (
 	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv4"
 	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv6"
 	"github.com/sagernet/gvisor/pkg/tcpip/stack"
-	"github.com/sagernet/gvisor/pkg/tcpip/transport/icmp"
-	"github.com/sagernet/gvisor/pkg/tcpip/transport/tcp"
-	"github.com/sagernet/gvisor/pkg/tcpip/transport/udp"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/transport/wireguard"
 	"github.com/sagernet/sing-tun"
@@ -29,15 +27,15 @@ import (
 )
 
 type stackDevice struct {
-	ctx    context.Context
-	logger log.ContextLogger
-	stack  *stack.Stack
-	mtu    uint32
-	events chan wgTun.Event
-	wgTun.Device
+	ctx            context.Context
+	logger         log.ContextLogger
+	stack          *stack.Stack
+	mtu            uint32
+	events         chan wgTun.Event
 	outbound       chan *stack.PacketBuffer
 	packetOutbound chan *buf.Buffer
 	done           chan struct{}
+	closeOnce      sync.Once
 	dispatcher     stack.NetworkDispatcher
 	inet4Address   netip.Addr
 	inet6Address   netip.Addr
@@ -84,13 +82,6 @@ func newStackDevice(options DeviceOptions) (*stackDevice, error) {
 		}
 	}
 	tunDevice.stack = ipStack
-	if options.Handler != nil {
-		ipStack.SetTransportProtocolHandler(tcp.ProtocolNumber, tun.NewTCPForwarder(options.Context, ipStack, options.Handler).HandlePacket)
-		ipStack.SetTransportProtocolHandler(udp.ProtocolNumber, tun.NewUDPForwarder(options.Context, ipStack, options.Handler, options.UDPTimeout).HandlePacket)
-		icmpForwarder := tun.NewICMPForwarder(options.Context, ipStack, options.Handler, options.UDPTimeout)
-		ipStack.SetTransportProtocolHandler(icmp.ProtocolNumber4, icmpForwarder.HandlePacket)
-		ipStack.SetTransportProtocolHandler(icmp.ProtocolNumber6, icmpForwarder.HandlePacket)
-	}
 	return tunDevice, nil
 }
 
@@ -141,9 +132,15 @@ func (w *stackDevice) ListenPacket(ctx context.Context, destination M.Socksaddr)
 	}
 	var networkProtocol tcpip.NetworkProtocolNumber
 	if destination.IsIPv4() {
+		if !w.inet4Address.IsValid() {
+			return nil, E.New("missing IPv4 local address")
+		}
 		networkProtocol = header.IPv4ProtocolNumber
 		bind.Addr = tun.AddressFromAddr(w.inet4Address)
 	} else {
+		if !w.inet6Address.IsValid() {
+			return nil, E.New("missing IPv6 local address")
+		}
 		networkProtocol = header.IPv6ProtocolNumber
 		bind.Addr = tun.AddressFromAddr(w.inet6Address)
 	}
@@ -228,13 +225,15 @@ func (w *stackDevice) Events() <-chan wgTun.Event {
 }
 
 func (w *stackDevice) Close() error {
-	close(w.done)
-	close(w.events)
-	w.stack.Close()
-	for _, endpoint := range w.stack.CleanupEndpoints() {
-		endpoint.Abort()
-	}
-	w.stack.Wait()
+	w.closeOnce.Do(func() {
+		close(w.done)
+		close(w.events)
+		w.stack.Close()
+		for _, endpoint := range w.stack.CleanupEndpoints() {
+			endpoint.Abort()
+		}
+		w.stack.Wait()
+	})
 	return nil
 }
 

transport/openvpn/device_system.go

@@ -0,0 +1,191 @@
+package openvpn
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/netip"
+	"os"
+	"runtime"
+	"sync"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-tun"
+	"github.com/sagernet/sing/common"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/service"
+	wgTun "github.com/sagernet/wireguard-go/tun"
+)
+
+var _ Device = (*systemDevice)(nil)
+
+type systemDevice struct {
+	options      DeviceOptions
+	dialer       N.Dialer
+	device       tun.Tun
+	batchDevice  tun.LinuxTUN
+	events       chan wgTun.Event
+	closeOnce    sync.Once
+	inet4Address netip.Addr
+	inet6Address netip.Addr
+}
+
+func newSystemDevice(options DeviceOptions) (*systemDevice, error) {
+	if options.Name == "" {
+		options.Name = tun.CalculateInterfaceName("openvpn")
+	}
+	var inet4Address netip.Addr
+	var inet6Address netip.Addr
+	if len(options.Address) > 0 {
+		if prefix := common.Find(options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is4()
+		}); prefix.IsValid() {
+			inet4Address = prefix.Addr()
+		}
+	}
+	if len(options.Address) > 0 {
+		if prefix := common.Find(options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is6()
+		}); prefix.IsValid() {
+			inet6Address = prefix.Addr()
+		}
+	}
+	return &systemDevice{
+		options:      options,
+		dialer:       options.CreateDialer(options.Name),
+		events:       make(chan wgTun.Event, 1),
+		inet4Address: inet4Address,
+		inet6Address: inet6Address,
+	}, nil
+}
+
+func (w *systemDevice) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	return w.dialer.DialContext(ctx, network, destination)
+}
+
+func (w *systemDevice) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	return w.dialer.ListenPacket(ctx, destination)
+}
+
+func (w *systemDevice) Inet4Address() netip.Addr {
+	return w.inet4Address
+}
+
+func (w *systemDevice) Inet6Address() netip.Addr {
+	return w.inet6Address
+}
+
+func (w *systemDevice) Start() error {
+	networkManager := service.FromContext[adapter.NetworkManager](w.options.Context)
+	tunOptions := tun.Options{
+		Name: w.options.Name,
+		Inet4Address: common.Filter(w.options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is4()
+		}),
+		Inet6Address: common.Filter(w.options.Address, func(it netip.Prefix) bool {
+			return it.Addr().Is6()
+		}),
+		MTU:            w.options.MTU,
+		GSO:            true,
+		InterfaceScope: true,
+		Inet4RouteAddress: common.Filter(w.options.AllowedAddress, func(it netip.Prefix) bool {
+			return it.Addr().Is4()
+		}),
+		Inet6RouteAddress: common.Filter(w.options.AllowedAddress, func(it netip.Prefix) bool {
+			return it.Addr().Is6()
+		}),
+		InterfaceMonitor: networkManager.InterfaceMonitor(),
+		InterfaceFinder:  networkManager.InterfaceFinder(),
+		Logger:           w.options.Logger,
+	}
+	if runtime.GOOS == "darwin" {
+		tunOptions.AutoRoute = true
+	}
+	tunInterface, err := tun.New(tunOptions)
+	if err != nil {
+		return err
+	}
+	err = tunInterface.Start()
+	if err != nil {
+		tunInterface.Close()
+		return err
+	}
+	w.options.Logger.Notice("started at ", w.options.Name)
+	w.device = tunInterface
+	batchTUN, isBatchTUN := tunInterface.(tun.LinuxTUN)
+	if isBatchTUN && batchTUN.BatchSize() > 1 {
+		w.batchDevice = batchTUN
+	}
+	w.events <- wgTun.EventUp
+	return nil
+}
+
+func (w *systemDevice) File() *os.File {
+	return nil
+}
+
+func (w *systemDevice) Read(bufs [][]byte, sizes []int, offset int) (count int, err error) {
+	if w.batchDevice != nil {
+		count, err = w.batchDevice.BatchRead(bufs, offset-tun.PacketOffset, sizes)
+	} else {
+		sizes[0], err = w.device.Read(bufs[0][offset-tun.PacketOffset:])
+		if err == nil {
+			count = 1
+		} else if errors.Is(err, tun.ErrTooManySegments) {
+			err = wgTun.ErrTooManySegments
+		}
+	}
+	return
+}
+
+func (w *systemDevice) Write(bufs [][]byte, offset int) (count int, err error) {
+	if w.batchDevice != nil {
+		return w.batchDevice.BatchWrite(bufs, offset)
+	}
+	for _, packet := range bufs {
+		if tun.PacketOffset > 0 {
+			clear(packet[offset-tun.PacketOffset : offset])
+			tun.PacketFillHeader(packet[offset-tun.PacketOffset:], tun.PacketIPVersion(packet[offset:]))
+		}
+		_, err = w.device.Write(packet[offset-tun.PacketOffset:])
+		if err != nil {
+			return
+		}
+	}
+	return
+}
+
+func (w *systemDevice) Flush() error {
+	return nil
+}
+
+func (w *systemDevice) MTU() (int, error) {
+	return int(w.options.MTU), nil
+}
+
+func (w *systemDevice) Name() (string, error) {
+	return w.options.Name, nil
+}
+
+func (w *systemDevice) Events() <-chan wgTun.Event {
+	return w.events
+}
+
+func (w *systemDevice) Close() error {
+	var err error
+	w.closeOnce.Do(func() {
+		close(w.events)
+		if w.device != nil {
+			err = w.device.Close()
+		}
+	})
+	return err
+}
+
+func (w *systemDevice) BatchSize() int {
+	if w.batchDevice != nil {
+		return w.batchDevice.BatchSize()
+	}
+	return 1
+}

transport/openvpn/device_system_stack.go

@@ -0,0 +1,200 @@
+//go:build with_gvisor
+
+package openvpn
+
+import (
+	"net/netip"
+	"sync"
+
+	"github.com/sagernet/gvisor/pkg/buffer"
+	"github.com/sagernet/gvisor/pkg/tcpip"
+	"github.com/sagernet/gvisor/pkg/tcpip/header"
+	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv4"
+	"github.com/sagernet/gvisor/pkg/tcpip/network/ipv6"
+	"github.com/sagernet/gvisor/pkg/tcpip/stack"
+	"github.com/sagernet/sing-tun"
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+var _ Device = (*systemStackDevice)(nil)
+
+type systemStackDevice struct {
+	*systemDevice
+	stack     *stack.Stack
+	endpoint  *systemStackEndpoint
+	writeBufs [][]byte
+	closeOnce sync.Once
+}
+
+func newSystemStackDevice(options DeviceOptions) (*systemStackDevice, error) {
+	system, err := newSystemDevice(options)
+	if err != nil {
+		return nil, err
+	}
+	endpoint := &systemStackEndpoint{
+		mtu:  options.MTU,
+		done: make(chan struct{}),
+	}
+	ipStack, err := tun.NewGVisorStackWithOptions(endpoint, stack.NICOptions{}, true)
+	if err != nil {
+		return nil, err
+	}
+	for _, prefix := range options.Address {
+		addr := tun.AddressFromAddr(prefix.Addr())
+		protoAddr := tcpip.ProtocolAddress{
+			AddressWithPrefix: tcpip.AddressWithPrefix{
+				Address:   addr,
+				PrefixLen: prefix.Bits(),
+			},
+		}
+		if prefix.Addr().Is4() {
+			protoAddr.Protocol = ipv4.ProtocolNumber
+		} else {
+			protoAddr.Protocol = ipv6.ProtocolNumber
+		}
+		gErr := ipStack.AddProtocolAddress(tun.DefaultNIC, protoAddr, stack.AddressProperties{})
+		if gErr != nil {
+			return nil, E.New("parse local address ", protoAddr.AddressWithPrefix, ": ", gErr.String())
+		}
+	}
+	sd := &systemStackDevice{
+		systemDevice: system,
+		stack:        ipStack,
+		endpoint:     endpoint,
+	}
+	endpoint.device = sd
+	return sd, nil
+}
+
+func (w *systemStackDevice) Write(bufs [][]byte, offset int) (count int, err error) {
+	if w.batchDevice != nil {
+		w.writeBufs = w.writeBufs[:0]
+		for _, packet := range bufs {
+			if !w.writeStack(packet[offset:]) {
+				w.writeBufs = append(w.writeBufs, packet)
+			}
+		}
+		if len(w.writeBufs) > 0 {
+			return w.batchDevice.BatchWrite(w.writeBufs, offset)
+		}
+	} else {
+		for _, packet := range bufs {
+			if !w.writeStack(packet[offset:]) {
+				if tun.PacketOffset > 0 {
+					clear(packet[offset-tun.PacketOffset : offset])
+					tun.PacketFillHeader(packet[offset-tun.PacketOffset:], tun.PacketIPVersion(packet[offset:]))
+				}
+				_, err = w.device.Write(packet[offset-tun.PacketOffset:])
+			}
+			if err != nil {
+				return
+			}
+		}
+	}
+	return
+}
+
+func (w *systemStackDevice) Close() error {
+	var err error
+	w.closeOnce.Do(func() {
+		close(w.endpoint.done)
+		w.stack.Close()
+		for _, endpoint := range w.stack.CleanupEndpoints() {
+			endpoint.Abort()
+		}
+		w.stack.Wait()
+		err = w.systemDevice.Close()
+	})
+	return err
+}
+
+func (w *systemStackDevice) writeStack(packet []byte) bool {
+	var (
+		networkProtocol tcpip.NetworkProtocolNumber
+		destination     netip.Addr
+	)
+	switch header.IPVersion(packet) {
+	case header.IPv4Version:
+		networkProtocol = header.IPv4ProtocolNumber
+		destination = netip.AddrFrom4(header.IPv4(packet).DestinationAddress().As4())
+	case header.IPv6Version:
+		networkProtocol = header.IPv6ProtocolNumber
+		destination = netip.AddrFrom16(header.IPv6(packet).DestinationAddress().As16())
+	}
+	for _, prefix := range w.options.Address {
+		if prefix.Contains(destination) {
+			return false
+		}
+	}
+	packetBuffer := stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Payload: buffer.MakeWithData(packet),
+	})
+	w.endpoint.dispatcher.DeliverNetworkPacket(networkProtocol, packetBuffer)
+	packetBuffer.DecRef()
+	return true
+}
+
+type systemStackEndpoint struct {
+	mtu        uint32
+	done       chan struct{}
+	device     Device
+	dispatcher stack.NetworkDispatcher
+}
+
+func (ep *systemStackEndpoint) MTU() uint32 {
+	return ep.mtu
+}
+
+func (ep *systemStackEndpoint) SetMTU(mtu uint32) {
+}
+
+func (ep *systemStackEndpoint) MaxHeaderLength() uint16 {
+	return 0
+}
+
+func (ep *systemStackEndpoint) LinkAddress() tcpip.LinkAddress {
+	return ""
+}
+
+func (ep *systemStackEndpoint) SetLinkAddress(addr tcpip.LinkAddress) {
+}
+
+func (ep *systemStackEndpoint) Capabilities() stack.LinkEndpointCapabilities {
+	return stack.CapabilityRXChecksumOffload
+}
+
+func (ep *systemStackEndpoint) Attach(dispatcher stack.NetworkDispatcher) {
+	ep.dispatcher = dispatcher
+}
+
+func (ep *systemStackEndpoint) IsAttached() bool {
+	return ep.dispatcher != nil
+}
+
+func (ep *systemStackEndpoint) Wait() {
+}
+
+func (ep *systemStackEndpoint) ARPHardwareType() header.ARPHardwareType {
+	return header.ARPHardwareNone
+}
+
+func (ep *systemStackEndpoint) AddHeader(buffer *stack.PacketBuffer) {
+}
+
+func (ep *systemStackEndpoint) ParseHeader(ptr *stack.PacketBuffer) bool {
+	return true
+}
+
+func (ep *systemStackEndpoint) WritePackets(list stack.PacketBufferList) (int, tcpip.Error) {
+	for _, packetBuffer := range list.AsSlice() {
+		packet := packetBuffer.ToView().AsSlice()
+		ep.device.Write([][]byte{packet}, 0)
+	}
+	return list.Len(), nil
+}
+
+func (ep *systemStackEndpoint) Close() {
+}
+
+func (ep *systemStackEndpoint) SetOnCloseAction(f func()) {
+}

transport/openvpn/tunnel.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"net/netip"
 	"os"
 	"sync"
 	"time"
@@ -18,10 +19,14 @@ import (
 )
 
 type TunnelOptions struct {
+	System         bool
+	Name           string
+	CreateDialer   func(interfaceName string) N.Dialer
 	Dialer         N.Dialer
 	Servers        []option.ServerOptions
 	TLSConfig      tls.Config
 	Config         *ClientConfig
+	AllowedAddress []netip.Prefix
 	UDPTimeout     time.Duration
 	ReconnectDelay time.Duration
 	PingInterval   time.Duration
@@ -65,11 +70,15 @@ func (t *Tunnel) Start() error {
 			t.mtu = client.push.MTU
 		}
 		deviceOptions := DeviceOptions{
-			Context:    t.ctx,
-			Logger:     t.logger,
-			UDPTimeout: t.options.UDPTimeout,
-			MTU:        t.mtu,
-			Address:    client.push.Prefixes,
+			Context:        t.ctx,
+			Logger:         t.logger,
+			System:         t.options.System,
+			UDPTimeout:     t.options.UDPTimeout,
+			CreateDialer:   t.options.CreateDialer,
+			Name:           t.options.Name,
+			MTU:            t.mtu,
+			Address:        client.push.Prefixes,
+			AllowedAddress: t.options.AllowedAddress,
 		}
 		device, err := NewDevice(deviceOptions)
 		if err != nil {
@@ -214,7 +223,7 @@ func (t *Tunnel) getClient() (*Client, error) {
 	timer := time.NewTimer(0)
 	defer timer.Stop()
 	for {
-		t.logger.InfoContext(t.ctx, "connecting to OpenVPN server")
+		t.logger.NoticeContext(t.ctx, "connecting to OpenVPN server")
 		client, err := t.connect()
 		if err != nil {
 			t.logger.ErrorContext(t.ctx, fmt.Errorf("connect failed: %v", err))
@@ -227,7 +236,7 @@ func (t *Tunnel) getClient() (*Client, error) {
 			continue
 		}
 		t.client = client
-		t.logger.InfoContext(t.ctx, "connected to OpenVPN server")
+		t.logger.NoticeContext(t.ctx, "connected to OpenVPN server")
 		return client, nil
 	}
 }

transport/sudoku/obfs/httpmask/tunnel.go

@@ -19,7 +19,6 @@ import (
 	"syscall"
 	"time"
 
-
 	"net/http"
 	"net/http/httputil"
 

transport/sudoku/uot.go

@@ -10,7 +10,6 @@ import (
 	"net/netip"
 	"sync"
 	"time"
-
 )
 
 const (

transport/trusttunnel/protocol.go

@@ -13,9 +13,9 @@ import (
 )
 
 const (
-	UDPMagicAddress         = "_udp2"
-	ICMPMagicAddress        = "_icmp"
-	HealthCheckMagicAddress = "_check"
+	UDPMagicAddress           = "_udp2"
+	ICMPMagicAddress          = "_icmp"
+	HealthCheckMagicAddress   = "_check"
 	DefaultConnectionTimeout  = 30 * time.Second
 	DefaultHealthCheckTimeout = 7 * time.Second
 	DefaultSessionTimeout     = 30 * time.Second

transport/v2rayxhttp/client.go

@@ -48,6 +48,9 @@ func NewClient(ctx context.Context, logger log.ContextLogger, dialer N.Dialer, s
 	if options.Mode == "" {
 		return nil, E.New("mode is not set")
 	}
+	if tlsConfig != nil && len(tlsConfig.NextProtos()) == 0 {
+		tlsConfig.SetNextProtos([]string{"h2"})
+	}
 	dest := serverAddr
 	baseRequestURL, err := getBaseRequestURL(&options.V2RayXHTTPBaseOptions, dest, tlsConfig)
 	if err != nil {
@@ -84,6 +87,9 @@ func NewClient(ctx context.Context, logger log.ContextLogger, dialer N.Dialer, s
 				return nil, err
 			}
 		}
+		if tlsConfig2 != nil && len(tlsConfig2.NextProtos()) == 0 {
+			tlsConfig2.SetNextProtos([]string{"h2"})
+		}
 		baseRequestURL2, err = getBaseRequestURL(&options2.V2RayXHTTPBaseOptions, dest2, tlsConfig2)
 		if err != nil {
 			return nil, err

transport/v2rayxhttp/server.go

@@ -197,7 +197,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 				Reader: httpSC,
 			})
 			if err != nil {
-				s.logger.InfoContext(request.Context(), err, "failed to upload (PushReader)")
+				s.logger.DebugContext(request.Context(), err, "failed to upload (PushReader)")
 				writer.WriteHeader(http.StatusConflict)
 			} else {
 				writer.Header().Set("X-Accel-Buffering", "no")
@@ -242,7 +242,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 			headerPayloadEncoded := strings.Join(headerPayloadChunks, "")
 			headerPayload, err = base64.RawURLEncoding.DecodeString(headerPayloadEncoded)
 			if err != nil {
-				s.logger.InfoContext(request.Context(), err, "Invalid base64 in header's payload")
+				s.logger.DebugContext(request.Context(), err, "Invalid base64 in header's payload")
 				writer.WriteHeader(http.StatusBadRequest)
 				return
 			}
@@ -261,7 +261,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 			cookiePayloadEncoded := strings.Join(cookiePayloadChunks, "")
 			cookiePayload, err = base64.RawURLEncoding.DecodeString(cookiePayloadEncoded)
 			if err != nil {
-				s.logger.InfoContext(request.Context(), err, "Invalid base64 in cookies' payload")
+				s.logger.DebugContext(request.Context(), err, "Invalid base64 in cookies' payload")
 				writer.WriteHeader(http.StatusBadRequest)
 				return
 			}
@@ -281,7 +281,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 				bodyPayload, readErr = buf.ReadAllToBytes(io.LimitReader(request.Body, int64(scMaxEachPostBytes)+1))
 			}
 			if readErr != nil {
-				s.logger.InfoContext(request.Context(), readErr, "failed to read body payload")
+				s.logger.DebugContext(request.Context(), readErr, "failed to read body payload")
 				writer.WriteHeader(http.StatusBadRequest)
 				return
 			}
@@ -304,7 +304,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 		}
 		seq, err := strconv.ParseUint(seqStr, 10, 64)
 		if err != nil {
-			s.logger.InfoContext(request.Context(), err, "failed to upload (ParseUint)")
+			s.logger.DebugContext(request.Context(), err, "failed to upload (ParseUint)")
 			writer.WriteHeader(http.StatusInternalServerError)
 			return
 		}
@@ -313,7 +313,7 @@ func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
 			Seq:     seq,
 		})
 		if err != nil {
-			s.logger.InfoContext(request.Context(), err, "failed to upload (PushPayload)")
+			s.logger.DebugContext(request.Context(), err, "failed to upload (PushPayload)")
 			writer.WriteHeader(http.StatusInternalServerError)
 			return
 		}

transport/wireguard/device_system.go

@@ -114,7 +114,7 @@ func (w *systemDevice) Start() error {
 		tunInterface.Close()
 		return err
 	}
-	w.options.Logger.Info("started at ", w.options.Name)
+	w.options.Logger.Notice("started at ", w.options.Name)
 	w.device = tunInterface
 	batchTUN, isBatchTUN := tunInterface.(tun.LinuxTUN)
 	if isBatchTUN && batchTUN.BatchSize() > 1 {