Add xhttp transport

transport/v2ray/transport.go

@@ -10,6 +10,7 @@ import (
 	"github.com/sagernet/sing-box/transport/v2rayhttp"
 	"github.com/sagernet/sing-box/transport/v2rayhttpupgrade"
 	"github.com/sagernet/sing-box/transport/v2raywebsocket"
+	xhttp "github.com/sagernet/sing-box/transport/v2rayxhttp"
 	E "github.com/sagernet/sing/common/exceptions"
 	"github.com/sagernet/sing/common/logger"
 	M "github.com/sagernet/sing/common/metadata"
@@ -39,6 +40,8 @@ func NewServerTransport(ctx context.Context, logger logger.ContextLogger, option
 		return NewGRPCServer(ctx, logger, options.GRPCOptions, tlsConfig, handler)
 	case C.V2RayTransportTypeHTTPUpgrade:
 		return v2rayhttpupgrade.NewServer(ctx, logger, options.HTTPUpgradeOptions, tlsConfig, handler)
+	case C.V2RayTransportTypeXHTTP:
+		return xhttp.NewServer(ctx, logger, options.XHTTPOptions, tlsConfig, handler)
 	default:
 		return nil, E.New("unknown transport type: " + options.Type)
 	}
@@ -62,6 +65,8 @@ func NewClientTransport(ctx context.Context, dialer N.Dialer, serverAddr M.Socks
 		return NewQUICClient(ctx, dialer, serverAddr, options.QUICOptions, tlsConfig)
 	case C.V2RayTransportTypeHTTPUpgrade:
 		return v2rayhttpupgrade.NewClient(ctx, dialer, serverAddr, options.HTTPUpgradeOptions, tlsConfig)
+	case C.V2RayTransportTypeXHTTP:
+		return xhttp.NewClient(ctx, dialer, serverAddr, options.XHTTPOptions, tlsConfig)
 	default:
 		return nil, E.New("unknown transport type: " + options.Type)
 	}

transport/v2rayxhttp/client.go

@@ -0,0 +1,400 @@
+package xhttp
+
+import (
+	"context"
+	gotls "crypto/tls"
+	"io"
+	"net/http"
+	"net/http/httptrace"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/http3"
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/tls"
+	"github.com/sagernet/sing-box/common/xray/buf"
+	"github.com/sagernet/sing-box/common/xray/net"
+	"github.com/sagernet/sing-box/common/xray/pipe"
+	"github.com/sagernet/sing-box/common/xray/signal/done"
+	"github.com/sagernet/sing-box/common/xray/uuid"
+	"github.com/sagernet/sing-box/option"
+	dns "github.com/sagernet/sing-dns"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/bufio"
+	E "github.com/sagernet/sing/common/exceptions"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+	sHTTP "github.com/sagernet/sing/protocol/http"
+	"github.com/sagernet/sing/service"
+	"golang.org/x/net/http2"
+)
+
+type Client struct {
+	ctx            context.Context
+	options        *option.V2RayXHTTPOptions
+	getRequestURL  func(sessionId string) url.URL
+	getRequestURL2 func(sessionId string) url.URL
+	getHTTPClient  func() (DialerClient, *XmuxClient)
+	getHTTPClient2 func() (DialerClient, *XmuxClient)
+}
+
+func NewClient(ctx context.Context, dialer N.Dialer, serverAddr M.Socksaddr, options option.V2RayXHTTPOptions, tlsConfig tls.Config) (adapter.V2RayClientTransport, error) {
+	if options.Mode == "" {
+		return nil, E.New("mode is not set")
+	}
+	router := service.FromContext[adapter.Router](ctx)
+	dest := serverAddr
+	var gotlsConfig *gotls.Config
+	if tlsConfig != nil {
+		var err error
+		gotlsConfig, err = tlsConfig.Config()
+		if err != nil {
+			return nil, err
+		}
+	}
+	baseRequestURL, err := getBaseRequestURL(
+		&options.V2RayXHTTPBaseOptions, dest, tlsConfig,
+	)
+	if err != nil {
+		return nil, err
+	}
+	getRequestURL := func(sessionId string) url.URL {
+		requestURL := baseRequestURL
+		requestURL.Path += sessionId
+		return requestURL
+	}
+	if dest.IsFqdn() {
+		addresses, err := router.Lookup(ctx, dest.AddrString(), dns.DomainStrategy(options.DomainStrategy))
+		if err != nil {
+			return nil, err
+		}
+		dest.Addr = addresses[0]
+	}
+	var xmuxOptions option.V2RayXHTTPXmuxOptions
+	if options.Xmux != nil {
+		xmuxOptions = *options.Xmux
+	}
+	xmuxManager := NewXmuxManager(xmuxOptions, func() XmuxConn {
+		return createHTTPClient(dest, dialer, &options.V2RayXHTTPBaseOptions, tlsConfig, gotlsConfig)
+	})
+	getHTTPClient := func() (DialerClient, *XmuxClient) {
+		xmuxClient := xmuxManager.GetXmuxClient(ctx)
+		return xmuxClient.XmuxConn.(DialerClient), xmuxClient
+	}
+	getRequestURL2 := getRequestURL
+	getHTTPClient2 := func() (DialerClient, *XmuxClient) {
+		return nil, nil
+	}
+	if options.Download != nil {
+		options2 := options.Download
+		dialer2 := dialer
+		if options2.Detour != "" {
+			var ok bool
+			dialer2, ok = service.FromContext[adapter.OutboundManager](ctx).Outbound(options2.Detour)
+			if !ok {
+				return nil, E.New("outbound detour not found: ", options2.Detour)
+			}
+		}
+		dest2 := options2.ServerOptions.Build()
+		var tlsConfig2 tls.Config
+		var gotlsConfig2 *gotls.Config
+		if options2.TLS != nil {
+			tlsConfig2, err = tls.NewClient(ctx, options2.Server, common.PtrValueOrDefault(options2.TLS))
+			if err != nil {
+				return nil, err
+			}
+			gotlsConfig2, err = tlsConfig2.Config()
+			if err != nil {
+				return nil, err
+			}
+		}
+		baseRequestURL2, err := getBaseRequestURL(&options2.V2RayXHTTPBaseOptions, dest2, tlsConfig2)
+		if err != nil {
+			return nil, err
+		}
+		getRequestURL2 = func(sessionId string) url.URL {
+			requestURL2 := baseRequestURL2
+			requestURL2.Path += sessionId
+			return requestURL2
+		}
+		if dest2.IsFqdn() {
+			addresses2, err := router.Lookup(ctx, dest2.AddrString(), dns.DomainStrategy(options2.DomainStrategy))
+			if err != nil {
+				return nil, err
+			}
+			dest2.Addr = addresses2[0]
+		}
+		var xmuxOptions2 option.V2RayXHTTPXmuxOptions
+		if options2.Xmux != nil {
+			xmuxOptions2 = *options2.Xmux
+		}
+		xmuxManager2 := NewXmuxManager(xmuxOptions2, func() XmuxConn {
+			return createHTTPClient(dest2, dialer2, &options2.V2RayXHTTPBaseOptions, tlsConfig2, gotlsConfig2)
+		})
+		getHTTPClient2 = func() (DialerClient, *XmuxClient) {
+			xmuxClient2 := xmuxManager2.GetXmuxClient(ctx)
+			return xmuxClient2.XmuxConn.(DialerClient), xmuxClient2
+		}
+	}
+	return &Client{
+		ctx:            ctx,
+		options:        &options,
+		getHTTPClient:  getHTTPClient,
+		getHTTPClient2: getHTTPClient2,
+		getRequestURL:  getRequestURL,
+		getRequestURL2: getRequestURL2,
+	}, nil
+}
+
+func (c *Client) DialContext(ctx context.Context) (net.Conn, error) {
+	options := c.options
+	mode := c.options.Mode
+	sessionIdUuid := uuid.New()
+	requestURL := c.getRequestURL(sessionIdUuid.String())
+	requestURL2 := c.getRequestURL(sessionIdUuid.String())
+	httpClient, xmuxClient := c.getHTTPClient()
+	httpClient2, xmuxClient2 := c.getHTTPClient2()
+	if xmuxClient != nil {
+		xmuxClient.OpenUsage.Add(1)
+	}
+	if xmuxClient2 != nil && xmuxClient2 != xmuxClient {
+		xmuxClient2.OpenUsage.Add(1)
+	}
+	var closed atomic.Int32
+	reader, writer := io.Pipe()
+	conn := splitConn{
+		writer: writer,
+		onClose: func() {
+			if closed.Add(1) > 1 {
+				return
+			}
+			if xmuxClient != nil {
+				xmuxClient.OpenUsage.Add(-1)
+			}
+			if xmuxClient2 != nil && xmuxClient2 != xmuxClient {
+				xmuxClient2.OpenUsage.Add(-1)
+			}
+		},
+	}
+	var err error
+	if mode == "stream-one" {
+		requestURL.Path = options.GetNormalizedPath()
+		if xmuxClient != nil {
+			xmuxClient.LeftRequests.Add(-1)
+		}
+		conn.reader, conn.remoteAddr, conn.localAddr, err = httpClient.OpenStream(ctx, requestURL.String(), reader, false)
+		if err != nil { // browser dialer only
+			return nil, err
+		}
+		return &conn, nil
+	} else { // stream-down
+		if xmuxClient2 != nil {
+			xmuxClient2.LeftRequests.Add(-1)
+		}
+		conn.reader, conn.remoteAddr, conn.localAddr, err = httpClient2.OpenStream(ctx, requestURL2.String(), nil, false)
+		if err != nil { // browser dialer only
+			return nil, err
+		}
+	}
+	if mode == "stream-up" {
+		if xmuxClient != nil {
+			xmuxClient.LeftRequests.Add(-1)
+		}
+		_, _, _, err = httpClient.OpenStream(ctx, requestURL.String(), reader, true)
+		if err != nil { // browser dialer only
+			return nil, err
+		}
+		return &conn, nil
+	}
+	scMaxEachPostBytes := options.GetNormalizedScMaxEachPostBytes()
+	scMinPostsIntervalMs := options.GetNormalizedScMinPostsIntervalMs()
+	if scMaxEachPostBytes.From <= buf.Size {
+		panic("`scMaxEachPostBytes` should be bigger than " + strconv.Itoa(buf.Size))
+	}
+	maxUploadSize := scMaxEachPostBytes.Rand()
+	// WithSizeLimit(0) will still allow single bytes to pass, and a lot of
+	// code relies on this behavior. Subtract 1 so that together with
+	// uploadWriter wrapper, exact size limits can be enforced
+	// uploadPipeReader, uploadPipeWriter := pipe.New(pipe.WithSizeLimit(maxUploadSize - 1))
+	uploadPipeReader, uploadPipeWriter := pipe.New(pipe.WithSizeLimit(maxUploadSize - buf.Size))
+	conn.writer = uploadWriter{
+		uploadPipeWriter,
+		maxUploadSize,
+	}
+	go func() {
+		var seq int64
+		var lastWrite time.Time
+		for {
+			wroteRequest := done.New()
+			ctx := httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
+				WroteRequest: func(httptrace.WroteRequestInfo) {
+					wroteRequest.Close()
+				},
+			})
+			// this intentionally makes a shallow-copy of the struct so we
+			// can reassign Path (potentially concurrently)
+			url := requestURL
+			url.Path += "/" + strconv.FormatInt(seq, 10)
+			seq += 1
+			if scMinPostsIntervalMs.From > 0 {
+				time.Sleep(time.Duration(scMinPostsIntervalMs.Rand())*time.Millisecond - time.Since(lastWrite))
+			}
+			// by offloading the uploads into a buffered pipe, multiple conn.Write
+			// calls get automatically batched together into larger POST requests.
+			// without batching, bandwidth is extremely limited.
+			chunk, err := uploadPipeReader.ReadMultiBuffer()
+			if err != nil {
+				break
+			}
+			lastWrite = time.Now()
+			if xmuxClient != nil && (xmuxClient.LeftRequests.Add(-1) <= 0 ||
+				(xmuxClient.UnreusableAt != time.Time{} && lastWrite.After(xmuxClient.UnreusableAt))) {
+				httpClient, xmuxClient = c.getHTTPClient()
+			}
+			go func() {
+				err := httpClient.PostPacket(
+					ctx,
+					url.String(),
+					&buf.MultiBufferContainer{MultiBuffer: chunk},
+					int64(chunk.Len()),
+				)
+				wroteRequest.Close()
+				if err != nil {
+					uploadPipeReader.Interrupt()
+				}
+			}()
+			if _, ok := httpClient.(*DefaultDialerClient); ok {
+				<-wroteRequest.Wait()
+			}
+		}
+	}()
+	return &conn, nil
+}
+
+func (c *Client) Close() error {
+	return nil
+}
+
+func decideHTTPVersion(gotlsConfig *gotls.Config) string {
+	if gotlsConfig == nil || len(gotlsConfig.NextProtos) == 0 || gotlsConfig.NextProtos[0] == "http/1.1" {
+		return "1.1"
+	}
+	if gotlsConfig.NextProtos[0] == "h3" {
+		return "3"
+	}
+	return "2"
+}
+
+func getBaseRequestURL(options *option.V2RayXHTTPBaseOptions, dest M.Socksaddr, tlsConfig tls.Config) (url.URL, error) {
+	var requestURL url.URL
+	if tlsConfig == nil {
+		requestURL.Scheme = "http"
+	} else {
+		requestURL.Scheme = "https"
+	}
+	requestURL.Host = options.Host
+	if requestURL.Host == "" && tlsConfig != nil {
+		requestURL.Host = tlsConfig.ServerName()
+	}
+	if requestURL.Host == "" {
+		requestURL.Host = dest.AddrString()
+	}
+	requestURL.Path = options.Path
+	if err := sHTTP.URLSetPath(&requestURL, options.Path); err != nil {
+		return requestURL, E.New(err, "parse path")
+	}
+	if !strings.HasPrefix(requestURL.Path, "/") {
+		requestURL.Path = "/" + requestURL.Path
+	}
+	requestURL.Path = options.GetNormalizedPath()
+	requestURL.RawQuery = options.GetNormalizedQuery()
+	return requestURL, nil
+}
+
+func createHTTPClient(dest M.Socksaddr, dialer N.Dialer, options *option.V2RayXHTTPBaseOptions, tlsConfig tls.Config, gotlsConfig *gotls.Config) DialerClient {
+	httpVersion := decideHTTPVersion(gotlsConfig)
+	dialContext := func(ctxInner context.Context) (net.Conn, error) {
+		conn, err := dialer.DialContext(ctxInner, "tcp", dest)
+		if err != nil {
+			return nil, err
+		}
+		if httpVersion == "2" {
+			return tls.ClientHandshake(ctxInner, conn, tlsConfig)
+		}
+		return conn, nil
+	}
+	var keepAlivePeriod time.Duration
+	if options.Xmux != nil {
+		keepAlivePeriod = time.Duration(options.Xmux.HKeepAlivePeriod) * time.Second
+	}
+	var transport http.RoundTripper
+	switch httpVersion {
+	case "3":
+		if keepAlivePeriod == 0 {
+			keepAlivePeriod = net.QuicgoH3KeepAlivePeriod
+		}
+		if keepAlivePeriod < 0 {
+			keepAlivePeriod = 0
+		}
+		quicConfig := &quic.Config{
+			MaxIdleTimeout: net.ConnIdleTimeout,
+			// these two are defaults of quic-go/http3. the default of quic-go (no
+			// http3) is different, so it is hardcoded here for clarity.
+			// https://github.com/quic-go/quic-go/blob/b8ea5c798155950fb5bbfdd06cad1939c9355878/http3/client.go#L36-L39
+			MaxIncomingStreams: -1,
+			KeepAlivePeriod:    keepAlivePeriod,
+		}
+		transport = &http3.Transport{
+			QUICConfig:      quicConfig,
+			TLSClientConfig: gotlsConfig.Clone(),
+			Dial: func(ctx context.Context, addr string, tlsCfg *gotls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
+				udpConn, dErr := dialer.DialContext(ctx, N.NetworkUDP, dest)
+				if dErr != nil {
+					return nil, dErr
+				}
+				return quic.DialEarly(ctx, bufio.NewUnbindPacketConn(udpConn), udpConn.RemoteAddr(), tlsCfg, cfg)
+			},
+		}
+	case "2":
+		if keepAlivePeriod == 0 {
+			keepAlivePeriod = net.ChromeH2KeepAlivePeriod
+		}
+		if keepAlivePeriod < 0 {
+			keepAlivePeriod = 0
+		}
+		transport = &http2.Transport{
+			DialTLSContext: func(ctxInner context.Context, network string, addr string, cfg *gotls.Config) (net.Conn, error) {
+				return dialContext(ctxInner)
+			},
+			IdleConnTimeout: net.ConnIdleTimeout,
+			ReadIdleTimeout: keepAlivePeriod,
+		}
+	default:
+		httpDialContext := func(ctxInner context.Context, network string, addr string) (net.Conn, error) {
+			return dialContext(ctxInner)
+		}
+		transport = &http.Transport{
+			DialTLSContext:  httpDialContext,
+			DialContext:     httpDialContext,
+			IdleConnTimeout: net.ConnIdleTimeout,
+			// chunked transfer download with KeepAlives is buggy with
+			// http.Client and our custom dial context.
+			DisableKeepAlives: true,
+		}
+	}
+	client := &DefaultDialerClient{
+		options: options,
+		client: &http.Client{
+			Transport: transport,
+		},
+		httpVersion:    httpVersion,
+		uploadRawPool:  &sync.Pool{},
+		dialUploadConn: dialContext,
+	}
+	return client
+}

transport/v2rayxhttp/conn.go

@@ -0,0 +1,108 @@
+package xhttp
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/sagernet/sing-box/common/xray/signal/done"
+)
+
+type splitConn struct {
+	writer     io.WriteCloser
+	reader     io.ReadCloser
+	remoteAddr net.Addr
+	localAddr  net.Addr
+	onClose    func()
+}
+
+func (c *splitConn) Write(b []byte) (int, error) {
+	return c.writer.Write(b)
+}
+
+func (c *splitConn) Read(b []byte) (int, error) {
+	return c.reader.Read(b)
+}
+
+func (c *splitConn) Close() error {
+	if c.onClose != nil {
+		c.onClose()
+	}
+
+	err := c.writer.Close()
+	err2 := c.reader.Close()
+	if err != nil {
+		return err
+	}
+
+	if err2 != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (c *splitConn) LocalAddr() net.Addr {
+	return c.localAddr
+}
+
+func (c *splitConn) RemoteAddr() net.Addr {
+	return c.remoteAddr
+}
+
+func (c *splitConn) SetDeadline(t time.Time) error {
+	// TODO cannot do anything useful
+	return nil
+}
+
+func (c *splitConn) SetReadDeadline(t time.Time) error {
+	// TODO cannot do anything useful
+	return nil
+}
+
+func (c *splitConn) SetWriteDeadline(t time.Time) error {
+	// TODO cannot do anything useful
+	return nil
+}
+
+type H1Conn struct {
+	UnreadedResponsesCount int
+	RespBufReader          *bufio.Reader
+	net.Conn
+}
+
+func NewH1Conn(conn net.Conn) *H1Conn {
+	return &H1Conn{
+		RespBufReader: bufio.NewReader(conn),
+		Conn:          conn,
+	}
+}
+
+type httpServerConn struct {
+	sync.Mutex
+	*done.Instance
+	io.Reader // no need to Close request.Body
+	http.ResponseWriter
+}
+
+func (c *httpServerConn) Write(b []byte) (int, error) {
+	c.Lock()
+	defer c.Unlock()
+	if c.Done() {
+		return 0, io.ErrClosedPipe
+	}
+	n, err := c.ResponseWriter.Write(b)
+	if err == nil {
+		c.ResponseWriter.(http.Flusher).Flush()
+	}
+	return n, err
+}
+
+func (c *httpServerConn) Close() error {
+	c.Lock()
+	defer c.Unlock()
+	return c.Instance.Close()
+}

transport/v2rayxhttp/dialer.go

@@ -0,0 +1,192 @@
+package xhttp
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptrace"
+	"sync"
+
+	"github.com/sagernet/sing-box/common/xray"
+	"github.com/sagernet/sing-box/common/xray/signal/done"
+	"github.com/sagernet/sing-box/option"
+)
+
+// interface to abstract between use of browser dialer, vs net/http
+type DialerClient interface {
+	IsClosed() bool
+
+	// ctx, url, body, uploadOnly
+	OpenStream(context.Context, string, io.Reader, bool) (io.ReadCloser, net.Addr, net.Addr, error)
+
+	// ctx, url, body, contentLength
+	PostPacket(context.Context, string, io.Reader, int64) error
+}
+
+// implements xhttp.DialerClient in terms of direct network connections
+type DefaultDialerClient struct {
+	options     *option.V2RayXHTTPBaseOptions
+	client      *http.Client
+	closed      bool
+	httpVersion string
+	// pool of net.Conn, created using dialUploadConn
+	uploadRawPool  *sync.Pool
+	dialUploadConn func(ctxInner context.Context) (net.Conn, error)
+}
+
+func (c *DefaultDialerClient) IsClosed() bool {
+	return c.closed
+}
+
+func (c *DefaultDialerClient) OpenStream(ctx context.Context, url string, body io.Reader, uploadOnly bool) (wrc io.ReadCloser, remoteAddr, localAddr net.Addr, err error) {
+	// this is done when the TCP/UDP connection to the server was established,
+	// and we can unblock the Dial function and print correct net addresses in
+	// logs
+	gotConn := done.New()
+	ctx = httptrace.WithClientTrace(ctx, &httptrace.ClientTrace{
+		GotConn: func(connInfo httptrace.GotConnInfo) {
+			remoteAddr = connInfo.Conn.RemoteAddr()
+			localAddr = connInfo.Conn.LocalAddr()
+			gotConn.Close()
+		},
+	})
+	method := "GET" // stream-down
+	if body != nil {
+		method = "POST" // stream-up/one
+	}
+	req, _ := http.NewRequestWithContext(context.WithoutCancel(ctx), method, url, body)
+	req.Header = c.options.GetRequestHeader(url)
+	if method == "POST" && !c.options.NoGRPCHeader {
+		req.Header.Set("Content-Type", "application/grpc")
+	}
+	wrc = &WaitReadCloser{Wait: make(chan struct{})}
+	go func() {
+		resp, err := c.client.Do(req)
+		if err != nil {
+			if !uploadOnly { // stream-down is enough
+				c.closed = true
+			}
+			gotConn.Close()
+			wrc.Close()
+			return
+		}
+		if resp.StatusCode != 200 || uploadOnly { // stream-up
+			io.Copy(io.Discard, resp.Body)
+			resp.Body.Close() // if it is called immediately, the upload will be interrupted also
+			wrc.Close()
+			return
+		}
+		wrc.(*WaitReadCloser).Set(resp.Body)
+	}()
+	<-gotConn.Wait()
+	return
+}
+
+func (c *DefaultDialerClient) PostPacket(ctx context.Context, url string, body io.Reader, contentLength int64) error {
+	req, err := http.NewRequestWithContext(context.WithoutCancel(ctx), "POST", url, body)
+	if err != nil {
+		return err
+	}
+	req.ContentLength = contentLength
+	req.Header = c.options.GetRequestHeader(url)
+	if c.httpVersion != "1.1" {
+		resp, err := c.client.Do(req)
+		if err != nil {
+			c.closed = true
+			return err
+		}
+		io.Copy(io.Discard, resp.Body)
+		defer resp.Body.Close()
+	} else {
+		// stringify the entire HTTP/1.1 request so it can be
+		// safely retried. if instead req.Write is called multiple
+		// times, the body is already drained after the first
+		// request
+		requestBuff := new(bytes.Buffer)
+		common.Must(req.Write(requestBuff))
+		var uploadConn any
+		var h1UploadConn *H1Conn
+		for {
+			uploadConn = c.uploadRawPool.Get()
+			newConnection := uploadConn == nil
+			if newConnection {
+				newConn, err := c.dialUploadConn(context.WithoutCancel(ctx))
+				if err != nil {
+					return err
+				}
+				h1UploadConn = NewH1Conn(newConn)
+				uploadConn = h1UploadConn
+			} else {
+				h1UploadConn = uploadConn.(*H1Conn)
+
+				// TODO: Replace 0 here with a config value later
+				// Or add some other condition for optimization purposes
+				if h1UploadConn.UnreadedResponsesCount > 0 {
+					resp, err := http.ReadResponse(h1UploadConn.RespBufReader, req)
+					if err != nil {
+						c.closed = true
+						return fmt.Errorf("error while reading response: %s", err.Error())
+					}
+					io.Copy(io.Discard, resp.Body)
+					defer resp.Body.Close()
+					if resp.StatusCode != 200 {
+						return fmt.Errorf("got non-200 error response code: %d", resp.StatusCode)
+					}
+				}
+			}
+			_, err := h1UploadConn.Write(requestBuff.Bytes())
+			// if the write failed, we try another connection from
+			// the pool, until the write on a new connection fails.
+			// failed writes to a pooled connection are normal when
+			// the connection has been closed in the meantime.
+			if err == nil {
+				break
+			} else if newConnection {
+				return err
+			}
+		}
+		c.uploadRawPool.Put(uploadConn)
+	}
+
+	return nil
+}
+
+type WaitReadCloser struct {
+	Wait chan struct{}
+	io.ReadCloser
+}
+
+func (w *WaitReadCloser) Set(rc io.ReadCloser) {
+	w.ReadCloser = rc
+	defer func() {
+		if recover() != nil {
+			rc.Close()
+		}
+	}()
+	close(w.Wait)
+}
+
+func (w *WaitReadCloser) Read(b []byte) (int, error) {
+	if w.ReadCloser == nil {
+		if <-w.Wait; w.ReadCloser == nil {
+			return 0, io.ErrClosedPipe
+		}
+	}
+	return w.ReadCloser.Read(b)
+}
+
+func (w *WaitReadCloser) Close() error {
+	if w.ReadCloser != nil {
+		return w.ReadCloser.Close()
+	}
+	defer func() {
+		if recover() != nil && w.ReadCloser != nil {
+			w.ReadCloser.Close()
+		}
+	}()
+	close(w.Wait)
+	return nil
+}

transport/v2rayxhttp/http.go

@@ -0,0 +1,41 @@
+package xhttp
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/sagernet/sing-box/common/xray/net"
+	"github.com/sagernet/sing-box/common/xray/signal/done"
+)
+
+type httpSession struct {
+	uploadQueue *uploadQueue
+	// for as long as the GET request is not opened by the client, this will be
+	// open ("undone"), and the session may be expired within a certain TTL.
+	// after the client connects, this becomes "done" and the session lives as
+	// long as the GET request.
+	isFullyConnected *done.Instance
+}
+
+func parseXForwardedFor(header http.Header) []net.Address {
+	xff := header.Get("X-Forwarded-For")
+	if xff == "" {
+		return nil
+	}
+	list := strings.Split(xff, ",")
+	addrs := make([]net.Address, 0, len(list))
+	for _, proxy := range list {
+		addrs = append(addrs, net.ParseAddress(proxy))
+	}
+	return addrs
+}
+
+func isValidHTTPHost(request string, config string) bool {
+	r := strings.ToLower(request)
+	c := strings.ToLower(config)
+	if strings.Contains(r, ":") {
+		h, _, _ := net.SplitHostPort(r)
+		return h == c
+	}
+	return r == c
+}

transport/v2rayxhttp/mux.go

@@ -0,0 +1,104 @@
+package xhttp
+
+import (
+	"context"
+	"crypto/rand"
+	"math"
+	"math/big"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/sagernet/sing-box/option"
+)
+
+type XmuxConn interface {
+	IsClosed() bool
+}
+
+type XmuxClient struct {
+	XmuxConn     XmuxConn
+	OpenUsage    atomic.Int32
+	leftUsage    int32
+	LeftRequests atomic.Int32
+	UnreusableAt time.Time
+}
+
+type XmuxManager struct {
+	options     option.V2RayXHTTPXmuxOptions
+	concurrency int32
+	connections int32
+	newConnFunc func() XmuxConn
+	xmuxClients []*XmuxClient
+	mtx         sync.Mutex
+}
+
+func NewXmuxManager(options option.V2RayXHTTPXmuxOptions, newConnFunc func() XmuxConn) *XmuxManager {
+	return &XmuxManager{
+		options:     options,
+		concurrency: options.GetNormalizedMaxConcurrency().Rand(),
+		connections: options.GetNormalizedMaxConnections().Rand(),
+		newConnFunc: newConnFunc,
+		xmuxClients: make([]*XmuxClient, 0),
+	}
+}
+
+func (m *XmuxManager) newXmuxClient() *XmuxClient {
+	xmuxClient := &XmuxClient{
+		XmuxConn:  m.newConnFunc(),
+		leftUsage: -1,
+	}
+	if x := m.options.GetNormalizedCMaxReuseTimes().Rand(); x > 0 {
+		xmuxClient.leftUsage = x - 1
+	}
+	xmuxClient.LeftRequests.Store(math.MaxInt32)
+	if x := m.options.GetNormalizedHMaxRequestTimes().Rand(); x > 0 {
+		xmuxClient.LeftRequests.Store(x)
+	}
+	if x := m.options.GetNormalizedHMaxReusableSecs().Rand(); x > 0 {
+		xmuxClient.UnreusableAt = time.Now().Add(time.Duration(x) * time.Second)
+	}
+	m.xmuxClients = append(m.xmuxClients, xmuxClient)
+	return xmuxClient
+}
+
+func (m *XmuxManager) GetXmuxClient(ctx context.Context) *XmuxClient {
+	m.mtx.Lock()
+	defer m.mtx.Unlock()
+	for i := 0; i < len(m.xmuxClients); {
+		xmuxClient := m.xmuxClients[i]
+		if xmuxClient.XmuxConn.IsClosed() ||
+			xmuxClient.leftUsage == 0 ||
+			xmuxClient.LeftRequests.Load() <= 0 ||
+			(xmuxClient.UnreusableAt != time.Time{} && time.Now().After(xmuxClient.UnreusableAt)) {
+			m.xmuxClients = append(m.xmuxClients[:i], m.xmuxClients[i+1:]...)
+		} else {
+			i++
+		}
+	}
+	if len(m.xmuxClients) == 0 {
+		return m.newXmuxClient()
+	}
+	if m.connections > 0 && len(m.xmuxClients) < int(m.connections) {
+		return m.newXmuxClient()
+	}
+	xmuxClients := make([]*XmuxClient, 0)
+	if m.concurrency > 0 {
+		for _, xmuxClient := range m.xmuxClients {
+			if xmuxClient.OpenUsage.Load() < m.concurrency {
+				xmuxClients = append(xmuxClients, xmuxClient)
+			}
+		}
+	} else {
+		xmuxClients = m.xmuxClients
+	}
+	if len(xmuxClients) == 0 {
+		return m.newXmuxClient()
+	}
+	i, _ := rand.Int(rand.Reader, big.NewInt(int64(len(xmuxClients))))
+	xmuxClient := xmuxClients[i.Int64()]
+	if xmuxClient.leftUsage > 0 {
+		xmuxClient.leftUsage -= 1
+	}
+	return xmuxClient
+}

transport/v2rayxhttp/server.go

@@ -0,0 +1,354 @@
+package xhttp
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/sagernet/quic-go"
+	"github.com/sagernet/quic-go/http3"
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/tls"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
+	qtls "github.com/sagernet/sing-quic"
+
+	// qtls "github.com/sagernet/sing-quic"
+	"github.com/sagernet/sing-box/common/xray/signal/done"
+	"github.com/sagernet/sing/common"
+	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+	aTLS "github.com/sagernet/sing/common/tls"
+	sHttp "github.com/sagernet/sing/protocol/http"
+)
+
+var _ adapter.V2RayServerTransport = (*Server)(nil)
+
+type Server struct {
+	ctx         context.Context
+	logger      logger.ContextLogger
+	tlsConfig   tls.ServerConfig
+	quicConfig  *quic.Config
+	handler     adapter.V2RayServerTransportHandler
+	httpServer  *http.Server
+	http3Server *http3.Server
+	localAddr   net.Addr
+	options     *option.V2RayXHTTPOptions
+	host        string
+	path        string
+	sessionMu   sync.Mutex
+	sessions    sync.Map
+}
+
+func NewServer(ctx context.Context, logger logger.ContextLogger, options option.V2RayXHTTPOptions, tlsConfig tls.ServerConfig, handler adapter.V2RayServerTransportHandler) (*Server, error) {
+	server := &Server{
+		ctx:       ctx,
+		logger:    logger,
+		tlsConfig: tlsConfig,
+		handler:   handler,
+		options:   &options,
+		host:      options.Host,
+		path:      options.GetNormalizedPath(),
+	}
+	if server.network() == N.NetworkTCP {
+		protocols := new(http.Protocols)
+		protocols.SetHTTP1(true)
+		protocols.SetUnencryptedHTTP2(true)
+		server.httpServer = &http.Server{
+			Handler:           server,
+			ReadHeaderTimeout: time.Second * 4,
+			MaxHeaderBytes:    8192,
+			Protocols:         protocols,
+			BaseContext: func(net.Listener) context.Context {
+				return ctx
+			},
+			ConnContext: func(ctx context.Context, c net.Conn) context.Context {
+				return log.ContextWithNewID(ctx)
+			},
+		}
+	} else {
+		server.quicConfig = &quic.Config{
+			DisablePathMTUDiscovery: !C.IsLinux && !C.IsWindows,
+		}
+		server.http3Server = &http3.Server{
+			Handler: server,
+		}
+	}
+	return server, nil
+}
+
+func (s *Server) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	if len(s.host) > 0 && !isValidHTTPHost(request.Host, s.host) {
+		s.logger.ErrorContext(request.Context(), "failed to validate host, request:", request.Host, ", config:", s.host)
+		writer.WriteHeader(http.StatusNotFound)
+		return
+	}
+	if !strings.HasPrefix(request.URL.Path, s.path) {
+		s.logger.ErrorContext(request.Context(), "failed to validate path, request:", request.URL.Path, ", config:", s.path)
+		writer.WriteHeader(http.StatusNotFound)
+		return
+	}
+	writer.Header().Set("Access-Control-Allow-Origin", "*")
+	writer.Header().Set("Access-Control-Allow-Methods", "GET, POST")
+	writer.Header().Set("X-Padding", strings.Repeat("X", int(s.options.GetNormalizedXPaddingBytes().Rand())))
+	validRange := s.options.GetNormalizedXPaddingBytes()
+	paddingLength := 0
+	referrer := request.Header.Get("Referer")
+	if referrer != "" {
+		if referrerURL, err := url.Parse(referrer); err == nil {
+			// Browser dialer cannot control the host part of referrer header, so only check the query
+			paddingLength = len(referrerURL.Query().Get("x_padding"))
+		}
+	} else {
+		paddingLength = len(request.URL.Query().Get("x_padding"))
+	}
+	if int32(paddingLength) < validRange.From || int32(paddingLength) > validRange.To {
+		s.logger.ErrorContext(request.Context(), "invalid x_padding length:", int32(paddingLength))
+		writer.WriteHeader(http.StatusBadRequest)
+		return
+	}
+	sessionId := ""
+	subpath := strings.Split(request.URL.Path[len(s.path):], "/")
+	if len(subpath) > 0 {
+		sessionId = subpath[0]
+	}
+	if sessionId == "" && s.options.Mode != "" && s.options.Mode != "auto" && s.options.Mode != "stream-one" && s.options.Mode != "stream-up" {
+		s.logger.ErrorContext(request.Context(), "stream-one mode is not allowed")
+		writer.WriteHeader(http.StatusBadRequest)
+		return
+	}
+	forwardedAddrs := parseXForwardedFor(request.Header)
+	var remoteAddr net.Addr
+	var err error
+	remoteAddr, err = net.ResolveTCPAddr("tcp", request.RemoteAddr)
+	if err != nil {
+		remoteAddr = &net.TCPAddr{
+			IP:   []byte{0, 0, 0, 0},
+			Port: 0,
+		}
+	}
+	if request.ProtoMajor == 3 {
+		remoteAddr = &net.UDPAddr{
+			IP:   remoteAddr.(*net.TCPAddr).IP,
+			Port: remoteAddr.(*net.TCPAddr).Port,
+		}
+	}
+	if len(forwardedAddrs) > 0 && forwardedAddrs[0].Family().IsIP() {
+		remoteAddr = &net.TCPAddr{
+			IP:   forwardedAddrs[0].IP(),
+			Port: 0,
+		}
+	}
+	var currentSession *httpSession
+	if sessionId != "" {
+		currentSession = s.upsertSession(sessionId)
+	}
+	scMaxEachPostBytes := int(s.options.GetNormalizedScMaxEachPostBytes().To)
+	if request.Method == "POST" && sessionId != "" { // stream-up, packet-up
+		seq := ""
+		if len(subpath) > 1 {
+			seq = subpath[1]
+		}
+		if seq == "" {
+			if s.options.Mode != "" && s.options.Mode != "auto" && s.options.Mode != "stream-up" {
+				s.logger.ErrorContext(request.Context(), "stream-up mode is not allowed")
+				writer.WriteHeader(http.StatusBadRequest)
+				return
+			}
+			httpSC := &httpServerConn{
+				Instance:       done.New(),
+				Reader:         request.Body,
+				ResponseWriter: writer,
+			}
+			err = currentSession.uploadQueue.Push(Packet{
+				Reader: httpSC,
+			})
+			if err != nil {
+				s.logger.InfoContext(request.Context(), err, "failed to upload (PushReader)")
+				writer.WriteHeader(http.StatusConflict)
+			} else {
+				writer.Header().Set("X-Accel-Buffering", "no")
+				writer.Header().Set("Cache-Control", "no-store")
+				writer.WriteHeader(http.StatusOK)
+				scStreamUpServerSecs := s.options.GetNormalizedScStreamUpServerSecs()
+				if referrer != "" && scStreamUpServerSecs.To > 0 {
+					go func() {
+						for {
+							_, err := httpSC.Write(bytes.Repeat([]byte{'X'}, int(s.options.GetNormalizedXPaddingBytes().Rand())))
+							if err != nil {
+								break
+							}
+							time.Sleep(time.Duration(scStreamUpServerSecs.Rand()) * time.Second)
+						}
+					}()
+				}
+				select {
+				case <-request.Context().Done():
+				case <-httpSC.Wait():
+				}
+			}
+			httpSC.Close()
+			return
+		}
+		if s.options.Mode != "" && s.options.Mode != "auto" && s.options.Mode != "packet-up" {
+			s.logger.ErrorContext(request.Context(), "packet-up mode is not allowed")
+			writer.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		payload, err := io.ReadAll(io.LimitReader(request.Body, int64(scMaxEachPostBytes)+1))
+		if len(payload) > scMaxEachPostBytes {
+			s.logger.ErrorContext(request.Context(), "Too large upload. scMaxEachPostBytes is set to ", scMaxEachPostBytes, "but request size exceed it. Adjust scMaxEachPostBytes on the server to be at least as large as client.")
+			writer.WriteHeader(http.StatusRequestEntityTooLarge)
+			return
+		}
+		if err != nil {
+			s.logger.InfoContext(request.Context(), err, "failed to upload (ReadAll)")
+			writer.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		seqInt, err := strconv.ParseUint(seq, 10, 64)
+		if err != nil {
+			s.logger.InfoContext(request.Context(), err, "failed to upload (ParseUint)")
+			writer.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		err = currentSession.uploadQueue.Push(Packet{
+			Payload: payload,
+			Seq:     seqInt,
+		})
+		if err != nil {
+			s.logger.InfoContext(request.Context(), err, "failed to upload (PushPayload)")
+			writer.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		writer.WriteHeader(http.StatusOK)
+	} else if request.Method == "GET" || sessionId == "" { // stream-down, stream-one
+		if sessionId != "" {
+			// after GET is done, the connection is finished. disable automatic
+			// session reaping, and handle it in defer
+			currentSession.isFullyConnected.Close()
+			defer s.sessions.Delete(sessionId)
+		}
+		// magic header instructs nginx + apache to not buffer response body
+		writer.Header().Set("X-Accel-Buffering", "no")
+		// A web-compliant header telling all middleboxes to disable caching.
+		// Should be able to prevent overloading the cache, or stop CDNs from
+		// teeing the response stream into their cache, causing slowdowns.
+		writer.Header().Set("Cache-Control", "no-store")
+		if !s.options.NoSSEHeader {
+			// magic header to make the HTTP middle box consider this as SSE to disable buffer
+			writer.Header().Set("Content-Type", "text/event-stream")
+		}
+		writer.WriteHeader(http.StatusOK)
+		writer.(http.Flusher).Flush()
+		httpSC := &httpServerConn{
+			Instance:       done.New(),
+			Reader:         request.Body,
+			ResponseWriter: writer,
+		}
+		conn := splitConn{
+			writer:     httpSC,
+			reader:     httpSC,
+			remoteAddr: remoteAddr,
+			localAddr:  s.localAddr,
+		}
+		if sessionId != "" { // if not stream-one
+			conn.reader = currentSession.uploadQueue
+		}
+		s.handler.NewConnectionEx(request.Context(), &conn, sHttp.SourceAddress(request), M.Socksaddr{}, func(it error) {})
+		// "A ResponseWriter may not be used after [Handler.ServeHTTP] has returned."
+		select {
+		case <-request.Context().Done():
+		case <-httpSC.Wait():
+		}
+		conn.Close()
+	} else {
+		s.logger.ErrorContext(request.Context(), "unsupported method: ", request.Method)
+		writer.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (s *Server) Network() []string {
+	return []string{s.network()}
+}
+
+func (s *Server) Serve(listener net.Listener) error {
+	if s.network() == N.NetworkTCP {
+		if s.tlsConfig != nil {
+			listener = aTLS.NewListener(listener, s.tlsConfig)
+		}
+		s.localAddr = listener.Addr()
+		return s.httpServer.Serve(listener)
+	}
+	return os.ErrInvalid
+}
+
+func (s *Server) ServePacket(listener net.PacketConn) error {
+	if s.network() == N.NetworkUDP {
+		quicListener, err := qtls.ListenEarly(listener, s.tlsConfig, s.quicConfig)
+		if err != nil {
+			return err
+		}
+		s.localAddr = quicListener.Addr()
+		return s.http3Server.ServeListener(quicListener)
+	}
+	return os.ErrInvalid
+}
+
+func (s *Server) Close() error {
+	if s.network() == N.NetworkTCP {
+		return common.Close(s.httpServer)
+	}
+	return common.Close(s.http3Server)
+}
+
+func (s *Server) network() string {
+	if s.tlsConfig != nil && len(s.tlsConfig.NextProtos()) == 1 && s.tlsConfig.NextProtos()[0] == "h3" {
+		return N.NetworkUDP
+	}
+	return N.NetworkTCP
+}
+
+func (s *Server) upsertSession(sessionId string) *httpSession {
+	// fast path
+	currentSessionAny, ok := s.sessions.Load(sessionId)
+	if ok {
+		return currentSessionAny.(*httpSession)
+	}
+	// slow path
+	s.sessionMu.Lock()
+	defer s.sessionMu.Unlock()
+	currentSessionAny, ok = s.sessions.Load(sessionId)
+	if ok {
+		return currentSessionAny.(*httpSession)
+	}
+	session := &httpSession{
+		uploadQueue:      NewUploadQueue(s.options.GetNormalizedScMaxBufferedPosts()),
+		isFullyConnected: done.New(),
+	}
+	s.sessions.Store(sessionId, session)
+	shouldReap := done.New()
+	go func() {
+		time.Sleep(30 * time.Second)
+		shouldReap.Close()
+	}()
+	go func() {
+		select {
+		case <-shouldReap.Wait():
+			s.sessions.Delete(sessionId)
+			session.uploadQueue.Close()
+		case <-session.isFullyConnected.Wait():
+		}
+	}()
+	return session
+}

transport/v2rayxhttp/upload_queue.go

@@ -0,0 +1,157 @@
+package xhttp
+
+// upload_queue is a specialized priorityqueue + channel to reorder generic
+// packets by a sequence number
+
+import (
+	"container/heap"
+	"io"
+	"runtime"
+	"sync"
+
+	E "github.com/sagernet/sing/common/exceptions"
+)
+
+type Packet struct {
+	Reader  io.ReadCloser
+	Payload []byte
+	Seq     uint64
+}
+
+type uploadQueue struct {
+	reader          io.ReadCloser
+	nomore          bool
+	pushedPackets   chan Packet
+	writeCloseMutex sync.Mutex
+	heap            uploadHeap
+	nextSeq         uint64
+	closed          bool
+	maxPackets      int
+}
+
+func NewUploadQueue(maxPackets int) *uploadQueue {
+	return &uploadQueue{
+		pushedPackets: make(chan Packet, maxPackets),
+		heap:          uploadHeap{},
+		nextSeq:       0,
+		closed:        false,
+		maxPackets:    maxPackets,
+	}
+}
+
+func (h *uploadQueue) Push(p Packet) error {
+	h.writeCloseMutex.Lock()
+	defer h.writeCloseMutex.Unlock()
+	if h.closed {
+		return E.New("packet queue closed")
+	}
+	if h.nomore {
+		return E.New("h.reader already exists")
+	}
+	if p.Reader != nil {
+		h.nomore = true
+	}
+	h.pushedPackets <- p
+	return nil
+}
+
+func (h *uploadQueue) Close() error {
+	h.writeCloseMutex.Lock()
+	defer h.writeCloseMutex.Unlock()
+	if !h.closed {
+		h.closed = true
+		runtime.Gosched() // hope Read() gets the packet
+	f:
+		for {
+			select {
+			case p := <-h.pushedPackets:
+				if p.Reader != nil {
+					h.reader = p.Reader
+				}
+			default:
+				break f
+			}
+		}
+		close(h.pushedPackets)
+	}
+	if h.reader != nil {
+		return h.reader.Close()
+	}
+	return nil
+}
+
+func (h *uploadQueue) Read(b []byte) (int, error) {
+	if h.reader != nil {
+		return h.reader.Read(b)
+	}
+	if h.closed {
+		return 0, io.EOF
+	}
+	if len(h.heap) == 0 {
+		packet, more := <-h.pushedPackets
+		if !more {
+			return 0, io.EOF
+		}
+		if packet.Reader != nil {
+			h.reader = packet.Reader
+			return h.reader.Read(b)
+		}
+		heap.Push(&h.heap, packet)
+	}
+	for len(h.heap) > 0 {
+		packet := heap.Pop(&h.heap).(Packet)
+		n := 0
+
+		if packet.Seq == h.nextSeq {
+			copy(b, packet.Payload)
+			n = min(len(b), len(packet.Payload))
+
+			if n < len(packet.Payload) {
+				// partial read
+				packet.Payload = packet.Payload[n:]
+				heap.Push(&h.heap, packet)
+			} else {
+				h.nextSeq = packet.Seq + 1
+			}
+
+			return n, nil
+		}
+		// misordered packet
+		if packet.Seq > h.nextSeq {
+			if len(h.heap) > h.maxPackets {
+				// the "reassembly buffer" is too large, and we want to
+				// constrain memory usage somehow. let's tear down the
+				// connection, and hope the application retries.
+				return 0, E.New("packet queue is too large")
+			}
+			heap.Push(&h.heap, packet)
+			packet2, more := <-h.pushedPackets
+			if !more {
+				return 0, io.EOF
+			}
+			heap.Push(&h.heap, packet2)
+		}
+	}
+	return 0, nil
+}
+
+// heap code directly taken from https://pkg.go.dev/container/heap
+type uploadHeap []Packet
+
+func (h uploadHeap) Len() int           { return len(h) }
+func (h uploadHeap) Less(i, j int) bool { return h[i].Seq < h[j].Seq }
+func (h uploadHeap) Swap(i, j int)      { h[i], h[j] = h[j], h[i] }
+
+func (h *uploadHeap) Push(x any) {
+	// Push and Pop use pointer receivers because they modify the slice's length,
+	// not just its contents.
+	*h = append(*h, x.(Packet))
+}
+
+func (h *uploadHeap) Pop() any {
+	old := *h
+	n := len(old)
+	x := old[n-1]
+	*h = old[0 : n-1]
+	return x
+}

transport/v2rayxhttp/writer.go

@@ -0,0 +1,38 @@
+package xhttp
+
+import (
+	"github.com/sagernet/sing-box/common/xray/buf"
+	"github.com/sagernet/sing-box/common/xray/pipe"
+)
+
+// A wrapper around pipe that ensures the size limit is exactly honored.
+//
+// The MultiBuffer pipe accepts any single WriteMultiBuffer call even if that
+// single MultiBuffer exceeds the size limit, and then starts blocking on the
+// next WriteMultiBuffer call. This means that ReadMultiBuffer can return more
+// bytes than the size limit. We work around this by splitting a potentially
+// too large write up into multiple.
+type uploadWriter struct {
+	*pipe.Writer
+	maxLen int32
+}
+
+func (w uploadWriter) Write(b []byte) (int, error) {
+	/*
+		capacity := int(w.maxLen - w.Len())
+		if capacity > 0 && capacity < len(b) {
+			b = b[:capacity]
+		}
+	*/
+	buffer := buf.New()
+	n, err := buffer.Write(b)
+	if err != nil {
+		return 0, err
+	}
+
+	err = w.WriteMultiBuffer([]*buf.Buffer{buffer})
+	if err != nil {
+		return 0, err
+	}
+	return n, nil
+}