feat: support trusttunnel inbound and outbound

transport/gun/gun.go

@@ -40,10 +40,10 @@ var defaultHeader = http.Header{
 type DialFn = func(ctx context.Context, network, addr string) (net.Conn, error)
 
 type Conn struct {
-	initFn func() (io.ReadCloser, netAddr, error)
+	initFn func() (io.ReadCloser, NetAddr, error)
 	writer io.Writer // writer must not nil
 	closer io.Closer
-	netAddr
+	NetAddr
 
 	initOnce sync.Once
 	initErr  error
@@ -73,7 +73,7 @@ func (g *Conn) initReader() {
 		}
 		return
 	}
-	g.netAddr = addr
+	g.NetAddr = addr
 
 	g.closeMutex.Lock()
 	defer g.closeMutex.Unlock()
@@ -339,12 +339,12 @@ func StreamGunWithTransport(transport *TransportWrap, cfg *Config) (net.Conn, er
 	request = request.WithContext(transport.ctx)
 
 	conn := &Conn{
-		initFn: func() (io.ReadCloser, netAddr, error) {
-			nAddr := netAddr{}
+		initFn: func() (io.ReadCloser, NetAddr, error) {
+			nAddr := NetAddr{}
 			trace := &httptrace.ClientTrace{
 				GotConn: func(connInfo httptrace.GotConnInfo) {
-					nAddr.localAddr = connInfo.Conn.LocalAddr()
-					nAddr.remoteAddr = connInfo.Conn.RemoteAddr()
+					nAddr.SetLocalAddr(connInfo.Conn.LocalAddr())
+					nAddr.SetRemoteAddr(connInfo.Conn.RemoteAddr())
 				},
 			}
 			request = request.WithContext(httptrace.WithClientTrace(request.Context(), trace))

transport/gun/server.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/metacubex/mihomo/common/buf"
 	N "github.com/metacubex/mihomo/common/net"
-	C "github.com/metacubex/mihomo/constant"
 
 	"github.com/metacubex/http"
 	"github.com/metacubex/http/h2c"
@@ -42,17 +41,9 @@ func NewServerHandler(options ServerOption) http.Handler {
 			writer.WriteHeader(http.StatusOK)
 
 			conn := &Conn{
-				initFn: func() (io.ReadCloser, netAddr, error) {
-					nAddr := netAddr{}
-					if request.RemoteAddr != "" {
-						metadata := C.Metadata{}
-						if err := metadata.SetRemoteAddress(request.RemoteAddr); err == nil {
-							nAddr.remoteAddr = net.TCPAddrFromAddrPort(metadata.AddrPort())
-						}
-					}
-					if addr, ok := request.Context().Value(http.LocalAddrContextKey).(net.Addr); ok {
-						nAddr.localAddr = addr
-					}
+				initFn: func() (io.ReadCloser, NetAddr, error) {
+					nAddr := NetAddr{}
+					nAddr.SetAddrFromRequest(request)
 					return request.Body, nAddr, nil
 				},
 				writer: writer,

transport/gun/transport.go

@@ -5,6 +5,8 @@ import (
 	"net"
 	"sync"
 
+	C "github.com/metacubex/mihomo/constant"
+
 	"github.com/metacubex/http"
 )
 
@@ -18,20 +20,40 @@ type TransportWrap struct {
 func (tw *TransportWrap) Close() error {
 	tw.closeOnce.Do(func() {
 		tw.cancel()
-		closeTransport(tw.Http2Transport)
+		CloseTransport(tw.Http2Transport)
 	})
 	return nil
 }
 
-type netAddr struct {
+type NetAddr struct {
 	remoteAddr net.Addr
 	localAddr  net.Addr
 }
 
-func (addr netAddr) RemoteAddr() net.Addr {
+func (addr NetAddr) RemoteAddr() net.Addr {
 	return addr.remoteAddr
 }
 
-func (addr netAddr) LocalAddr() net.Addr {
+func (addr NetAddr) LocalAddr() net.Addr {
 	return addr.localAddr
 }
+
+func (addr *NetAddr) SetAddrFromRequest(request *http.Request) {
+	if request.RemoteAddr != "" {
+		metadata := C.Metadata{}
+		if err := metadata.SetRemoteAddress(request.RemoteAddr); err == nil {
+			addr.remoteAddr = net.TCPAddrFromAddrPort(metadata.AddrPort())
+		}
+	}
+	if netAddr, ok := request.Context().Value(http.LocalAddrContextKey).(net.Addr); ok {
+		addr.localAddr = netAddr
+	}
+}
+
+func (addr *NetAddr) SetRemoteAddr(remoteAddr net.Addr) {
+	addr.remoteAddr = remoteAddr
+}
+
+func (addr *NetAddr) SetLocalAddr(localAddr net.Addr) {
+	addr.localAddr = localAddr
+}

transport/gun/transport_close.go

@@ -44,7 +44,7 @@ func closeClientConn(cc *http.Http2ClientConn) { // like forceCloseConn() in htt
 	_ = cc.Close()
 }
 
-func closeTransport(tr *http.Http2Transport) {
+func CloseTransport(tr *http.Http2Transport) {
 	connPool := transportConnPool(tr)
 	p := (*clientConnPool)((*efaceWords)(unsafe.Pointer(&connPool)).data)
 	p.mu.Lock()

transport/trusttunnel/client.go

@@ -0,0 +1,269 @@
+package trusttunnel
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"net/url"
+	"sync"
+	"time"
+
+	C "github.com/metacubex/mihomo/constant"
+	"github.com/metacubex/mihomo/transport/vmess"
+
+	"github.com/metacubex/http"
+	"github.com/metacubex/http/httptrace"
+	"github.com/metacubex/tls"
+	"golang.org/x/exp/slices"
+)
+
+type RoundTripper interface {
+	http.RoundTripper
+	CloseIdleConnections()
+}
+
+type ResolvUDPFunc func(ctx context.Context, server string) (netip.AddrPort, error)
+
+type ClientOptions struct {
+	Dialer                C.Dialer
+	ResolvUDP             ResolvUDPFunc
+	Server                string
+	Username              string
+	Password              string
+	TLSConfig             *vmess.TLSConfig
+	QUIC                  bool
+	QUICCongestionControl string
+	QUICCwnd              int
+	HealthCheck           bool
+}
+
+type Client struct {
+	ctx              context.Context
+	dialer           C.Dialer
+	resolv           ResolvUDPFunc
+	server           string
+	auth             string
+	roundTripper     RoundTripper
+	startOnce        sync.Once
+	healthCheck      bool
+	healthCheckTimer *time.Timer
+}
+
+func NewClient(ctx context.Context, options ClientOptions) (client *Client, err error) {
+	client = &Client{
+		ctx:    ctx,
+		dialer: options.Dialer,
+		resolv: options.ResolvUDP,
+		server: options.Server,
+		auth:   buildAuth(options.Username, options.Password),
+	}
+	if options.QUIC {
+		if len(options.TLSConfig.NextProtos) == 0 {
+			options.TLSConfig.NextProtos = []string{"h3"}
+		} else if !slices.Contains(options.TLSConfig.NextProtos, "h3") {
+			return nil, errors.New("require alpn h3")
+		}
+		err = client.quicRoundTripper(options.TLSConfig, options.QUICCongestionControl, options.QUICCwnd)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		if len(options.TLSConfig.NextProtos) == 0 {
+			options.TLSConfig.NextProtos = []string{"h2"}
+		} else if !slices.Contains(options.TLSConfig.NextProtos, "h2") {
+			return nil, errors.New("require alpn h2")
+		}
+		client.h2RoundTripper(options.TLSConfig)
+	}
+	if options.HealthCheck {
+		client.healthCheck = true
+	}
+	return client, nil
+}
+
+func (c *Client) h2RoundTripper(tlsConfig *vmess.TLSConfig) {
+	c.roundTripper = &http.Http2Transport{
+		DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
+			conn, err := c.dialer.DialContext(ctx, network, c.server)
+			if err != nil {
+				return nil, err
+			}
+			tlsConn, err := vmess.StreamTLSConn(ctx, conn, tlsConfig)
+			if err != nil {
+				_ = conn.Close()
+				return nil, err
+			}
+			return tlsConn, nil
+		},
+		AllowHTTP:       false,
+		IdleConnTimeout: DefaultSessionTimeout,
+	}
+}
+
+func (c *Client) start() {
+	if c.healthCheck {
+		c.healthCheckTimer = time.NewTimer(DefaultHealthCheckTimeout)
+		go c.loopHealthCheck()
+	}
+}
+
+func (c *Client) loopHealthCheck() {
+	for {
+		select {
+		case <-c.healthCheckTimer.C:
+		case <-c.ctx.Done():
+			c.healthCheckTimer.Stop()
+			return
+		}
+		ctx, cancel := context.WithTimeout(c.ctx, DefaultHealthCheckTimeout)
+		_ = c.HealthCheck(ctx)
+		cancel()
+	}
+}
+
+func (c *Client) resetHealthCheckTimer() {
+	if c.healthCheckTimer == nil {
+		return
+	}
+	c.healthCheckTimer.Reset(DefaultHealthCheckTimeout)
+}
+
+func (c *Client) dial(ctx context.Context, request *http.Request, conn *httpConn, pipeReader *io.PipeReader, pipeWriter *io.PipeWriter) {
+	c.startOnce.Do(c.start)
+	trace := &httptrace.ClientTrace{
+		GotConn: func(connInfo httptrace.GotConnInfo) {
+			conn.SetLocalAddr(connInfo.Conn.LocalAddr())
+			conn.SetRemoteAddr(connInfo.Conn.RemoteAddr())
+		},
+	}
+	request = request.WithContext(httptrace.WithClientTrace(ctx, trace))
+	response, err := c.roundTripper.RoundTrip(request)
+	if err != nil {
+		_ = pipeWriter.CloseWithError(err)
+		_ = pipeReader.CloseWithError(err)
+		conn.setUp(nil, err)
+	} else if response.StatusCode != http.StatusOK {
+		_ = response.Body.Close()
+		err = fmt.Errorf("unexpected status code: %d", response.StatusCode)
+		_ = pipeWriter.CloseWithError(err)
+		_ = pipeReader.CloseWithError(err)
+		conn.setUp(nil, err)
+	} else {
+		c.resetHealthCheckTimer()
+		conn.setUp(response.Body, nil)
+	}
+}
+
+func (c *Client) Dial(ctx context.Context, host string) (net.Conn, error) {
+	pipeReader, pipeWriter := io.Pipe()
+	request := &http.Request{
+		Method: http.MethodConnect,
+		URL: &url.URL{
+			Scheme: "https",
+			Host:   host,
+		},
+		Header: make(http.Header),
+		Body:   pipeReader,
+		Host:   host,
+	}
+	request.Header.Add("User-Agent", TCPUserAgent)
+	request.Header.Add("Proxy-Authorization", c.auth)
+	conn := &tcpConn{
+		httpConn: httpConn{
+			writer:  pipeWriter,
+			created: make(chan struct{}),
+		},
+	}
+	go c.dial(ctx, request, &conn.httpConn, pipeReader, pipeWriter)
+	return conn, nil
+}
+
+func (c *Client) ListenPacket(ctx context.Context) (net.PacketConn, error) {
+	pipeReader, pipeWriter := io.Pipe()
+	request := &http.Request{
+		Method: http.MethodConnect,
+		URL: &url.URL{
+			Scheme: "https",
+			Host:   UDPMagicAddress,
+		},
+		Header: make(http.Header),
+		Body:   pipeReader,
+		Host:   UDPMagicAddress,
+	}
+	request.Header.Add("User-Agent", UDPUserAgent)
+	request.Header.Add("Proxy-Authorization", c.auth)
+	conn := &clientPacketConn{
+		packetConn: packetConn{
+			httpConn: httpConn{
+				writer:  pipeWriter,
+				created: make(chan struct{}),
+			},
+		},
+	}
+	go c.dial(ctx, request, &conn.httpConn, pipeReader, pipeWriter)
+	return conn, nil
+}
+
+func (c *Client) ListenICMP(ctx context.Context) (*IcmpConn, error) {
+	pipeReader, pipeWriter := io.Pipe()
+	request := &http.Request{
+		Method: http.MethodConnect,
+		URL: &url.URL{
+			Scheme: "https",
+			Host:   ICMPMagicAddress,
+		},
+		Header: make(http.Header),
+		Body:   pipeReader,
+		Host:   ICMPMagicAddress,
+	}
+	request.Header.Add("User-Agent", ICMPUserAgent)
+	request.Header.Add("Proxy-Authorization", c.auth)
+	conn := &IcmpConn{
+		httpConn{
+			writer:  pipeWriter,
+			created: make(chan struct{}),
+		},
+	}
+	go c.dial(ctx, request, &conn.httpConn, pipeReader, pipeWriter)
+	return conn, nil
+}
+
+func (c *Client) Close() error {
+	forceCloseAllConnections(c.roundTripper)
+	if c.healthCheckTimer != nil {
+		c.healthCheckTimer.Stop()
+	}
+	return nil
+}
+
+func (c *Client) ResetConnections() {
+	forceCloseAllConnections(c.roundTripper)
+	c.resetHealthCheckTimer()
+}
+
+func (c *Client) HealthCheck(ctx context.Context) error {
+	defer c.resetHealthCheckTimer()
+	request := &http.Request{
+		Method: http.MethodConnect,
+		URL: &url.URL{
+			Scheme: "https",
+			Host:   HealthCheckMagicAddress,
+		},
+		Header: make(http.Header),
+		Host:   HealthCheckMagicAddress,
+	}
+	request.Header.Add("User-Agent", HealthCheckUserAgent)
+	request.Header.Add("Proxy-Authorization", c.auth)
+	response, err := c.roundTripper.RoundTrip(request.WithContext(ctx))
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected status code: %d", response.StatusCode)
+	}
+	return nil
+}

transport/trusttunnel/doc.go

@@ -0,0 +1,4 @@
+// Package trusttunnel copy and modify from:
+// https://github.com/xchacha20-poly1305/sing-trusttunnel/tree/v0.1.1
+// adopt for mihomo
+package trusttunnel

transport/trusttunnel/force_close.go

@@ -0,0 +1,18 @@
+package trusttunnel
+
+import (
+	"github.com/metacubex/mihomo/transport/gun"
+
+	"github.com/metacubex/http"
+	"github.com/metacubex/quic-go/http3"
+)
+
+func forceCloseAllConnections(roundTripper RoundTripper) {
+	roundTripper.CloseIdleConnections()
+	switch tr := roundTripper.(type) {
+	case *http.Http2Transport:
+		gun.CloseTransport(tr)
+	case *http3.Transport:
+		_ = tr.Close()
+	}
+}

transport/trusttunnel/icmp.go

@@ -0,0 +1,82 @@
+package trusttunnel
+
+import (
+	"encoding/binary"
+	"net/netip"
+
+	"github.com/metacubex/mihomo/common/buf"
+)
+
+type IcmpConn struct {
+	httpConn
+}
+
+func (i *IcmpConn) WritePing(id uint16, destination netip.Addr, sequenceNumber uint16, ttl uint8, size uint16) error {
+	request := buf.NewSize(2 + 16 + 2 + 1 + 2)
+	defer request.Release()
+	buf.Must(binary.Write(request, binary.BigEndian, id))
+	destinationAddress := buildPaddingIP(destination)
+	buf.Must1(request.Write(destinationAddress[:]))
+	buf.Must(binary.Write(request, binary.BigEndian, sequenceNumber))
+	buf.Must(binary.Write(request, binary.BigEndian, ttl))
+	buf.Must(binary.Write(request, binary.BigEndian, size))
+	return buf.Error(i.writeFlush(request.Bytes()))
+}
+
+func (i *IcmpConn) ReadPing() (id uint16, sourceAddress netip.Addr, icmpType uint8, code uint8, sequenceNumber uint16, err error) {
+	err = i.waitCreated()
+	if err != nil {
+		return
+	}
+	response := buf.NewSize(2 + 16 + 1 + 1 + 2)
+	defer response.Release()
+	_, err = response.ReadFullFrom(i.body, response.Cap())
+	if err != nil {
+		return
+	}
+	buf.Must(binary.Read(response, binary.BigEndian, &id))
+	var sourceAddressBuffer [16]byte
+	buf.Must1(response.Read(sourceAddressBuffer[:]))
+	sourceAddress = parse16BytesIP(sourceAddressBuffer)
+	buf.Must(binary.Read(response, binary.BigEndian, &icmpType))
+	buf.Must(binary.Read(response, binary.BigEndian, &code))
+	buf.Must(binary.Read(response, binary.BigEndian, &sequenceNumber))
+	return
+}
+
+func (i *IcmpConn) Close() error {
+	return i.httpConn.Close()
+}
+
+func (i *IcmpConn) ReadPingRequest() (id uint16, destination netip.Addr, sequenceNumber uint16, ttl uint8, size uint16, err error) {
+	err = i.waitCreated()
+	if err != nil {
+		return
+	}
+	request := buf.NewSize(2 + 16 + 2 + 1 + 2)
+	defer request.Release()
+	_, err = request.ReadFullFrom(i.body, request.Cap())
+	if err != nil {
+		return
+	}
+	buf.Must(binary.Read(request, binary.BigEndian, &id))
+	var destinationAddressBuffer [16]byte
+	buf.Must1(request.Read(destinationAddressBuffer[:]))
+	destination = parse16BytesIP(destinationAddressBuffer)
+	buf.Must(binary.Read(request, binary.BigEndian, &sequenceNumber))
+	buf.Must(binary.Read(request, binary.BigEndian, &ttl))
+	buf.Must(binary.Read(request, binary.BigEndian, &size))
+	return
+}
+
+func (i *IcmpConn) WritePingResponse(id uint16, sourceAddress netip.Addr, icmpType uint8, code uint8, sequenceNumber uint16) error {
+	response := buf.NewSize(2 + 16 + 1 + 1 + 2)
+	defer response.Release()
+	buf.Must(binary.Write(response, binary.BigEndian, id))
+	sourceAddressBytes := buildPaddingIP(sourceAddress)
+	buf.Must1(response.Write(sourceAddressBytes[:]))
+	buf.Must(binary.Write(response, binary.BigEndian, icmpType))
+	buf.Must(binary.Write(response, binary.BigEndian, code))
+	buf.Must(binary.Write(response, binary.BigEndian, sequenceNumber))
+	return buf.Error(i.writeFlush(response.Bytes()))
+}

transport/trusttunnel/packet.go

@@ -0,0 +1,280 @@
+package trusttunnel
+
+import (
+	"encoding/binary"
+	"math"
+	"net"
+
+	"github.com/metacubex/sing/common"
+	"github.com/metacubex/sing/common/buf"
+	E "github.com/metacubex/sing/common/exceptions"
+	M "github.com/metacubex/sing/common/metadata"
+	N "github.com/metacubex/sing/common/network"
+	"github.com/metacubex/sing/common/rw"
+)
+
+type packetConn struct {
+	httpConn
+	readWaitOptions N.ReadWaitOptions
+}
+
+func (c *packetConn) InitializeReadWaiter(options N.ReadWaitOptions) (needCopy bool) {
+	c.readWaitOptions = options
+	return false
+}
+
+var (
+	_ N.NetPacketConn    = (*clientPacketConn)(nil)
+	_ N.FrontHeadroom    = (*clientPacketConn)(nil)
+	_ N.PacketReadWaiter = (*clientPacketConn)(nil)
+)
+
+type clientPacketConn struct {
+	packetConn
+}
+
+func (u *clientPacketConn) FrontHeadroom() int {
+	return 4 + 16 + 2 + 16 + 2 + 1 + math.MaxUint8
+}
+
+func (u *clientPacketConn) WaitReadPacket() (buffer *buf.Buffer, destination M.Socksaddr, err error) {
+	buffer = u.readWaitOptions.NewPacketBuffer()
+	destination, err = u.ReadPacket(buffer)
+	if err != nil {
+		buffer.Release()
+		return nil, M.Socksaddr{}, err
+	}
+	u.readWaitOptions.PostReturn(buffer)
+	return buffer, destination, nil
+}
+
+func (u *clientPacketConn) ReadPacket(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
+	err = u.waitCreated()
+	if err != nil {
+		return M.Socksaddr{}, err
+	}
+	return u.readPacketFromServer(buffer)
+}
+
+func (u *clientPacketConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
+	buffer := buf.With(p)
+	destination, err := u.ReadPacket(buffer)
+	if err != nil {
+		return 0, nil, err
+	}
+	return buffer.Len(), destination.UDPAddr(), nil
+}
+
+func (u *clientPacketConn) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
+	return u.writePacketToServer(buffer, destination)
+}
+
+func (u *clientPacketConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
+	err = u.WritePacket(buf.As(p), M.SocksaddrFromNet(addr))
+	if err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+func (u *clientPacketConn) readPacketFromServer(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
+	header := buf.NewSize(4 + 16 + 2 + 16 + 2)
+	defer header.Release()
+	_, err = header.ReadFullFrom(u.body, header.Cap())
+	if err != nil {
+		return
+	}
+	var length uint32
+	common.Must(binary.Read(header, binary.BigEndian, &length))
+	var sourceAddressBuffer [16]byte
+	common.Must1(header.Read(sourceAddressBuffer[:]))
+	destination.Addr = parse16BytesIP(sourceAddressBuffer)
+	common.Must(binary.Read(header, binary.BigEndian, &destination.Port))
+	common.Must(rw.SkipN(header, 16+2)) // To local address:port
+	payloadLen := int(length) - (16 + 2 + 16 + 2)
+	if payloadLen < 0 {
+		return M.Socksaddr{}, E.New("invalid udp length: ", length)
+	}
+	_, err = buffer.ReadFullFrom(u.body, payloadLen)
+	return
+}
+
+func (u *clientPacketConn) writePacketToServer(buffer *buf.Buffer, source M.Socksaddr) error {
+	defer buffer.Release()
+	if !source.IsIP() {
+		return E.New("only support IP")
+	}
+	appName := AppName
+	if len(appName) > math.MaxUint8 {
+		appName = appName[:math.MaxUint8]
+	}
+	payloadLen := buffer.Len()
+	headerLen := 4 + 16 + 2 + 16 + 2 + 1 + len(appName)
+	lengthField := uint32(16 + 2 + 16 + 2 + 1 + len(appName) + payloadLen)
+	destinationAddress := buildPaddingIP(source.Addr)
+
+	var (
+		header         *buf.Buffer
+		headerInBuffer bool
+	)
+	if buffer.Start() >= headerLen {
+		headerBytes := buffer.ExtendHeader(headerLen)
+		header = buf.With(headerBytes)
+		headerInBuffer = true
+	} else {
+		header = buf.NewSize(headerLen)
+		defer header.Release()
+	}
+	common.Must(binary.Write(header, binary.BigEndian, lengthField))
+	common.Must(header.WriteZeroN(16 + 2)) // Source address:port (unknown)
+	common.Must1(header.Write(destinationAddress[:]))
+	common.Must(binary.Write(header, binary.BigEndian, source.Port))
+	common.Must(binary.Write(header, binary.BigEndian, uint8(len(appName))))
+	common.Must1(header.WriteString(appName))
+	if !headerInBuffer {
+		_, err := u.writer.Write(header.Bytes())
+		if err != nil {
+			return err
+		}
+	}
+	_, err := u.writer.Write(buffer.Bytes())
+	if err != nil {
+		return err
+	}
+	if u.flusher != nil {
+		u.flusher.Flush()
+	}
+	return nil
+}
+
+var (
+	_ N.NetPacketConn    = (*serverPacketConn)(nil)
+	_ N.FrontHeadroom    = (*serverPacketConn)(nil)
+	_ N.PacketReadWaiter = (*serverPacketConn)(nil)
+)
+
+type serverPacketConn struct {
+	packetConn
+}
+
+func (u *serverPacketConn) FrontHeadroom() int {
+	return 4 + 16 + 2 + 16 + 2
+}
+
+func (u *serverPacketConn) WaitReadPacket() (buffer *buf.Buffer, destination M.Socksaddr, err error) {
+	buffer = u.readWaitOptions.NewPacketBuffer()
+	destination, err = u.ReadPacket(buffer)
+	if err != nil {
+		buffer.Release()
+		return nil, M.Socksaddr{}, err
+	}
+	u.readWaitOptions.PostReturn(buffer)
+	return buffer, destination, nil
+}
+
+func (u *serverPacketConn) ReadPacket(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
+	err = u.waitCreated()
+	if err != nil {
+		return M.Socksaddr{}, err
+	}
+	return u.readPacketFromClient(buffer)
+}
+
+func (u *serverPacketConn) ReadFrom(p []byte) (n int, addr net.Addr, err error) {
+	buffer := buf.With(p)
+	destination, err := u.ReadPacket(buffer)
+	if err != nil {
+		return 0, nil, err
+	}
+	return buffer.Len(), destination.UDPAddr(), nil
+}
+
+func (u *serverPacketConn) WritePacket(buffer *buf.Buffer, destination M.Socksaddr) error {
+	return u.writePacketToClient(buffer, destination)
+}
+
+func (u *serverPacketConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
+	err = u.WritePacket(buf.As(p), M.SocksaddrFromNet(addr))
+	if err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+func (u *serverPacketConn) readPacketFromClient(buffer *buf.Buffer) (destination M.Socksaddr, err error) {
+	header := buf.NewSize(4 + 16 + 2 + 16 + 2 + 1)
+	defer header.Release()
+	_, err = header.ReadFullFrom(u.body, header.Cap())
+	if err != nil {
+		return
+	}
+	var length uint32
+	common.Must(binary.Read(header, binary.BigEndian, &length))
+	var sourceAddressBuffer [16]byte
+	common.Must1(header.Read(sourceAddressBuffer[:]))
+	var sourcePort uint16
+	common.Must(binary.Read(header, binary.BigEndian, &sourcePort))
+	_ = sourcePort
+	var destinationAddressBuffer [16]byte
+	common.Must1(header.Read(destinationAddressBuffer[:]))
+	destination.Addr = parse16BytesIP(destinationAddressBuffer)
+	common.Must(binary.Read(header, binary.BigEndian, &destination.Port))
+	var appNameLen uint8
+	common.Must(binary.Read(header, binary.BigEndian, &appNameLen))
+	if appNameLen > 0 {
+		err = rw.SkipN(u.body, int(appNameLen))
+		if err != nil {
+			return M.Socksaddr{}, err
+		}
+	}
+	payloadLen := int(length) - (16 + 2 + 16 + 2 + 1 + int(appNameLen))
+	if payloadLen < 0 {
+		return M.Socksaddr{}, E.New("invalid udp length: ", length)
+	}
+	_, err = buffer.ReadFullFrom(u.body, payloadLen)
+	return
+}
+
+func (u *serverPacketConn) writePacketToClient(buffer *buf.Buffer, source M.Socksaddr) error {
+	defer buffer.Release()
+	if !source.IsIP() {
+		return E.New("only support IP")
+	}
+	payloadLen := buffer.Len()
+	headerLen := 4 + 16 + 2 + 16 + 2
+	lengthField := uint32(16 + 2 + 16 + 2 + payloadLen)
+	sourceAddress := buildPaddingIP(source.Addr)
+	var destinationAddress [16]byte
+	var destinationPort uint16
+	var (
+		header         *buf.Buffer
+		headerInBuffer bool
+	)
+	if buffer.Start() >= headerLen {
+		headerBytes := buffer.ExtendHeader(headerLen)
+		header = buf.With(headerBytes)
+		headerInBuffer = true
+	} else {
+		header = buf.NewSize(headerLen)
+		defer header.Release()
+	}
+	common.Must(binary.Write(header, binary.BigEndian, lengthField))
+	common.Must1(header.Write(sourceAddress[:]))
+	common.Must(binary.Write(header, binary.BigEndian, source.Port))
+	common.Must1(header.Write(destinationAddress[:]))
+	common.Must(binary.Write(header, binary.BigEndian, destinationPort))
+	if !headerInBuffer {
+		_, err := u.writer.Write(header.Bytes())
+		if err != nil {
+			return err
+		}
+	}
+	_, err := u.writer.Write(buffer.Bytes())
+	if err != nil {
+		return err
+	}
+	if u.flusher != nil {
+		u.flusher.Flush()
+	}
+	return nil
+}

transport/trusttunnel/protocol.go

@@ -0,0 +1,178 @@
+package trusttunnel
+
+import (
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/netip"
+	"runtime"
+	"strings"
+	"time"
+
+	C "github.com/metacubex/mihomo/constant"
+	"github.com/metacubex/mihomo/transport/gun"
+)
+
+const (
+	UDPMagicAddress         = "_udp2"
+	ICMPMagicAddress        = "_icmp"
+	HealthCheckMagicAddress = "_check"
+
+	DefaultQuicStreamReceiveWindow = 131072 // Chrome's default
+	DefaultConnectionTimeout       = 30 * time.Second
+	DefaultHealthCheckTimeout      = 7 * time.Second
+	DefaultQuicMaxIdleTimeout      = 2 * (DefaultConnectionTimeout + DefaultHealthCheckTimeout)
+	DefaultSessionTimeout          = 30 * time.Second
+)
+
+var (
+	AppName = C.Name
+	Version = C.Version
+
+	// TCPUserAgent is user-agent for TCP connections.
+	// Format: <platform> <app_name>
+	TCPUserAgent = runtime.GOOS + " " + AppName + "/" + Version
+
+	// UDPUserAgent is user-agent for UDP multiplexinh.
+	// Format: <platform> _udp2
+	UDPUserAgent = runtime.GOOS + " " + UDPMagicAddress
+
+	// ICMPUserAgent is user-agent for ICMP multiplexinh.
+	// Format: <platform> _icmp
+	ICMPUserAgent = runtime.GOOS + " " + ICMPMagicAddress
+
+	HealthCheckUserAgent = runtime.GOOS
+)
+
+func buildAuth(username string, password string) string {
+	return "Basic " + base64.StdEncoding.EncodeToString([]byte(username+":"+password))
+}
+
+// parseBasicAuth parses an HTTP Basic Authentication strinh.
+// "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" returns ("Aladdin", "open sesame", true).
+func parseBasicAuth(auth string) (username, password string, ok bool) {
+	const prefix = "Basic "
+	// Case insensitive prefix match. See Issue 22736.
+	if len(auth) < len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
+		return "", "", false
+	}
+	c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
+	if err != nil {
+		return "", "", false
+	}
+	cs := string(c)
+	username, password, ok = strings.Cut(cs, ":")
+	if !ok {
+		return "", "", false
+	}
+	return username, password, true
+}
+
+func parse16BytesIP(buffer [16]byte) netip.Addr {
+	var zeroPrefix [12]byte
+	isIPv4 := bytes.HasPrefix(buffer[:], zeroPrefix[:])
+	// Special: check ::1
+	isIPv4 = isIPv4 && !(buffer[12] == 0 && buffer[13] == 0 && buffer[14] == 0 && buffer[15] == 1)
+	if isIPv4 {
+		return netip.AddrFrom4([4]byte(buffer[12:16]))
+	}
+	return netip.AddrFrom16(buffer)
+}
+
+func buildPaddingIP(addr netip.Addr) (buffer [16]byte) {
+	if addr.Is6() {
+		return addr.As16()
+	}
+	ipv4 := addr.As4()
+	copy(buffer[12:16], ipv4[:])
+	return buffer
+}
+
+type httpConn struct {
+	writer    io.Writer
+	flusher   http.Flusher
+	body      io.ReadCloser
+	created   chan struct{}
+	createErr error
+	gun.NetAddr
+
+	// deadlines
+	deadline *time.Timer
+}
+
+func (h *httpConn) setUp(body io.ReadCloser, err error) {
+	h.body = body
+	h.createErr = err
+	close(h.created)
+}
+
+func (h *httpConn) waitCreated() error {
+	if h.body != nil || h.createErr != nil {
+		return h.createErr
+	}
+	<-h.created
+	return h.createErr
+}
+
+func (h *httpConn) Close() error {
+	var errorArr []error
+	if closer, ok := h.writer.(io.Closer); ok {
+		errorArr = append(errorArr, closer.Close())
+	}
+	if h.body != nil {
+		errorArr = append(errorArr, h.body.Close())
+	}
+	return errors.Join(errorArr...)
+}
+
+func (h *httpConn) writeFlush(p []byte) (n int, err error) {
+	n, err = h.writer.Write(p)
+	if h.flusher != nil {
+		h.flusher.Flush()
+	}
+	return n, err
+}
+
+func (h *httpConn) SetReadDeadline(t time.Time) error  { return h.SetDeadline(t) }
+func (h *httpConn) SetWriteDeadline(t time.Time) error { return h.SetDeadline(t) }
+
+func (h *httpConn) SetDeadline(t time.Time) error {
+	if t.IsZero() {
+		if h.deadline != nil {
+			h.deadline.Stop()
+			h.deadline = nil
+		}
+		return nil
+	}
+	d := time.Until(t)
+	if h.deadline != nil {
+		h.deadline.Reset(d)
+		return nil
+	}
+	h.deadline = time.AfterFunc(d, func() {
+		h.Close()
+	})
+	return nil
+}
+
+var _ net.Conn = (*tcpConn)(nil)
+
+type tcpConn struct {
+	httpConn
+}
+
+func (t *tcpConn) Read(b []byte) (n int, err error) {
+	err = t.waitCreated()
+	if err != nil {
+		return 0, err
+	}
+	n, err = t.body.Read(b)
+	return
+}
+
+func (t *tcpConn) Write(b []byte) (int, error) {
+	return t.writeFlush(b)
+}

transport/trusttunnel/quic.go

@@ -0,0 +1,85 @@
+package trusttunnel
+
+import (
+	"context"
+	"errors"
+	"net"
+	"runtime"
+
+	"github.com/metacubex/mihomo/transport/tuic/common"
+	"github.com/metacubex/mihomo/transport/vmess"
+
+	"github.com/metacubex/http"
+	"github.com/metacubex/quic-go"
+	"github.com/metacubex/quic-go/http3"
+	"github.com/metacubex/tls"
+)
+
+func (c *Client) quicRoundTripper(tlsConfig *vmess.TLSConfig, congestionControlName string, cwnd int) error {
+	stdConfig, err := tlsConfig.ToStdConfig()
+	if err != nil {
+		return err
+	}
+	c.roundTripper = &http3.Transport{
+		TLSClientConfig: stdConfig,
+		QUICConfig: &quic.Config{
+			Versions:                   []quic.Version{quic.Version1},
+			MaxIdleTimeout:             DefaultQuicMaxIdleTimeout,
+			InitialStreamReceiveWindow: DefaultQuicStreamReceiveWindow,
+			DisablePathMTUDiscovery:    !(runtime.GOOS == "windows" || runtime.GOOS == "linux" || runtime.GOOS == "android" || runtime.GOOS == "darwin"),
+			Allow0RTT:                  false,
+		},
+		Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
+			addrPort, err := c.resolv(ctx, c.server)
+			if err != nil {
+				return nil, err
+			}
+			err = tlsConfig.ECH.ClientHandle(ctx, tlsCfg)
+			if err != nil {
+				return nil, err
+			}
+			packetConn, err := c.dialer.ListenPacket(ctx, "udp", "", addrPort)
+			if err != nil {
+				return nil, err
+			}
+			quicConn, err := quic.DialEarly(ctx, packetConn, net.UDPAddrFromAddrPort(addrPort), tlsCfg, cfg)
+			if err != nil {
+				_ = packetConn.Close()
+				return nil, err
+			}
+			common.SetCongestionController(quicConn, congestionControlName, cwnd)
+			return quicConn, nil
+		},
+	}
+	return nil
+}
+
+func (s *Service) configHTTP3Server(tlsConfig *tls.Config, udpConn net.PacketConn) error {
+	tlsConfig = http3.ConfigureTLSConfig(tlsConfig)
+	quicListener, err := quic.ListenEarly(udpConn, tlsConfig, &quic.Config{
+		Versions:           []quic.Version{quic.Version1},
+		MaxIdleTimeout:     DefaultQuicMaxIdleTimeout,
+		MaxIncomingStreams: 1 << 60,
+		Allow0RTT:          true,
+	})
+	if err != nil {
+		return err
+	}
+	h3Server := &http3.Server{
+		Handler:     s,
+		IdleTimeout: DefaultSessionTimeout,
+		ConnContext: func(ctx context.Context, conn *quic.Conn) context.Context {
+			common.SetCongestionController(conn, s.quicCongestionControl, s.quicCwnd)
+			return ctx
+		},
+	}
+	s.h3Server = h3Server
+	s.udpConn = udpConn
+	go func() {
+		sErr := h3Server.ServeListener(quicListener)
+		if sErr != nil && !errors.Is(sErr, http.ErrServerClosed) {
+			s.logger.ErrorContext(s.ctx, "HTTP3 server close: ", sErr)
+		}
+	}()
+	return nil
+}

transport/trusttunnel/service.go

@@ -0,0 +1,250 @@
+package trusttunnel
+
+import (
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"github.com/metacubex/http"
+	"github.com/metacubex/http/h2c"
+	"github.com/metacubex/quic-go/http3"
+	"github.com/metacubex/sing/common"
+	"github.com/metacubex/sing/common/auth"
+	"github.com/metacubex/sing/common/buf"
+	"github.com/metacubex/sing/common/bufio"
+	E "github.com/metacubex/sing/common/exceptions"
+	"github.com/metacubex/sing/common/logger"
+	M "github.com/metacubex/sing/common/metadata"
+	N "github.com/metacubex/sing/common/network"
+	"github.com/metacubex/tls"
+)
+
+type Handler interface {
+	N.TCPConnectionHandler
+	N.UDPConnectionHandler
+}
+
+type ICMPHandler interface {
+	NewICMPConnection(ctx context.Context, conn *IcmpConn)
+}
+
+type ServiceOptions struct {
+	Ctx                   context.Context
+	Logger                logger.ContextLogger
+	Handler               Handler
+	ICMPHandler           ICMPHandler
+	QUICCongestionControl string
+	QUICCwnd              int
+}
+
+type Service struct {
+	ctx                   context.Context
+	logger                logger.ContextLogger
+	users                 map[string]string
+	handler               Handler
+	icmpHandler           ICMPHandler
+	quicCongestionControl string
+	quicCwnd              int
+	httpServer            *http.Server
+	h2Server              *http.Http2Server
+	h3Server              *http3.Server
+	tcpListener           net.Listener
+	tlsListener           net.Listener
+	udpConn               net.PacketConn
+}
+
+func NewService(options ServiceOptions) *Service {
+	return &Service{
+		ctx:                   options.Ctx,
+		logger:                options.Logger,
+		handler:               options.Handler,
+		icmpHandler:           options.ICMPHandler,
+		quicCongestionControl: options.QUICCongestionControl,
+		quicCwnd:              options.QUICCwnd,
+	}
+}
+
+func (s *Service) Start(tcpListener net.Listener, udpConn net.PacketConn, tlsConfig *tls.Config) error {
+	if tcpListener != nil {
+		h2Server := &http.Http2Server{}
+		s.httpServer = &http.Server{
+			Handler:     h2c.NewHandler(s, h2Server),
+			IdleTimeout: DefaultSessionTimeout,
+			BaseContext: func(net.Listener) context.Context {
+				return s.ctx
+			},
+		}
+		err := http.Http2ConfigureServer(s.httpServer, h2Server)
+		if err != nil {
+			return err
+		}
+		s.h2Server = h2Server
+		listener := tcpListener
+		s.tcpListener = tcpListener
+		if tlsConfig != nil {
+			listener = tls.NewListener(listener, tlsConfig)
+			s.tlsListener = listener
+		}
+		go func() {
+			sErr := s.httpServer.Serve(listener)
+			if sErr != nil && !errors.Is(sErr, http.ErrServerClosed) {
+				s.logger.ErrorContext(s.ctx, "HTTP server close: ", sErr)
+			}
+		}()
+	}
+	if udpConn != nil {
+		err := s.configHTTP3Server(tlsConfig, udpConn)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *Service) UpdateUsers(users map[string]string) {
+	s.users = users
+}
+
+func (s *Service) Close() error {
+	var shutdownErr error
+	if s.httpServer != nil {
+		const shutdownTimeout = 5 * time.Second
+		ctx, cancel := context.WithTimeout(s.ctx, shutdownTimeout)
+		shutdownErr = s.httpServer.Shutdown(ctx)
+		cancel()
+		if errors.Is(shutdownErr, http.ErrServerClosed) {
+			shutdownErr = nil
+		}
+	}
+	closeErr := common.Close(
+		common.PtrOrNil(s.httpServer),
+		s.tlsListener,
+		s.tcpListener,
+		common.PtrOrNil(s.h3Server),
+		s.udpConn,
+	)
+	return E.Errors(shutdownErr, closeErr)
+}
+
+func (s *Service) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	authorization := request.Header.Get("Proxy-Authorization")
+	username, loaded := s.verify(authorization)
+	if !loaded {
+		writer.WriteHeader(http.StatusProxyAuthRequired)
+		s.badRequest(request.Context(), request, E.New("authorization failed"))
+		return
+	}
+	if request.Method != http.MethodConnect {
+		writer.WriteHeader(http.StatusMethodNotAllowed)
+		s.badRequest(request.Context(), request, E.New("unexpected HTTP method ", request.Method))
+		return
+	}
+	ctx := request.Context()
+	ctx = auth.ContextWithUser(ctx, username)
+	s.logger.DebugContext(ctx, "[", username, "] ", "request from ", request.RemoteAddr)
+	s.logger.DebugContext(ctx, "[", username, "] ", "request to ", request.Host)
+	switch request.Host {
+	case UDPMagicAddress:
+		writer.WriteHeader(http.StatusOK)
+		flusher, isFlusher := writer.(http.Flusher)
+		if isFlusher {
+			flusher.Flush()
+		}
+		conn := &serverPacketConn{
+			packetConn: packetConn{
+				httpConn: httpConn{
+					writer:  writer,
+					flusher: flusher,
+					created: make(chan struct{}),
+				},
+			},
+		}
+		conn.SetAddrFromRequest(request)
+		conn.setUp(request.Body, nil)
+		firstPacket := buf.NewPacket()
+		destination, err := conn.ReadPacket(firstPacket)
+		if err != nil {
+			firstPacket.Release()
+			_ = conn.Close()
+			s.logger.ErrorContext(ctx, E.Cause(err, "read first packet of ", request.RemoteAddr))
+			return
+		}
+		destination = destination.Unwrap()
+		cachedConn := bufio.NewCachedPacketConn(conn, firstPacket, destination)
+		_ = s.handler.NewPacketConnection(ctx, cachedConn, M.Metadata{
+			Protocol:    "trusttunnel",
+			Source:      M.ParseSocksaddr(request.RemoteAddr),
+			Destination: destination,
+		})
+	case ICMPMagicAddress:
+		flusher, isFlusher := writer.(http.Flusher)
+		if s.icmpHandler == nil {
+			writer.WriteHeader(http.StatusNotImplemented)
+			if isFlusher {
+				flusher.Flush()
+			}
+			_ = request.Body.Close()
+		} else {
+			writer.WriteHeader(http.StatusOK)
+			if isFlusher {
+				flusher.Flush()
+			}
+			conn := &IcmpConn{
+				httpConn{
+					writer:  writer,
+					flusher: flusher,
+					created: make(chan struct{}),
+				},
+			}
+			conn.SetAddrFromRequest(request)
+			conn.setUp(request.Body, nil)
+			s.icmpHandler.NewICMPConnection(ctx, conn)
+		}
+	case HealthCheckMagicAddress:
+		writer.WriteHeader(http.StatusOK)
+		if flusher, isFlusher := writer.(http.Flusher); isFlusher {
+			flusher.Flush()
+		}
+		_ = request.Body.Close()
+	default:
+		writer.WriteHeader(http.StatusOK)
+		flusher, isFlusher := writer.(http.Flusher)
+		if isFlusher {
+			flusher.Flush()
+		}
+		conn := &tcpConn{
+			httpConn{
+				writer:  writer,
+				flusher: flusher,
+				created: make(chan struct{}),
+			},
+		}
+		conn.SetAddrFromRequest(request)
+		conn.setUp(request.Body, nil)
+		_ = s.handler.NewConnection(ctx, conn, M.Metadata{
+			Protocol:    "trusttunnel",
+			Source:      M.ParseSocksaddr(request.RemoteAddr),
+			Destination: M.ParseSocksaddr(request.Host).Unwrap(),
+		})
+	}
+}
+
+func (s *Service) verify(authorization string) (username string, loaded bool) {
+	username, password, loaded := parseBasicAuth(authorization)
+	if !loaded {
+		return "", false
+	}
+	recordedPassword, loaded := s.users[username]
+	if !loaded {
+		return "", false
+	}
+	if password != recordedPassword {
+		return "", false
+	}
+	return username, true
+}
+
+func (s *Service) badRequest(ctx context.Context, request *http.Request, err error) {
+	s.logger.ErrorContext(ctx, E.Cause(err, "process connection from ", request.RemoteAddr))
+}

transport/vmess/tls.go

@@ -24,8 +24,8 @@ type TLSConfig struct {
 	Reality           *tlsC.RealityConfig
 }
 
-func StreamTLSConn(ctx context.Context, conn net.Conn, cfg *TLSConfig) (net.Conn, error) {
-	tlsConfig, err := ca.GetTLSConfig(ca.Option{
+func (cfg *TLSConfig) ToStdConfig() (*tls.Config, error) {
+	return ca.GetTLSConfig(ca.Option{
 		TLSConfig: &tls.Config{
 			ServerName:         cfg.Host,
 			InsecureSkipVerify: cfg.SkipCertVerify,
@@ -35,6 +35,10 @@ func StreamTLSConn(ctx context.Context, conn net.Conn, cfg *TLSConfig) (net.Conn
 		Certificate: cfg.Certificate,
 		PrivateKey:  cfg.PrivateKey,
 	})
+}
+
+func StreamTLSConn(ctx context.Context, conn net.Conn, cfg *TLSConfig) (net.Conn, error) {
+	tlsConfig, err := cfg.ToStdConfig()
 	if err != nil {
 		return nil, err
 	}