Implement lean "system" TCP/IP stack backend for TUN inbound

Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com>

proxy/tun/tun_linux.go

@@ -10,9 +10,12 @@ import (
 	"sync"
 
 	"github.com/vishvananda/netlink"
+	"github.com/xtls/xray-core/common/buf"
 	"github.com/xtls/xray-core/common/errors"
 	"github.com/xtls/xray-core/common/platform"
 	"golang.org/x/sys/unix"
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/link/fdbased"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 )
@@ -35,6 +38,22 @@ type LinuxTun struct {
 // LinuxTun implements Tun
 var _ Tun = (*LinuxTun)(nil)
 
+// LinuxTun implements GVisorDevice, used by the "system" (lite) ip stack
+var _ GVisorDevice = (*LinuxTun)(nil)
+
+// fdReadWriter adapts a raw, already non-blocking file descriptor to io.Reader/io.Writer,
+// so it can be used with buf.Buffer.ReadFrom, without the ownership/finalizer overhead of
+// wrapping it in an *os.File (the fd is owned and closed elsewhere, see LinuxTun.Close).
+type fdReadWriter int
+
+func (f fdReadWriter) Read(p []byte) (int, error) {
+	return unix.Read(int(f), p)
+}
+
+func (f fdReadWriter) Write(p []byte) (int, error) {
+	return unix.Write(int(f), p)
+}
+
 // NewTun builds new tun interface handler (linux specific)
 func NewTun(options *Config) (Tun, error) {
 	tunFd, tunLink, fdProvided, err := openFromEnv(options.Name)
@@ -228,6 +247,72 @@ func (t *LinuxTun) newEndpoint() (stack.LinkEndpoint, error) {
 	})
 }
 
+// ReadPacket implements GVisorDevice method to read one packet from the tun device, used by
+// the "system" (lite) ip stack. The gVisor backed stack instead talks to the fd directly through
+// fdbased.New above, for lower overhead batched IO, bypassing GVisorDevice entirely.
+// It is expected that the method will not block, rather return ErrQueueEmpty when there is nothing on the line,
+// which will make the stack call Wait which should implement desired push-back
+func (t *LinuxTun) ReadPacket() (byte, *stack.PacketBuffer, error) {
+	// request memory to write from reusable buffer pool
+	b := buf.NewWithSize(int32(t.options.MTU))
+
+	// read the bytes from the interface file descriptor, which is already non-blocking
+	n, err := b.ReadFrom(fdReadWriter(t.tunFd))
+	if err == unix.EAGAIN || err == unix.EWOULDBLOCK || err == unix.EINTR {
+		b.Release()
+		return 0, nil, ErrQueueEmpty
+	}
+	if err != nil {
+		b.Release()
+		return 0, nil, err
+	}
+
+	// discard empty packets
+	if n == 0 {
+		b.Release()
+		return 0, nil, ErrQueueEmpty
+	}
+
+	// network protocol version from the first nibble of the raw packet
+	version := b.Byte(0) >> 4
+	packetBuffer := buffer.MakeWithData(b.Bytes())
+	return version, stack.NewPacketBuffer(stack.PacketBufferOptions{
+		Payload:           packetBuffer,
+		IsForwardedPacket: true,
+		OnRelease: func() {
+			b.Release()
+		},
+	}), nil
+}
+
+// WritePacket implements GVisorDevice method to write one packet to the tun device
+func (t *LinuxTun) WritePacket(packet *stack.PacketBuffer) tcpip.Error {
+	// request memory to write from reusable buffer pool
+	b := buf.NewWithSize(int32(t.options.MTU))
+	defer b.Release()
+
+	// copy the bytes of slices that compose the packet into the allocated buffer, no
+	// Linux specific header is needed here, unlike Darwin/FreeBSD's utun devices
+	for _, packetElement := range packet.AsSlices() {
+		_, _ = b.Write(packetElement)
+	}
+
+	if _, err := fdReadWriter(t.tunFd).Write(b.Bytes()); err != nil {
+		if err == unix.EAGAIN || err == unix.EWOULDBLOCK {
+			return &tcpip.ErrWouldBlock{}
+		}
+		return &tcpip.ErrAborted{}
+	}
+	return nil
+}
+
+// Wait blocks until the tun fd is likely readable again, rather than spinning the CPU.
+// A bounded timeout keeps this responsive to a Close() racing a call already parked here.
+func (t *LinuxTun) Wait() {
+	fds := []unix.PollFd{{Fd: int32(t.tunFd), Events: unix.POLLIN}}
+	_, _ = unix.Poll(fds, 1000)
+}
+
 func setinterface(network, address string, fd uintptr, iface *net.Interface) error {
 	return unix.BindToDevice(int(fd), iface.Name)
 }