TUN inbound: Refine gateway and autoSystemRoutingTable on Linux (#6398)

https://github.com/XTLS/Xray-core/pull/6398#issuecomment-4880261591

go.mod

@@ -8,6 +8,7 @@ require (
 	github.com/ghodss/yaml v1.0.1-0.20220118164431-d8423dcdf344
 	github.com/golang/mock v1.7.0-rc.1
 	github.com/google/go-cmp v0.7.0
+	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/klauspost/cpuid/v2 v2.4.0
 	github.com/miekg/dns v1.1.72

proxy/hysteria/account/config.go

@@ -5,14 +5,14 @@ import (
 
 	"github.com/xtls/xray-core/common/net"
 	"github.com/xtls/xray-core/common/protocol"
-	"github.com/xtls/xray-core/common/uuid"
 
+	"github.com/google/uuid"
 	"google.golang.org/protobuf/proto"
 )
 
 func (a *Account) AsAccount() (protocol.Account, error) {
 	var VR net.Port
-	if id, err := uuid.ParseString(a.Auth); err == nil {
+	if id, err := uuid.Parse(a.Auth); err == nil {
 		VR = net.PortFromBytes(id[6:8])
 	}
 	return &MemoryAccount{
@@ -41,29 +41,71 @@ func (a *MemoryAccount) ToProto() proto.Message {
 
 type Validator struct {
 	users sync.Map
+	ids   sync.Map
+	mu    sync.Mutex
 }
 
 func NewValidator() *Validator {
 	return &Validator{}
 }
 
-func (v *Validator) Add(user *protocol.MemoryUser) error {
+func (v *Validator) Add(user *protocol.MemoryUser) (err error) {
+	v.mu.Lock()
 	v.users.Store(user.Account.(*MemoryAccount).Auth, user)
-	return nil
+	if id, err := uuid.Parse(user.Account.(*MemoryAccount).Auth); err == nil {
+		id[6] = 0
+		id[7] = 0
+		v.ids.Store(id, user)
+	}
+	v.mu.Unlock()
+	return
 }
 
-func (v *Validator) DelByEmail(email string) error {
+func (v *Validator) DelByEmail(email string) (err error) {
+	v.mu.Lock()
 	if user := v.GetByEmail(email); user != nil {
-		v.users.Delete(user.Account.(*MemoryAccount).Auth)
+		auth := user.Account.(*MemoryAccount).Auth
+		v.users.Delete(auth)
+		if id, err := uuid.Parse(auth); err == nil {
+			id[6] = 0
+			id[7] = 0
+			v.ids.Delete(id)
+		}
 	}
-	return nil
+	v.mu.Unlock()
+	return
 }
 
-func (v *Validator) Get(auth string) *protocol.MemoryUser {
-	if value, ok := v.users.Load(auth); ok {
-		return value.(*protocol.MemoryUser)
+func (v *Validator) Get(auth string) (user *protocol.MemoryUser) {
+	if id, err := uuid.Parse(auth); err == nil {
+		if user = v.GetByID(id); user != nil {
+			VR := net.PortFromBytes(id[6:8])
+			if user.Account.(*MemoryAccount).VR != VR {
+				user = &protocol.MemoryUser{
+					Email: user.Email,
+					Level: user.Level,
+					Account: &MemoryAccount{
+						Auth: auth,
+						VR:   VR,
+					},
+				}
+			}
+		}
+		return
 	}
-	return nil
+	if value, ok := v.users.Load(auth); ok {
+		user = value.(*protocol.MemoryUser)
+	}
+	return
+}
+
+func (v *Validator) GetByID(id uuid.UUID) (user *protocol.MemoryUser) {
+	id[6] = 0
+	id[7] = 0
+	if value, ok := v.ids.Load(id); ok {
+		user = value.(*protocol.MemoryUser)
+	}
+	return
 }
 
 func (v *Validator) GetByEmail(email string) (user *protocol.MemoryUser) {

proxy/tun/README.md

@@ -14,11 +14,11 @@ Plainly enabling it in the config probably will result nothing, or lock your rou
 
 ## DETAILS
 
-Current implementation does not contain options to configure network level addresses, routing or rules.
-Enabling the feature will result only tun interface up, and that's it. \
-This is explicit decision, significantly simplifying implementation, and allowing any number of custom configurations, consumers could come up with. Network interface is OS level entity, and OS is what should manage it. \
-Working configuration, is tun enabled in Xray config with specific name (e.g. xray0), and OS level configuration to manage "xray0" interface, applying routing and rules on interface up.
-This way consistency of system level routing and rules is ensured from single place of responsibility - the OS itself. \
+By default, enabling the feature will only bring the tun interface up. \
+When configured explicitly, Windows and Linux can also apply interface addresses from `gateway` and on-link routes from `autoSystemRoutingTable`.
+Linux does not configure system DNS from the `dns` field; system DNS remains managed by the OS or distribution-specific network services. \
+For more advanced routing policies or rules, OS level configuration can still manage the named interface (e.g. xray0) when it appears.
+This keeps complex system level routing and rules in a single place of responsibility - the OS itself. \
 Examples of how to achieve this on a simple Linux system (Ubuntu with systemd-networkd) can be found at the end of this README.
 
 Due to this inbound not actually being a proxy, the configuration ignore required listen and port options, and never listen on any port. \

proxy/tun/tun_linux.go

@@ -26,9 +26,10 @@ type LinuxTun struct {
 	options *Config
 	ownsTun bool
 
-	systemRoutes     []netlink.Route
-	routeMonitorStop chan struct{}
-	routeMonitorOnce sync.Once
+	interfaceAddresses []netlink.Addr
+	systemRoutes       []netlink.Route
+	routeMonitorStop   chan struct{}
+	routeMonitorOnce   sync.Once
 }
 
 // LinuxTun implements Tun
@@ -172,7 +173,14 @@ func (t *LinuxTun) Start() error {
 		return err
 	}
 
+	if err := t.setInterfaceAddresses(); err != nil {
+		_ = netlink.LinkSetDown(t.tunLink)
+		return err
+	}
+
 	if err := t.setSystemRoutes(); err != nil {
+		_ = t.unsetInterfaceAddresses()
+		_ = netlink.LinkSetDown(t.tunLink)
 		return err
 	}
 
@@ -193,6 +201,7 @@ func (t *LinuxTun) Close() error {
 	})
 
 	_ = t.unsetSystemRoutes()
+	_ = t.unsetInterfaceAddresses()
 
 	if t.ownsTun {
 		_ = netlink.LinkSetDown(t.tunLink)
@@ -223,6 +232,37 @@ func setinterface(network, address string, fd uintptr, iface *net.Interface) err
 	return unix.BindToDevice(int(fd), iface.Name)
 }
 
+func (t *LinuxTun) setInterfaceAddresses() error {
+	if len(t.options.Gateway) == 0 {
+		return nil
+	}
+	for _, address := range t.options.Gateway {
+		addr, err := netlink.ParseAddr(address)
+		if err != nil {
+			_ = t.unsetInterfaceAddresses()
+			return errors.New("invalid interface address ", address).Base(err)
+		}
+		if err := netlink.AddrAdd(t.tunLink, addr); err != nil {
+			_ = t.unsetInterfaceAddresses()
+			return errors.New("failed to add interface address ", address).Base(err)
+		}
+		t.interfaceAddresses = append(t.interfaceAddresses, *addr)
+	}
+	return nil
+}
+
+func (t *LinuxTun) unsetInterfaceAddresses() error {
+	var errs []error
+	for i := len(t.interfaceAddresses) - 1; i >= 0; i-- {
+		address := t.interfaceAddresses[i]
+		if err := netlink.AddrDel(t.tunLink, &address); err != nil {
+			errs = append(errs, errors.New("failed to delete interface address ", address.String()).Base(err))
+		}
+	}
+	t.interfaceAddresses = nil
+	return errors.Combine(errs...)
+}
+
 func (t *LinuxTun) setSystemRoutes() error {
 	if len(t.options.AutoSystemRoutingTable) == 0 {
 		return nil
@@ -308,36 +348,37 @@ func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, erro
 		return iface, nil
 	}
 
-	probeIPs := []net.IP{
-		net.ParseIP("8.8.8.8"),
-		net.ParseIP("2001:4860:4860::8888"),
+	for _, family := range []int{
+		netlink.FAMILY_V4,
+		netlink.FAMILY_V6,
+	} {
+		iface, err := findDefaultInterface(family, tunIndex)
+		if err == nil {
+			return iface, nil
+		}
 	}
 
-	for _, ip := range probeIPs {
-		routes, err := netlink.RouteGet(ip)
-		if err != nil || len(routes) == 0 {
-			continue
-		}
-		route := routes[0]
-		if route.LinkIndex == tunIndex {
-			continue
+	return nil, errors.New("no usable outbound interface found")
+}
+
+func findDefaultInterface(family int, tunIndex int) (*net.Interface, error) {
+	routes, err := netlink.RouteList(nil, family)
+	if err != nil {
+		return nil, err
+	}
+
+	var selected *net.Interface
+	selectedMetric := -1
+
+	for _, route := range routes {
+		if route.Dst != nil {
+			ones, _ := route.Dst.Mask.Size()
+			if ones != 0 {
+				continue
+			}
 		}
 
-		link, err := netlink.LinkByIndex(route.LinkIndex)
-		if err != nil {
-			continue
-		}
-		attrs := link.Attrs()
-
-		if attrs.Flags&net.FlagUp == 0 {
-			continue
-		}
-		operState := attrs.OperState
-		if operState != netlink.OperUp && operState != netlink.OperUnknown {
-			continue
-		}
-
-		if route.Src == nil || route.Src.IsLoopback() || route.Src.IsLinkLocalUnicast() {
+		if route.LinkIndex == 0 || route.LinkIndex == tunIndex {
 			continue
 		}
 
@@ -345,8 +386,21 @@ func findOutboundInterface(tunIndex int, fixedName string) (*net.Interface, erro
 		if err != nil {
 			continue
 		}
-		return iface, nil
+
+		if iface.Flags&net.FlagUp == 0 ||
+			iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+
+		if selected == nil || route.Priority < selectedMetric {
+			selected = iface
+			selectedMetric = route.Priority
+		}
 	}
 
-	return nil, errors.New("no usable outbound interface found")
+	if selected == nil {
+		return nil, errors.New("physical default route not found")
+	}
+
+	return selected, nil
 }