anytls 0.1.0

data/lib/anytls/inbound/socks5.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require "stringio"
+require "socket"
+
+module AnyTLS
+  module Inbound
+    # 支持无认证的 SOCKS5 CONNECT 与 UDP ASSOCIATE；拒绝 BIND 和 UDP 分片。
+    # UDP 来源限定为 TCP 对端 IP 和选定的源端口；
+    # 控制连接关闭时，同时关闭 UDP 转发资源及工作线程。
+    class Socks5
+      def initialize(client:, logger: nil, handshake_timeout: 5)
+        @client = client
+        @logger = logger
+        @handshake_timeout = handshake_timeout
+      end
+
+      def handle(io)
+        version, count = exact(io, 2).unpack("CC")
+        raise ProtocolError, "invalid SOCKS5 greeting" unless version == 5 && count.positive?
+
+        methods = exact(io, count).bytes
+        unless methods.include?(0)
+          io.write("\x05\xff".b)
+          return
+        end
+        io.write("\x05\x00".b)
+        version, command, reserved = exact(io, 3).unpack("CCC")
+        raise ProtocolError, "invalid SOCKS5 request" unless version == 5 && reserved.zero?
+
+        destination = Protocol::SocksAddress.read(io, timeout: @handshake_timeout)
+        case command
+        when 1 then connect(io, destination)
+        when 3 then associate(io, destination)
+        else reply(io, 7)
+        end
+      rescue ProtocolError, ArgumentError
+        reply(io, 8)
+      rescue TimeoutError
+        reply(io, 6)
+      rescue RemoteError, TransportError, SocketError, SystemCallError
+        reply(io, 5)
+      end
+
+      private
+
+      def exact(io, length)
+        IOHelpers.read_exact(io, length, timeout: @handshake_timeout)
+      end
+
+      def reply(io, status, address = Address.new(host: "0.0.0.0", port: 0))
+        return if @request_replied
+
+        io.write([5, status, 0].pack("CCC") + Protocol::SocksAddress.encode(address))
+        @request_replied = true
+      rescue IOError, SystemCallError, Error
+        nil
+      end
+
+      def connect(io, destination)
+        raise ProtocolError, "invalid destination port" if destination.port.zero?
+
+        stream = @client.connect(destination.host, destination.port, timeout: @handshake_timeout)
+        reply(io, 0)
+        io.timeout = nil
+        Relay.copy(io, stream)
+      ensure
+        stream&.close
+      end
+
+      def associate(io, requested_source)
+        socket = UDPSocket.new(io.addr[0] == "AF_INET6" ? Socket::AF_INET6 : Socket::AF_INET)
+        socket.bind(io.addr[3], 0)
+        packets = @client.open_datagrams(timeout: @handshake_timeout)
+        reply(io, 0, Address.new(host: socket.addr[3], port: socket.addr[1]))
+        io.timeout = nil
+        source_ip = IPAddr.new(io.peeraddr[3]).native.to_s
+        source_port = requested_source.port.zero? ? nil : requested_source.port
+        peer = nil
+        peer_lock = Mutex.new
+        done = Queue.new
+        workers = []
+        workers << packet_worker(done) do
+          loop do
+            wire, sender = socket.recvfrom(UoT::Connection::MAX_PACKET_SIZE + 263)
+            next unless IPAddr.new(sender[3]).native.to_s == source_ip
+            next if source_port && sender[1] != source_port
+            next unless wire.bytesize >= 4 && wire.byteslice(0, 3) == "\0\0\0".b
+
+            begin
+              input = StringIO.new(wire.byteslice(3..))
+              destination = Protocol::SocksAddress.read(input)
+              payload = input.read
+              next if payload.bytesize > UoT::Connection::MAX_PACKET_SIZE || destination.port.zero?
+
+              accepted = peer_lock.synchronize do
+                peer ||= [sender[3], sender[1]]
+                peer == [sender[3], sender[1]]
+              end
+              next unless accepted
+
+              packets.send_packet(payload, destination: destination)
+            rescue ProtocolError, EOFError, ArgumentError
+              next
+            end
+          end
+        end
+        workers << packet_worker(done) do
+          loop do
+            payload, destination = packets.receive_packet
+            target = peer_lock.synchronize { peer }
+            next unless target
+
+            wire = "\0\0\0".b + Protocol::SocksAddress.encode(destination) + payload
+            socket.send(wire, 0, target[0], target[1])
+          end
+        end
+        workers << packet_worker(done) { loop { io.readpartial(1024) } }
+        done.pop
+      ensure
+        socket&.close
+        packets&.close
+        io.close
+        workers&.each(&:join)
+      end
+
+      def packet_worker(done, &block)
+        Thread.new do
+          block.call
+        rescue IOError, SystemCallError, Error, SocketError
+          nil
+        ensure
+          done << true
+        end
+      end
+    end
+  end
+end

data/lib/anytls/io_helpers.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 为原生 socket、StringIO 和支持超时的流提供完整二进制读写。
+  # 部分进度消耗同一预算；辅助方法不重放失败写入。
+  module IOHelpers
+    module_function
+
+    # Linux 上仅关闭描述符不能唤醒另一线程的 select；先终止 socket 通信。
+    # 未连接的 UDP socket 可能拒绝 shutdown，但仍需完成关闭。
+    def close(io)
+      if io.is_a?(BasicSocket) && !io.closed?
+        begin
+          io.shutdown(Socket::SHUT_RDWR)
+        rescue IOError, SystemCallError
+          nil
+        end
+      end
+      io.close
+    end
+
+    def read_exact(io, length, timeout: nil)
+      raise ArgumentError, "negative length" unless length.is_a?(Integer) && length >= 0
+
+      deadline = Deadline.new(timeout)
+      output = String.new(encoding: Encoding::BINARY)
+      while output.bytesize < length
+        chunk = read_partial(io, length - output.bytesize, deadline: deadline)
+        raise EOFError, "unexpected end of input" if chunk.nil? || chunk.empty?
+
+        output << chunk
+      end
+      output
+    end
+
+    def read_partial(io, length, deadline: Deadline.new)
+      deadline.check!
+      if io.respond_to?(:read_nonblock)
+        loop do
+          result = io.read_nonblock(length, exception: false)
+          return result unless result.is_a?(Symbol)
+
+          wait(io, result, deadline)
+        end
+      elsif io.is_a?(StringIO)
+        io.read(length)
+      else
+        io.readpartial(length, timeout: deadline.remaining)
+      end
+    end
+
+    def write_all(io, bytes, timeout: nil)
+      deadline = Deadline.new(timeout)
+      offset = 0
+      while offset < bytes.bytesize
+        deadline.check!
+        part = bytes.byteslice(offset..)
+        count = nil
+        if io.respond_to?(:write_nonblock)
+          loop do
+            count = io.write_nonblock(part, exception: false)
+            break unless count.is_a?(Symbol)
+
+            wait(io, count, deadline)
+          end
+        elsif io.is_a?(StringIO)
+          count = io.write(part)
+        else
+          count = io.write(part, timeout: deadline.remaining)
+        end
+        raise TransportError, "write made no progress" unless count.is_a?(Integer) && count.positive?
+
+        offset += count
+      end
+      offset
+    end
+
+    def wait(io, direction, deadline)
+      return io.wait_for_io(direction, deadline) if io.respond_to?(:wait_for_io)
+
+      deadline.check!
+      readable = direction == :wait_readable ? [io] : nil
+      writable = direction == :wait_writable ? [io] : nil
+      raise TimeoutError, "I/O timed out" unless IO.select(readable, writable, nil, deadline.remaining)
+    end
+  end
+end

data/lib/anytls/log.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 可选诊断边界；日志器异常作为返回值交给调用者检查。
+  module Log
+    # 诊断失败不能替换传输异常，也不能中断资源清理。
+    # 调用者可保留返回的异常，供诊断接口查询。
+    def self.emit(logger, level, message)
+      logger&.public_send(level, message)
+      nil
+    rescue StandardError => error
+      error
+    end
+  end
+end

data/lib/anytls/padding/scheme.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+
+module AnyTLS
+  # 经过校验的线协议填充方案，以及每个会话独立的明文分片。
+  module Padding
+    # 保存不可变的原始字节和校验后的范围；MD5 仅标识填充方案，
+    # 不用于认证或完整性保护。
+    class Scheme
+      CHECK = -1
+      MAX_RULES = 256
+      MAX_STOP = 256
+      MAX_SEGMENTS = 64
+      MAX_PACKET_BYTES = 262_144
+      MAX_PADDING_BYTES = 1_048_576
+      DEFAULT_RAW = <<~SCHEME.chomp.freeze
+        stop=8
+        0=30-30
+        1=100-400
+        2=400-500,c,500-1000,c,500-1000,c,500-1000,c,500-1000
+        3=9-9,500-1000
+        4=500-1000
+        5=500-1000
+        6=500-1000
+        7=500-1000
+      SCHEME
+
+      attr_reader :raw, :md5, :stop, :max_padding_bytes
+
+      def self.default
+        new(DEFAULT_RAW)
+      end
+
+      def initialize(raw)
+        raise TypeError, "padding scheme must be a String" unless raw.is_a?(String)
+        raise ConfigurationError, "padding scheme exceeds frame limit" if raw.bytesize > Protocol::MAX_PAYLOAD
+
+        @raw = raw.b.freeze
+        @md5 = Digest::MD5.hexdigest(@raw).freeze
+        @rules = parse_rules
+        freeze
+      end
+
+      def sizes(packet, random: SecureRandom)
+        raise ArgumentError, "packet number must be a nonnegative Integer" unless packet.is_a?(Integer) && packet >= 0
+
+        @rules.fetch(packet, []).map do |rule|
+          next CHECK if rule == CHECK
+
+          minimum, maximum = rule
+          next minimum if minimum == maximum
+
+          # 与 Go 参考实现一致：非固定范围不包含上界。
+          minimum + if random.respond_to?(:random_number)
+                      random.random_number(maximum - minimum)
+                    else
+                      random.rand(maximum - minimum)
+                    end
+        end
+      end
+
+      private
+
+      def parse_rules
+        settings = Protocol::Settings.decode(@raw)
+        stop_text = settings.fetch("stop") { raise ConfigurationError, "padding scheme requires stop" }
+        unless stop_text.match?(/\A\d+\z/) && (0..MAX_STOP).cover?(stop_text.to_i)
+          raise ConfigurationError, "padding stop must be between 0 and #{MAX_STOP}"
+        end
+
+        @stop = stop_text.to_i
+        raise ConfigurationError, "too many padding rules" if settings.size > MAX_RULES + 1
+
+        budget = 0
+        @max_padding_bytes = 0
+        rules = settings.each_with_object({}) do |(packet, value), result|
+          next if packet == "stop"
+          unless packet.match?(/\A(?:0|[1-9]\d*)\z/) && packet.to_i < MAX_STOP
+            raise ConfigurationError, "invalid padding packet number"
+          end
+
+          tokens = value.split(",", -1)
+          raise ConfigurationError, "too many padding segments" if tokens.size > MAX_SEGMENTS
+
+          ranges = tokens.map { |token| parse_range(token) }.freeze
+          if packet == "0" && (ranges.size != 1 || ranges.first == CHECK)
+            raise ConfigurationError, "authentication padding requires one range"
+          end
+
+          packet_bytes = ranges.sum { |range| range == CHECK ? 0 : range.last + Protocol::HEADER_SIZE }
+          raise ConfigurationError, "padding packet exceeds byte budget" if packet_bytes > MAX_PACKET_BYTES
+
+          @max_padding_bytes = [@max_padding_bytes, packet_bytes].max
+          budget += packet_bytes
+          raise ConfigurationError, "padding scheme exceeds byte budget" if budget > MAX_PADDING_BYTES
+
+          result[packet.to_i] = ranges
+        end
+        rules.freeze
+      rescue ProtocolError => error
+        raise ConfigurationError, "invalid padding scheme", cause: error
+      end
+
+      def parse_range(token)
+        return CHECK if token == "c"
+
+        match = /\A(\d+)-(\d+)\z/.match(token)
+        raise ConfigurationError, "invalid padding range" unless match
+
+        minimum, maximum = match.captures.map(&:to_i).minmax
+        unless minimum.positive? && maximum <= Protocol::MAX_PAYLOAD
+          raise ConfigurationError, "padding lengths must be between 1 and 65535"
+        end
+
+        [minimum, maximum].freeze
+      end
+    end
+  end
+end

data/lib/anytls/padding/writer.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  module Padding
+    # 生成 TLS 明文写入片段；部分写入由传输层负责推进。
+    # 一次编码只推进一次包计数，不因片段数量而重复推进。
+    class Writer
+      attr_reader :packet_count, :scheme
+
+      def initialize(scheme, random: SecureRandom)
+        raise TypeError, "scheme must be a Padding::Scheme" unless scheme.is_a?(Scheme)
+
+        @scheme = scheme
+        @random = random
+        @packet_count = 0
+      end
+
+      def encode(bytes)
+        raise TypeError, "bytes must be a String" unless bytes.is_a?(String)
+
+        @packet_count += 1
+        remaining = bytes.b
+        return [remaining] if @packet_count >= @scheme.stop
+
+        chunks = []
+        @scheme.sizes(@packet_count, random: @random).each do |size|
+          if size == Scheme::CHECK
+            break if remaining.empty?
+
+            next
+          end
+          if remaining.bytesize > size
+            chunks << remaining.byteslice(0, size)
+            remaining = remaining.byteslice(size..)
+          elsif remaining.empty?
+            # 保持 Go 参考实现的纯填充长度语义：载荷长度加帧头长度。
+            chunks << waste(size)
+          else
+            padding_size = size - remaining.bytesize - Protocol::HEADER_SIZE
+            chunks << (padding_size.positive? ? remaining + waste(padding_size) : remaining)
+            remaining = "".b
+          end
+        end
+        chunks << remaining unless remaining.empty?
+        chunks
+      end
+
+      private
+
+      def waste(size)
+        Protocol::Frame.new(command: Protocol::WASTE, stream_id: 0, payload: "\0".b * size).encode
+      end
+    end
+  end
+end

data/lib/anytls/protocol/authentication.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module AnyTLS
+  module Protocol
+    # 仅在 TLS 内传输的认证前导：SHA-256 原始字节、uint16 长度和填充。
+    # 读取仅消费该认证记录；协议没有独立的对端认证回执。
+    module Authentication
+      module_function
+
+      def encode(password_digest, scheme:)
+        validate_digest!(password_digest)
+        length = scheme.sizes(0).first || 0
+        password_digest.b + [length].pack("n") + ("\0".b * length)
+      end
+
+      # 该解析器消费认证记录，调用语义与 SocksAddress.read 一致。
+      # rubocop:disable-next Naming/PredicateMethod
+      def read(io, password_digest:, timeout: nil)
+        validate_digest!(password_digest)
+        deadline = Deadline.new(timeout)
+        header = IOHelpers.read_exact(io, 34, timeout: deadline.remaining)
+        digest = header.byteslice(0, 32)
+        length = header.unpack1("n", offset: 32)
+        IOHelpers.read_exact(io, length, timeout: deadline.remaining) if length.positive?
+        unless OpenSSL.fixed_length_secure_compare(digest, password_digest.b)
+          raise AuthenticationError, "authentication failed"
+        end
+
+        true
+      end
+
+      def validate_digest!(digest)
+        unless digest.is_a?(String) && digest.bytesize == 32
+          raise ArgumentError,
+                "password digest must contain 32 raw bytes"
+        end
+      end
+
+      private_class_method :validate_digest!
+    end
+  end
+end

data/lib/anytls/protocol/decoder.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  module Protocol
+    # 增量解析任意传输片段，不假定 TLS 记录边界就是协议帧边界。
+    class Decoder
+      def initialize
+        @buffer = String.new(encoding: Encoding::BINARY)
+      end
+
+      def feed(bytes)
+        raise TypeError, "bytes must be a String" unless bytes.is_a?(String)
+
+        @buffer << bytes.b
+        frames = []
+        offset = 0
+        while @buffer.bytesize - offset >= HEADER_SIZE
+          command, stream_id, length = @buffer.unpack("CNn", offset:)
+          break if @buffer.bytesize - offset < HEADER_SIZE + length
+
+          frames << Frame.new(command:, stream_id:, payload: @buffer.byteslice(offset + HEADER_SIZE, length))
+          offset += HEADER_SIZE + length
+        end
+        @buffer = @buffer.byteslice(offset..) if offset.positive?
+        frames
+      end
+
+      def finish!
+        raise ProtocolError, "truncated frame at end of connection" unless @buffer.empty?
+
+        self
+      end
+
+      def buffered_bytes
+        @buffer.bytesize
+      end
+    end
+  end
+end

data/lib/anytls/protocol/frame.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # AnyTLS 线协议常量与编解码；命令语义由会话状态机校验。
+  module Protocol
+    WASTE = 0
+    SYN = 1
+    PSH = 2
+    FIN = 3
+    SETTINGS = 4
+    ALERT = 5
+    UPDATE_PADDING_SCHEME = 6
+    SYNACK = 7
+    HEART_REQUEST = 8
+    HEART_RESPONSE = 9
+    SERVER_SETTINGS = 10
+    HEADER_SIZE = 7
+    MAX_PAYLOAD = 65_535
+    MAX_STREAM_ID = 0xffff_ffff
+
+    # 持有不可变载荷，使用七字节网络序帧头；在 pack 前校验范围，
+    # 避免非法数值在线协议中被静默截断。
+    Frame = Data.define(:command, :stream_id, :payload) do
+      def initialize(command:, stream_id:, payload: "".b)
+        raise ArgumentError, "command must be a byte" unless command.is_a?(Integer) && (0..255).cover?(command)
+        unless stream_id.is_a?(Integer) && (0..MAX_STREAM_ID).cover?(stream_id)
+          raise ArgumentError, "stream ID must be an unsigned 32-bit integer"
+        end
+        raise TypeError, "payload must be a String" unless payload.is_a?(String)
+        raise ArgumentError, "frame payload exceeds 65535 bytes" if payload.bytesize > MAX_PAYLOAD
+
+        super(command:, stream_id:, payload: payload.b.freeze)
+      end
+
+      def encode
+        [command, stream_id, payload.bytesize].pack("CNn") + payload
+      end
+    end
+  end
+end

data/lib/anytls/protocol/settings.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  module Protocol
+    # 换行分隔的 UTF-8 键值编解码；保留未知字段用于协商扩展。
+    # 格式非法、重复或超长条目直接拒绝，不做隐式修正。
+    module Settings
+      module_function
+
+      def encode(settings)
+        raise TypeError, "settings must be a Hash" unless settings.is_a?(Hash)
+
+        result = settings.map do |key, value|
+          key = key.to_s if key.is_a?(Symbol)
+          validate_pair!(key, value)
+          "#{key}=#{value}"
+        end.join("\n")
+        raise ProtocolError, "settings exceed frame limit" if result.bytesize > MAX_PAYLOAD
+
+        result.b
+      end
+
+      def decode(bytes)
+        raise TypeError, "settings must be a String" unless bytes.is_a?(String)
+        raise ProtocolError, "settings exceed frame limit" if bytes.bytesize > MAX_PAYLOAD
+
+        text = bytes.dup.force_encoding(Encoding::UTF_8)
+        raise ProtocolError, "settings must be UTF-8" unless text.valid_encoding?
+
+        text.split("\n").each_with_object({}) do |line, settings|
+          key, value = line.split("=", 2)
+          validate_pair!(key, value)
+          raise ProtocolError, "duplicate setting" if settings.key?(key)
+
+          settings[key.freeze] = value.freeze
+        end.freeze
+      end
+
+      def validate_pair!(key, value)
+        unless key.is_a?(String) && key.match?(/\A[a-zA-Z0-9_-]+\z/) && value.is_a?(String)
+          raise ProtocolError, "invalid settings entry"
+        end
+
+        utf8 = value.dup.force_encoding(Encoding::UTF_8)
+        unless utf8.valid_encoding? && !utf8.match?(/[\x00-\x1f\x7f]/)
+          raise ProtocolError, "invalid settings value"
+        end
+      end
+
+      private_class_method :validate_pair!
+    end
+  end
+end

data/lib/anytls/protocol/socks_address.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "stringio"
+
+module AnyTLS
+  module Protocol
+    # 流目标地址和 UoT 握手共用的 SOCKS 地址编解码。
+    # read 只消费一个地址；decode 还会拒绝地址后的多余字节。
+    module SocksAddress
+      module_function
+
+      def encode(address)
+        raise TypeError, "address must be an AnyTLS::Address" unless address.is_a?(Address)
+
+        host = if address.ipv4?
+                 "\x01".b + IPAddr.new(address.host).hton
+               elsif address.ipv6?
+                 "\x04".b + IPAddr.new(address.host).hton
+               else
+                 [3, address.host.bytesize].pack("CC") + address.host.b
+               end
+        host + [address.port].pack("n")
+      end
+
+      def read(io, timeout: nil)
+        deadline = Deadline.new(timeout)
+        reader = ->(length) { IOHelpers.read_exact(io, length, timeout: deadline.remaining) }
+        type = reader.call(1).unpack1("C")
+        host = case type
+               when 1 then IPAddr.new_ntoh(reader.call(4)).to_s
+               when 4 then IPAddr.new_ntoh(reader.call(16)).to_s
+               when 3
+                 length = reader.call(1).unpack1("C")
+                 raise ProtocolError, "empty destination domain" if length.zero?
+
+                 reader.call(length)
+               else
+                 raise ProtocolError, "unsupported address type"
+               end
+        port = reader.call(2).unpack1("n")
+        begin
+          Address.new(host:, port:)
+        rescue ArgumentError => error
+          raise ProtocolError, "invalid destination address", cause: error
+        end
+      end
+
+      def decode(bytes)
+        raise TypeError, "address must be a String" unless bytes.is_a?(String)
+
+        io = StringIO.new(bytes.b)
+        address = read(io)
+        raise ProtocolError, "trailing bytes after destination address" unless io.eof?
+
+        address
+      end
+    end
+  end
+end