@opensoha/contracts 0.1.27 → 0.2.0

package/proxytransport/udp_http.go

@@ -0,0 +1,372 @@
+package proxytransport
+
+import (
+	"bufio"
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
+	"crypto/tls"
+	"encoding/base64"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+type packetAssociation struct{ front, back net.Conn }
+
+func (a *packetAssociation) close() { _ = a.front.Close(); _ = a.back.Close() }
+func refreshPacketConn(c net.Conn, until time.Time) error {
+	if r, ok := c.(interface{ Refresh(time.Time) error }); ok {
+		return r.Refresh(until)
+	}
+	return c.SetDeadline(until)
+}
+func packetCredentials(credentials map[string]string, maxUser int) (map[string][32]byte, error) {
+	if len(credentials) == 0 || len(credentials) > 2048 {
+		return nil, errors.New("invalid packet credentials")
+	}
+	out := make(map[string][32]byte, len(credentials))
+	for user, password := range credentials {
+		if user == "" || len(user) > maxUser || len(password) < 32 {
+			return nil, errors.New("invalid packet credential")
+		}
+		out[user] = sha256.Sum256([]byte(password))
+	}
+	return out, nil
+}
+func authenticatePacket(credentials map[string][32]byte, user, password string) bool {
+	expected, exists := credentials[user]
+	actual := sha256.Sum256([]byte(password))
+	return exists && subtle.ConstantTimeCompare(expected[:], actual[:]) == 1
+}
+func singleHeader(h http.Header, name string) (string, bool) {
+	var values []string
+	for k, v := range h {
+		if strings.EqualFold(k, name) {
+			values = append(values, v...)
+		}
+	}
+	if len(values) != 1 {
+		return "", false
+	}
+	return values[0], true
+}
+func packetTarget(target string) error {
+	host, port, err := net.SplitHostPort(target)
+	n, e := strconv.Atoi(port)
+	if err != nil || e != nil || n < 1 || n > 65535 || host == "" || len(host) > 253 || strings.ContainsAny(host, "/@?#\\\r\n\t %") {
+		return errors.New("invalid packet target")
+	}
+	return nil
+}
+func authorizePacket(authorize PacketAuthorize, user, target string, until time.Time) error {
+	if !until.After(time.Now()) {
+		return net.ErrClosed
+	}
+	ctx, cancel := context.WithDeadline(context.Background(), earlier(until, time.Now().Add(3*time.Second)))
+	defer cancel()
+	return authorize(ctx, user, target)
+}
+
+// PacketHandler is an explicitly selected HTTP/1 TLS datagram handler. Dispatch
+// only requests carrying Soha-Transport to it; header-free requests retain the
+// existing TCP Handler behavior. NoNew rejects new associations, not active ones.
+type PacketHandler struct {
+	mu            sync.Mutex
+	credentials   map[string][32]byte
+	dial          DialPacket
+	authorize     PacketAuthorize
+	until         time.Time
+	closed, noNew bool
+	pending       int
+	associations  map[*packetAssociation]struct{}
+}
+
+func NewPacketHandler(credentials map[string]string, dial DialPacket, authorize PacketAuthorize, deadline time.Time) (*PacketHandler, error) {
+	c, err := packetCredentials(credentials, MaxUsernameBytes)
+	if err != nil {
+		return nil, err
+	}
+	if dial == nil || authorize == nil || !validPacketLease(deadline) {
+		return nil, errors.New("invalid packet handler dependencies or lease")
+	}
+	return &PacketHandler{credentials: c, dial: dial, authorize: authorize, until: deadline, associations: map[*packetAssociation]struct{}{}}, nil
+}
+func (h *PacketHandler) NoNew() { h.mu.Lock(); h.noNew = true; h.mu.Unlock() }
+
+// ActiveCount counts admitted datagram associations, not HTTP or SOCKS controls.
+func (h *PacketHandler) ActiveCount() int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return len(h.associations)
+}
+func (h *PacketHandler) Refresh(until time.Time) error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.closed || !h.until.After(time.Now()) {
+		return net.ErrClosed
+	}
+	if !validPacketLease(until) {
+		return errors.New("invalid packet renewal")
+	}
+	h.until = until
+	for a := range h.associations {
+		for _, c := range []net.Conn{a.front, a.back} {
+			if err := refreshPacketConn(c, until); err != nil {
+				if errors.Is(err, net.ErrClosed) {
+					a.close()
+					delete(h.associations, a)
+					break
+				}
+				return err
+			}
+		}
+	}
+	return nil
+}
+func (h *PacketHandler) Close() error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.closed = true
+	h.noNew = true
+	for a := range h.associations {
+		a.close()
+		delete(h.associations, a)
+	}
+	return nil
+}
+func (h *PacketHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	transport, ok := singleHeader(r.Header, PacketTransportHeader)
+	if r.TLS == nil || r.ProtoMajor != 1 || r.Method != http.MethodConnect || !ok || transport != PacketTransportVersion || r.ContentLength != 0 || len(r.TransferEncoding) != 0 || r.URL.User != nil || r.URL.RawQuery != "" || r.URL.Path != "" || r.URL.Host != "" && r.URL.Host != r.Host || packetTarget(r.Host) != nil {
+		http.Error(w, "invalid datagram tunnel", http.StatusBadRequest)
+		return
+	}
+	auth, ok := singleHeader(r.Header, "Proxy-Authorization")
+	request := r.Clone(r.Context())
+	request.Header = make(http.Header)
+	request.Header.Set("Authorization", auth)
+	user, secret, basicOK := request.BasicAuth()
+	if !ok || !basicOK || !authenticatePacket(h.credentials, user, secret) {
+		w.Header().Set("Proxy-Authenticate", `Basic realm="Soha managed transport"`)
+		http.Error(w, "proxy authentication required", http.StatusProxyAuthRequired)
+		return
+	}
+	h.mu.Lock()
+	until := h.until
+	available := !h.closed && !h.noNew && until.After(time.Now()) && len(h.associations)+h.pending < MaxPacketAssociations
+	if available {
+		h.pending++
+	}
+	h.mu.Unlock()
+	if !available {
+		http.Error(w, "datagram transport unavailable", http.StatusServiceUnavailable)
+		return
+	}
+	reserved := true
+	defer func() {
+		if reserved {
+			h.mu.Lock()
+			h.pending--
+			h.mu.Unlock()
+		}
+	}()
+	if err := authorizePacket(h.authorize, user, r.Host, until); err != nil {
+		http.Error(w, "datagram authorization denied", http.StatusForbidden)
+		return
+	}
+	ctx, cancel := context.WithDeadline(r.Context(), earlier(until, time.Now().Add(5*time.Second)))
+	back, err := h.dial(ctx, user, r.Host)
+	cancel()
+	if err != nil || back == nil {
+		if errors.Is(err, ErrPacketUnsupported) {
+			w.Header().Set(PacketTransportHeader, PacketTransportVersion)
+			http.Error(w, "guarded UDP transport unsupported", http.StatusNotImplemented)
+		} else {
+			http.Error(w, "datagram backend unavailable", http.StatusBadGateway)
+		}
+		return
+	}
+	defer func() { _ = back.Close() }()
+	if err := refreshPacketConn(back, until); err != nil {
+		http.Error(w, "datagram backend unavailable", http.StatusBadGateway)
+		return
+	}
+	hijacker, ok := w.(http.Hijacker)
+	if !ok {
+		http.Error(w, "datagram hijack unavailable", http.StatusInternalServerError)
+		return
+	}
+	raw, buffer, err := hijacker.Hijack()
+	if err != nil {
+		return
+	}
+	defer func() { _ = raw.Close() }()
+	front, err := NewPacketConn(&bufferedPacketStream{Conn: raw, reader: buffer.Reader}, until)
+	if err != nil {
+		return
+	}
+	defer func() { _ = front.Close() }()
+	association := &packetAssociation{front: front, back: back}
+	h.mu.Lock()
+	if h.closed || h.noNew || !h.until.After(time.Now()) {
+		h.mu.Unlock()
+		return
+	}
+	h.pending--
+	reserved = false
+	h.associations[association] = struct{}{}
+	h.mu.Unlock()
+	defer func() { association.close(); h.mu.Lock(); delete(h.associations, association); h.mu.Unlock() }()
+	if _, err := buffer.WriteString("HTTP/1.1 200 Connection Established\r\nSoha-Transport: udp/1\r\n\r\n"); err != nil {
+		return
+	}
+	if buffer.Flush() != nil {
+		return
+	}
+	done := make(chan struct{}, 2)
+	copyPackets := func(dst, src net.Conn) {
+		defer func() { done <- struct{}{} }()
+		b := make([]byte, MaxDatagramBytes)
+		for {
+			n, err := src.Read(b)
+			if err != nil {
+				return
+			}
+			h.mu.Lock()
+			lease := h.until
+			closed := h.closed
+			h.mu.Unlock()
+			if closed || authorizePacket(h.authorize, user, r.Host, lease) != nil {
+				return
+			}
+			if _, err := dst.Write(b[:n]); err != nil {
+				return
+			}
+		}
+	}
+	go copyPackets(back, front)
+	go copyPackets(front, back)
+	<-done
+	association.close()
+	<-done
+}
+
+type bufferedPacketStream struct {
+	net.Conn
+	reader       *bufio.Reader
+	responseBody io.Closer
+}
+
+func (c *bufferedPacketStream) Read(p []byte) (int, error) { return c.reader.Read(p) }
+
+func (c *bufferedPacketStream) Close() error {
+	// Closing the transport first prevents an HTTP body closer from draining
+	// the live CONNECT datagram stream. PacketConn owns this close exactly once.
+	err := c.Conn.Close()
+	if c.responseBody != nil {
+		return errors.Join(err, c.responseBody.Close())
+	}
+	return err
+}
+
+type packetHeaderReader struct {
+	reader    io.Reader
+	remaining int
+	tail      uint32
+	done      bool
+}
+
+func (r *packetHeaderReader) Read(p []byte) (int, error) {
+	if len(p) == 0 {
+		return 0, nil
+	}
+	if r.done {
+		return r.reader.Read(p)
+	}
+	if r.remaining <= 0 {
+		return 0, errors.New("packet tunnel header exceeds limit")
+	}
+	n, err := r.reader.Read(p[:1])
+	if n > 0 {
+		r.remaining--
+		r.tail = r.tail<<8 | uint32(p[0])
+		r.done = r.tail == 0x0d0a0d0a
+	}
+	return n, err
+}
+
+// DialPacketTunnel consumes an already verified TLS connection to the approved
+// internal endpoint, using the existing mapped HTTP Basic username. It does not
+// follow redirects, select endpoints or fall back to TCP or OS UDP.
+func DialPacketTunnel(ctx context.Context, rawTLSConn net.Conn, target, user, secret string, deadline time.Time) (*PacketConn, error) {
+	fail := func(err error) (*PacketConn, error) {
+		if rawTLSConn != nil {
+			_ = rawTLSConn.Close()
+		}
+		return nil, err
+	}
+	if rawTLSConn == nil || packetTarget(target) != nil || user == "" || len(user) > MaxUsernameBytes || strings.Contains(user, ":") || len(secret) < 32 || !validPacketLease(deadline) {
+		return fail(errors.New("invalid packet tunnel dependencies"))
+	}
+	stopCancel := context.AfterFunc(ctx, func() { _ = rawTLSConn.Close() })
+	defer stopCancel()
+	secured, ok := rawTLSConn.(*tls.Conn)
+	if !ok {
+		return fail(errors.New("packet tunnel requires TLS"))
+	}
+	handshake := earlier(deadline, time.Now().Add(5*time.Second))
+	if d, ok := ctx.Deadline(); ok {
+		handshake = earlier(handshake, d)
+	}
+	if err := rawTLSConn.SetDeadline(handshake); err != nil {
+		return fail(err)
+	}
+	handshakeCtx, cancel := context.WithDeadline(ctx, handshake)
+	err := secured.HandshakeContext(handshakeCtx)
+	cancel()
+	if err != nil {
+		return fail(errors.New("packet TLS handshake failed"))
+	}
+	state := secured.ConnectionState()
+	if len(state.VerifiedChains) == 0 {
+		return fail(errors.New("packet TLS identity unverified"))
+	}
+	req := &http.Request{Method: http.MethodConnect, URL: &url.URL{Opaque: target}, Host: target, Header: make(http.Header)}
+	req.Header.Set(PacketTransportHeader, PacketTransportVersion)
+	req.Header.Set("Proxy-Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(user+":"+secret)))
+	if err := req.Write(rawTLSConn); err != nil {
+		return fail(errors.New("packet tunnel request failed"))
+	}
+	reader := bufio.NewReader(&packetHeaderReader{reader: rawTLSConn, remaining: 16 << 10})
+	response, err := http.ReadResponse(reader, req)
+	if err != nil {
+		return fail(errors.New("packet tunnel response failed"))
+	}
+	defer func() { _ = response.Body.Close() }()
+	version, ok := singleHeader(response.Header, PacketTransportHeader)
+	if response.ProtoMajor != 1 || !ok || version != PacketTransportVersion || len(response.TransferEncoding) != 0 {
+		return fail(errors.New("unsafe packet tunnel response"))
+	}
+	if response.StatusCode == http.StatusNotImplemented {
+		return fail(ErrPacketUnsupported)
+	}
+	if response.StatusCode != http.StatusOK {
+		return fail(errors.New("packet tunnel refused"))
+	}
+	stream := &bufferedPacketStream{Conn: rawTLSConn, reader: reader}
+	packet, err := NewPacketConn(stream, deadline)
+	if err != nil {
+		return fail(err)
+	}
+	// Transfer the response body to the returned connection; the deferred closer
+	// handles failure paths only and must not consume a successful tunnel.
+	stream.responseBody = response.Body
+	response.Body = http.NoBody
+	return packet, nil
+}

package/proxytransport/udp_socks.go

@@ -0,0 +1,288 @@
+package proxytransport
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"strconv"
+	"sync"
+	"time"
+)
+
+func loopbackAddress(address string) bool {
+	host, port, err := net.SplitHostPort(address)
+	n, e := strconv.Atoi(port)
+	ip := net.ParseIP(host)
+	return err == nil && e == nil && n > 0 && n <= 65535 && ip != nil && ip.IsLoopback()
+}
+func readSOCKSAddress(r io.Reader) (string, error) {
+	var kind [1]byte
+	if _, err := io.ReadFull(r, kind[:]); err != nil {
+		return "", err
+	}
+	return readSOCKSAddressType(r, kind[0])
+}
+func readSOCKSAddressType(r io.Reader, kind byte) (string, error) {
+	var host string
+	switch kind {
+	case 1:
+		b := make([]byte, 4)
+		if _, err := io.ReadFull(r, b); err != nil {
+			return "", err
+		}
+		host = net.IP(b).String()
+	case 4:
+		b := make([]byte, 16)
+		if _, err := io.ReadFull(r, b); err != nil {
+			return "", err
+		}
+		host = net.IP(b).String()
+	case 3:
+		var size [1]byte
+		if _, err := io.ReadFull(r, size[:]); err != nil {
+			return "", err
+		}
+		if size[0] == 0 || size[0] > 253 {
+			return "", errors.New("invalid SOCKS hostname")
+		}
+		b := make([]byte, int(size[0]))
+		if _, err := io.ReadFull(r, b); err != nil {
+			return "", err
+		}
+		host = string(b)
+	default:
+		return "", errors.New("invalid SOCKS address type")
+	}
+	var port [2]byte
+	if _, err := io.ReadFull(r, port[:]); err != nil {
+		return "", err
+	}
+	return net.JoinHostPort(host, strconv.Itoa(int(binary.BigEndian.Uint16(port[:])))), nil
+}
+func encodeSOCKSAddress(target string, allowZero bool) ([]byte, error) {
+	host, port, err := net.SplitHostPort(target)
+	n, e := strconv.Atoi(port)
+	hostSize := len(host)
+	if err != nil || e != nil || n < 0 || n > 65535 || !allowZero && n == 0 || hostSize == 0 || hostSize > 253 {
+		return nil, errors.New("invalid SOCKS target")
+	}
+	var b []byte
+	if ip := net.ParseIP(host); ip != nil {
+		if ip4 := ip.To4(); ip4 != nil {
+			b = append([]byte{1}, ip4...)
+		} else {
+			b = append([]byte{4}, ip.To16()...)
+		}
+	} else {
+		if !allowZero && packetTarget(target) != nil {
+			return nil, errors.New("invalid SOCKS hostname")
+		}
+		b = append([]byte{3, byte(hostSize)}, []byte(host)...)
+	}
+	b = binary.BigEndian.AppendUint16(b, uint16(n))
+	return b, nil
+}
+func encodeSOCKSDatagram(target string, payload []byte) ([]byte, error) {
+	address, err := encodeSOCKSAddress(target, false)
+	if err != nil {
+		return nil, err
+	}
+	if 3+len(address)+len(payload) > MaxDatagramBytes {
+		return nil, errors.New("SOCKS datagram exceeds total packet limit")
+	}
+	b := make([]byte, 3, 3+len(address)+len(payload))
+	b = append(b, address...)
+	return append(b, payload...), nil
+}
+func decodeSOCKSDatagram(packet []byte) (string, []byte, error) {
+	if len(packet) < 4 || len(packet) > MaxDatagramBytes || packet[0] != 0 || packet[1] != 0 || packet[2] != 0 {
+		return "", nil, errors.New("invalid or fragmented SOCKS datagram")
+	}
+	reader := &packetByteReader{data: packet[3:]}
+	target, err := readSOCKSAddress(reader)
+	if err != nil || packetTarget(target) != nil {
+		return "", nil, errors.New("invalid SOCKS datagram target")
+	}
+	return target, reader.data, nil
+}
+
+type packetByteReader struct{ data []byte }
+
+func (r *packetByteReader) Read(p []byte) (int, error) {
+	if len(r.data) == 0 {
+		return 0, io.EOF
+	}
+	n := copy(p, r.data)
+	r.data = r.data[n:]
+	return n, nil
+}
+func socksClientAuth(c net.Conn, user, secret string) error {
+	userSize, secretSize := len(user), len(secret)
+	if userSize == 0 || userSize > 255 || secretSize < 32 || secretSize > 255 {
+		return errors.New("invalid SOCKS credential size")
+	}
+	if err := writePacketAll(c, []byte{5, 1, 2}); err != nil {
+		return err
+	}
+	var reply [2]byte
+	if _, err := io.ReadFull(c, reply[:]); err != nil {
+		return err
+	}
+	if reply != [2]byte{5, 2} {
+		return errors.New("SOCKS password authentication required")
+	}
+	b := []byte{1, byte(userSize)}
+	b = append(b, []byte(user)...)
+	b = append(b, byte(secretSize))
+	b = append(b, []byte(secret)...)
+	if err := writePacketAll(c, b); err != nil {
+		return err
+	}
+	if _, err := io.ReadFull(c, reply[:]); err != nil {
+		return err
+	}
+	if reply != [2]byte{1, 0} {
+		return errors.New("SOCKS authentication rejected")
+	}
+	return nil
+}
+func socksReply(c net.Conn, code byte, address string) error {
+	encoded, err := encodeSOCKSAddress(address, true)
+	if err != nil {
+		return err
+	}
+	return writePacketAll(c, append([]byte{5, code, 0}, encoded...))
+}
+
+type socksUDPTransport struct {
+	udp     *net.UDPConn
+	control net.Conn
+	once    sync.Once
+	err     error
+	target  string
+}
+
+func (c *socksUDPTransport) Read(p []byte) (int, error) {
+	b := make([]byte, 65536)
+	n, err := c.udp.Read(b)
+	if err != nil {
+		return 0, err
+	}
+	target, payload, err := decodeSOCKSDatagram(b[:n])
+	if err != nil {
+		return 0, err
+	}
+	if target != c.target {
+		return 0, errors.New("SOCKS UDP response changed pinned target")
+	}
+	if len(payload) > len(p) {
+		return 0, io.ErrShortBuffer
+	}
+	return copy(p, payload), nil
+}
+func (c *socksUDPTransport) Write(p []byte) (int, error) {
+	b, err := encodeSOCKSDatagram(c.target, p)
+	if err != nil {
+		return 0, err
+	}
+	n, err := c.udp.Write(b)
+	if err != nil {
+		return 0, err
+	}
+	if n != len(b) {
+		return 0, io.ErrShortWrite
+	}
+	return len(p), nil
+}
+func (c *socksUDPTransport) Close() error {
+	c.once.Do(func() { c.err = errors.Join(c.udp.Close(), c.control.Close()) })
+	return c.err
+}
+func (c *socksUDPTransport) LocalAddr() net.Addr  { return c.udp.LocalAddr() }
+func (c *socksUDPTransport) RemoteAddr() net.Addr { return c.udp.RemoteAddr() }
+func (c *socksUDPTransport) SetDeadline(t time.Time) error {
+	return errors.Join(c.udp.SetDeadline(t), c.control.SetDeadline(t))
+}
+func (c *socksUDPTransport) SetReadDeadline(t time.Time) error {
+	return errors.Join(c.udp.SetReadDeadline(t), c.control.SetReadDeadline(t))
+}
+func (c *socksUDPTransport) SetWriteDeadline(t time.Time) error {
+	return errors.Join(c.udp.SetWriteDeadline(t), c.control.SetWriteDeadline(t))
+}
+
+// DialSOCKS5UDP uses an installer-owned loopback SOCKS server. target MUST be a
+// previously authorized literal pinned IP:port. Only the relay's loopback UDP
+// socket is dialled by the OS; the actual target is reached by the owned engine.
+func DialSOCKS5UDP(ctx context.Context, backendAddr, user, secret, target string, deadline time.Time) (net.Conn, error) {
+	host, _, err := net.SplitHostPort(target)
+	if err != nil || net.ParseIP(host) == nil || packetTarget(target) != nil || !loopbackAddress(backendAddr) || !validPacketLease(deadline) {
+		return nil, errors.New("invalid owned SOCKS UDP endpoint or target")
+	}
+	until := earlier(deadline, time.Now().Add(5*time.Second))
+	if d, ok := ctx.Deadline(); ok {
+		until = earlier(until, d)
+	}
+	control, err := (&net.Dialer{Deadline: until}).DialContext(ctx, "tcp", backendAddr)
+	if err != nil {
+		return nil, err
+	}
+	success := false
+	defer func() {
+		if !success {
+			_ = control.Close()
+		}
+	}()
+	stop := context.AfterFunc(ctx, func() { _ = control.Close() })
+	defer stop()
+	if err := control.SetDeadline(until); err != nil {
+		return nil, err
+	}
+	if err := socksClientAuth(control, user, secret); err != nil {
+		return nil, err
+	}
+	address, _ := encodeSOCKSAddress("0.0.0.0:0", true)
+	if err := writePacketAll(control, append([]byte{5, 3, 0}, address...)); err != nil {
+		return nil, err
+	}
+	var reply [3]byte
+	if _, err := io.ReadFull(control, reply[:]); err != nil {
+		return nil, err
+	}
+	if reply == [3]byte{5, 7, 0} {
+		return nil, ErrPacketUnsupported
+	}
+	if reply != [3]byte{5, 0, 0} {
+		return nil, errors.New("SOCKS UDP association rejected")
+	}
+	relay, err := readSOCKSAddress(control)
+	if err != nil || !loopbackAddress(relay) {
+		return nil, errors.New("SOCKS UDP relay is not loopback")
+	}
+	remote, err := net.ResolveUDPAddr("udp", relay)
+	if err != nil {
+		return nil, err
+	}
+	udp, err := net.DialUDP("udp", nil, remote)
+	if err != nil {
+		return nil, err
+	}
+	// Normalize literal spellings so a response cannot switch addresses/ports.
+	canonical, _ := encodeSOCKSAddress(target, false)
+	reader := &packetByteReader{data: canonical}
+	target, err = readSOCKSAddress(reader)
+	if err != nil {
+		_ = udp.Close()
+		return nil, err
+	}
+	transport := &socksUDPTransport{udp: udp, control: control, target: target}
+	packet, err := newMessageConn(transport, deadline, transport.Read, transport.Write)
+	if err != nil {
+		_ = transport.Close()
+		return nil, err
+	}
+	success = true
+	go func() { _, _ = io.Copy(io.Discard, control); _ = packet.Close() }()
+	return packet, nil
+}