feat: TUN Support #2541

AkinoKaede · 2023-05-28T07:31:12Z

TODO

codecov-commenter · 2023-05-28T10:27:06Z

Codecov Report

Attention: 550 lines in your changes are missing coverage. Please review.

Comparison is base (442eb44) 38.27% compared to head (0ca8496) 37.74%.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2541      +/-   ##
==========================================
- Coverage   38.27%   37.74%   -0.53%     
==========================================
  Files         637      654      +17     
  Lines       38147    38720     +573     
==========================================
+ Hits        14600    14616      +16     
- Misses      21938    22489     +551     
- Partials     1609     1615       +6

Files	Coverage Δ
app/tun/packetparse/errors.generated.go	`100.00% <100.00%> (ø)`
transport/internet/domainsocket/config.go	`63.15% <100.00%> (ø)`
transport/internet/domainsocket/config.pb.go	`39.13% <ø> (ø)`
app/tun/device/errors.generated.go	`0.00% <0.00%> (ø)`
app/tun/device/gvisor/errors.generated.go	`0.00% <0.00%> (ø)`
app/tun/errors.generated.go	`0.00% <0.00%> (ø)`
app/tun/net/net.go	`0.00% <0.00%> (ø)`
app/tun/tunsorter/errors.generated.go	`0.00% <0.00%> (ø)`
transport/internet/udp/dispatcher_packetaddr.go	`0.00% <0.00%> (ø)`
app/tun/packetaddradaptar.go	`0.00% <0.00%> (ø)`
... and 10 more

... and 3 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Vigilans · 2023-05-29T15:49:19Z

One use case of tun may be for supporting ICMP for Fake IPs. With tproxy, only TCP and UDP can be handled by V2Ray, but with tun, v2ray can convert Fake IP to real IP and forward ICMP requests for it.

I may help to do such ICMP forwarding, write corresponding tests, and add v2ray v4 config support.

If already exists, bind to existing device instead of create one?

rurirei · 2023-05-29T16:43:51Z

1 app/tun/handler_tcp.go app/tun/handler_udp.go a unneed channel (unbuffered even) to receives the conn.
2 app/tun/handler_udp.go note the unsupported udp nat-cone as gvisor warps a udp-conn with given target.
3 app/tun/handler_tcp.go app/tun/handler_udp.go do not implements a inbound-handler here (app/tun/), you could implements the handler as io.ReadWriteCloser instead. or implements a proxy-inbound like this. https://github.com/rurirei/v2ray-core/tree/init/proxy/tun

AkinoKaede · 2023-05-30T00:13:55Z

@rurirei Thanks for your suggestions. I don't know much about how gVisor's UDP works, can you give some advice?

AkinoKaede · 2023-05-30T00:21:16Z

One use case of tun may be for supporting ICMP for Fake IPs. With tproxy, only TCP and UDP can be handled by V2Ray, but with tun, v2ray can convert Fake IP to real IP and forward ICMP requests for it.

I may help to do such ICMP forwarding, write corresponding tests, and add v2ray v4 config support.

If already exists, bind to existing device instead of create one?

The goal of handling ICMP can be difficult to achieve, most proxy protocols do not support ICMP forwarding.

Vigilans · 2023-05-30T03:58:09Z

The goal of handling ICMP can be difficult to achieve, most proxy protocols do not support ICMP forwarding.

One of the reason may be related to this issue:
google/gvisor#8657

May need dig into the source code to find a way out. If achieved, there may be following icmp forward options: 1) fake, instantly response icmp echo packet (current behavior), 2) local/direct, send the icmp echo packet locally (like dns server's local), and 3) route/proxy. may we use something like packetaddr's special domain to wrap icmp payload and sent via procotols like vmess, finally handled by direct outbound?

rurirei · 2023-05-30T04:17:24Z

@rurirei Thanks for your suggestions. I don't know much about how gVisor's UDP works, can you give some advice?

https://github.com/xjasonlyu/tun2socks/blob/main/core/udp.go https://github.com/SagerNet/sing-tun/blob/dev/gvisor_udp.go

AkinoKaede · 2023-05-30T05:44:00Z

1 app/tun/handler_tcp.go app/tun/handler_udp.go a unneed channel (unbuffered even) to receives the conn. 2 app/tun/handler_udp.go note the unsupported udp nat-cone as gvisor warps a udp-conn with given target. 3 app/tun/handler_tcp.go app/tun/handler_udp.go do not implements a inbound-handler here (app/tun/), you could implements the handler as io.ReadWriteCloser instead. or implements a proxy-inbound like this. https://github.com/rurirei/v2ray-core/tree/init/proxy/tun

Consider that TUN is not a proxy, so I implements it as App.

AkinoKaede · 2023-05-30T05:46:48Z

The goal of handling ICMP can be difficult to achieve, most proxy protocols do not support ICMP forwarding.

One of the reason may be related to this issue: google/gvisor#8657

May need dig into the source code to find a way out. If achieved, there may be following icmp forward options: 1) fake, instantly response icmp echo packet (current behavior), 2) local/direct, send the icmp echo packet locally (like dns server's local), and 3) route/proxy. may we use something like packetaddr's special domain to wrap icmp payload and sent via procotols like vmess, finally handled by direct outbound?

I think the first option and the third option are feasible.

AkinoKaede · 2023-05-30T15:20:44Z

I test it on my Fedora VM, its' works.
Here this is a example config:

{
    "services": {
        "tun": {
            "name": "tun0",
            "mtu": 1500,
            "tag": "tun",
            "ips": [
                {
                    "ip": [192, 18, 0, 1],
                    "prefix": 24
                }
            ],
            "routes": [
                {
                    "ip": [0, 0, 0, 0],
                    "prefix": 0
                }
            ],
            "enablePromiscuousMode": true,
            "enableSpoofing": true
        }
    },
    "log": {
        "error": {
            "level": "Debug",
            "type": "Console"
        },
        "access": {
            "type": "None"
        }
    },
    "outbounds": [
        {
            "protocol": "freedom",
            "streamSettings": {
                "socketSettings": {
                    "bindToDevice": "eth0"
                }
            }
        }
    ]
}

github-actions · 2023-09-29T01:48:46Z

It has been open 120 days with no activity. Remove stale label or comment or this will be closed in 5 days

xiaokangwang · 2023-10-23T00:55:33Z

I have added packetEncoding option to tun app and it should just works.

You can test it by:

On a environment with network access

Run a server provides network access to other process with access to its domain socket with:

{
  "log": {
    "error": {
      "level": "Debug",
      "type": "Console"
    },
    "access": {
      "type": "None"
    }
  },
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ],
  "inbounds": [
    {
      "protocol": "vmess",
      "settings": {
        "users": [
          "9aea4057-dae2-4e2a-b50a-26eada70323a"
        ]
      },
      "listen": "/run/shm/v2rayvmess"
    }
  ]
}

Run tun with fullcone enabled in a separate network namespace

Create a separate user, network, mount namespace with

unshare -r
unshare -n
unshare -m

In this environment, run the v2ray with following configuration in the background:

{
  "log": {
    "error": {
      "level": "Debug",
      "type": "Console"
    },
    "access": {
      "type": "None"
    }
  },
  "outbounds": [
    {
      "protocol": "vmess",
      "settings": {
        "uuid": "9aea4057-dae2-4e2a-b50a-26eada70323a",
        "address": "@v2rayvmess"
      },
      "streamSettings": {
        "transport": "domainsocket",
        "transportSettings": {
          "path": "/run/shm/v2rayvmess",
          "abstract": false
        }
      }
    }
  ],
  "services": {
    "tun": {
      "name": "tun0",
      "mtu": 1500,
      "tag": "tun",
      "ips": [
        {
          "ip": [192, 18, 0, 1],
          "prefix": 24
        }
      ],
      "routes": [
        {
          "ip": [0, 0, 0, 0],
          "prefix": 0
        }
      ],
      "enablePromiscuousMode": true,
      "enableSpoofing": true,
      "packetEncoding": "Packet"
    }
  }
}

Finalize network setup with:

ip link set tun0 up
ip addr add 192.18.0.1/24 dev tun0
ip route add default dev tun0

You may need to fix the dns settings, as the default system setting may not work in this environment:

echo 'nameserver 1.1.1.1' > resolv.conf
mount --bind  resolv.conf /etc/resolv.conf

Then you have finished the setup of a separate tun based network ready for testing.

lluu131 · 2023-10-31T06:26:51Z

使用tun作爲網關的時候，本機可以正常通過wget進行訪問，但是其他計算機使用網關的時候，wget卡住，curl正常

sakurawald · 2023-11-07T05:47:39Z

I test it on my Fedora VM, its' works. Here this is a example config:

{
    "services": {
        "tun": {
            "name": "tun0",
            "mtu": 1500,
            "tag": "tun",
            "ips": [
                {
                    "ip": [192, 18, 0, 1],
                    "prefix": 24
                }
            ],
            "routes": [
                {
                    "ip": [0, 0, 0, 0],
                    "prefix": 0
                }
            ],
            "enablePromiscuousMode": true,
            "enableSpoofing": true
        }
    },
    "log": {
        "error": {
            "level": "Debug",
            "type": "Console"
        },
        "access": {
            "type": "None"
        }
    },
    "outbounds": [
        {
            "protocol": "freedom",
            "streamSettings": {
                "socketSettings": {
                    "bindToDevice": "eth0"
                }
            }
        }
    ]
}

Got error message using this template config:
Failed to start: main/commands: failed to load config: [./v.json] > infra/conf/v4: Cannot load service > infra/conf/v4: in V2Ray 5.9.0 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.21.3 linux/amd64) A unified platform for anti-censorship.

Is the format changed ?

lluu131 · 2023-11-07T08:52:31Z

I test it on my Fedora VM, its' works. Here this is a example config:

{
    "services": {
        "tun": {
            "name": "tun0",
            "mtu": 1500,
            "tag": "tun",
            "ips": [
                {
                    "ip": [192, 18, 0, 1],
                    "prefix": 24
                }
            ],
            "routes": [
                {
                    "ip": [0, 0, 0, 0],
                    "prefix": 0
                }
            ],
            "enablePromiscuousMode": true,
            "enableSpoofing": true
        }
    },
    "log": {
        "error": {
            "level": "Debug",
            "type": "Console"
        },
        "access": {
            "type": "None"
        }
    },
    "outbounds": [
        {
            "protocol": "freedom",
            "streamSettings": {
                "socketSettings": {
                    "bindToDevice": "eth0"
                }
            }
        }
    ]
}

Got error message using this template config: Failed to start: main/commands: failed to load config: [./v.json] > infra/conf/v4: Cannot load service > infra/conf/v4: in V2Ray 5.9.0 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.21.3 linux/amd64) A unified platform for anti-censorship.

Is the format changed ?

V5才支持

r3a1d3a1 · 2023-11-08T14:47:24Z

Same config parsing issue with this. Renamed the config to config.v5.json to no avail.

AkinoKaede · 2023-11-08T14:49:43Z

Considering that the PR has been merged, it is recommended to submit issues for questions about use.

r3a1d3a1 · 2023-11-08T15:12:36Z

Jk, figured out the -format=jsonv5 arg. A link to differences vs v4 would still be appreciated however.

sakurawald · 2023-11-08T15:14:13Z

Jk, figured out the -format=jsonv5 arg. A link to differences vs v4 would still be appreciated however.

You guys just hide so many secreeeeets.

Kein · 2024-03-20T22:16:58Z

Does anyone have an example how to tunnel ALL QUERIES from only specific application under Windows but at the same time also support SOCKS inbounds as well for others?
What are server/side configurations required

Losalado · 2024-04-25T11:44:21Z

One use case of tun may be for supporting ICMP for Fake IPs. With tproxy, only TCP and UDP can be handled by V2Ray, but with tun, v2ray can convert Fake IP to real IP and forward ICMP requests for it.

I may help to do such ICMP forwarding, write corresponding tests, and add v2ray v4 config support.

If already exists, bind to existing device instead of create one?

v5 config is WIP status, is it possible to add v2ray v4 config support for TUN?

KouYamora

package specs

import (
"encoding/json"
)

type OutboundConfig struct {
Protocol string json:"protocol"
Settings json.RawMessage json:"settings"
StreamSetting *StreamConfig json:"streamSettings"
Metadata map[string]string json:"metadata"
}

type StreamConfig struct {
Transport string json:"transport"
TransportSettings json.RawMessage json:"transportSettings"
Security string json:"security"
SecuritySettings json.RawMessage json:"securitySettings"
}

AkinoKaede force-pushed the dev-tun branch from 7cd905a to 02df397 Compare May 28, 2023 09:45

AkinoKaede force-pushed the dev-tun branch from 12605b4 to 422f9e9 Compare May 28, 2023 11:31

AkinoKaede mentioned this pull request Jul 30, 2023

[Feature Request] Support tun to remove the dependency on tun2socks. #1189

Closed

github-actions bot added the Stale label Sep 29, 2023

AkinoKaede removed the Stale label Sep 30, 2023

AkinoKaede added 14 commits October 22, 2023 22:44

feat: add tun support for tcp

12567c6

feat: set default config

a3728b6

chore: rename DeviceCreator

4276ee9

style: refine code style

225d638

feat: create NIC

06ed6f9

feat: add udp handler

1cb3ab7

style: refine code style

f39b046

feat: set MTU for gVisor tun

e2d2676

fix: inbound context

5fafc29

feat: add address to NIC

a1c5a6b

feat: add promiscuous mode and spoofing config

04104ad

feat: set route config

f9ea860

feat: add tun to all distro

c6c1cdb

fix: cannot start tun

2617a4c

AkinoKaede added 7 commits October 22, 2023 22:44

style: refine code style

c324d3a

chore: refine code struct

5f6031b

feat: refine handle logic

0a090a0

feat: use goroutines to process connections

c439a12

feat: remove packetaddr support because gVisor not support cone-nat

98463db

feat: add error log for create endpoint

7a42380

feat: socket options

89ff606

xiaokangwang force-pushed the dev-tun branch from bb20fc7 to 5b6fe79 Compare October 23, 2023 00:08

xiaokangwang marked this pull request as ready for review October 23, 2023 00:08

xiaokangwang force-pushed the dev-tun branch from 5b6fe79 to ae9e4a9 Compare October 23, 2023 00:12

xiaokangwang added 2 commits October 23, 2023 01:13

Add fullcone packet filtering to tun app

efdc05f

fix domain socket abstract name and add jsonv5 support

263fbf5

xiaokangwang force-pushed the dev-tun branch from ae9e4a9 to 263fbf5 Compare October 23, 2023 00:13

xiaokangwang added 2 commits October 23, 2023 01:39

fix crash when tun app has no socket option

e87af12

fix tun app lints

0ca8496

xiaokangwang merged commit 0ca8496 into v2fly:master Oct 23, 2023
48 of 50 checks passed

weaving118 mentioned this pull request Oct 27, 2023

v2fly v5.9.0 tun docs optimize #2731

Closed

Vigilans mentioned this pull request May 7, 2024

Support "services" root config in cfgv4 #3006

Merged

KouYamora suggested changes Jan 1, 2025

View reviewed changes

Fiyaas approved these changes Jan 15, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: TUN Support #2541

feat: TUN Support #2541

AkinoKaede commented May 28, 2023 •

edited

Loading

codecov-commenter commented May 28, 2023 •

edited

Loading

Vigilans commented May 29, 2023 •

edited

Loading

rurirei commented May 29, 2023

AkinoKaede commented May 30, 2023

AkinoKaede commented May 30, 2023

Vigilans commented May 30, 2023 •

edited

Loading

rurirei commented May 30, 2023

AkinoKaede commented May 30, 2023 •

edited

Loading

AkinoKaede commented May 30, 2023

AkinoKaede commented May 30, 2023 •

edited

Loading

github-actions bot commented Sep 29, 2023

xiaokangwang commented Oct 23, 2023

lluu131 commented Oct 31, 2023

sakurawald commented Nov 7, 2023 •

edited

Loading

lluu131 commented Nov 7, 2023

r3a1d3a1 commented Nov 8, 2023

AkinoKaede commented Nov 8, 2023

r3a1d3a1 commented Nov 8, 2023

sakurawald commented Nov 8, 2023

Kein commented Mar 20, 2024

Losalado commented Apr 25, 2024 •

edited

Loading

KouYamora left a comment

feat: TUN Support #2541

feat: TUN Support #2541

Conversation

AkinoKaede commented May 28, 2023 • edited Loading

TODO

codecov-commenter commented May 28, 2023 • edited Loading

Codecov Report

Vigilans commented May 29, 2023 • edited Loading

rurirei commented May 29, 2023

AkinoKaede commented May 30, 2023

AkinoKaede commented May 30, 2023

Vigilans commented May 30, 2023 • edited Loading

rurirei commented May 30, 2023

AkinoKaede commented May 30, 2023 • edited Loading

AkinoKaede commented May 30, 2023

AkinoKaede commented May 30, 2023 • edited Loading

github-actions bot commented Sep 29, 2023

xiaokangwang commented Oct 23, 2023

On a environment with network access

Run tun with fullcone enabled in a separate network namespace

lluu131 commented Oct 31, 2023

sakurawald commented Nov 7, 2023 • edited Loading

lluu131 commented Nov 7, 2023

r3a1d3a1 commented Nov 8, 2023

AkinoKaede commented Nov 8, 2023

r3a1d3a1 commented Nov 8, 2023

sakurawald commented Nov 8, 2023

Kein commented Mar 20, 2024

Losalado commented Apr 25, 2024 • edited Loading

KouYamora left a comment

Choose a reason for hiding this comment

AkinoKaede commented May 28, 2023 •

edited

Loading

codecov-commenter commented May 28, 2023 •

edited

Loading

Vigilans commented May 29, 2023 •

edited

Loading

Vigilans commented May 30, 2023 •

edited

Loading

AkinoKaede commented May 30, 2023 •

edited

Loading

AkinoKaede commented May 30, 2023 •

edited

Loading

sakurawald commented Nov 7, 2023 •

edited

Loading

Losalado commented Apr 25, 2024 •

edited

Loading