Skip to content

Commit 157e54f

Browse files
kunsonxkunsonx
committed
feat : optimize wireguard client kernel mode impls
1 parent 2570855 commit 157e54f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+5808
-73
lines changed

‎.github/docker/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ WORKDIR /root
1010
COPY .github/docker/files/config.json /etc/xray/config.json
1111
COPY --from=build /src/xray /usr/bin/xray
1212
RUN set -ex \
13-
&& apk add --no-cache tzdata ca-certificates \
13+
&& apk add --no-cache tzdata ca-certificates iptables \
1414
&& mkdir -p /var/log/xray /usr/share/xray \
1515
&& chmod +x /usr/bin/xray \
1616
&& wget -O /usr/share/xray/geosite.dat https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download/geosite.dat \

‎go.mod‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ require (
2929
google.golang.org/protobuf v1.31.0
3030
gvisor.dev/gvisor v0.0.0-20231104011432-48a6d7d5bd0b
3131
h12.io/socks v1.0.3
32+
kernel.org/pub/linux/libs/security/libcap/cap v1.2.69
3233
lukechampine.com/blake3 v1.2.1
3334
)
3435

@@ -45,6 +46,8 @@ require (
4546
github.com/google/pprof v0.0.0-20231101202521-4ca4178f5c7a // indirect
4647
github.com/klauspost/compress v1.17.2 // indirect
4748
github.com/klauspost/cpuid/v2 v2.2.6 // indirect
49+
github.com/kr/text v0.2.0 // indirect
50+
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
4851
github.com/onsi/ginkgo/v2 v2.13.1 // indirect
4952
github.com/pmezard/go-difflib v1.0.0 // indirect
5053
github.com/quic-go/qtls-go1-20 v0.4.1 // indirect
@@ -58,6 +61,8 @@ require (
5861
golang.org/x/tools v0.15.0 // indirect
5962
golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
6063
google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17 // indirect
64+
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
6165
gopkg.in/yaml.v2 v2.4.0 // indirect
6266
gopkg.in/yaml.v3 v3.0.1 // indirect
67+
kernel.org/pub/linux/libs/security/libcap/psx v1.2.69 // indirect
6368
)

‎go.sum‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
1818
github.com/cloudflare/circl v1.3.6 h1:/xbKIqSHbZXHwkhbrhrt2YOHIwYJlXH94E3tI/gDlUg=
1919
github.com/cloudflare/circl v1.3.6/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
2020
github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
21+
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
2122
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
2223
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
2324
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -82,12 +83,12 @@ github.com/klauspost/compress v1.17.2 h1:RlWWUY/Dr4fL8qk9YG7DTZ7PDgME2V4csBXA8L/
8283
github.com/klauspost/compress v1.17.2/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
8384
github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
8485
github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
85-
github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
8686
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
8787
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
8888
github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
89-
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
9089
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
90+
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
91+
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
9192
github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm/+2c2E2WMI=
9293
github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
9394
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -98,6 +99,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
9899
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
99100
github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
100101
github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
102+
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
103+
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
101104
github.com/onsi/ginkgo/v2 v2.13.1 h1:LNGfMbR2OVGBfXjvRZIZ2YCTQdGKtPLvuI1rMCCj3OU=
102105
github.com/onsi/ginkgo/v2 v2.13.1/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
103106
github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
@@ -287,8 +290,8 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ
287290
google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
288291
google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
289292
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
290-
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
291-
gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
293+
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
294+
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
292295
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
293296
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
294297
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -306,6 +309,10 @@ h12.io/socks v1.0.3/go.mod h1:AIhxy1jOId/XCz9BO+EIgNL2rQiPTBNnOfnVnQ+3Eck=
306309
honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
307310
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
308311
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
312+
kernel.org/pub/linux/libs/security/libcap/cap v1.2.69 h1:N0m3tKYbkRMmDobh/47ngz+AWeV7PcfXMDi8xu3Vrag=
313+
kernel.org/pub/linux/libs/security/libcap/cap v1.2.69/go.mod h1:Tk5Ip2TuxaWGpccL7//rAsLRH6RQ/jfqTGxuN/+i/FQ=
314+
kernel.org/pub/linux/libs/security/libcap/psx v1.2.69 h1:IdrOs1ZgwGw5CI+BH6GgVVlOt+LAXoPyh7enr8lfaXs=
315+
kernel.org/pub/linux/libs/security/libcap/psx v1.2.69/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=
309316
lukechampine.com/blake3 v1.2.1 h1:YuqqRuaqsGV71BV/nm9xlI0MKUv4QC54jQnBChWbGnI=
310317
lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
311318
sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck=

‎infra/conf/wireguard.go‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -116,19 +116,25 @@ func (c *WireGuardConfig) Build() (proto.Message, error) {
116116
return nil, newError("unsupported domain strategy: ", c.DomainStrategy)
117117
}
118118

119+
// check device exist for wireguard setup
120+
// module "golang.zx2c4.com/wireguard" only support linux and require /dev/net/tun
121+
if wireguard.IsLinux() && !wireguard.CheckUnixKernelTunDeviceEnabled() {
122+
return nil, newError("wireguard module require device /dev/net/tun")
123+
}
124+
119125
config.IsClient = c.IsClient
120-
if c.KernelMode != nil {
121-
config.KernelMode = *c.KernelMode
122-
if config.KernelMode && !wireguard.KernelTunSupported() {
123-
newError("kernel mode is not supported on your OS or permission is insufficient").AtWarning().WriteToLog()
124-
}
125-
} else {
126-
config.KernelMode = wireguard.KernelTunSupported()
127-
if config.KernelMode {
128-
newError("kernel mode is enabled as it's supported and permission is sufficient").AtDebug().WriteToLog()
126+
if c.IsClient {
127+
if support := wireguard.CheckUnixKernelTunSupported(); c.KernelMode == nil {
128+
config.KernelMode = support
129+
} else if *c.KernelMode && support {
130+
config.KernelMode = true
131+
} else {
132+
config.KernelMode = false
129133
}
130134
}
131-
135+
if !c.IsClient {
136+
config.KernelMode = false
137+
}
132138
return config, nil
133139
}
134140

‎proxy/wireguard/client.go‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,6 @@ func New(ctx context.Context, conf *DeviceConfig) (*Handler, error) {
7979
func (h *Handler) processWireGuard(dialer internet.Dialer) (err error) {
8080
h.wgLock.Lock()
8181
defer h.wgLock.Unlock()
82-
8382
if h.bind != nil && h.bind.dialer == dialer && h.net != nil {
8483
return nil
8584
}
@@ -127,6 +126,10 @@ func (h *Handler) processWireGuard(dialer internet.Dialer) (err error) {
127126

128127
// Process implements OutboundHandler.Dispatch().
129128
func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer internet.Dialer) error {
129+
if err := h.processWireGuard(dialer); err != nil {
130+
return err
131+
}
132+
130133
outbound := session.OutboundFromContext(ctx)
131134
if outbound == nil || !outbound.Target.IsValid() {
132135
return newError("target not specified")
@@ -137,10 +140,6 @@ func (h *Handler) Process(ctx context.Context, link *transport.Link, dialer inte
137140
inbound.SetCanSpliceCopy(3)
138141
}
139142

140-
if err := h.processWireGuard(dialer); err != nil {
141-
return err
142-
}
143-
144143
// Destination of the inner request.
145144
destination := outbound.Target
146145
command := protocol.RequestCommandTCP

‎proxy/wireguard/config.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ func (c *DeviceConfig) fallbackIP6() bool {
2525
}
2626

2727
func (c *DeviceConfig) createTun() tunCreator {
28-
if c.KernelMode {
28+
if c.IsClient && c.KernelMode {
2929
return createKernelTun
3030
}
3131
return createGVisorTun

‎proxy/wireguard/iptables/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# kubernetes iptables
2+
3+
source code from:
4+
5+
| package | from | repo |
6+
|------------------|-------------------------------------|---------------------|
7+
| iptables/errors | k8s.io/apimachinery/pkg/util/errors | k8s.io/apimachinery |
8+
| iptables/exec | k8s.io/utils/exec | k8s.io/utils |
9+
| iptables/sets | k8s.io/apimachinery/pkg/util/sets | k8s.io/apimachinery |
10+
| iptables/version | k8s.io/apimachinery/pkg/version | k8s.io/apimachinery |
11+
| iptables/wait | k8s.io/apimachinery/pkg/util/wait | k8s.io/apimachinery |
12+
| iptables | k8s.io/kubernetes/pkg/util/iptables | k8s.io/kubernetes |

‎proxy/wireguard/iptables/errors/doc.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
/*
2+
Copyright 2015 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
// Package errors implements various utility functions and types around errors.
18+
package errors // import "k8s.io/apimachinery/pkg/util/errors"

0 commit comments

Comments
 (0)