Refactor OpenVPN and OpenConnect endpoints

2026-07-18 09:40:17 +08:00
parent 60f3012444
commit a4367df680
25 changed files with 758 additions and 182 deletions
@@ -120,15 +120,24 @@ func NewEndpoint(ctx context.Context, router adapter.Router, logger log.ContextL
 	if err != nil {
 		return nil, err
 	}
+	udpTimeout := C.UDPTimeout
+	if options.UDPTimeout != 0 {
+		udpTimeout = time.Duration(options.UDPTimeout)
+	}
+	networkManager := service.FromContext[adapter.NetworkManager](ctx)
 	device, err := openconnecttransport.NewDevice(openconnecttransport.DeviceOptions{
-		Context:     ctx,
-		Logger:      logger,
-		System:      options.System,
-		Handler:     openConnectEndpoint,
-		UDPTimeout:  C.UDPTimeout,
-		ICMPTimeout: C.ICMPTimeout,
-		Name:        options.Name,
-		MTU:         openconnecttransport.DefaultMTU,
+		Context:         ctx,
+		Logger:          logger,
+		System:          options.System,
+		Handler:         openConnectEndpoint,
+		UDPTimeout:      udpTimeout,
+		ICMPTimeout:     C.ICMPTimeout,
+		UDPMapping:      tun.NATMapping(options.UDPMapping),
+		UDPFiltering:    tun.NATFiltering(options.UDPFiltering),
+		UDPNATMax:       options.UDPNATMax,
+		InterfaceFinder: networkManager.InterfaceFinder(),
+		Name:            options.Name,
+		MTU:             openconnecttransport.DefaultMTU,
 		Configuration: openconnecttransport.Configuration{
 			MTU: openconnecttransport.DefaultMTU,
 		},
@@ -116,14 +116,18 @@ func NewClientEndpoint(ctx context.Context, router adapter.Router, logger log.Co
 		udpTimeout = time.Duration(options.UDPTimeout)
 	}
 	device, err := ovpntransport.NewDevice(ovpntransport.DeviceOptions{
-		Context:     ctx,
-		Logger:      logger,
-		System:      options.System,
-		Handler:     clientEndpoint,
-		UDPTimeout:  udpTimeout,
-		ICMPTimeout: C.ICMPTimeout,
-		Name:        options.Name,
-		MTU:         options.MTU,
+		Context:         ctx,
+		Logger:          logger,
+		System:          options.System,
+		Handler:         clientEndpoint,
+		UDPTimeout:      udpTimeout,
+		ICMPTimeout:     C.ICMPTimeout,
+		UDPMapping:      tun.NATMapping(options.UDPMapping),
+		UDPFiltering:    tun.NATFiltering(options.UDPFiltering),
+		UDPNATMax:       options.UDPNATMax,
+		InterfaceFinder: service.FromContext[adapter.NetworkManager](ctx).InterfaceFinder(),
+		Name:            options.Name,
+		MTU:             options.MTU,
 		Configuration: ovpntransport.Configuration{
 			MTU:     options.MTU,
 			Address: clientOptions.Tunnel.LocalAddress,
@@ -260,11 +264,11 @@ func (c *ClientEndpoint) buildClientOptions(options option.OpenVPNClientEndpoint
 		Context: c.loopContext,
 		Mode:    ovpn.ModeTLS,
 		Transport: ovpn.ClientTransportOptions{
-			Remotes:            remotes,
-			RemoteRandom:       options.RemoteRandom,
-			Protocol:           protocol,
-			ExplicitExitNotify: options.ExplicitExitNotify,
-			DialContext:        c.transportDialContext,
+			Remotes:                     remotes,
+			RemoteRandom:                options.RemoteRandom,
+			Protocol:                    protocol,
+			ExplicitExitNotify:          options.ExplicitExitNotify,
+			DialContextWithAddressIndex: c.transportDialContextWithAddressIndex,
 		},
 		DataChannel: ovpn.ClientDataChannelOptions{
 			MTU:              options.MTU,
@@ -301,8 +305,8 @@ func (c *ClientEndpoint) buildClientOptions(options option.OpenVPNClientEndpoint
 		},
 		Timing: ovpn.ClientTimingOptions{
 			RenegotiationInterval: time.Duration(options.RenegotiateInterval),
-			PingInterval:          time.Duration(options.KeepaliveInterval),
-			PingRestart:           time.Duration(options.KeepaliveTimeout),
+			PingInterval:          time.Duration(options.PingInterval),
+			PingRestart:           time.Duration(options.PingRestart),
 		},
 		KeyDirection:          keyDirection,
 		OnTunnelConfiguration: c.handleTunnelConfiguration,
@@ -310,21 +314,21 @@ func (c *ClientEndpoint) buildClientOptions(options option.OpenVPNClientEndpoint
 	}, nil
 }

-func (c *ClientEndpoint) transportDialContext(ctx context.Context, network string, address string) (net.Conn, error) {
+func (c *ClientEndpoint) transportDialContextWithAddressIndex(ctx context.Context, network string, address string, addressIndex int) (net.Conn, error) {
 	destination := M.ParseSocksaddr(address)
-	var (
-		connection net.Conn
-		err        error
-	)
 	if destination.IsDomain() {
 		destinationAddresses, lookupErr := c.dnsRouter.Lookup(ctx, destination.Fqdn, c.queryOptions)
 		if lookupErr != nil {
 			return nil, lookupErr
 		}
-		connection, err = N.DialSerial(ctx, c.outboundDialer, network, destination, destinationAddresses)
-	} else {
-		connection, err = c.outboundDialer.DialContext(ctx, network, destination)
+		if addressIndex < 0 || addressIndex >= len(destinationAddresses) {
+			return nil, ovpn.ErrRemoteAddressExhausted
+		}
+		destination = M.SocksaddrFrom(destinationAddresses[addressIndex], destination.Port)
+	} else if addressIndex != 0 {
+		return nil, ovpn.ErrRemoteAddressExhausted
 	}
+	connection, err := c.outboundDialer.DialContext(ctx, network, destination)
 	if err != nil {
 		return nil, err
 	}
@@ -91,6 +91,7 @@ func NewServerEndpoint(ctx context.Context, router adapter.Router, logger log.Co
 	}
 	serverOptions.Context = loopContext
 	serverOptions.Authentication.Authenticator = authenticatorFromUsers(options.Users)
+	serverOptions.Authentication.DuplicateCN = options.DuplicateCN
 	serverOptions.Logger = logger
 	serverEndpoint.serverOptions = serverOptions
 	udpTimeout := C.UDPTimeout
@@ -102,14 +103,18 @@ func NewServerEndpoint(ctx context.Context, router adapter.Router, logger log.Co
 		deviceRoutes = append(deviceRoutes, ovpntransport.Route{Prefix: prefix.Masked()})
 	}
 	device, err := ovpntransport.NewDevice(ovpntransport.DeviceOptions{
-		Context:     ctx,
-		Logger:      logger,
-		System:      options.System,
-		Handler:     serverEndpoint,
-		UDPTimeout:  udpTimeout,
-		ICMPTimeout: C.ICMPTimeout,
-		Name:        options.Name,
-		MTU:         options.MTU,
+		Context:         ctx,
+		Logger:          logger,
+		System:          options.System,
+		Handler:         serverEndpoint,
+		UDPTimeout:      udpTimeout,
+		ICMPTimeout:     C.ICMPTimeout,
+		UDPMapping:      tun.NATMapping(options.UDPMapping),
+		UDPFiltering:    tun.NATFiltering(options.UDPFiltering),
+		UDPNATMax:       options.UDPNATMax,
+		InterfaceFinder: service.FromContext[adapter.NetworkManager](ctx).InterfaceFinder(),
+		Name:            options.Name,
+		MTU:             options.MTU,
 		Configuration: ovpntransport.Configuration{
 			MTU:      options.MTU,
 			Address:  options.Address,
@@ -299,6 +304,9 @@ func buildServerOptions(options option.OpenVPNServerEndpointOptions) (ovpn.Serve
 		TLS: tlsOptions,
 		Timing: ovpn.ServerTimingOptions{
 			RenegotiationInterval: time.Duration(options.RenegotiateInterval),
+			HandWindow:            time.Duration(options.HandshakeWindow),
+			PingInterval:          time.Duration(options.PingInterval),
+			PingRestart:           time.Duration(options.PingRestart),
 		},
 	}
 	applyServerPushOptions(&serverOptions, options)
@@ -331,13 +339,16 @@ func buildServerTLSOptions(options option.OpenVPNInboundTLSOptions) (ovpn.Server
 	}
 	keyDirection := -1
 	controlWrap := options.ControlWrap
-	if controlWrap != nil && (controlWrap.Type != "" || len(controlWrap.Key) > 0 || controlWrap.KeyPath != "" || controlWrap.Direction != "") {
+	if controlWrap != nil && (controlWrap.Type != "" || len(controlWrap.Key) > 0 || controlWrap.KeyPath != "" || controlWrap.Direction != "" || controlWrap.ForceCookie) {
 		wrapKey, wrapErr := requiredMaterialSource("tls.control_wrap.key", controlWrap.Key, controlWrap.KeyPath)
 		if wrapErr != nil {
 			return ovpn.ServerTLSOptions{}, 0, wrapErr
 		}
 		switch controlWrap.Type {
 		case "tls_auth":
+			if controlWrap.ForceCookie {
+				return ovpn.ServerTLSOptions{}, 0, E.New("`tls.control_wrap.force_cookie` is only supported by `tls_crypt_v2`")
+			}
 			keyDirection, err = keyDirectionValue(controlWrap.Direction)
 			if err != nil {
 				return ovpn.ServerTLSOptions{}, 0, err
@@ -348,9 +359,13 @@ func buildServerTLSOptions(options option.OpenVPNInboundTLSOptions) (ovpn.Server
 				return ovpn.ServerTLSOptions{}, 0, E.New("`tls.control_wrap.direction` is only supported by `tls_auth`")
 			}
 			if controlWrap.Type == "tls_crypt" {
+				if controlWrap.ForceCookie {
+					return ovpn.ServerTLSOptions{}, 0, E.New("`tls.control_wrap.force_cookie` is only supported by `tls_crypt_v2`")
+				}
 				tlsOptions.Crypt = wrapKey
 			} else {
 				tlsOptions.CryptV2 = wrapKey
+				tlsOptions.CryptV2ForceCookie = controlWrap.ForceCookie
 			}
 		case "":
 			return ovpn.ServerTLSOptions{}, 0, E.New("missing OpenVPN control wrap type")
@@ -382,16 +397,14 @@ func applyServerPushOptions(serverOptions *ovpn.ServerOptions, options option.Op
 		Topology:     topology,
 		LocalAddress: localAddresses,
 	}
-	serverOptions.Push = ovpn.ServerPushOptions{
-		PingInterval: time.Duration(options.KeepaliveInterval),
-		PingRestart:  time.Duration(options.KeepaliveTimeout),
-	}
 	if options.Push == nil {
 		return
 	}
 	serverOptions.Push.Routes = slices.Clone(options.Push.Routes)
 	serverOptions.Push.DNS = slices.Clone(options.Push.DNS)
 	serverOptions.Push.BlockOutsideDNS = options.Push.BlockOutsideDNS
+	serverOptions.Push.PingInterval = time.Duration(options.Push.PingInterval)
+	serverOptions.Push.PingRestart = time.Duration(options.Push.PingRestart)
 	if options.Push.RedirectGateway {
 		serverOptions.Push.RedirectGateway = true
 		if len(options.Push.RedirectGatewayFlags) > 0 {