Add L3 forwarding support

protocol/wireguard/endpoint.go

@@ -13,7 +13,6 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing-box/log"
 	"github.com/sagernet/sing-box/option"
-	"github.com/sagernet/sing-box/route/rule"
 	"github.com/sagernet/sing-box/transport/wireguard"
 	"github.com/sagernet/sing-tun"
 	"github.com/sagernet/sing/common"
@@ -137,37 +136,45 @@ func (w *Endpoint) Close() error {
 	return w.endpoint.Close()
 }
 
-func (w *Endpoint) PrepareConnection(network string, source M.Socksaddr, destination M.Socksaddr, routeContext tun.DirectRouteContext, timeout time.Duration) (tun.DirectRouteDestination, error) {
-	if !w.started.Load() {
-		return nil, E.New("WireGuard is not ready yet")
+func (w *Endpoint) SupportsFlow(network string) bool {
+	switch network {
+	case N.NetworkTCP, N.NetworkUDP, N.NetworkICMP:
+		return true
+	default:
+		return false
 	}
-	var ipVersion uint8
-	if !destination.IsIPv6() {
-		ipVersion = 4
-	} else {
-		ipVersion = 6
-	}
-	routeDestination, err := w.router.PreMatch(adapter.InboundContext{
-		Inbound:     w.Tag(),
-		InboundType: w.Type(),
-		IPVersion:   ipVersion,
-		Network:     network,
-		Source:      source,
-		Destination: destination,
-	}, routeContext, timeout, false)
-	if err != nil {
-		switch {
-		case rule.IsBypassed(err):
-			err = nil
-		case rule.IsRejected(err):
-			w.logger.Trace("reject ", network, " connection from ", source.AddrString(), " to ", destination.AddrString())
-		default:
-			if network == N.NetworkICMP {
-				w.logger.Warn(E.Cause(err, "link ", network, " connection from ", source.AddrString(), " to ", destination.AddrString()))
-			}
+}
+
+func (w *Endpoint) PortAddresses() (netip.Addr, netip.Addr) {
+	return w.endpoint.PortAddresses()
+}
+
+func (w *Endpoint) PortMTU() uint32 {
+	return w.endpoint.PortMTU()
+}
+
+func (w *Endpoint) AttachReturn(returnPath tun.Return) error {
+	return w.endpoint.AttachReturn(returnPath)
+}
+
+func (w *Endpoint) DetachReturn(returnPath tun.Return) error {
+	return w.endpoint.DetachReturn(returnPath)
+}
+
+func (w *Endpoint) JudgeFlow(network uint8, source netip.AddrPort, destination netip.AddrPort) tun.FlowVerdict {
+	for _, localPrefix := range w.localAddresses {
+		if localPrefix.Contains(destination.Addr()) {
+			return tun.FlowVerdict{Action: tun.ActionAccept}
 		}
 	}
-	return routeDestination, err
+	return adapter.JudgeFlow(w.router, w.Tag(), w.Type(), network, source, destination)
+}
+
+func (w *Endpoint) WritePackets(packets [][]byte) error {
+	if !w.started.Load() {
+		return E.New("WireGuard is not ready yet")
+	}
+	return w.endpoint.WritePackets(packets)
 }
 
 func (w *Endpoint) NewConnectionEx(ctx context.Context, conn net.Conn, source M.Socksaddr, destination M.Socksaddr, onClose N.CloseHandlerFunc) {
@@ -279,10 +286,3 @@ func (w *Endpoint) PreferredAddress(address netip.Addr) bool {
 	}
 	return w.endpoint.Lookup(address) != nil
 }
-
-func (w *Endpoint) NewDirectRouteConnection(metadata adapter.InboundContext, routeContext tun.DirectRouteContext, timeout time.Duration) (tun.DirectRouteDestination, error) {
-	if !w.started.Load() {
-		return nil, E.New("WireGuard is not ready yet")
-	}
-	return w.endpoint.NewDirectRouteConnection(metadata, routeContext, timeout)
-}