feat(local-redir, server): Check IP stack capability globally

- ref #1543 - Reference Implementation: golang src/net/ipsock_posix.go ipStckCapabilities
shadowsocks · Jun 16, 2024 · 5ba8b7d · 5ba8b7d
1 parent 79d68f1
commit 5ba8b7d
Show file tree

Hide file tree

Showing 8 changed files with 210 additions and 226 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "shadowsocks-rust"
-version = "1.20.0"
+version = "1.20.1"
 authors = ["Shadowsocks Contributors"]
 description = "shadowsocks is a fast tunnel proxy that helps you bypass firewalls."
 repository = "https://github.com/shadowsocks/shadowsocks-rust"
@@ -248,7 +248,7 @@ jemallocator = { version = "0.5", optional = true }
 snmalloc-rs = { version = "0.3", optional = true }
 rpmalloc = { version = "0.2", optional = true }
 
-shadowsocks-service = { version = "1.20.0", path = "./crates/shadowsocks-service" }
+shadowsocks-service = { version = "1.20.1", path = "./crates/shadowsocks-service" }
 
 windows-service = { version = "0.7", optional = true }
 

diff --git a/crates/shadowsocks-service/Cargo.toml b/crates/shadowsocks-service/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "shadowsocks-service"
-version = "1.20.0"
+version = "1.20.1"
 authors = ["Shadowsocks Contributors"]
 description = "shadowsocks is a fast tunnel proxy that helps you bypass firewalls."
 repository = "https://github.com/shadowsocks/shadowsocks-rust"
@@ -198,7 +198,7 @@ serde = { version = "1.0", features = ["derive"] }
 json5 = "0.4"
 bson = { version = "2.10.0", optional = true }
 
-shadowsocks = { version = "1.20.0", path = "../shadowsocks", default-features = false }
+shadowsocks = { version = "1.20.1", path = "../shadowsocks", default-features = false }
 
 # Just for the ioctl call macro
 [target.'cfg(any(target_os = "macos", target_os = "ios", target_os = "freebsd"))'.dependencies]

diff --git a/crates/shadowsocks-service/src/local/redir/udprelay/mod.rs b/crates/shadowsocks-service/src/local/redir/udprelay/mod.rs
@@ -3,10 +3,7 @@
 use std::{
  io::{self, ErrorKind},
  net::{IpAddr, SocketAddr},
- sync::{
- atomic::{AtomicBool, Ordering},
- Arc,
- },
+ sync::Arc,
  time::Duration,
 };
 
@@ -15,7 +12,7 @@ use log::{debug, error, info, trace, warn};
 use lru_time_cache::LruCache;
 use shadowsocks::{
  lookup_then,
- net::ConnectOpts,
+ net::{get_ip_stack_capabilities, ConnectOpts},
  relay::{socks5::Address, udprelay::MAXIMUM_UDP_PAYLOAD_SIZE},
  ServerAddr,
 };
@@ -99,134 +96,106 @@ impl UdpInboundWrite for UdpRedirInboundWriter {
  async fn send_to(&self, mut peer_addr: SocketAddr, remote_addr: &Address, data: &[u8]) -> io::Result<()> {
  // If IPv6 Transparent Proxy is supported on the current platform,
  // then we should always use IPv6 sockets for sending IPv4 packets.
- static SUPPORT_IPV6_TRANSPARENT: AtomicBool = AtomicBool::new(true);
-
- loop {
- let mut addr_mapped_ipv6 = false;
-
- let addr = match *remote_addr {
- Address::SocketAddress(sa) => {
- if SUPPORT_IPV6_TRANSPARENT.load(Ordering::Relaxed) {
- match sa {
- // Converts IPv4 address to IPv4-mapped-IPv6
- // All sockets will be created in IPv6 (nearly all modern OS supports IPv6 sockets)
- SocketAddr::V4(ref v4) => {
- addr_mapped_ipv6 = true;
- SocketAddr::new(v4.ip().to_ipv6_mapped().into(), v4.port())
- }
- SocketAddr::V6(..) => sa,
+ let ip_stack_caps = get_ip_stack_capabilities();
+
+ let addr = match *remote_addr {
+ Address::SocketAddress(sa) => {
+ match sa {
+ SocketAddr::V4(ref v4) => {
+ // If IPv4-mapped-IPv6 is supported.
+ // Converts IPv4 address to IPv4-mapped-IPv6
+ // All sockets will be created in IPv6 (nearly all modern OS supports IPv6 sockets)
+ if ip_stack_caps.support_ipv4_mapped_ipv6 {
+ SocketAddr::new(v4.ip().to_ipv6_mapped().into(), v4.port())
+ } else {
+ sa
  }
- } else {
-  match sa {
-  // Converts IPv4-mapped-IPv6 to IPv4
-  SocketAddr::V4(..) => sa,
- SocketAddr::V6(ref v6) => match v6.ip().to_ipv4_mapped() {
+ }
+ SocketAddr::V6(ref v6) => {
+ // If IPv6 is not supported. Try to map it back to IPv4.
+ if !ip_stack_caps.support_ipv6 || !ip_stack_caps.support_ipv4_mapped_ipv6 {
+ match v6.ip().to_ipv4_mapped() {
  Some(v4) => SocketAddr::new(v4.into(), v6.port()),
  None => sa,
- },
+ }
+ } else {
+ sa
  }
  }
  }
- Address::DomainNameAddress(..) => {
- let err = io::Error::new(
- ErrorKind::InvalidInput,
- "redir destination must not be an domain name address",
- );
- return Err(err);
- }
- };
-
- let inbound = {
- let mut cache = self.inbound_cache.cache.lock().await;
- if let Some(socket) = cache.get(&addr) {
- socket.clone()
- } else {
- // Create a socket binds to destination addr
- // This only works for systems that supports binding to non-local addresses
- //
- // This socket has to set SO_REUSEADDR and SO_REUSEPORT.
- // Outbound addresses could be connected from different source addresses.
- let inbound = match UdpRedirSocket::bind_nonlocal(self.redir_ty, addr, &self.socket_opts) {
- Ok(s) => s,
- #[cfg(unix)]
- Err(err) => match err.raw_os_error() {
- None => return Err(err),
- // https://github.com/shadowsocks/shadowsocks-rust/issues/988
- // IPV6_TRANSPARENT was supported since 2.6.37.
- Some(libc::ENOPROTOOPT) if addr_mapped_ipv6 => {
- SUPPORT_IPV6_TRANSPARENT.store(false, Ordering::Relaxed);
- debug!("redir destination socket doesn't support IPv6, addr cannot be IPv4-mapped-IPv6: {}", addr);
- continue;
- }
- Some(_) => return Err(err),
- },
- #[cfg(not(unix))]
- Err(err) => return Err(err),
- };
+ }
+ Address::DomainNameAddress(..) => {
+ let err = io::Error::new(
+ ErrorKind::InvalidInput,
+ "redir destination must not be an domain name address",
+ );
+ return Err(err);
+ }
+ };
 
- // UDP socket could be shared between threads and is safe to be manipulated by multiple threads
- let inbound = Arc::new(inbound);
- cache.insert(addr, inbound.clone());
+ let inbound = {
+ let mut cache = self.inbound_cache.cache.lock().await;
+ if let Some(socket) = cache.get(&addr) {
+ socket.clone()
+ } else {
+ // Create a socket binds to destination addr
+ // This only works for systems that supports binding to non-local addresses
+ //
+ // This socket has to set SO_REUSEADDR and SO_REUSEPORT.
+ // Outbound addresses could be connected from different source addresses.
+ let inbound = UdpRedirSocket::bind_nonlocal(self.redir_ty, addr, &self.socket_opts)?;
+
+ // UDP socket could be shared between threads and is safe to be manipulated by multiple threads
+ let inbound = Arc::new(inbound);
+ cache.insert(addr, inbound.clone());
+
+ inbound
+ }
+ };
 
- inbound
- }
- };
-
- match (addr, peer_addr) {
- (SocketAddr::V4(..), SocketAddr::V4(..)) | (SocketAddr::V6(..), SocketAddr::V6(..)) => {}
- (SocketAddr::V4(..), SocketAddr::V6(v6_peer_addr)) => {
- if let Some(v4_ip) = v6_peer_addr.ip().to_ipv4_mapped() {
- peer_addr = SocketAddr::new(v4_ip.into(), v6_peer_addr.port());
- } else {
- warn!(
- "udp redir send back {} bytes, remote: {}, peer: {}, protocol not match",
- data.len(),
- addr,
- peer_addr
- );
- }
- }
- (SocketAddr::V6(..), SocketAddr::V4(v4_peer_addr)) => {
- peer_addr = SocketAddr::new(v4_peer_addr.ip().to_ipv6_mapped().into(), v4_peer_addr.port());
+ // Convert peer_addr (client)'s address family to match remote_addr (target)
+ match (addr, peer_addr) {
+ (SocketAddr::V4(..), SocketAddr::V4(..)) | (SocketAddr::V6(..), SocketAddr::V6(..)) => {}
+ (SocketAddr::V4(..), SocketAddr::V6(v6_peer_addr)) => {
+ if let Some(v4_ip) = v6_peer_addr.ip().to_ipv4_mapped() {
+ peer_addr = SocketAddr::new(v4_ip.into(), v6_peer_addr.port());
+ } else {
+ warn!(
+ "udp redir send back {} bytes, remote: {}, peer: {}, protocol not match",
+ data.len(),
+ addr,
+ peer_addr
+ );
  }
  }
+ (SocketAddr::V6(..), SocketAddr::V4(v4_peer_addr)) => {
+ peer_addr = SocketAddr::new(v4_peer_addr.ip().to_ipv6_mapped().into(), v4_peer_addr.port());
+ }
+ }
 
- match inbound.send_to(data, peer_addr).await {
- Ok(n) => {
- if n < data.len() {
- warn!(
- "udp redir send back data (actual: {} bytes, sent: {} bytes), remote: {}, peer: {}",
- n,
- data.len(),
- remote_addr,
- peer_addr
- );
- }
-
- trace!(
- "udp redir send back data {} bytes, remote: {}, peer: {}, socket_opts: {:?}",
+ match inbound.send_to(data, peer_addr).await {
+ Ok(n) => {
+ if n < data.len() {
+ warn!(
+ "udp redir send back data (actual: {} bytes, sent: {} bytes), remote: {}, peer: {}",
  n,
+ data.len(),
  remote_addr,
- peer_addr,
- self.socket_opts
+ peer_addr
  );
-
- return Ok(());
- }
- Err(err) => {
- match err.kind() {
- // Invalid Argument
- ErrorKind::InvalidInput if addr_mapped_ipv6 => {
- SUPPORT_IPV6_TRANSPARENT.store(false, Ordering::Relaxed);
- debug!(
- "redir destination socket doesn't support dual-stack routing, addr cannot be IPv4-mapped-IPv6: {}",
- addr
- );
- }
- _ => return Err(err),
- }
  }
+
+ trace!(
+ "udp redir send back data {} bytes, remote: {}, peer: {}, socket_opts: {:?}",
+ n,
+ remote_addr,
+ peer_addr,
+ self.socket_opts
+ );
+
+ Ok(())
  }
+ Err(err) => Err(err),
  }
  }
 }