initial

2026-03-05 13:33:05 +08:00
commit 648aa93360
22 changed files with 1427 additions and 0 deletions
@@ -0,0 +1,258 @@
+--- /dev/null	2026-03-05 11:06:53.990718185 +0800
+++ /data/projects/arknights/omv-dijiang/works/core/protocol/mysql/inbound.go	2026-03-05 13:14:59.956258942 +0800
+@@ -0,0 +1,255 @@
+// OMV
+package mysql
+
+import (
+	"context"
+	"net"
+	"os"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/adapter/inbound"
+	"github.com/sagernet/sing-box/common/listener"
+	"github.com/sagernet/sing-box/common/mux"
+	boxTLS "github.com/sagernet/sing-box/common/tls"
+	"github.com/sagernet/sing-box/common/uot"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing/common"
+	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/common/task"
+	"github.com/sagernet/smux"
+
+	gmysql "github.com/go-mysql-org/go-mysql/mysql"
+	"github.com/go-mysql-org/go-mysql/server"
+)
+
+func RegisterInbound(registry *inbound.Registry) {
+	inbound.Register[option.MySQLInboundOptions](registry, C.TypeMySQL, NewInbound)
+}
+
+var _ adapter.TCPInjectableInbound = (*Inbound)(nil)
+
+type Inbound struct {
+	inbound.Adapter
+	router           adapter.ConnectionRouterEx
+	logger           logger.ContextLogger
+	listener         *listener.Listener
+	tlsConfig        boxTLS.ServerConfig
+	identityProvider *server.InMemoryProvider
+	mysqlServer      *server.Server
+}
+
+func NewInbound(ctx context.Context, router adapter.Router, logger log.ContextLogger, tag string, options option.MySQLInboundOptions) (adapter.Inbound, error) {
+	inbound := &Inbound{
+		Adapter:          inbound.NewAdapter(C.TypeMySQL, tag),
+		router:           uot.NewRouter(router, logger),
+		logger:           logger,
+		identityProvider: server.NewInMemoryProvider(),
+	}
+	for _, user := range options.Users {
+		inbound.identityProvider.AddUser(user.User, user.Password)
+	}
+
+	if options.TLS == nil || !options.TLS.Enabled {
+		return nil, C.ErrTLSRequired
+	}
+
+	tlsConfig, err := boxTLS.NewServer(ctx, logger, common.PtrValueOrDefault(options.TLS))
+	if err != nil {
+		return nil, err
+	}
+	inbound.tlsConfig = tlsConfig
+
+	// Get the standard *tls.Config from our TLS config for go-mysql server
+	stdTLSConfig, err := tlsConfig.STDConfig()
+	if err != nil {
+		return nil, E.Cause(err, "get std tls config")
+	}
+
+	// Create a go-mysql server with our TLS config
+	inbound.mysqlServer = server.NewServer(
+		"8.0.12",
+		gmysql.DEFAULT_COLLATION_ID,
+		gmysql.AUTH_NATIVE_PASSWORD,
+		nil,
+		stdTLSConfig,
+	)
+
+	inbound.router, err = mux.NewRouterWithOptions(inbound.router, logger, common.PtrValueOrDefault(options.Multiplex))
+	if err != nil {
+		return nil, err
+	}
+
+	inbound.listener = listener.New(listener.Options{
+		Context:           ctx,
+		Logger:            logger,
+		Network:           []string{N.NetworkTCP},
+		Listen:            options.ListenOptions,
+		ConnectionHandler: inbound,
+	})
+	return inbound, nil
+}
+
+func (h *Inbound) Start(stage adapter.StartStage) error {
+	if stage != adapter.StartStateStart {
+		return nil
+	}
+	if h.tlsConfig != nil {
+		err := h.tlsConfig.Start()
+		if err != nil {
+			return E.Cause(err, "create TLS config")
+		}
+	}
+	return h.listener.Start()
+}
+
+func (h *Inbound) Close() error {
+	return common.Close(
+		h.listener,
+		h.tlsConfig,
+	)
+}
+
+func (h *Inbound) NewConnectionEx(ctx context.Context, conn net.Conn, metadata adapter.InboundContext, onClose N.CloseHandlerFunc) {
+	// Use go-mysql server to perform the MySQL handshake (which negotiates TLS)
+	mysqlConn, err := h.mysqlServer.NewCustomizedConn(conn, h.identityProvider, &emptyHandler{})
+	if err != nil {
+		N.CloseOnHandshakeFailure(conn, onClose, err)
+		h.logger.ErrorContext(ctx, E.Cause(err, "process connection from ", metadata.Source, ": MySQL handshake"))
+		return
+	}
+
+	// After MySQL handshake, the underlying connection is TLS-encrypted.
+	// Now get the underlying net.Conn (which is a *tls.Conn) and use smux on top of it.
+	tlsConn := mysqlConn.Conn.Conn
+
+	h.logger.InfoContext(ctx, "MySQL handshake completed from ", metadata.Source)
+
+	// Handle smux session over the TLS-encrypted connection
+	err = h.handleMuxSession(ctx, tlsConn, metadata.Source, onClose, mysqlConn.GetUser())
+	if err != nil && !E.IsClosed(err) {
+		h.logger.ErrorContext(ctx, E.Cause(err, "process mux session from ", metadata.Source))
+	}
+}
+
+func (h *Inbound) handleMuxSession(ctx context.Context, conn net.Conn, source M.Socksaddr, onClose N.CloseHandlerFunc, user string) error {
+	session, err := smux.Server(conn, smuxConfig())
+	if err != nil {
+		if onClose != nil {
+			onClose(err)
+		}
+		return err
+	}
+	var group task.Group
+	group.Append0(func(_ context.Context) error {
+		for {
+			stream, sErr := session.AcceptStream()
+			if sErr != nil {
+				return sErr
+			}
+			go h.handleMuxStream(ctx, stream, source, user)
+		}
+	})
+	group.Cleanup(func() {
+		session.Close()
+		if onClose != nil {
+			onClose(os.ErrClosed)
+		}
+	})
+	return group.Run(ctx)
+}
+
+func (h *Inbound) handleMuxStream(ctx context.Context, conn net.Conn, source M.Socksaddr, user string) {
+	err := h.handleMuxStream0(ctx, conn, source, user)
+	if err != nil {
+		h.logger.ErrorContext(ctx, E.Cause(err, "process mux stream"))
+	}
+}
+
+func (h *Inbound) handleMuxStream0(ctx context.Context, conn net.Conn, source M.Socksaddr, user string) error {
+	// Read destination from the stream header:
+	// 1 byte command (0x01=TCP, 0x03=UDP)
+	// then socks address (using SocksaddrSerializer)
+	var cmdBuf [1]byte
+	_, err := conn.Read(cmdBuf[:])
+	if err != nil {
+		return E.Cause(err, "read command")
+	}
+	command := cmdBuf[0]
+
+	destination, err := M.SocksaddrSerializer.ReadAddrPort(conn)
+	if err != nil {
+		return E.Cause(err, "read destination")
+	}
+
+	var metadata adapter.InboundContext
+	metadata.Inbound = h.Tag()
+	metadata.InboundType = h.Type()
+	metadata.Source = source
+	metadata.User = user
+
+	switch command {
+	case commandTCP:
+		metadata.Destination = destination
+		h.logger.InfoContext(ctx, "inbound connection to ", metadata.Destination)
+		h.router.RouteConnectionEx(ctx, conn, metadata, nil)
+	case commandUDP:
+		metadata.Destination = destination
+		h.logger.InfoContext(ctx, "inbound UoT packet connection to ", metadata.Destination)
+		h.router.RouteConnectionEx(ctx, conn, metadata, nil)
+	default:
+		return E.New("unknown command ", command)
+	}
+	return nil
+}
+
+func smuxConfig() *smux.Config {
+	config := smux.DefaultConfig()
+	config.KeepAliveDisabled = true
+	return config
+}
+
+const (
+	commandTCP byte = 0x01
+	commandUDP byte = 0x03
+)
+
+// emptyHandler implements go-mysql server.Handler with no-op operations.
+// It is used because we only need the MySQL handshake for TLS negotiation,
+// not actual MySQL query handling.
+type emptyHandler struct{}
+
+func (h *emptyHandler) UseDB(dbName string) error {
+	return nil
+}
+
+func (h *emptyHandler) HandleQuery(query string) (*gmysql.Result, error) {
+	return nil, gmysql.NewError(gmysql.ER_UNKNOWN_ERROR, "not supported")
+}
+
+func (h *emptyHandler) HandleFieldList(table string, fieldWildcard string) ([]*gmysql.Field, error) {
+	return nil, gmysql.NewError(gmysql.ER_UNKNOWN_ERROR, "not supported")
+}
+
+func (h *emptyHandler) HandleStmtPrepare(query string) (int, int, interface{}, error) {
+	return 0, 0, nil, gmysql.NewError(gmysql.ER_UNKNOWN_ERROR, "not supported")
+}
+
+func (h *emptyHandler) HandleStmtExecute(context interface{}, query string, args []interface{}) (*gmysql.Result, error) {
+	return nil, gmysql.NewError(gmysql.ER_UNKNOWN_ERROR, "not supported")
+}
+
+func (h *emptyHandler) HandleStmtClose(context interface{}) error {
+	return nil
+}
+
+func (h *emptyHandler) HandleOtherCommand(cmd byte, data []byte) error {
+	return gmysql.NewError(gmysql.ER_UNKNOWN_ERROR, "not supported")
+}
+
+// compile-time check
+var _ server.Handler = (*emptyHandler)(nil)
@@ -0,0 +1,299 @@
+--- /dev/null	2026-03-05 11:06:53.990718185 +0800
+++ /data/projects/arknights/omv-dijiang/works/core/protocol/mysql/outbound.go	2026-03-05 13:15:28.015911006 +0800
+@@ -0,0 +1,296 @@
+// OMV
+package mysql
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"sync"
+	"sync/atomic"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/adapter/outbound"
+	"github.com/sagernet/sing-box/common/dialer"
+	C "github.com/sagernet/sing-box/constant"
+	"github.com/sagernet/sing-box/log"
+	"github.com/sagernet/sing-box/option"
+	"github.com/sagernet/sing/common"
+	E "github.com/sagernet/sing/common/exceptions"
+	"github.com/sagernet/sing/common/logger"
+	M "github.com/sagernet/sing/common/metadata"
+	N "github.com/sagernet/sing/common/network"
+	"github.com/sagernet/sing/common/uot"
+	"github.com/sagernet/smux"
+
+	"github.com/go-mysql-org/go-mysql/client"
+)
+
+func RegisterOutbound(registry *outbound.Registry) {
+	outbound.Register[option.MySQLOutboundOptions](registry, C.TypeMySQL, NewOutbound)
+}
+
+var _ adapter.InterfaceUpdateListener = (*Outbound)(nil)
+
+type Outbound struct {
+	outbound.Adapter
+	ctx            context.Context
+	logger         logger.ContextLogger
+	dialer         N.Dialer
+	serverAddr     M.Socksaddr
+	username       string
+	password       string
+	tlsConfig      *tls.Config
+	maxConnections int
+	nextSession    uint32
+
+	sessionAccess sync.Mutex
+	sessions      []*muxSession
+}
+
+type muxSession struct {
+	session *smux.Session
+	conn    net.Conn
+}
+
+func closeMuxSession(entry *muxSession) {
+	if entry == nil {
+		return
+	}
+	_ = common.Close(entry.session, entry.conn)
+}
+
+func NewOutbound(ctx context.Context, router adapter.Router, logger log.ContextLogger, tag string, options option.MySQLOutboundOptions) (adapter.Outbound, error) {
+	outboundDialer, err := dialer.New(ctx, options.DialerOptions, options.ServerIsDomain())
+	if err != nil {
+		return nil, err
+	}
+
+	outbound := &Outbound{
+		Adapter:        outbound.NewAdapterWithDialerOptions(C.TypeMySQL, tag, []string{N.NetworkTCP, N.NetworkUDP}, options.DialerOptions),
+		ctx:            ctx,
+		logger:         logger,
+		dialer:         outboundDialer,
+		serverAddr:     options.ServerOptions.Build(),
+		username:       options.Username,
+		password:       options.Password,
+		maxConnections: 1,
+	}
+
+	if options.Multiplex != nil && options.Multiplex.Enabled && options.Multiplex.MaxConnections > 1 {
+		outbound.maxConnections = options.Multiplex.MaxConnections
+	}
+	outbound.sessions = make([]*muxSession, outbound.maxConnections)
+
+	if outbound.serverAddr.Port == 0 {
+		outbound.serverAddr.Port = 3306
+	}
+
+	if outbound.username == "" {
+		outbound.username = "root"
+	}
+
+	// Build TLS config for MySQL client handshake
+	if options.TLS != nil && options.TLS.Enabled {
+		outbound.tlsConfig = &tls.Config{
+			InsecureSkipVerify: options.TLS.Insecure,
+			ServerName:         options.TLS.ServerName,
+		}
+		if outbound.tlsConfig.ServerName == "" {
+			outbound.tlsConfig.ServerName = options.Server
+		}
+	} else {
+		// Default: use insecure TLS (since this is for tunneling, not real MySQL)
+		outbound.tlsConfig = &tls.Config{
+			InsecureSkipVerify: true,
+		}
+	}
+
+	return outbound, nil
+}
+
+func (h *Outbound) createSession() (*muxSession, error) {
+	h.logger.InfoContext(h.ctx, "creating smux session")
+	// Dial TCP connection to server
+	conn, err := h.dialer.DialContext(h.ctx, N.NetworkTCP, h.serverAddr)
+	if err != nil {
+		return nil, E.Cause(err, "dial server")
+	}
+
+	// Perform MySQL handshake with TLS
+	mysqlConn, err := client.ConnectWithDialer(
+		h.ctx,
+		"tcp",
+		h.serverAddr.String(),
+		h.username,
+		h.password,
+		"",
+		func(ctx context.Context, network, address string) (net.Conn, error) {
+			// Return the already-established connection
+			return conn, nil
+		},
+		func(c *client.Conn) error {
+			c.SetTLSConfig(h.tlsConfig)
+			return nil
+		},
+	)
+	if err != nil {
+		conn.Close()
+		return nil, E.Cause(err, "MySQL handshake")
+	}
+
+	// After MySQL handshake, the underlying connection is TLS-encrypted.
+	// Get the underlying net.Conn.
+	tlsConn := mysqlConn.Conn.Conn
+
+	// Create smux session over the TLS connection
+	session, err := smux.Client(tlsConn, smuxConfig())
+	if err != nil {
+		tlsConn.Close()
+		return nil, E.Cause(err, "create mux session")
+	}
+
+	return &muxSession{session: session, conn: tlsConn}, nil
+}
+
+func (h *Outbound) getSession(index int) (*smux.Session, error) {
+	h.sessionAccess.Lock()
+	defer h.sessionAccess.Unlock()
+
+	entry := h.sessions[index]
+	if entry != nil && !entry.session.IsClosed() {
+		return entry.session, nil
+	}
+	if entry != nil {
+		closeMuxSession(entry)
+		h.sessions[index] = nil
+	}
+
+	entry, err := h.createSession()
+	if err != nil {
+		return nil, err
+	}
+	h.sessions[index] = entry
+
+	go func(index int, session *smux.Session, conn net.Conn) {
+		// When session is closed, clean up
+		<-session.CloseChan()
+		h.sessionAccess.Lock()
+		if current := h.sessions[index]; current != nil && current.session == session {
+			h.sessions[index] = nil
+		}
+		h.sessionAccess.Unlock()
+		_ = common.Close(session, conn)
+	}(index, entry.session, entry.conn)
+
+	return entry.session, nil
+}
+
+func (h *Outbound) invalidateSession(index int, session *smux.Session) {
+	h.sessionAccess.Lock()
+	defer h.sessionAccess.Unlock()
+
+	if current := h.sessions[index]; current != nil && current.session == session {
+		h.sessions[index] = nil
+		closeMuxSession(current)
+	}
+}
+
+func (h *Outbound) openStream(ctx context.Context, command byte, destination M.Socksaddr) (net.Conn, error) {
+	_ = ctx
+	start := int(atomic.AddUint32(&h.nextSession, 1)-1) % h.maxConnections
+	var lastErr error
+	for i := 0; i < h.maxConnections; i++ {
+		index := (start + i) % h.maxConnections
+		session, err := h.getSession(index)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+
+		stream, err := session.OpenStream()
+		if err != nil {
+			h.invalidateSession(index, session)
+			lastErr = err
+			continue
+		}
+
+		// Write stream header: command + destination
+		_, err = stream.Write([]byte{command})
+		if err != nil {
+			stream.Close()
+			lastErr = E.Cause(err, "write stream header command")
+			continue
+		}
+		err = M.SocksaddrSerializer.WriteAddrPort(stream, destination)
+		if err != nil {
+			stream.Close()
+			lastErr = E.Cause(err, "write stream header destination")
+			continue
+		}
+
+		return stream, nil
+	}
+	if lastErr == nil {
+		lastErr = E.New("open mux stream")
+	}
+	return nil, E.Cause(lastErr, "open mux stream")
+}
+
+func (h *Outbound) DialContext(ctx context.Context, network string, destination M.Socksaddr) (net.Conn, error) {
+	switch N.NetworkName(network) {
+	case N.NetworkTCP:
+		h.logger.InfoContext(ctx, "outbound connection to ", destination)
+		return h.openStream(ctx, commandTCP, destination)
+	case N.NetworkUDP:
+		h.logger.InfoContext(ctx, "outbound UoT packet connection to ", destination)
+		conn, err := h.openStream(ctx, commandUDP, uot.RequestDestination(uot.Version))
+		if err != nil {
+			return nil, err
+		}
+		return uot.NewLazyConn(conn, uot.Request{
+			IsConnect:   true,
+			Destination: destination,
+		}), nil
+	default:
+		return nil, E.New("unsupported network: ", network)
+	}
+}
+
+func (h *Outbound) ListenPacket(ctx context.Context, destination M.Socksaddr) (net.PacketConn, error) {
+	h.logger.InfoContext(ctx, "outbound UoT packet connection to ", destination)
+	conn, err := h.openStream(ctx, commandUDP, uot.RequestDestination(uot.Version))
+	if err != nil {
+		return nil, err
+	}
+	return uot.NewLazyConn(conn, uot.Request{
+		IsConnect:   false,
+		Destination: destination,
+	}), nil
+}
+
+func (h *Outbound) InterfaceUpdated() {
+	h.sessionAccess.Lock()
+	defer h.sessionAccess.Unlock()
+	for i, session := range h.sessions {
+		if session == nil {
+			continue
+		}
+		session.session.Close()
+		session.conn.Close()
+		h.sessions[i] = nil
+	}
+}
+
+func (h *Outbound) Close() error {
+	h.sessionAccess.Lock()
+	defer h.sessionAccess.Unlock()
+	var err error
+	for i, session := range h.sessions {
+		if session == nil {
+			continue
+		}
+		err = common.Close(session.session, session.conn)
+		h.sessions[i] = nil
+	}
+	return err
+}