Add ECH support for QUIC based protocols

transport/tuic/client.go

@@ -1,8 +1,9 @@
+//go:build with_quic
+
 package tuic
 
 import (
 	"context"
-	"crypto/tls"
 	"io"
 	"net"
 	"runtime"
@@ -10,6 +11,8 @@ import (
 	"time"
 
 	"github.com/sagernet/quic-go"
+	"github.com/sagernet/sing-box/common/qtls"
+	"github.com/sagernet/sing-box/common/tls"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/baderror"
 	"github.com/sagernet/sing/common/buf"
@@ -25,7 +28,7 @@ type ClientOptions struct {
 	Context           context.Context
 	Dialer            N.Dialer
 	ServerAddress     M.Socksaddr
-	TLSConfig         *tls.Config
+	TLSConfig         tls.Config
 	UUID              uuid.UUID
 	Password          string
 	CongestionControl string
@@ -38,7 +41,7 @@ type Client struct {
 	ctx               context.Context
 	dialer            N.Dialer
 	serverAddr        M.Socksaddr
-	tlsConfig         *tls.Config
+	tlsConfig         tls.Config
 	quicConfig        *quic.Config
 	uuid              uuid.UUID
 	password          string
@@ -108,9 +111,9 @@ func (c *Client) offerNew(ctx context.Context) (*clientQUICConnection, error) {
 	}
 	var quicConn quic.Connection
 	if c.zeroRTTHandshake {
-		quicConn, err = quic.DialEarly(ctx, bufio.NewUnbindPacketConn(udpConn), udpConn.RemoteAddr(), c.tlsConfig, c.quicConfig)
+		quicConn, err = qtls.DialEarly(ctx, bufio.NewUnbindPacketConn(udpConn), udpConn.RemoteAddr(), c.tlsConfig, c.quicConfig)
 	} else {
-		quicConn, err = quic.Dial(ctx, bufio.NewUnbindPacketConn(udpConn), udpConn.RemoteAddr(), c.tlsConfig, c.quicConfig)
+		quicConn, err = qtls.Dial(ctx, bufio.NewUnbindPacketConn(udpConn), udpConn.RemoteAddr(), c.tlsConfig, c.quicConfig)
 	}
 	if err != nil {
 		udpConn.Close()
@@ -141,13 +144,13 @@ func (c *Client) offerNew(ctx context.Context) (*clientQUICConnection, error) {
 func (c *Client) clientHandshake(conn quic.Connection) error {
 	authStream, err := conn.OpenUniStream()
 	if err != nil {
-		return err
+		return E.Cause(err, "open handshake stream")
 	}
 	defer authStream.Close()
-	handshakeState := conn.ConnectionState().TLS
+	handshakeState := conn.ConnectionState()
 	tuicAuthToken, err := handshakeState.ExportKeyingMaterial(string(c.uuid[:]), []byte(c.password), 32)
 	if err != nil {
-		return err
+		return E.Cause(err, "export keying material")
 	}
 	authRequest := buf.NewSize(AuthenticateLen)
 	authRequest.WriteByte(Version)

transport/tuic/client_packet.go

@@ -1,3 +1,5 @@
+//go:build with_quic
+
 package tuic
 
 import (

transport/tuic/server.go

@@ -1,9 +1,10 @@
+//go:build with_quic
+
 package tuic
 
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/binary"
 	"io"
 	"net"
@@ -13,6 +14,8 @@ import (
 	"time"
 
 	"github.com/sagernet/quic-go"
+	"github.com/sagernet/sing-box/common/qtls"
+	"github.com/sagernet/sing-box/common/tls"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/auth"
 	"github.com/sagernet/sing/common/baderror"
@@ -29,7 +32,7 @@ import (
 type ServerOptions struct {
 	Context           context.Context
 	Logger            logger.Logger
-	TLSConfig         *tls.Config
+	TLSConfig         tls.ServerConfig
 	Users             []User
 	CongestionControl string
 	AuthTimeout       time.Duration
@@ -52,7 +55,7 @@ type ServerHandler interface {
 type Server struct {
 	ctx               context.Context
 	logger            logger.Logger
-	tlsConfig         *tls.Config
+	tlsConfig         tls.ServerConfig
 	heartbeat         time.Duration
 	quicConfig        *quic.Config
 	userMap           map[uuid.UUID]User
@@ -107,7 +110,7 @@ func NewServer(options ServerOptions) (*Server, error) {
 
 func (s *Server) Start(conn net.PacketConn) error {
 	if !s.quicConfig.Allow0RTT {
-		listener, err := quic.Listen(conn, s.tlsConfig, s.quicConfig)
+		listener, err := qtls.Listen(conn, s.tlsConfig, s.quicConfig)
 		if err != nil {
 			return err
 		}
@@ -127,7 +130,7 @@ func (s *Server) Start(conn net.PacketConn) error {
 			}
 		}()
 	} else {
-		listener, err := quic.ListenEarly(conn, s.tlsConfig, s.quicConfig)
+		listener, err := qtls.ListenEarly(conn, s.tlsConfig, s.quicConfig)
 		if err != nil {
 			return err
 		}
@@ -247,7 +250,7 @@ func (s *serverSession) handleUniStream(stream quic.ReceiveStream) error {
 		if !loaded {
 			return E.New("authentication: unknown user ", userUUID)
 		}
-		handshakeState := s.quicConn.ConnectionState().TLS
+		handshakeState := s.quicConn.ConnectionState()
 		tuicToken, err := handshakeState.ExportKeyingMaterial(string(user.UUID[:]), []byte(user.Password), 32)
 		if err != nil {
 			return E.Cause(err, "authentication: export keying material")

transport/tuic/server_packet.go

@@ -1,3 +1,5 @@
+//go:build with_quic
+
 package tuic
 
 import (