refactor(firebasetunnel): merge client/server into single Endpoint type#25
Open
hiddifydeveloper wants to merge 1297 commits into
Open
refactor(firebasetunnel): merge client/server into single Endpoint type#25hiddifydeveloper wants to merge 1297 commits into
hiddifydeveloper wants to merge 1297 commits into
Conversation
DNS rules referencing rule-sets that contain only ip_cidr predicates silently stopped matching when legacy DNS mode was disabled, because the IP-CIDR branch cannot match against an in-flight DNS query. The existing validation intentionally let every rule_set through on the premise that mixed sets still work via their non-IP branches, which is only true when such a branch exists. Track whether a rule-set carries any non-IP-CIDR predicate and reject pure-IP references the same way bare ip_cidr fields are already rejected.
…s-e000eb feat(gooserelay): add GooseRelay outbound under protocol/hiddify/gooserelay
Rebase the hiddify/sing-box-extended work onto the latest upstream testing branch from https://github.com/SagerNet/sing-box, preserving fork-specific protocols (AWG, XHTTP, mieru, DNSTT, GooseRelay, WARP, psiphon, monitoring, smart DNS pool, etc.) while taking upstream updates for core platform, TLS, routing, and clients submodules. Co-authored-by: Cursor <cursoragent@cursor.com>
… after merge Co-authored-by: Cursor <cursoragent@cursor.com>
Re-sync lifecycle logging, platform/network helpers, service managers, and the Linux neighbor resolver with SagerNet sing-box testing after the hiddify merge accidentally dropped or replaced upstream implementations. Co-authored-by: Cursor <cursoragent@cursor.com>
Drop fork-only ConnectionHandlerEx types and restore the unified upstream handler model across listeners, upstream adapters, route, balancer/selector groups, and SSH inbound so the tree builds against current sing APIs. Co-authored-by: Cursor <cursoragent@cursor.com>
…stream Restore upstream DNS query options, neighbor LookupAddresses, certificate ExclusiveAnchors, and local DNS exchange on Darwin. Remove the obsolete darwin-only local transport stub that blocked shared resolver code. Co-authored-by: Cursor <cursoragent@cursor.com>
Bring back upstream Tailscale exit-node and SSH session RPC definitions, generated protobuf code, and daemon helpers removed during the merge so libbox and started_service compile against the current testing branch. Co-authored-by: Cursor <cursoragent@cursor.com>
Re-add upstream TLSSpoof metadata to InboundContext while keeping hiddify tunnel routing fields (TunnelSource, RealOutbound, etc.) required by the fork's route and monitoring logic. Co-authored-by: Cursor <cursoragent@cursor.com>
Preserve fork-specific DNS types, monitoring/unified-delay settings, WARP cache storage, tunnel routing rules, and related option fields needed by hiddify protocols without altering upstream core interfaces. Co-authored-by: Cursor <cursoragent@cursor.com>
…upstream API Add WARP/binary cache helpers via LoadRuleSet delegation and per-outbound traffic accounting through additive Manager methods, keeping upstream PushUploaded/PushDownloaded signatures unchanged. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: xream <1210282+xream@users.noreply.github.com>
Wire merged upstream and extended-fork protocol work into the existing adapter surface without breaking core interfaces. - MASQUE: cloudflare EnrollKey/GetProfile4471, cache via StoreMASQUEConfig and LoadBinary/SaveBinary, connect-ip-go replace, masque_client TLS init - VLESS encryption: NewUpstreamContextHandler, tls.NewClient logger arg, starifly/sing-vmess replace for vision/canSplice APIs - Restore DNSTTOptions in v2ray transport and upstream xhttp option fixes Co-authored-by: Cursor <cursoragent@cursor.com>
Add Snell and shadowsocks simple-obfs examples, fix configs that failed sing-box check, and add examples/check.sh to validate all JSON examples (with_gvisor,with_wireguard,with_awg,with_masque build tags). Co-authored-by: Cursor <cursoragent@cursor.com>
Adds FirebaseTunnelClientOptions/FirebaseTunnelServerOptions and the firebasetunnel_client/firebasetunnel_server type constants, laying the groundwork for a Firebase Realtime Database relay endpoint adapted from github.com/Hiddify2/Firebase-Tunnel.
Implements the Firebase Realtime Database REST client (Get/Put/Delete with retry, SSE Listen with jittered reconnect), the chunk batching/reassembly pipeline (chunkSender/chunkReceiver), optional AES-256-GCM payload encryption, and zstd compression helpers. Adapted from github.com/Hiddify2/Firebase-Tunnel (no LICENSE upstream; mechanism studied and reimplemented rather than vendored). Adds backpressure limits and jittered backoff not present in the original PoC.
Implements ClientEndpoint and ServerEndpoint as adapter.Endpoint, mirroring the existing tunnel_client/tunnel_server shape. Client adapts the relay into a net.Pipe-backed DialContext; server discovers sessions via Firebase SSE, enforces per-user/global session caps and per-user creation rate limits, dials real targets via router.RouteConnectionEx (so existing routing/DNS/sniffing rules apply), and wires per-user traffic accounting into the SSM tracker (the same subsystem used for Shadowsocks usage). Adds a background GC sweep for abandoned sessions and panic-recovery restart for the poll/GC loops so a fault here can't take down the rest of the sing-box process. Registered in include/registry.go's EndpointRegistry().
Covers zstd round-trip, AES-256-GCM encrypt/decrypt (including wrong-key and truncated-ciphertext failure cases), chunk sender/receiver round-trip against an in-memory fake Firebase REST server, out-of-order chunk reassembly, duplicate-chunk handling, and the sender backpressure cap.
Adds protocol/firebasetunnel/docs/ covering architecture, configuration reference, threat model/security tradeoffs, and operational guidance (limits, GC, failure isolation, rollout), plus a provenance doc detailing what was reused vs. rewritten from github.com/Hiddify2/Firebase-Tunnel.
- Add HMAC-SHA256 integrity tags (16 B, derived from firebase_secret) on all unencrypted chunks so a Firebase-side observer cannot silently flip payload bytes without detection. - Add AES-256-GCM AEAD additional data binding: each encrypted chunk now encodes sessionID + direction + seq as AAD, so a chunk cannot be replayed from one session, direction, or sequence position into another. - Thread sessionID + direction + hmacKey through newChunkSender / newChunkReceiver / flushBuffer / decodeChunkPayload — all call sites in client.go and server.go updated. - Add maxChunkBytes (1 MiB) cap in decodeChunkPayload: oversized chunks are rejected before any allocation, preventing memory exhaustion from malicious/buggy clients. - Client activation fail-fast: waitForActive now backs off on consecutive GET errors (jitteredBackoff) instead of fixed 250 ms, and logs a Warn after 3 s of pending state so operators can detect absent servers early. - Session ID collision defense in handleSession: re-fetches metadata after acquireSessionSlot and verifies CreatedAt matches the polled value; mismatches (GC-lag collisions, stale seen-map entries) are rejected. - Graceful drain on Close(): sets closing atomic, waits up to 5 s for activeSessions to reach 0, then cancels the server context; new sessions are rejected while draining. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- fakeFirebaseServer now implements SSE streaming: GET with Accept: text/event-stream returns a live event-stream, broadcasting Firebase put-style events to connected listeners on every PUT, so pollLoop's SSE path is exercised without a real Firebase project. - TestChunkSenderHMAC: verifies HMAC tags are written and verified; wrong HMAC key must fail ingest. - TestChunkAADBinding: verifies that an encrypted chunk cannot be decrypted if sessionID, direction, or seq in the AAD differs. - TestChunkSizeCapRejected: verifies oversized chunks are rejected. - TestRelayRoundTrip / TestRelayEncryptedRoundTrip: full end-to-end chunk relay using fakeFirebaseServer — client runSession writes c2s chunks, server runRelay reads and echoes them back via s2c chunks, client reads the echo; covers both HMAC-only and PSK-encrypted paths. - FuzzIngestChunk / FuzzParseSessionMetadata / FuzzDecodeChunkPayload: fuzz targets for all attacker-reachable JSON parsing and chunk decode paths; must not panic on arbitrary input. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace TypeFirebaseTunnelClient + TypeFirebaseTunnelServer (two separate
proxy types) with a single TypeFirebaseTunnel. Role — server (inbound) or
client (outbound) — is now determined at construction time by which sub-config
is present in FirebaseTunnelOptions: options.Server != nil → server mode,
options.Client != nil → client mode.
Changes:
- option/firebasetunnel.go: one FirebaseTunnelOptions with nested
*FirebaseTunnelServerConfig and *FirebaseTunnelClientConfig; shared fields
(firebase_urls, firebase_secret, firebase_auth_token, retry_limit) at top level
- constant/proxy.go: two constants → TypeFirebaseTunnel = "firebasetunnel"
- protocol/firebasetunnel/endpoint.go: single Endpoint struct with srv *serverState
(nil in client mode); extract drainInto, copyToSender, isTerminal helpers;
fix perUserActive map leak on releaseSessionSlot; add all missing constants
- protocol/firebasetunnel/client.go: deleted
- protocol/firebasetunnel/server.go: deleted
- include/registry.go: two Register calls → one RegisterEndpoint call
- protocol/firebasetunnel/endpoint_test.go: update struct literals to Endpoint{}
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TypeFirebaseTunnelClient+TypeFirebaseTunnelServer(two separateproxy types) with a single
TypeFirebaseTunnel = "firebasetunnel"options.Server != nil→ inbound,options.Client != nil→ outboundclient.go+server.gointo singleendpoint.goNew JSON config shape: