feat(firebasetunnel): port Firebase Tunnel as proper inbound/outbound pair#29
Open
hiddifydeveloper wants to merge 395 commits into
Open
feat(firebasetunnel): port Firebase Tunnel as proper inbound/outbound pair#29hiddifydeveloper wants to merge 395 commits into
hiddifydeveloper wants to merge 395 commits into
Conversation
`SecTrustEvaluateWithError` is serial
…stream Restore upstream DNS query options, neighbor LookupAddresses, certificate ExclusiveAnchors, and local DNS exchange on Darwin. Remove the obsolete darwin-only local transport stub that blocked shared resolver code. Co-authored-by: Cursor <cursoragent@cursor.com>
Bring back upstream Tailscale exit-node and SSH session RPC definitions, generated protobuf code, and daemon helpers removed during the merge so libbox and started_service compile against the current testing branch. Co-authored-by: Cursor <cursoragent@cursor.com>
Re-add upstream TLSSpoof metadata to InboundContext while keeping hiddify tunnel routing fields (TunnelSource, RealOutbound, etc.) required by the fork's route and monitoring logic. Co-authored-by: Cursor <cursoragent@cursor.com>
Preserve fork-specific DNS types, monitoring/unified-delay settings, WARP cache storage, tunnel routing rules, and related option fields needed by hiddify protocols without altering upstream core interfaces. Co-authored-by: Cursor <cursoragent@cursor.com>
…upstream API Add WARP/binary cache helpers via LoadRuleSet delegation and per-outbound traffic accounting through additive Manager methods, keeping upstream PushUploaded/PushDownloaded signatures unchanged. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: xream <1210282+xream@users.noreply.github.com>
Wire merged upstream and extended-fork protocol work into the existing adapter surface without breaking core interfaces. - MASQUE: cloudflare EnrollKey/GetProfile4471, cache via StoreMASQUEConfig and LoadBinary/SaveBinary, connect-ip-go replace, masque_client TLS init - VLESS encryption: NewUpstreamContextHandler, tls.NewClient logger arg, starifly/sing-vmess replace for vision/canSplice APIs - Restore DNSTTOptions in v2ray transport and upstream xhttp option fixes Co-authored-by: Cursor <cursoragent@cursor.com>
Add Snell and shadowsocks simple-obfs examples, fix configs that failed sing-box check, and add examples/check.sh to validate all JSON examples (with_gvisor,with_wireguard,with_awg,with_masque build tags). Co-authored-by: Cursor <cursoragent@cursor.com>
These nested submodules have no entry in .gitmodules, breaking recursive submodule checkout. They are the native GUI client apps, not needed for the Go core build. Removed so hiddify-core CI can clone recursively. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: remove clients/android + clients/apple gitlinks (broken submodules)
Implements the Firebase Realtime Database REST client (Get/Put/Delete with retry, SSE Listen with jittered reconnect), the chunk batching/reassembly pipeline (chunkSender/chunkReceiver), optional AES-256-GCM payload encryption, and zstd compression helpers. Adapted from github.com/Hiddify2/Firebase-Tunnel (no LICENSE upstream; mechanism studied and reimplemented rather than vendored). Adds backpressure limits and jittered backoff not present in the original PoC.
Implements ClientEndpoint and ServerEndpoint as adapter.Endpoint, mirroring the existing tunnel_client/tunnel_server shape. Client adapts the relay into a net.Pipe-backed DialContext; server discovers sessions via Firebase SSE, enforces per-user/global session caps and per-user creation rate limits, dials real targets via router.RouteConnectionEx (so existing routing/DNS/sniffing rules apply), and wires per-user traffic accounting into the SSM tracker (the same subsystem used for Shadowsocks usage). Adds a background GC sweep for abandoned sessions and panic-recovery restart for the poll/GC loops so a fault here can't take down the rest of the sing-box process. Registered in include/registry.go's EndpointRegistry().
Covers zstd round-trip, AES-256-GCM encrypt/decrypt (including wrong-key and truncated-ciphertext failure cases), chunk sender/receiver round-trip against an in-memory fake Firebase REST server, out-of-order chunk reassembly, duplicate-chunk handling, and the sender backpressure cap.
- Add HMAC-SHA256 integrity tags (16 B, derived from firebase_secret) on all unencrypted chunks so a Firebase-side observer cannot silently flip payload bytes without detection. - Add AES-256-GCM AEAD additional data binding: each encrypted chunk now encodes sessionID + direction + seq as AAD, so a chunk cannot be replayed from one session, direction, or sequence position into another. - Thread sessionID + direction + hmacKey through newChunkSender / newChunkReceiver / flushBuffer / decodeChunkPayload — all call sites in client.go and server.go updated. - Add maxChunkBytes (1 MiB) cap in decodeChunkPayload: oversized chunks are rejected before any allocation, preventing memory exhaustion from malicious/buggy clients. - Client activation fail-fast: waitForActive now backs off on consecutive GET errors (jitteredBackoff) instead of fixed 250 ms, and logs a Warn after 3 s of pending state so operators can detect absent servers early. - Session ID collision defense in handleSession: re-fetches metadata after acquireSessionSlot and verifies CreatedAt matches the polled value; mismatches (GC-lag collisions, stale seen-map entries) are rejected. - Graceful drain on Close(): sets closing atomic, waits up to 5 s for activeSessions to reach 0, then cancels the server context; new sessions are rejected while draining. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- fakeFirebaseServer now implements SSE streaming: GET with Accept: text/event-stream returns a live event-stream, broadcasting Firebase put-style events to connected listeners on every PUT, so pollLoop's SSE path is exercised without a real Firebase project. - TestChunkSenderHMAC: verifies HMAC tags are written and verified; wrong HMAC key must fail ingest. - TestChunkAADBinding: verifies that an encrypted chunk cannot be decrypted if sessionID, direction, or seq in the AAD differs. - TestChunkSizeCapRejected: verifies oversized chunks are rejected. - TestRelayRoundTrip / TestRelayEncryptedRoundTrip: full end-to-end chunk relay using fakeFirebaseServer — client runSession writes c2s chunks, server runRelay reads and echoes them back via s2c chunks, client reads the echo; covers both HMAC-only and PSK-encrypted paths. - FuzzIngestChunk / FuzzParseSessionMetadata / FuzzDecodeChunkPayload: fuzz targets for all attacker-reachable JSON parsing and chunk decode paths; must not panic on arbitrary input. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace TypeFirebaseTunnelClient + TypeFirebaseTunnelServer (two separate
proxy types) with a single TypeFirebaseTunnel. Role — server (inbound) or
client (outbound) — is now determined at construction time by which sub-config
is present in FirebaseTunnelOptions: options.Server != nil → server mode,
options.Client != nil → client mode.
Changes:
- option/firebasetunnel.go: one FirebaseTunnelOptions with nested
*FirebaseTunnelServerConfig and *FirebaseTunnelClientConfig; shared fields
(firebase_urls, firebase_secret, firebase_auth_token, retry_limit) at top level
- constant/proxy.go: two constants → TypeFirebaseTunnel = "firebasetunnel"
- protocol/firebasetunnel/endpoint.go: single Endpoint struct with srv *serverState
(nil in client mode); extract drainInto, copyToSender, isTerminal helpers;
fix perUserActive map leak on releaseSessionSlot; add all missing constants
- protocol/firebasetunnel/client.go: deleted
- protocol/firebasetunnel/server.go: deleted
- include/registry.go: two Register calls → one RegisterEndpoint call
- protocol/firebasetunnel/endpoint_test.go: update struct literals to Endpoint{}
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ctor clientKey → key to match merged Endpoint struct field name. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
….Once init() with panic is disallowed per project conventions. Replace with lazy initialization via sync.Once on first use; initialization errors are propagated to callers rather than crashing the process. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace the single `Endpoint` struct (with `if srv != nil` branching) with a clean inbound/outbound separation following the mieru/anytls pattern: - `inbound.go` — `Inbound` struct embedding `inbound.Adapter`; accept loop discovers Firebase sessions and routes each via `router.RouteConnectionEx` after setting `metadata.User`; sing-box handles traffic accounting automatically — no SSMTracker needed. - `outbound.go` — `Outbound` struct embedding `outbound.Adapter`; `DialContext` creates sessions and relays data through Firebase. - `common.go` — shared constants and helper functions. `loopWithRestart` replaces `runWithRecovery`: loop function returns `error`; the outer loop restarts on non-nil error without using `recover()` or `panic`. Option structs split into `FirebaseTunnelInboundOptions` and `FirebaseTunnelOutboundOptions`. Type constants renamed to `TypeFirebaseTunnelInbound` / `TypeFirebaseTunnelOutbound`. `include/registry.go` updated to call `RegisterInbound` / `RegisterOutbound` instead of the old endpoint registrations. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
hiddifydeveloper
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports the Firebase Realtime Database relay mechanism from Hiddify2/Firebase-Tunnel into hiddify-sing-box as a proper inbound/outbound pair following the same pattern as
protocol/anytlsandprotocol/mieru.firebasetunnel-in(Inbound): accept loop discovers pending sessions via Firebase SSE stream + periodic polling fallback. Validates user, applies rate/session caps, setsmetadata.Userand callsrouter.RouteConnectionEx— sing-box handles all routing, outbound selection, and per-user traffic accounting automatically.firebasetunnel-out(Outbound):DialContextcreates a session node in Firebase RTDB, waits for the server to activate it, then relays bytes bidirectionally via batched/compressed/optionally-encrypted Firebase chunk queues.New files
protocol/firebasetunnel/inbound.goInboundstruct +RegisterInbound+ accept loopprotocol/firebasetunnel/outbound.goOutboundstruct +RegisterOutbound+DialContextprotocol/firebasetunnel/common.goprotocol/firebasetunnel/firebase.goprotocol/firebasetunnel/session.gochunkSender/chunkReceiverwith batching, ordering, ackprotocol/firebasetunnel/protocol.gosessionMetadata,chunk, path helpersprotocol/firebasetunnel/crypto.goprotocol/firebasetunnel/compress.gosync.Once(noinit/panic)protocol/firebasetunnel/util.gooption/firebasetunnel.goFirebaseTunnelInboundOptions+FirebaseTunnelOutboundOptionsRobustness
firebase_secret)sessionID+direction+seqas AEAD additional data — prevents cross-session chunk replayCreatedAtbefore marking session activeloopWithRestartreturns errors (norecover()/panic)Tests
session_test.go— chunk sender/receiver round-trips (plain, encrypted, HMAC, out-of-order, duplicate, backpressure, size cap)endpoint_test.go— E2E relay round-trips using in-processfakeFirebaseServerwith SSE supportcrypto_test.go— encrypt/decrypt, HMAC tag, AAD bindingcompress_test.go— compress/decompressfuzz_test.go—FuzzIngestChunk,FuzzParseSessionMetadata,FuzzDecodeChunkPayloadDocs
protocol/firebasetunnel/docs/contains architecture, configuration reference, and security model documentation.🤖 Generated with Claude Code