sniffing: full websocket frame recording

bypass/bypass.go

@@ -271,8 +271,8 @@ func (bp *localBypass) matched(addr string) bool {
 		host = addr
 	}
 
-	if ip := net.ParseIP(host); ip != nil {
-		return bp.cidrMatcher.Match(host)
+	if ip := net.ParseIP(host); ip != nil && bp.cidrMatcher.Match(host) {
+		return true
 	}
 
 	return bp.wildcardMatcher.Match(addr)

chain/router.go

@@ -96,6 +96,11 @@ func (r *Router) dial(ctx context.Context, network, address string, log logger.L
 			defer cancel()
 		}
 
+		buf := ctxvalue.BufferFromContext(ctx)
+		if buf != nil {
+			buf.Reset()
+		}
+
 		var ipAddr string
 		ipAddr, err = xnet.Resolve(ctx, "ip", address, r.options.Resolver, r.options.HostMapper, log)
 		if err != nil {
@@ -103,19 +108,23 @@ func (r *Router) dial(ctx context.Context, network, address string, log logger.L
 			break
 		}
 
+		if buf != nil {
+			buf.Reset()
+		}
+
 		var route chain.Route
 		if r.options.Chain != nil {
 			route = r.options.Chain.Route(ctx, network, ipAddr, chain.WithHostRouteOption(address))
 		}
 
-		if log.IsLevelEnabled(logger.DebugLevel) {
-			buf := bytes.Buffer{}
-			for _, node := range routePath(route) {
-				fmt.Fprintf(&buf, "%s@%s > ", node.Name, node.Addr)
-			}
-			fmt.Fprintf(&buf, "%s", ipAddr)
-			log.Debugf("route(retry=%d) %s", i, buf.String())
+		if buf == nil {
+			buf = &bytes.Buffer{}
 		}
+		for _, node := range routePath(route) {
+			fmt.Fprintf(buf, "%s@%s > ", node.Name, node.Addr)
+		}
+		fmt.Fprintf(buf, "%s", ipAddr)
+		log.Debugf("route(retry=%d) %s", i, buf.String())
 
 		if route == nil {
 			route = DefaultRoute

config/cmd/cmd.go

@@ -10,12 +10,12 @@ import (
 	"strings"
 	"time"
 
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/x/config"
 	xnet "github.com/go-gost/x/internal/net"
 	"github.com/go-gost/x/limiter/conn"
 	"github.com/go-gost/x/limiter/traffic"
 	mdx "github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 )
 

config/config.go

@@ -121,6 +121,7 @@ type TLSOptions struct {
 	MinVersion   string   `yaml:"minVersion,omitempty" json:"minVersion,omitempty"`
 	MaxVersion   string   `yaml:"maxVersion,omitempty" json:"maxVersion,omitempty"`
 	CipherSuites []string `yaml:"cipherSuites,omitempty" json:"cipherSuites,omitempty"`
+	ALPN         []string `yaml:"alpn,omitempty" json:"alpn,omitempty"`
 }
 
 type PluginConfig struct {
@@ -185,6 +186,7 @@ type FileLoader struct {
 type RedisLoader struct {
 	Addr     string `json:"addr"`
 	DB       int    `yaml:",omitempty" json:"db,omitempty"`
+	Username string `yaml:",omitempty" json:"username,omitempty"`
 	Password string `yaml:",omitempty" json:"password,omitempty"`
 	Key      string `yaml:",omitempty" json:"key,omitempty"`
 	Type     string `yaml:",omitempty" json:"type,omitempty"`
@@ -292,6 +294,7 @@ type HTTPRecorder struct {
 type RedisRecorder struct {
 	Addr     string `json:"addr"`
 	DB       int    `yaml:",omitempty" json:"db,omitempty"`
+	Username string `yaml:",omitempty" json:"username,omitempty"`
 	Password string `yaml:",omitempty" json:"password,omitempty"`
 	Key      string `yaml:",omitempty" json:"key,omitempty"`
 	Type     string `yaml:",omitempty" json:"type,omitempty"`

config/parsing/admission/parse.go

@@ -59,6 +59,7 @@ func ParseAdmission(cfg *config.AdmissionConfig) admission.Admission {
 		opts = append(opts, xadmission.RedisLoaderOption(loader.RedisSetLoader(
 			cfg.Redis.Addr,
 			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 			loader.KeyRedisLoaderOption(cfg.Redis.Key),
 		)))

config/parsing/auth/parse.go

@@ -67,6 +67,7 @@ func ParseAuther(cfg *config.AutherConfig) auth.Authenticator {
 		opts = append(opts, xauth.RedisLoaderOption(loader.RedisHashLoader(
 			cfg.Redis.Addr,
 			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 			loader.KeyRedisLoaderOption(cfg.Redis.Key),
 		)))

config/parsing/bypass/parse.go

@@ -59,6 +59,7 @@ func ParseBypass(cfg *config.BypassConfig) bypass.Bypass {
 		opts = append(opts, xbypass.RedisLoaderOption(loader.RedisSetLoader(
 			cfg.Redis.Addr,
 			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 			loader.KeyRedisLoaderOption(cfg.Redis.Key),
 		)))

config/parsing/hop/parse.go

@@ -8,7 +8,6 @@ import (
 	"github.com/go-gost/core/chain"
 	"github.com/go-gost/core/hop"
 	"github.com/go-gost/core/logger"
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/x/config"
 	"github.com/go-gost/x/config/parsing"
 	bypass_parser "github.com/go-gost/x/config/parsing/bypass"
@@ -19,6 +18,7 @@ import (
 	"github.com/go-gost/x/internal/loader"
 	"github.com/go-gost/x/internal/plugin"
 	"github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 func ParseHop(cfg *config.HopConfig, log logger.Logger) (hop.Hop, error) {
@@ -130,6 +130,7 @@ func ParseHop(cfg *config.HopConfig, log logger.Logger) (hop.Hop, error) {
 		opts = append(opts, xhop.RedisLoaderOption(loader.RedisStringLoader(
 			cfg.Redis.Addr,
 			loader.DBRedisLoaderOption(cfg.Redis.DB),
+			loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 			loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 			loader.KeyRedisLoaderOption(cfg.Redis.Key),
 		)))

config/parsing/hosts/parse.go

@@ -75,6 +75,7 @@ func ParseHostMapper(cfg *config.HostsConfig) hosts.HostMapper {
 			opts = append(opts, xhosts.RedisLoaderOption(loader.RedisListLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -82,6 +83,7 @@ func ParseHostMapper(cfg *config.HostsConfig) hosts.HostMapper {
 			opts = append(opts, xhosts.RedisLoaderOption(loader.RedisSetLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))

config/parsing/ingress/parse.go

@@ -70,6 +70,7 @@ func ParseIngress(cfg *config.IngressConfig) ingress.Ingress {
 			opts = append(opts, xingress.RedisLoaderOption(loader.RedisSetLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -77,6 +78,7 @@ func ParseIngress(cfg *config.IngressConfig) ingress.Ingress {
 			opts = append(opts, xingress.RedisLoaderOption(loader.RedisHashLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))

config/parsing/limiter/parse.go

@@ -57,6 +57,7 @@ func ParseTrafficLimiter(cfg *config.LimiterConfig) (lim traffic.TrafficLimiter)
 			opts = append(opts, xtraffic.RedisLoaderOption(loader.RedisListLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -64,6 +65,7 @@ func ParseTrafficLimiter(cfg *config.LimiterConfig) (lim traffic.TrafficLimiter)
 			opts = append(opts, xtraffic.RedisLoaderOption(loader.RedisSetLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -103,6 +105,7 @@ func ParseConnLimiter(cfg *config.LimiterConfig) (lim conn.ConnLimiter) {
 			opts = append(opts, xconn.RedisLoaderOption(loader.RedisListLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -110,6 +113,7 @@ func ParseConnLimiter(cfg *config.LimiterConfig) (lim conn.ConnLimiter) {
 			opts = append(opts, xconn.RedisLoaderOption(loader.RedisSetLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -149,6 +153,7 @@ func ParseRateLimiter(cfg *config.LimiterConfig) (lim rate.RateLimiter) {
 			opts = append(opts, xrate.RedisLoaderOption(loader.RedisListLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -156,6 +161,7 @@ func ParseRateLimiter(cfg *config.LimiterConfig) (lim rate.RateLimiter) {
 			opts = append(opts, xrate.RedisLoaderOption(loader.RedisSetLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))

config/parsing/node/parse.go

@@ -12,7 +12,7 @@ import (
 	"github.com/go-gost/core/dialer"
 	"github.com/go-gost/core/logger"
 	"github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	xauth "github.com/go-gost/x/auth"
 	xchain "github.com/go-gost/x/chain"
 	"github.com/go-gost/x/config"
@@ -220,6 +220,7 @@ func ParseNode(hop string, cfg *config.NodeConfig, log logger.Logger) (*chain.No
 			tlsCfg.Options.MinVersion = o.MinVersion
 			tlsCfg.Options.MaxVersion = o.MaxVersion
 			tlsCfg.Options.CipherSuites = o.CipherSuites
+			tlsCfg.Options.ALPN = o.ALPN
 		}
 		opts = append(opts, chain.TLSNodeOption(tlsCfg))
 	}

config/parsing/parse.go

@@ -15,4 +15,6 @@ const (
 	MDKeyRecorderDirection       = "direction"
 	MDKeyRecorderTimestampFormat = "timeStampFormat"
 	MDKeyRecorderHexdump         = "hexdump"
+	MDKeyRecorderHTTPBody        = "http.body"
+	MDKeyRecorderHTTPMaxBodySize = "http.maxBodySize"
 )

config/parsing/recorder/parse.go

@@ -70,18 +70,21 @@ func ParseRecorder(cfg *config.RecorderConfig) (r recorder.Recorder) {
 			return xrecorder.RedisListRecorder(cfg.Redis.Addr,
 				xrecorder.DBRedisRecorderOption(cfg.Redis.DB),
 				xrecorder.KeyRedisRecorderOption(cfg.Redis.Key),
+				xrecorder.UsernameRedisRecorderOption(cfg.Redis.Username),
 				xrecorder.PasswordRedisRecorderOption(cfg.Redis.Password),
 			)
 		case "sset": // sorted set
 			return xrecorder.RedisSortedSetRecorder(cfg.Redis.Addr,
 				xrecorder.DBRedisRecorderOption(cfg.Redis.DB),
 				xrecorder.KeyRedisRecorderOption(cfg.Redis.Key),
+				xrecorder.UsernameRedisRecorderOption(cfg.Redis.Username),
 				xrecorder.PasswordRedisRecorderOption(cfg.Redis.Password),
 			)
 		default: // redis set
 			return xrecorder.RedisSetRecorder(cfg.Redis.Addr,
 				xrecorder.DBRedisRecorderOption(cfg.Redis.DB),
 				xrecorder.KeyRedisRecorderOption(cfg.Redis.Key),
+				xrecorder.UsernameRedisRecorderOption(cfg.Redis.Username),
 				xrecorder.PasswordRedisRecorderOption(cfg.Redis.Password),
 			)
 		}

config/parsing/router/parse.go

@@ -76,6 +76,7 @@ func ParseRouter(cfg *config.RouterConfig) router.Router {
 			opts = append(opts, xrouter.RedisLoaderOption(loader.RedisListLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -83,6 +84,7 @@ func ParseRouter(cfg *config.RouterConfig) router.Router {
 			opts = append(opts, xrouter.RedisLoaderOption(loader.RedisSetLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))
@@ -90,6 +92,7 @@ func ParseRouter(cfg *config.RouterConfig) router.Router {
 			opts = append(opts, xrouter.RedisLoaderOption(loader.RedisHashLoader(
 				cfg.Redis.Addr,
 				loader.DBRedisLoaderOption(cfg.Redis.DB),
+				loader.UsernameRedisLoaderOption(cfg.Redis.Username),
 				loader.PasswordRedisLoaderOption(cfg.Redis.Password),
 				loader.KeyRedisLoaderOption(cfg.Redis.Key),
 			)))

config/parsing/service/parse.go

@@ -14,7 +14,6 @@ import (
 	"github.com/go-gost/core/hop"
 	"github.com/go-gost/core/listener"
 	"github.com/go-gost/core/logger"
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
 	"github.com/go-gost/core/selector"
@@ -30,6 +29,7 @@ import (
 	selector_parser "github.com/go-gost/x/config/parsing/selector"
 	tls_util "github.com/go-gost/x/internal/util/tls"
 	"github.com/go-gost/x/metadata"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/registry"
 	xservice "github.com/go-gost/x/service"
 	"github.com/vishvananda/netns"
@@ -73,6 +73,7 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 	}
 	if tlsConfig == nil {
 		tlsConfig = parsing.DefaultTLSConfig().Clone()
+		tls_util.SetTLSOptions(tlsConfig, tlsCfg.Options)
 	}
 
 	authers := auth_parser.List(cfg.Listener.Auther, cfg.Listener.Authers...)
@@ -222,6 +223,7 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 	}
 	if tlsConfig == nil {
 		tlsConfig = parsing.DefaultTLSConfig().Clone()
+		tls_util.SetTLSOptions(tlsConfig, tlsCfg.Options)
 	}
 
 	authers = auth_parser.List(cfg.Handler.Auther, cfg.Handler.Authers...)
@@ -246,6 +248,8 @@ func ParseService(cfg *config.ServiceConfig) (service.Service, error) {
 				Direction:       mdutil.GetBool(md, parsing.MDKeyRecorderDirection),
 				TimestampFormat: mdutil.GetString(md, parsing.MDKeyRecorderTimestampFormat),
 				Hexdump:         mdutil.GetBool(md, parsing.MDKeyRecorderHexdump),
+				HTTPBody:        mdutil.GetBool(md, parsing.MDKeyRecorderHTTPBody),
+				MaxBodySize:     mdutil.GetInt(md, parsing.MDKeyRecorderHTTPMaxBodySize),
 			},
 		})
 	}

connector/direct/connector.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -57,6 +58,7 @@ func (c *directConnector) Connect(ctx context.Context, _ net.Conn, network, addr
 		"local":   localAddr,
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/forward/connector.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -38,6 +39,7 @@ func (c *forwardConnector) Connect(ctx context.Context, conn net.Conn, network,
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/http/connector.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-gost/core/connector"
 	"github.com/go-gost/core/logger"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/internal/util/socks"
 	"github.com/go-gost/x/registry"
 )
@@ -48,6 +49,7 @@ func (c *httpConnector) Connect(ctx context.Context, conn net.Conn, network, add
 		"remote":  conn.RemoteAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/http/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/http2/connector.go

@@ -15,6 +15,7 @@ import (
 	"github.com/go-gost/core/connector"
 	"github.com/go-gost/core/logger"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -48,6 +49,7 @@ func (c *http2Connector) Connect(ctx context.Context, conn net.Conn, network, ad
 		"remote":  conn.RemoteAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/http2/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/relay/connector.go

@@ -10,6 +10,7 @@ import (
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
 	"github.com/go-gost/relay"
+	ctxvalue "github.com/go-gost/x/ctx"
 	relay_util "github.com/go-gost/x/internal/util/relay"
 	"github.com/go-gost/x/registry"
 )
@@ -44,6 +45,7 @@ func (c *relayConnector) Connect(ctx context.Context, conn net.Conn, network, ad
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/relay/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

connector/serial/connector.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -38,6 +39,7 @@ func (c *serialConnector) Connect(ctx context.Context, conn net.Conn, network, a
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/sni/connector.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -39,6 +40,7 @@ func (c *sniConnector) Connect(ctx context.Context, conn net.Conn, network, addr
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/sni/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/socks/v4/connector.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
 	"github.com/go-gost/gosocks4"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -45,6 +46,7 @@ func (c *socks4Connector) Connect(ctx context.Context, conn net.Conn, network, a
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/socks/v4/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/socks/v5/connector.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-gost/core/logger"
 	md "github.com/go-gost/core/metadata"
 	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/internal/util/socks"
 	"github.com/go-gost/x/registry"
 )
@@ -97,6 +98,7 @@ func (c *socks5Connector) Connect(ctx context.Context, conn net.Conn, network, a
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/socks/v5/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

connector/ss/connector.go

@@ -10,6 +10,7 @@ import (
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
 	"github.com/go-gost/gosocks5"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/internal/util/ss"
 	"github.com/go-gost/x/registry"
 	"github.com/shadowsocks/go-shadowsocks2/core"
@@ -56,6 +57,7 @@ func (c *ssConnector) Connect(ctx context.Context, conn net.Conn, network, addre
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/ss/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/ss/udp/connector.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/internal/util/relay"
 	"github.com/go-gost/x/internal/util/ss"
 	"github.com/go-gost/x/registry"
@@ -55,6 +56,7 @@ func (c *ssuConnector) Connect(ctx context.Context, conn net.Conn, network, addr
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/ss/udp/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

connector/sshd/connector.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	ssh_util "github.com/go-gost/x/internal/util/ssh"
 	"github.com/go-gost/x/registry"
 )
@@ -40,6 +41,7 @@ func (c *sshdConnector) Connect(ctx context.Context, conn net.Conn, network, add
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/tcp/connector.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -38,6 +39,7 @@ func (c *tcpConnector) Connect(ctx context.Context, conn net.Conn, network, addr
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/tunnel/connector.go

@@ -43,6 +43,7 @@ func (c *tunnelConnector) Connect(ctx context.Context, conn net.Conn, network, a
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

connector/tunnel/metadata.go

@@ -5,9 +5,9 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/relay"
 	"github.com/go-gost/x/internal/util/mux"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/google/uuid"
 )
 
@@ -56,6 +56,9 @@ func (c *tunnelConnector) parseMetadata(md mdata.Metadata) (err error) {
 	if c.md.muxCfg.Version == 0 {
 		c.md.muxCfg.Version = 2
 	}
+	if c.md.muxCfg.MaxStreamBuffer == 0 {
+		c.md.muxCfg.MaxStreamBuffer = 1048576
+	}
 
 	return
 }

connector/unix/connector.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/go-gost/core/connector"
 	md "github.com/go-gost/core/metadata"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/registry"
 )
 
@@ -38,6 +39,7 @@ func (c *unixConnector) Connect(ctx context.Context, conn net.Conn, network, add
 		"local":   conn.LocalAddr().String(),
 		"network": network,
 		"address": address,
+		"sid":     string(ctxvalue.SidFromContext(ctx)),
 	})
 	log.Debugf("connect %s/%s", address, network)
 

ctx/value.go

@@ -1,6 +1,11 @@
 package ctx
 
-import "context"
+import (
+	"bytes"
+	"context"
+
+	"github.com/go-gost/core/logger"
+)
 
 // clientAddrKey saves the client address.
 type clientAddrKey struct{}
@@ -74,3 +79,33 @@ func ClientIDFromContext(ctx context.Context) ClientID {
 	v, _ := ctx.Value(keyClientID).(ClientID)
 	return v
 }
+
+type bufferKey struct{}
+
+var (
+	keyBuffer = &bufferKey{}
+)
+
+func ContextWithBuffer(ctx context.Context, buffer *bytes.Buffer) context.Context {
+	return context.WithValue(ctx, keyBuffer, buffer)
+}
+
+func BufferFromContext(ctx context.Context) *bytes.Buffer {
+	v, _ := ctx.Value(keyBuffer).(*bytes.Buffer)
+	return v
+}
+
+type loggerKey struct{}
+
+var (
+	keyLogger = &loggerKey{}
+)
+
+func ContextWithLogger(ctx context.Context, log logger.Logger) context.Context {
+	return context.WithValue(ctx, keyLogger, log)
+}
+
+func LoggerFromContext(ctx context.Context) logger.Logger {
+	v, _ := ctx.Value(keyLogger).(logger.Logger)
+	return v
+}

dialer/dtls/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/grpc/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/http2/h2/dialer.go

@@ -93,7 +93,7 @@ func (d *h2Dialer) Dial(ctx context.Context, address string, opts ...dialer.Dial
 		if d.h2c {
 			client.Transport = &http2.Transport{
 				AllowHTTP: true,
-				DialTLS: func(network, addr string, cfg *tls.Config) (net.Conn, error) {
+				DialTLSContext: func(ctx context.Context, network, addr string, cfg *tls.Config) (net.Conn, error) {
 					return options.Dialer.Dial(ctx, network, addr)
 				},
 			}
@@ -126,14 +126,11 @@ func (d *h2Dialer) Dial(ctx context.Context, address string, opts ...dialer.Dial
 	}
 	pr, pw := io.Pipe()
 	req := &http.Request{
-		Method:     http.MethodConnect,
-		URL:        &url.URL{Scheme: scheme, Host: host},
-		Header:     d.md.header,
-		ProtoMajor: 2,
-		ProtoMinor: 0,
-		Body:       pr,
-		Host:       host,
-		// ContentLength: -1,
+		Method: http.MethodConnect,
+		URL:    &url.URL{Scheme: scheme, Host: host},
+		Header: d.md.header,
+		Body:   pr,
+		Host:   host,
 	}
 	if req.Header == nil {
 		req.Header = make(http.Header)

dialer/http2/h2/metadata.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/http3/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/http3/wt/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/icmp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/kcp/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	kcp_util "github.com/go-gost/x/internal/util/kcp"
 )
 

dialer/mtcp/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

dialer/mtls/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

dialer/mws/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
 )
 

dialer/obfs/http/metadata.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/obfs/tls/metadata.go

@@ -2,7 +2,7 @@ package tls
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/pht/metadata.go

@@ -4,7 +4,7 @@ import (
 	"strings"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

dialer/quic/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/ssh/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/mitchellh/go-homedir"
 	"github.com/zalando/go-keyring"
 	"golang.org/x/crypto/ssh"

dialer/sshd/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 	"github.com/mitchellh/go-homedir"
 	"github.com/zalando/go-keyring"
 	"golang.org/x/crypto/ssh"

dialer/tls/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

dialer/ws/metadata.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

go.mod

@@ -9,12 +9,12 @@ require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/gin-contrib/cors v1.6.0
 	github.com/gin-gonic/gin v1.9.1
-	github.com/go-gost/core v0.1.3
+	github.com/go-gost/core v0.1.7
 	github.com/go-gost/gosocks4 v0.0.1
 	github.com/go-gost/gosocks5 v0.4.2
 	github.com/go-gost/plugin v0.1.1
 	github.com/go-gost/relay v0.5.0
-	github.com/go-gost/tls-dissector v0.0.2-0.20220408131628-aac992c27451
+	github.com/go-gost/tls-dissector v0.1.1
 	github.com/go-redis/redis/v8 v8.11.5
 	github.com/gobwas/glob v0.2.3
 	github.com/golang/snappy v0.0.4

go.sum

@@ -53,8 +53,8 @@ github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
 github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU=
-github.com/go-gost/core v0.1.3 h1:Azq50of/OEv89/4THFbwNLidXK1fIwsMRVcgQUlvJug=
-github.com/go-gost/core v0.1.3/go.mod h1:WGI43jOka7FAsSAwi/fSMaqxdR+E339ycb4NBGlFr6A=
+github.com/go-gost/core v0.1.7 h1:EP2Ux2SZR1omV6362MfTZG+oZTuaAODGqc0M9c/ZdEI=
+github.com/go-gost/core v0.1.7/go.mod h1:WGI43jOka7FAsSAwi/fSMaqxdR+E339ycb4NBGlFr6A=
 github.com/go-gost/gosocks4 v0.0.1 h1:+k1sec8HlELuQV7rWftIkmy8UijzUt2I6t+iMPlGB2s=
 github.com/go-gost/gosocks4 v0.0.1/go.mod h1:3B6L47HbU/qugDg4JnoFPHgJXE43Inz8Bah1QaN9qCc=
 github.com/go-gost/gosocks5 v0.4.2 h1:IianxHTkACPqCwiOAT3MHoMdSUl+SEPSRu1ikawC1Pc=
@@ -63,8 +63,8 @@ github.com/go-gost/plugin v0.1.1 h1:LNoc/Rqwb3ceGhhxwhpjf1SeeYBGe80MJ9E4lpM3qak=
 github.com/go-gost/plugin v0.1.1/go.mod h1:oN23l+yGDCIP9G3KnDl/I/0zVGOobZUDCB2Z5yYYXts=
 github.com/go-gost/relay v0.5.0 h1:JG1tgy/KWiVXS0ukuVXvbM0kbYuJTWxYpJ5JwzsCf/c=
 github.com/go-gost/relay v0.5.0/go.mod h1:lcX+23LCQ3khIeASBo+tJ/WbwXFO32/N5YN6ucuYTG8=
-github.com/go-gost/tls-dissector v0.0.2-0.20220408131628-aac992c27451 h1:xj8gUZGYO3nb5+6Bjw9+tsFkA9sYynrOvDvvC4uDV2I=
-github.com/go-gost/tls-dissector v0.0.2-0.20220408131628-aac992c27451/go.mod h1:/9QfdewqmHdaE362Hv5nDaSWLx3pCmtD870d6GaquXs=
+github.com/go-gost/tls-dissector v0.1.1 h1:2zUOTPzCQAUQ54Rpy0UEi3JPMQSYsIFSeFeKrzmkCoU=
+github.com/go-gost/tls-dissector v0.1.1/go.mod h1:/9QfdewqmHdaE362Hv5nDaSWLx3pCmtD870d6GaquXs=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=

handler/auto/handler.go

@@ -12,7 +12,7 @@ import (
 	"github.com/go-gost/gosocks4"
 	"github.com/go-gost/gosocks5"
 	ctxvalue "github.com/go-gost/x/ctx"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	"github.com/go-gost/x/registry"
 )
 
@@ -101,7 +101,7 @@ func (h *autoHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler
 		return err
 	}
 
-	conn = netpkg.NewBufferReaderConn(conn, br)
+	conn = xnet.NewReadWriteConn(br, conn, conn)
 	switch b[0] {
 	case gosocks4.Ver4: // socks4
 		if h.socks4Handler != nil {

handler/dns/handler.go

@@ -1,6 +1,7 @@
 package dns
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -15,11 +16,13 @@ import (
 	"github.com/go-gost/core/hosts"
 	"github.com/go-gost/core/logger"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
 	ctxvalue "github.com/go-gost/x/ctx"
 	xhop "github.com/go-gost/x/hop"
 	resolver_util "github.com/go-gost/x/internal/util/resolver"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 	"github.com/go-gost/x/resolver/exchanger"
@@ -138,28 +141,46 @@ func (h *dnsHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 		Network:    conn.LocalAddr().Network(),
 		RemoteAddr: conn.RemoteAddr().String(),
 		LocalAddr:  conn.LocalAddr().String(),
+		Proto:      "dns",
 		Time:       start,
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
 
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
 
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
 		ro.Duration = time.Since(start)
 		if err != nil {
 			ro.Err = err.Error()
 		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
 		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
 			log.Warnf("recorder: %v", err)
 		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 
 	}()
@@ -289,7 +310,10 @@ func (h *dnsHandler) request(ctx context.Context, msg []byte, ro *xrecorder.Hand
 	}
 
 	log.Debugf("exchange message %d: %s", mq.Id, mq.Question[0].String())
-	mr, err := h.exchange(ctx, ex, &mq)
+
+	var buf bytes.Buffer
+	mr, err := h.exchange(ctxvalue.ContextWithBuffer(ctx, &buf), ex, &mq)
+	ro.Route = buf.String()
 	if err != nil {
 		return nil, err
 	}

handler/dns/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/file/handler.go

@@ -9,6 +9,8 @@ import (
 
 	"github.com/go-gost/core/handler"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/recorder"
+	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
 
@@ -17,11 +19,12 @@ func init() {
 }
 
 type fileHandler struct {
-	handler http.Handler
-	server  *http.Server
-	ln      *singleConnListener
-	md      metadata
-	options handler.Options
+	handler  http.Handler
+	server   *http.Server
+	ln       *singleConnListener
+	md       metadata
+	options  handler.Options
+	recorder recorder.RecorderObject
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -45,6 +48,13 @@ func (h *fileHandler) Init(md md.Metadata) (err error) {
 		Handler: http.HandlerFunc(h.handleFunc),
 	}
 
+	for _, ro := range h.options.Recorders {
+		if ro.Record == xrecorder.RecorderServiceHandler {
+			h.recorder = ro
+			break
+		}
+	}
+
 	h.ln = &singleConnListener{
 		conn: make(chan net.Conn),
 		done: make(chan struct{}),
@@ -70,8 +80,54 @@ func (h *fileHandler) Close() error {
 }
 
 func (h *fileHandler) handleFunc(w http.ResponseWriter, r *http.Request) {
+	start := time.Now()
+
+	ro := &xrecorder.HandlerRecorderObject{
+		Service:    h.options.Service,
+		RemoteAddr: r.RemoteAddr,
+		Network:    "tcp",
+		Host:       r.Host,
+		Proto:      "http",
+		HTTP: &xrecorder.HTTPRecorderObject{
+			Host:   r.Host,
+			Method: r.Method,
+			Proto:  r.Proto,
+			Scheme: r.URL.Scheme,
+			URI:    r.RequestURI,
+			Request: xrecorder.HTTPRequestRecorderObject{
+				ContentLength: r.ContentLength,
+				Header:        r.Header,
+			},
+		},
+		Time: start,
+	}
+	ro.ClientIP, _, _ = net.SplitHostPort(r.RemoteAddr)
+
+	log := h.options.Logger.WithFields(map[string]any{
+		"remote": r.RemoteAddr,
+	})
+
+	rw := &responseWriter{ResponseWriter: w, statusCode: http.StatusOK}
+
+	defer func() {
+		ro.Duration = time.Since(start)
+		ro.HTTP.StatusCode = rw.statusCode
+		ro.HTTP.Response = xrecorder.HTTPResponseRecorderObject{
+			ContentLength: rw.contentLength,
+			Header:        rw.Header(),
+		}
+		if err := ro.Record(context.Background(), h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration": time.Since(start),
+		}).Infof("%s %s %d %d", r.Method, r.RequestURI, rw.statusCode, rw.contentLength)
+	}()
+
 	if auther := h.options.Auther; auther != nil {
 		u, p, _ := r.BasicAuth()
+		ro.ClientID = u
 		if _, ok := auther.Authenticate(r.Context(), u, p); !ok {
 			w.Header().Set("WWW-Authenticate", "Basic")
 			w.WriteHeader(http.StatusUnauthorized)
@@ -79,16 +135,7 @@ func (h *fileHandler) handleFunc(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	log := h.options.Logger
-	start := time.Now()
-
-	h.handler.ServeHTTP(w, r)
-
-	log = log.WithFields(map[string]any{
-		"remote":   r.RemoteAddr,
-		"duration": time.Since(start),
-	})
-	log.Infof("%s %s", r.Method, r.RequestURI)
+	h.handler.ServeHTTP(rw, r)
 }
 
 type singleConnListener struct {
@@ -132,3 +179,20 @@ func (l *singleConnListener) send(conn net.Conn) {
 		return
 	}
 }
+
+type responseWriter struct {
+	http.ResponseWriter
+	statusCode    int
+	contentLength int64
+}
+
+func (w *responseWriter) Write(p []byte) (int, error) {
+	n, err := w.ResponseWriter.Write(p)
+	w.contentLength += int64(n)
+	return n, err
+}
+
+func (w *responseWriter) WriteHeader(statusCode int) {
+	w.statusCode = statusCode
+	w.ResponseWriter.WriteHeader(statusCode)
+}

handler/file/metadata.go

@@ -2,7 +2,7 @@ package file
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

handler/forward/local/handler.go

@@ -4,33 +4,24 @@ import (
 	"bufio"
 	"bytes"
 	"context"
-	"crypto/tls"
 	"errors"
 	"fmt"
-	"io"
 	"net"
-	"net/http"
-	"net/http/httputil"
-	"strconv"
-	"strings"
 	"time"
 
-	"github.com/go-gost/core/bypass"
 	"github.com/go-gost/core/chain"
 	"github.com/go-gost/core/handler"
 	"github.com/go-gost/core/hop"
-	"github.com/go-gost/core/logger"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
-	xbypass "github.com/go-gost/x/bypass"
-	"github.com/go-gost/x/config"
 	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
 	xnet "github.com/go-gost/x/internal/net"
-	xhttp "github.com/go-gost/x/internal/net/http"
-	"github.com/go-gost/x/internal/util/forward"
+	"github.com/go-gost/x/internal/util/forwarder"
+	"github.com/go-gost/x/internal/util/sniffing"
 	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
@@ -46,6 +37,7 @@ type forwardHandler struct {
 	md       metadata
 	options  handler.Options
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -71,6 +63,10 @@ func (h *forwardHandler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return
 }
 
@@ -88,29 +84,45 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 		Service:    h.options.Service,
 		RemoteAddr: conn.RemoteAddr().String(),
 		LocalAddr:  conn.LocalAddr().String(),
+		Network:    "tcp",
 		Time:       start,
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
-	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
 
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
-
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
-		if !ro.Time.IsZero() {
-			if err != nil {
-				ro.Err = err.Error()
-			}
-			ro.Duration = time.Since(start)
-			ro.Record(ctx, h.recorder.Recorder)
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
 		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -122,48 +134,71 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 	if _, ok := conn.(net.PacketConn); ok {
 		network = "udp"
 	}
+	ro.Network = network
 
-	var rw io.ReadWriter = conn
-	var host string
-	var protocol string
+	var proto string
 	if network == "tcp" && h.md.sniffing {
 		if h.md.sniffingTimeout > 0 {
 			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
 		}
-		rw, host, protocol, _ = forward.Sniffing(ctx, conn)
-		log.Debugf("sniffing: host=%s, protocol=%s", host, protocol)
+
+		br := bufio.NewReader(conn)
+		proto, _ = sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
 		if h.md.sniffingTimeout > 0 {
 			conn.SetReadDeadline(time.Time{})
 		}
-	}
 
-	if protocol == forward.ProtoHTTP {
-		ro2 := &xrecorder.HandlerRecorderObject{}
-		*ro2 = *ro
-		ro.Time = time.Time{}
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			var buf bytes.Buffer
+			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+			ro.Route = buf.String()
+			return cc, err
+		}
+		sniffer := &forwarder.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
 
-		h.handleHTTP(ctx, xio.NewReadWriteCloser(rw, rw, conn), conn.RemoteAddr(), ro2, log)
-		return nil
-	}
-
-	if _, _, err := net.SplitHostPort(host); err != nil {
-		host = net.JoinHostPort(strings.Trim(host, "[]"), "0")
-	}
-
-	var target *chain.Node
-	if host != "" {
-		target = &chain.Node{
-			Addr: host,
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithHTTPKeepalive(h.md.httpKeepalive),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
 		}
 	}
+
+	target := &chain.Node{}
 	if h.hop != nil {
 		target = h.hop.Select(ctx,
-			hop.HostSelectOption(host),
-			hop.ProtocolSelectOption(protocol),
+			hop.ProtocolSelectOption(proto),
 		)
 	}
 	if target == nil {
-		err := errors.New("target not available")
+		err := errors.New("node not available")
 		log.Error(err)
 		return err
 	}
@@ -184,14 +219,15 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 	ro.Host = addr
 
 	log = log.WithFields(map[string]any{
-		"host": host,
 		"node": target.Name,
 		"dst":  fmt.Sprintf("%s/%s", addr, network),
 	})
 
 	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
 
-	cc, err := h.options.Router.Dial(ctx, network, addr)
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, addr)
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		// TODO: the router itself may be failed due to the failed node in the router,
@@ -201,14 +237,14 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 		}
 		return err
 	}
-	defer cc.Close()
 	if marker := target.Marker(); marker != nil {
 		marker.Reset()
 	}
+	defer cc.Close()
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), target.Addr)
-	xnet.Transport(rw, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), target.Addr)
@@ -216,290 +252,6 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 	return nil
 }
 
-func (h *forwardHandler) handleHTTP(ctx context.Context, rw io.ReadWriteCloser, remoteAddr net.Addr, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
-	br := bufio.NewReader(rw)
-
-	for {
-		var cc net.Conn
-
-		resp := &http.Response{
-			ProtoMajor: 1,
-			ProtoMinor: 1,
-			Header:     http.Header{},
-			StatusCode: http.StatusServiceUnavailable,
-		}
-
-		err = func() error {
-			req, err := http.ReadRequest(br)
-			if err != nil {
-				// log.Errorf("read http request: %v", err)
-				return err
-			}
-
-			if log.IsLevelEnabled(logger.TraceLevel) {
-				dump, _ := httputil.DumpRequest(req, false)
-				log.Trace(string(dump))
-			}
-
-			start := time.Now()
-			ro.Time = start
-			ro.HTTP = &xrecorder.HTTPRecorderObject{
-				Host:   req.Host,
-				Proto:  req.Proto,
-				Scheme: req.URL.Scheme,
-				Method: req.Method,
-				URI:    req.RequestURI,
-				Request: xrecorder.HTTPRequestRecorderObject{
-					ContentLength: req.ContentLength,
-					Header:        req.Header.Clone(),
-				},
-			}
-			if clientIP := xhttp.GetClientIP(req); clientIP != nil {
-				ro.ClientIP = clientIP.String()
-			}
-
-			defer func() {
-				if err != nil {
-					ro.HTTP.StatusCode = resp.StatusCode
-					ro.HTTP.Response.Header = resp.Header
-
-					ro.Duration = time.Since(start)
-					ro.Err = err.Error()
-					ro.Record(ctx, h.recorder.Recorder)
-				}
-			}()
-
-			host := req.Host
-			if _, _, err := net.SplitHostPort(host); err != nil {
-				host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
-			}
-			if bp := h.options.Bypass; bp != nil && bp.Contains(ctx, "tcp", host, bypass.WithPathOption(req.RequestURI)) {
-				log.Debugf("bypass: %s %s", host, req.RequestURI)
-				resp.StatusCode = http.StatusForbidden
-				resp.Write(rw)
-				return xbypass.ErrBypass
-			}
-
-			if addr := getRealClientAddr(req, remoteAddr); addr != remoteAddr {
-				log = log.WithFields(map[string]any{
-					"src": addr.String(),
-				})
-				remoteAddr = addr
-				ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(remoteAddr.String()))
-			}
-
-			target := &chain.Node{
-				Addr: req.Host,
-			}
-			if h.hop != nil {
-				target = h.hop.Select(ctx,
-					hop.HostSelectOption(req.Host),
-					hop.ProtocolSelectOption(forward.ProtoHTTP),
-					hop.PathSelectOption(req.URL.Path),
-				)
-			}
-			if target == nil {
-				log.Warnf("node for %s not found", req.Host)
-				resp.StatusCode = http.StatusBadGateway
-				return resp.Write(rw)
-			}
-
-			ro.Host = target.Addr
-
-			log = log.WithFields(map[string]any{
-				"host": req.Host,
-				"node": target.Name,
-				"dst":  target.Addr,
-			})
-			log.Debugf("find node for host %s -> %s(%s)", req.Host, target.Name, target.Addr)
-
-			var bodyRewrites []chain.HTTPBodyRewriteSettings
-			if httpSettings := target.Options().HTTP; httpSettings != nil {
-				if auther := httpSettings.Auther; auther != nil {
-					username, password, _ := req.BasicAuth()
-					id, ok := auther.Authenticate(ctx, username, password)
-					if !ok {
-						resp.StatusCode = http.StatusUnauthorized
-						resp.Header.Set("WWW-Authenticate", "Basic")
-						log.Warnf("node %s(%s) 401 unauthorized", target.Name, target.Addr)
-						return resp.Write(rw)
-					}
-					ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(id))
-				}
-
-				if httpSettings.Host != "" {
-					req.Host = httpSettings.Host
-				}
-				for k, v := range httpSettings.Header {
-					req.Header.Set(k, v)
-				}
-
-				for _, re := range httpSettings.RewriteURL {
-					if re.Pattern.MatchString(req.URL.Path) {
-						if s := re.Pattern.ReplaceAllString(req.URL.Path, re.Replacement); s != "" {
-							req.URL.Path = s
-							break
-						}
-					}
-				}
-
-				bodyRewrites = httpSettings.RewriteBody
-			}
-
-			cc, err = h.options.Router.Dial(ctx, "tcp", target.Addr)
-			if err != nil {
-				// TODO: the router itself may be failed due to the failed node in the router,
-				// the dead marker may be a wrong operation.
-				if marker := target.Marker(); marker != nil {
-					marker.Mark()
-				}
-				log.Warnf("connect to node %s(%s) failed: %v", target.Name, target.Addr, err)
-				return resp.Write(rw)
-			}
-			if marker := target.Marker(); marker != nil {
-				marker.Reset()
-			}
-
-			log.Debugf("connection to node %s(%s)", target.Name, target.Addr)
-
-			if tlsSettings := target.Options().TLS; tlsSettings != nil {
-				cfg := &tls.Config{
-					ServerName:         tlsSettings.ServerName,
-					InsecureSkipVerify: !tlsSettings.Secure,
-				}
-				tls_util.SetTLSOptions(cfg, &config.TLSOptions{
-					MinVersion:   tlsSettings.Options.MinVersion,
-					MaxVersion:   tlsSettings.Options.MaxVersion,
-					CipherSuites: tlsSettings.Options.CipherSuites,
-				})
-				cc = tls.Client(cc, cfg)
-			}
-
-			if err = req.Write(cc); err != nil {
-				cc.Close()
-				log.Warnf("send request to node %s(%s): %v", target.Name, target.Addr, err)
-				resp.Write(rw)
-				return err
-			}
-
-			if req.Header.Get("Upgrade") == "websocket" {
-				err = xnet.Transport(cc, xio.NewReadWriter(br, rw))
-				if err == nil {
-					err = io.EOF
-				}
-				return err
-			}
-
-			go func() {
-				defer cc.Close()
-
-				var err error
-				var res *http.Response
-
-				defer func() {
-					ro.Duration = time.Since(start)
-					if err != nil {
-						ro.Err = err.Error()
-					}
-					if res != nil && ro.HTTP != nil {
-						ro.HTTP.Response.ContentLength = res.ContentLength
-						ro.HTTP.Response.Header = res.Header
-						ro.HTTP.StatusCode = res.StatusCode
-					}
-					ro.Record(ctx, h.recorder.Recorder)
-				}()
-
-				res, err = http.ReadResponse(bufio.NewReader(cc), req)
-				if err != nil {
-					log.Warnf("read response from node %s(%s): %v", target.Name, target.Addr, err)
-					resp.Write(rw)
-					return
-				}
-				defer res.Body.Close()
-
-				if log.IsLevelEnabled(logger.TraceLevel) {
-					dump, _ := httputil.DumpResponse(res, false)
-					log.Trace(string(dump))
-				}
-
-				if res.Close {
-					defer rw.Close()
-				}
-
-				if err = h.rewriteBody(res, bodyRewrites...); err != nil {
-					rw.Close()
-					log.Errorf("rewrite body: %v", err)
-					return
-				}
-
-				if err = res.Write(rw); err != nil {
-					rw.Close()
-					log.Errorf("write response from node %s(%s): %v", target.Name, target.Addr, err)
-				}
-			}()
-
-			return nil
-		}()
-
-		if err != nil {
-			if cc != nil {
-				cc.Close()
-			}
-			break
-		}
-	}
-
-	return
-}
-
-func (h *forwardHandler) rewriteBody(resp *http.Response, rewrites ...chain.HTTPBodyRewriteSettings) error {
-	if resp == nil || len(rewrites) == 0 || resp.ContentLength <= 0 {
-		return nil
-	}
-
-	if encoding := resp.Header.Get("Content-Encoding"); encoding != "" {
-		return nil
-	}
-
-	body, err := drainBody(resp.Body)
-	if err != nil || body == nil {
-		return err
-	}
-
-	contentType, _, _ := strings.Cut(resp.Header.Get("Content-Type"), ";")
-	for _, rewrite := range rewrites {
-		rewriteType := rewrite.Type
-		if rewriteType == "" {
-			rewriteType = "text/html"
-		}
-		if rewriteType != "*" && !strings.Contains(rewriteType, contentType) {
-			continue
-		}
-
-		body = rewrite.Pattern.ReplaceAll(body, rewrite.Replacement)
-	}
-
-	resp.Body = io.NopCloser(bytes.NewReader(body))
-	resp.ContentLength = int64(len(body))
-
-	return nil
-}
-
-func drainBody(b io.ReadCloser) (body []byte, err error) {
-	if b == nil || b == http.NoBody {
-		// No copying needed. Preserve the magic sentinel meaning of NoBody.
-		return nil, nil
-	}
-	var buf bytes.Buffer
-	if _, err = buf.ReadFrom(b); err != nil {
-		return nil, err
-	}
-	if err = b.Close(); err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
-}
-
 func (h *forwardHandler) checkRateLimit(addr net.Addr) bool {
 	if h.options.RateLimiter == nil {
 		return true
@@ -511,34 +263,3 @@ func (h *forwardHandler) checkRateLimit(addr net.Addr) bool {
 
 	return true
 }
-
-func getRealClientAddr(req *http.Request, raddr net.Addr) net.Addr {
-	if req == nil {
-		return nil
-	}
-	// cloudflare CDN
-	sip := req.Header.Get("CF-Connecting-IP")
-	if sip == "" {
-		ss := strings.Split(req.Header.Get("X-Forwarded-For"), ",")
-		if len(ss) > 0 && ss[0] != "" {
-			sip = ss[0]
-		}
-	}
-	if sip == "" {
-		sip = req.Header.Get("X-Real-Ip")
-	}
-
-	ip := net.ParseIP(sip)
-	if ip == nil {
-		return raddr
-	}
-
-	_, sp, _ := net.SplitHostPort(raddr.String())
-
-	port, _ := strconv.Atoi(sp)
-
-	return &net.TCPAddr{
-		IP:   ip,
-		Port: port,
-	}
-}

handler/forward/local/metadata.go

@@ -1,26 +1,60 @@
 package local
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
-	readTimeout     time.Duration
-	sniffing        bool
-	sniffingTimeout time.Duration
+	readTimeout   time.Duration
+	httpKeepalive bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *forwardHandler) parseMetadata(md mdata.Metadata) (err error) {
-	const (
-		readTimeout = "readTimeout"
-		sniffing    = "sniffing"
-	)
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
 
-	h.md.readTimeout = mdutil.GetDuration(md, readTimeout)
-	h.md.sniffing = mdutil.GetBool(md, sniffing)
+	h.md.httpKeepalive = mdutil.GetBool(md, "http.keepalive")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
 	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return
 }

handler/forward/remote/handler.go

@@ -4,35 +4,26 @@ import (
 	"bufio"
 	"bytes"
 	"context"
-	"crypto/tls"
 	"errors"
 	"fmt"
-	"io"
 	"net"
-	"net/http"
-	"net/http/httputil"
 	"strconv"
-	"strings"
 	"time"
 
-	"github.com/go-gost/core/bypass"
 	"github.com/go-gost/core/chain"
 	"github.com/go-gost/core/handler"
 	"github.com/go-gost/core/hop"
-	"github.com/go-gost/core/logger"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
-	xbypass "github.com/go-gost/x/bypass"
-	"github.com/go-gost/x/config"
 	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
 	xnet "github.com/go-gost/x/internal/net"
-	xhttp "github.com/go-gost/x/internal/net/http"
 	"github.com/go-gost/x/internal/net/proxyproto"
-	"github.com/go-gost/x/internal/util/forward"
+	"github.com/go-gost/x/internal/util/forwarder"
+	"github.com/go-gost/x/internal/util/sniffing"
 	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
@@ -47,6 +38,7 @@ type forwardHandler struct {
 	md       metadata
 	options  handler.Options
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -72,6 +64,10 @@ func (h *forwardHandler) Init(md mdata.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return
 }
 
@@ -89,29 +85,45 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 		Service:    h.options.Service,
 		RemoteAddr: conn.RemoteAddr().String(),
 		LocalAddr:  conn.LocalAddr().String(),
+		Network:    "tcp",
 		Time:       start,
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
-	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
 
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
-
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
-		if !ro.Time.IsZero() {
-			if err != nil {
-				ro.Err = err.Error()
-			}
-			ro.Duration = time.Since(start)
-			ro.Record(ctx, h.recorder.Recorder)
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
 		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -123,50 +135,71 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 	if _, ok := conn.(net.PacketConn); ok {
 		network = "udp"
 	}
+	ro.Network = network
 
-	localAddr := convertAddr(conn.LocalAddr())
-
-	var rw io.ReadWriter = conn
-	var host string
-	var protocol string
+	var proto string
 	if network == "tcp" && h.md.sniffing {
 		if h.md.sniffingTimeout > 0 {
 			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
 		}
-		rw, host, protocol, _ = forward.Sniffing(ctx, conn)
-		log.Debugf("sniffing: host=%s, protocol=%s", host, protocol)
+
+		br := bufio.NewReader(conn)
+		proto, _ = sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
 		if h.md.sniffingTimeout > 0 {
 			conn.SetReadDeadline(time.Time{})
 		}
-	}
-	if protocol == forward.ProtoHTTP {
-		ro2 := &xrecorder.HandlerRecorderObject{}
-		*ro2 = *ro
-		ro.Time = time.Time{}
 
-		h.handleHTTP(ctx, xio.NewReadWriteCloser(rw, rw, conn), conn.RemoteAddr(), localAddr, ro2, log)
-		return nil
-	}
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			var buf bytes.Buffer
+			cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+			ro.Route = buf.String()
+			return cc, err
+		}
+		sniffer := &forwarder.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
 
-	if md, ok := conn.(mdata.Metadatable); ok {
-		if v := mdutil.GetString(md.Metadata(), "host"); v != "" {
-			host = v
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithHTTPKeepalive(h.md.httpKeepalive),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				forwarder.WithDial(dial),
+				forwarder.WithHop(h.hop),
+				forwarder.WithBypass(h.options.Bypass),
+				forwarder.WithRecorderObject(ro),
+				forwarder.WithLog(log),
+			)
 		}
 	}
+
 	var target *chain.Node
-	if host != "" {
-		target = &chain.Node{
-			Addr: host,
-		}
-	}
 	if h.hop != nil {
 		target = h.hop.Select(ctx,
-			hop.HostSelectOption(host),
-			hop.ProtocolSelectOption(protocol),
+			hop.ProtocolSelectOption(proto),
 		)
 	}
 	if target == nil {
-		err := errors.New("target not available")
+		err := errors.New("node not available")
 		log.Error(err)
 		return err
 	}
@@ -183,14 +216,15 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 	ro.Host = target.Addr
 
 	log = log.WithFields(map[string]any{
-		"host": host,
 		"node": target.Name,
 		"dst":  fmt.Sprintf("%s/%s", target.Addr, network),
 	})
 
 	log.Debugf("%s >> %s", conn.RemoteAddr(), target.Addr)
 
-	cc, err := h.options.Router.Dial(ctx, network, target.Addr)
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, target.Addr)
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		// TODO: the router itself may be failed due to the failed node in the router,
@@ -205,11 +239,11 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 		marker.Reset()
 	}
 
-	cc = proxyproto.WrapClientConn(h.md.proxyProtocol, conn.RemoteAddr(), localAddr, cc)
+	cc = proxyproto.WrapClientConn(h.md.proxyProtocol, conn.RemoteAddr(), convertAddr(conn.LocalAddr()), cc)
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), target.Addr)
-	xnet.Transport(rw, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), target.Addr)
@@ -217,286 +251,6 @@ func (h *forwardHandler) Handle(ctx context.Context, conn net.Conn, opts ...hand
 	return nil
 }
 
-func (h *forwardHandler) handleHTTP(ctx context.Context, rw io.ReadWriteCloser, remoteAddr net.Addr, localAddr net.Addr, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
-	br := bufio.NewReader(rw)
-
-	for {
-		var cc net.Conn
-		resp := &http.Response{
-			ProtoMajor: 1,
-			ProtoMinor: 1,
-			Header:     http.Header{},
-			StatusCode: http.StatusServiceUnavailable,
-		}
-
-		err = func() error {
-			req, err := http.ReadRequest(br)
-			if err != nil {
-				// log.Errorf("read http request: %v", err)
-				return err
-			}
-
-			if log.IsLevelEnabled(logger.TraceLevel) {
-				dump, _ := httputil.DumpRequest(req, false)
-				log.Trace(string(dump))
-			}
-
-			start := time.Now()
-			ro.Time = start
-			ro.HTTP = &xrecorder.HTTPRecorderObject{
-				Host:   req.Host,
-				Proto:  req.Proto,
-				Scheme: req.URL.Scheme,
-				Method: req.Method,
-				URI:    req.RequestURI,
-				Request: xrecorder.HTTPRequestRecorderObject{
-					ContentLength: req.ContentLength,
-					Header:        req.Header.Clone(),
-				},
-			}
-			if clientIP := xhttp.GetClientIP(req); clientIP != nil {
-				ro.ClientIP = clientIP.String()
-			}
-
-			defer func() {
-				if err != nil {
-					ro.HTTP.StatusCode = resp.StatusCode
-					ro.HTTP.Response.Header = resp.Header
-
-					ro.Duration = time.Since(start)
-					ro.Err = err.Error()
-					ro.Record(ctx, h.recorder.Recorder)
-				}
-			}()
-
-			host := req.Host
-			if _, _, err := net.SplitHostPort(host); err != nil {
-				host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
-			}
-			if bp := h.options.Bypass; bp != nil && bp.Contains(ctx, "tcp", host, bypass.WithPathOption(req.RequestURI)) {
-				log.Debugf("bypass: %s %s", host, req.RequestURI)
-				resp.StatusCode = http.StatusForbidden
-				resp.Write(rw)
-				return xbypass.ErrBypass
-			}
-
-			if addr := getRealClientAddr(req, remoteAddr); addr != remoteAddr {
-				log = log.WithFields(map[string]any{
-					"src": addr.String(),
-				})
-				remoteAddr = addr
-				ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(remoteAddr.String()))
-			}
-
-			target := &chain.Node{
-				Addr: req.Host,
-			}
-			if h.hop != nil {
-				target = h.hop.Select(ctx,
-					hop.HostSelectOption(req.Host),
-					hop.ProtocolSelectOption(forward.ProtoHTTP),
-					hop.PathSelectOption(req.URL.Path),
-				)
-			}
-			if target == nil {
-				log.Warnf("node for %s not found", req.Host)
-				resp.StatusCode = http.StatusBadGateway
-				return resp.Write(rw)
-			}
-
-			ro.Host = target.Addr
-
-			log = log.WithFields(map[string]any{
-				"host": req.Host,
-				"node": target.Name,
-				"dst":  target.Addr,
-			})
-			log.Debugf("find node for host %s -> %s(%s)", req.Host, target.Name, target.Addr)
-
-			var bodyRewrites []chain.HTTPBodyRewriteSettings
-			if httpSettings := target.Options().HTTP; httpSettings != nil {
-				if auther := httpSettings.Auther; auther != nil {
-					username, password, _ := req.BasicAuth()
-					id, ok := auther.Authenticate(ctx, username, password)
-					if !ok {
-						resp.StatusCode = http.StatusUnauthorized
-						resp.Header.Set("WWW-Authenticate", "Basic")
-						log.Warnf("node %s(%s) 401 unauthorized", target.Name, target.Addr)
-						return resp.Write(rw)
-					}
-					ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(id))
-				}
-				if httpSettings.Host != "" {
-					req.Host = httpSettings.Host
-				}
-				for k, v := range httpSettings.Header {
-					req.Header.Set(k, v)
-				}
-
-				for _, re := range httpSettings.RewriteURL {
-					if re.Pattern.MatchString(req.URL.Path) {
-						if s := re.Pattern.ReplaceAllString(req.URL.Path, re.Replacement); s != "" {
-							req.URL.Path = s
-							break
-						}
-					}
-				}
-
-				bodyRewrites = httpSettings.RewriteBody
-			}
-
-			cc, err = h.options.Router.Dial(ctx, "tcp", target.Addr)
-			if err != nil {
-				// TODO: the router itself may be failed due to the failed node in the router,
-				// the dead marker may be a wrong operation.
-				if marker := target.Marker(); marker != nil {
-					marker.Mark()
-				}
-				log.Warnf("connect to node %s(%s) failed: %v", target.Name, target.Addr, err)
-				return resp.Write(rw)
-			}
-			if marker := target.Marker(); marker != nil {
-				marker.Reset()
-			}
-
-			log.Debugf("new connection to node %s(%s)", target.Name, target.Addr)
-
-			if tlsSettings := target.Options().TLS; tlsSettings != nil {
-				cfg := &tls.Config{
-					ServerName:         tlsSettings.ServerName,
-					InsecureSkipVerify: !tlsSettings.Secure,
-				}
-				tls_util.SetTLSOptions(cfg, &config.TLSOptions{
-					MinVersion:   tlsSettings.Options.MinVersion,
-					MaxVersion:   tlsSettings.Options.MaxVersion,
-					CipherSuites: tlsSettings.Options.CipherSuites,
-				})
-				cc = tls.Client(cc, cfg)
-			}
-
-			cc = proxyproto.WrapClientConn(h.md.proxyProtocol, remoteAddr, localAddr, cc)
-
-			if err = req.Write(cc); err != nil {
-				cc.Close()
-				log.Warnf("send request to node %s(%s): %v", target.Name, target.Addr, err)
-				resp.Write(rw)
-				return err
-			}
-
-			if req.Header.Get("Upgrade") == "websocket" {
-				err := xnet.Transport(cc, xio.NewReadWriter(br, rw))
-				if err == nil {
-					err = io.EOF
-				}
-				return err
-			}
-
-			go func() {
-				defer cc.Close()
-
-				var err error
-				var res *http.Response
-
-				defer func() {
-					ro.Duration = time.Since(start)
-					if err != nil {
-						ro.Err = err.Error()
-					}
-					if res != nil && ro.HTTP != nil {
-						ro.HTTP.Response.ContentLength = res.ContentLength
-						ro.HTTP.Response.Header = res.Header
-						ro.HTTP.StatusCode = res.StatusCode
-					}
-					ro.Record(ctx, h.recorder.Recorder)
-				}()
-
-				res, err = http.ReadResponse(bufio.NewReader(cc), req)
-				if err != nil {
-					log.Warnf("read response from node %s(%s): %v", target.Name, target.Addr, err)
-					resp.Write(rw)
-					return
-				}
-				defer res.Body.Close()
-
-				if log.IsLevelEnabled(logger.TraceLevel) {
-					dump, _ := httputil.DumpResponse(res, false)
-					log.Trace(string(dump))
-				}
-
-				if res.Close {
-					defer rw.Close()
-				}
-
-				if err = h.rewriteBody(res, bodyRewrites...); err != nil {
-					rw.Close()
-					log.Errorf("rewrite body: %v", err)
-					return
-				}
-
-				if err = res.Write(rw); err != nil {
-					rw.Close()
-					log.Errorf("write response from node %s(%s): %v", target.Name, target.Addr, err)
-				}
-			}()
-
-			return nil
-		}()
-
-		if err != nil {
-			if cc != nil {
-				cc.Close()
-			}
-			break
-		}
-	}
-
-	return
-}
-
-func (h *forwardHandler) rewriteBody(resp *http.Response, rewrites ...chain.HTTPBodyRewriteSettings) error {
-	if resp == nil || len(rewrites) == 0 || resp.ContentLength <= 0 {
-		return nil
-	}
-
-	body, err := drainBody(resp.Body)
-	if err != nil || body == nil {
-		return err
-	}
-
-	contentType, _, _ := strings.Cut(resp.Header.Get("Content-Type"), ";")
-	for _, rewrite := range rewrites {
-		rewriteType := rewrite.Type
-		if rewriteType == "" {
-			rewriteType = "text/html"
-		}
-		if rewriteType != "*" && !strings.Contains(rewriteType, contentType) {
-			continue
-		}
-
-		body = rewrite.Pattern.ReplaceAll(body, rewrite.Replacement)
-	}
-
-	resp.Body = io.NopCloser(bytes.NewReader(body))
-	resp.ContentLength = int64(len(body))
-
-	return nil
-}
-
-func drainBody(b io.ReadCloser) (body []byte, err error) {
-	if b == nil || b == http.NoBody {
-		// No copying needed. Preserve the magic sentinel meaning of NoBody.
-		return nil, nil
-	}
-	var buf bytes.Buffer
-	if _, err = buf.ReadFrom(b); err != nil {
-		return nil, err
-	}
-	if err = b.Close(); err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
-}
-
 func (h *forwardHandler) checkRateLimit(addr net.Addr) bool {
 	if h.options.RateLimiter == nil {
 		return true
@@ -532,34 +286,3 @@ func convertAddr(addr net.Addr) net.Addr {
 		}
 	}
 }
-
-func getRealClientAddr(req *http.Request, raddr net.Addr) net.Addr {
-	if req == nil {
-		return nil
-	}
-	// cloudflare CDN
-	sip := req.Header.Get("CF-Connecting-IP")
-	if sip == "" {
-		ss := strings.Split(req.Header.Get("X-Forwarded-For"), ",")
-		if len(ss) > 0 && ss[0] != "" {
-			sip = ss[0]
-		}
-	}
-	if sip == "" {
-		sip = req.Header.Get("X-Real-Ip")
-	}
-
-	ip := net.ParseIP(sip)
-	if ip == nil {
-		return raddr
-	}
-
-	_, sp, _ := net.SplitHostPort(raddr.String())
-
-	port, _ := strconv.Atoi(sp)
-
-	return &net.TCPAddr{
-		IP:   ip,
-		Port: port,
-	}
-}

handler/forward/remote/metadata.go

@@ -1,29 +1,61 @@
 package remote
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
-	readTimeout     time.Duration
-	sniffing        bool
-	sniffingTimeout time.Duration
-	proxyProtocol   int
+	readTimeout   time.Duration
+	proxyProtocol int
+	httpKeepalive bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *forwardHandler) parseMetadata(md mdata.Metadata) (err error) {
-	const (
-		readTimeout   = "readTimeout"
-		sniffing      = "sniffing"
-		proxyProtocol = "proxyProtocol"
-	)
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+	h.md.proxyProtocol = mdutil.GetInt(md, "proxyProtocol")
 
-	h.md.readTimeout = mdutil.GetDuration(md, readTimeout)
-	h.md.sniffing = mdutil.GetBool(md, sniffing)
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
 	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
-	h.md.proxyProtocol = mdutil.GetInt(md, proxyProtocol)
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	h.md.httpKeepalive = mdutil.GetBool(md, "http.keepalive")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
 	return
 }

handler/http/handler.go

@@ -2,7 +2,9 @@ package http
 
 import (
 	"bufio"
+	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/base64"
 	"encoding/binary"
 	"errors"
@@ -27,16 +29,21 @@ import (
 	"github.com/go-gost/core/recorder"
 	xbypass "github.com/go-gost/x/bypass"
 	ctxvalue "github.com/go-gost/x/ctx"
+	ctx_internal "github.com/go-gost/x/internal/ctx"
 	xio "github.com/go-gost/x/internal/io"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	xhttp "github.com/go-gost/x/internal/net/http"
 	limiter_util "github.com/go-gost/x/internal/util/limiter"
+	"github.com/go-gost/x/internal/util/sniffing"
 	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
+	ws_util "github.com/go-gost/x/internal/util/ws"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
 	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
 	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
+	"golang.org/x/net/http/httpguts"
 )
 
 func init() {
@@ -44,12 +51,14 @@ func init() {
 }
 
 type httpHandler struct {
-	md       metadata
-	options  handler.Options
-	stats    *stats_util.HandlerStats
-	limiter  traffic.TrafficLimiter
-	cancel   context.CancelFunc
-	recorder recorder.RecorderObject
+	md        metadata
+	options   handler.Options
+	stats     *stats_util.HandlerStats
+	limiter   traffic.TrafficLimiter
+	cancel    context.CancelFunc
+	recorder  recorder.RecorderObject
+	certPool  tls_util.CertPool
+	transport http.RoundTripper
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -87,6 +96,17 @@ func (h *httpHandler) Init(md md.Metadata) error {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
+	h.transport = &http.Transport{
+		DialContext:           h.dial,
+		IdleConnTimeout:       30 * time.Second,
+		ResponseHeaderTimeout: h.md.readTimeout,
+		DisableKeepAlives:     !h.md.keepalive,
+	}
+
 	return nil
 }
 
@@ -99,28 +119,45 @@ func (h *httpHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler
 		Service:    h.options.Service,
 		RemoteAddr: conn.RemoteAddr().String(),
 		LocalAddr:  conn.LocalAddr().String(),
+		Proto:      "http",
 		Time:       start,
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
-	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
 
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
-		if !ro.Time.IsZero() {
-			if err != nil {
-				ro.Err = err.Error()
-			}
-			ro.Duration = time.Since(start)
-			ro.Record(ctx, h.recorder.Recorder)
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Error("record: %v", err)
 		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -128,7 +165,8 @@ func (h *httpHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler
 		return rate_limiter.ErrRateLimit
 	}
 
-	req, err := http.ReadRequest(bufio.NewReader(conn))
+	br := bufio.NewReader(conn)
+	req, err := http.ReadRequest(br)
 	if err != nil {
 		log.Error(err)
 		return err
@@ -139,6 +177,8 @@ func (h *httpHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler
 		ro.ClientIP = clientIP.String()
 	}
 
+	conn = xnet.NewReadWriteConn(br, conn, conn)
+
 	return h.handleRequest(ctx, conn, req, ro, log)
 }
 
@@ -173,14 +213,15 @@ func (h *httpHandler) handleRequest(ctx context.Context, conn net.Conn, req *htt
 		}
 	}
 
-	ro.Host = req.Host
 	addr := req.Host
 	if _, port, _ := net.SplitHostPort(addr); port == "" {
 		addr = net.JoinHostPort(strings.Trim(addr, "[]"), "80")
 	}
+	ro.Host = addr
 
 	fields := map[string]any{
-		"dst": addr,
+		"dst":  addr,
+		"host": addr,
 	}
 
 	if u, _, _ := h.basicProxyAuth(req.Header.Get("Proxy-Authorization")); u != "" {
@@ -224,28 +265,6 @@ func (h *httpHandler) handleRequest(ctx context.Context, conn net.Conn, req *htt
 		ro.HTTP.Response.Header = resp.Header
 	}()
 
-	clientID, ok := h.authenticate(ctx, conn, req, resp, log)
-	if !ok {
-		return errors.New("authenication failed")
-	}
-	ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
-
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, network, addr) {
-		resp.StatusCode = http.StatusForbidden
-
-		if log.IsLevelEnabled(logger.TraceLevel) {
-			dump, _ := httputil.DumpResponse(resp, false)
-			log.Trace(string(dump))
-		}
-		log.Debug("bypass: ", addr)
-		resp.Write(conn)
-		return xbypass.ErrBypass
-	}
-
-	if network == "udp" {
-		return h.handleUDP(ctx, conn, log)
-	}
-
 	if req.Method == "PRI" ||
 		(req.Method != http.MethodConnect && req.URL.Scheme != "http") {
 		resp.StatusCode = http.StatusBadRequest
@@ -258,12 +277,60 @@ func (h *httpHandler) handleRequest(ctx context.Context, conn net.Conn, req *htt
 		return resp.Write(conn)
 	}
 
-	switch h.md.hash {
-	case "host":
-		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
+	clientID, ok := h.authenticate(ctx, conn, req, resp, log)
+	if !ok {
+		return errors.New("authentication failed")
+	}
+	ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
+
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, network, addr) {
+		resp.StatusCode = http.StatusForbidden
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpResponse(resp, false)
+			log.Trace(string(dump))
+		}
+		log.Debug("bypass: ", addr)
+		resp.Write(conn)
+		return xbypass.ErrBypass
 	}
 
-	cc, err := h.options.Router.Dial(ctx, network, addr)
+	if network == "udp" {
+		return h.handleUDP(ctx, conn, ro, log)
+	}
+
+	{
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			clientID,
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(addr),
+			limiter.ClientOption(clientID),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(clientID)
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if req.Method != http.MethodConnect {
+		return h.handleProxy(ctx, conn, req, ro, log)
+	}
+
+	ctx = ctx_internal.ContextWithRecorderObject(ctx, ro)
+	ctx = ctxvalue.ContextWithLogger(ctx, log)
+	cc, err := h.dial(ctx, "tcp", addr)
+
 	if err != nil {
 		resp.StatusCode = http.StatusServiceUnavailable
 
@@ -276,33 +343,6 @@ func (h *httpHandler) handleRequest(ctx context.Context, conn net.Conn, req *htt
 	}
 	defer cc.Close()
 
-	rw := traffic_wrapper.WrapReadWriter(
-		h.limiter,
-		conn,
-		clientID,
-		limiter.ScopeOption(limiter.ScopeClient),
-		limiter.ServiceOption(h.options.Service),
-		limiter.NetworkOption(network),
-		limiter.AddrOption(addr),
-		limiter.ClientOption(clientID),
-		limiter.SrcOption(conn.RemoteAddr().String()),
-	)
-	if h.options.Observer != nil {
-		pstats := h.stats.Stats(clientID)
-		pstats.Add(stats.KindTotalConns, 1)
-		pstats.Add(stats.KindCurrentConns, 1)
-		defer pstats.Add(stats.KindCurrentConns, -1)
-		rw = stats_wrapper.WrapReadWriter(rw, pstats)
-	}
-
-	if req.Method != http.MethodConnect {
-		ro2 := &xrecorder.HandlerRecorderObject{}
-		*ro2 = *ro
-		ro.Time = time.Time{}
-
-		return h.handleProxy(ctx, xio.NewReadWriteCloser(rw, rw, conn), cc, req, ro2, log)
-	}
-
 	resp.StatusCode = http.StatusOK
 	resp.Status = "200 Connection established"
 
@@ -310,14 +350,65 @@ func (h *httpHandler) handleRequest(ctx context.Context, conn net.Conn, req *htt
 		dump, _ := httputil.DumpResponse(resp, false)
 		log.Trace(string(dump))
 	}
-	if err = resp.Write(rw); err != nil {
+	if err = resp.Write(conn); err != nil {
 		log.Error(err)
 		return err
 	}
 
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
 	start := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), addr)
-	netpkg.Transport(rw, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(start),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), addr)
@@ -325,119 +416,21 @@ func (h *httpHandler) handleRequest(ctx context.Context, conn net.Conn, req *htt
 	return nil
 }
 
-func (h *httpHandler) handleProxy(ctx context.Context, rw io.ReadWriteCloser, cc io.ReadWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
-	roundTrip := func(req *http.Request) error {
-		if req == nil {
-			return nil
-		}
+func (h *httpHandler) handleProxy(ctx context.Context, conn net.Conn, req *http.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
 
-		resp := &http.Response{
-			ProtoMajor: req.ProtoMajor,
-			ProtoMinor: req.ProtoMinor,
-			Header:     http.Header{},
-			StatusCode: http.StatusServiceUnavailable,
-		}
+	ro.Time = time.Time{}
 
-		start := time.Now()
-		ro.Time = start
-
-		if ro.HTTP != nil {
-			ro.HTTP = &xrecorder.HTTPRecorderObject{
-				Host:       req.Host,
-				Proto:      req.Proto,
-				Scheme:     req.URL.Scheme,
-				Method:     req.Method,
-				URI:        req.RequestURI,
-				StatusCode: resp.StatusCode,
-				Request: xrecorder.HTTPRequestRecorderObject{
-					ContentLength: req.ContentLength,
-					Header:        req.Header.Clone(),
-				},
-			}
-		}
-
-		// HTTP/1.0
-		if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
-			if strings.ToLower(req.Header.Get("Connection")) == "keep-alive" {
-				req.Header.Del("Connection")
-			} else {
-				req.Header.Set("Connection", "close")
-			}
-		}
-
-		req.Header.Del("Proxy-Authorization")
-		req.Header.Del("Proxy-Connection")
-		req.Header.Del("Gost-Target")
-		req.Header.Del("X-Gost-Target")
-
-		if err = req.Write(cc); err != nil {
-			resp.Write(rw)
-
-			ro.Duration = time.Since(start)
-			ro.Err = err.Error()
-			ro.Record(ctx, h.recorder.Recorder)
-
-			return err
-		}
-
-		go func() {
-			var err error
-			var res *http.Response
-
-			defer func() {
-				ro.Duration = time.Since(start)
-				if err != nil {
-					ro.Err = err.Error()
-				}
-				if res != nil && ro.HTTP != nil {
-					ro.HTTP.Response.ContentLength = res.ContentLength
-					ro.HTTP.Response.Header = res.Header
-					ro.HTTP.StatusCode = res.StatusCode
-				}
-				ro.Record(ctx, h.recorder.Recorder)
-			}()
-
-			res, err = http.ReadResponse(bufio.NewReader(cc), req)
-			if err != nil {
-				h.options.Logger.Errorf("read response: %v", err)
-				resp.Write(rw)
-				return
-			}
-			defer res.Body.Close()
-
-			if log.IsLevelEnabled(logger.TraceLevel) {
-				dump, _ := httputil.DumpResponse(res, false)
-				log.Trace(string(dump))
-			}
-
-			if res.Close {
-				defer rw.Close()
-			}
-
-			// HTTP/1.0
-			if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
-				if !res.Close {
-					res.Header.Set("Connection", "keep-alive")
-				}
-				res.ProtoMajor = req.ProtoMajor
-				res.ProtoMinor = req.ProtoMinor
-			}
-
-			if err = res.Write(rw); err != nil {
-				rw.Close()
-				log.Errorf("write response: %v", err)
-			}
-		}()
-
-		return nil
-	}
-
-	if err = roundTrip(req); err != nil {
+	if err := h.proxyRoundTrip(ctx, conn, req, ro, &pStats, log); err != nil {
 		return err
 	}
 
+	br := bufio.NewReader(conn)
 	for {
-		req, err := http.ReadRequest(bufio.NewReader(rw))
+		pStats.Reset()
+
+		req, err := http.ReadRequest(br)
 		if err != nil {
 			if errors.Is(err, io.EOF) || errors.Is(err, net.ErrClosed) {
 				return nil
@@ -450,12 +443,376 @@ func (h *httpHandler) handleProxy(ctx context.Context, rw io.ReadWriteCloser, cc
 			log.Trace(string(dump))
 		}
 
-		if err = roundTrip(req); err != nil {
+		if err := h.proxyRoundTrip(ctx, xio.NewReadWriter(br, conn), req, ro, &pStats, log); err != nil {
 			return err
 		}
 	}
 }
 
+func (h *httpHandler) proxyRoundTrip(ctx context.Context, rw io.ReadWriter, req *http.Request, ro *xrecorder.HandlerRecorderObject, pStats *stats.Stats, log logger.Logger) (err error) {
+	ro2 := &xrecorder.HandlerRecorderObject{}
+	*ro2 = *ro
+	ro = ro2
+
+	host := req.Host
+	if _, port, _ := net.SplitHostPort(host); port == "" {
+		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
+	}
+	ro.Host = host
+	ro.Time = time.Now()
+
+	log = log.WithFields(map[string]any{
+		"host": host,
+	})
+
+	log.Infof("%s <-> %s", ro.RemoteAddr, req.Host)
+	defer func() {
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(ro.Time)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
+
+		log.WithFields(map[string]any{
+			"duration":    time.Since(ro.Time),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
+		}).Infof("%s >-< %s", ro.RemoteAddr, req.Host)
+	}()
+
+	ro.HTTP = &xrecorder.HTTPRecorderObject{
+		Host:   req.Host,
+		Proto:  req.Proto,
+		Scheme: req.URL.Scheme,
+		Method: req.Method,
+		URI:    req.RequestURI,
+		Request: xrecorder.HTTPRequestRecorderObject{
+			ContentLength: req.ContentLength,
+			Header:        req.Header.Clone(),
+		},
+	}
+	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
+		ro.ClientIP = clientIP.String()
+	}
+
+	clientAddr := ro.RemoteAddr
+	if ro.ClientIP != "" {
+		if _, port, _ := net.SplitHostPort(ro.RemoteAddr); port != "" {
+			clientAddr = net.JoinHostPort(ro.ClientIP, port)
+		}
+	}
+
+	// HTTP/1.0
+	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
+		if strings.ToLower(req.Header.Get("Connection")) == "keep-alive" {
+			req.Header.Del("Connection")
+		} else {
+			req.Header.Set("Connection", "close")
+		}
+	}
+
+	req.Header.Del("Proxy-Authorization")
+	req.Header.Del("Proxy-Connection")
+	req.Header.Del("Gost-Target")
+	req.Header.Del("X-Gost-Target")
+
+	res := &http.Response{
+		ProtoMajor: req.ProtoMajor,
+		ProtoMinor: req.ProtoMinor,
+		Header:     http.Header{},
+		StatusCode: http.StatusServiceUnavailable,
+	}
+	ro.HTTP.StatusCode = res.StatusCode
+
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, "tcp", host) {
+		res.StatusCode = http.StatusForbidden
+
+		if log.IsLevelEnabled(logger.TraceLevel) {
+			dump, _ := httputil.DumpResponse(res, false)
+			log.Trace(string(dump))
+		}
+		log.Debug("bypass: ", host)
+		res.Write(rw)
+		return xbypass.ErrBypass
+	}
+
+	var reqBody *xhttp.Body
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		if req.Body != nil {
+			bodySize := opts.MaxBodySize
+			if bodySize <= 0 {
+				bodySize = sniffing.DefaultBodySize
+			}
+			if bodySize > sniffing.MaxBodySize {
+				bodySize = sniffing.MaxBodySize
+			}
+			reqBody = xhttp.NewBody(req.Body, bodySize)
+			req.Body = reqBody
+		}
+	}
+
+	ctx = ctxvalue.ContextWithClientAddr(ctx, ctxvalue.ClientAddr(clientAddr))
+	ctx = ctx_internal.ContextWithRecorderObject(ctx, ro)
+	ctx = ctxvalue.ContextWithLogger(ctx, log)
+
+	resp, err := h.transport.RoundTrip(req.WithContext(ctx))
+	if err != nil {
+		res.Write(rw)
+		return
+	}
+	defer resp.Body.Close()
+
+	if reqBody != nil {
+		ro.HTTP.Request.Body = reqBody.Content()
+		ro.HTTP.Request.ContentLength = reqBody.Length()
+	}
+
+	ro.HTTP.StatusCode = resp.StatusCode
+	ro.HTTP.Response.Header = resp.Header.Clone()
+	ro.HTTP.Response.ContentLength = resp.ContentLength
+
+	if log.IsLevelEnabled(logger.TraceLevel) {
+		dump, _ := httputil.DumpResponse(resp, false)
+		log.Trace(string(dump))
+	}
+
+	// HTTP/1.0
+	if req.ProtoMajor == 1 && req.ProtoMinor == 0 {
+		if !resp.Close {
+			resp.Header.Set("Connection", "keep-alive")
+		}
+		resp.ProtoMajor = req.ProtoMajor
+		resp.ProtoMinor = req.ProtoMinor
+	}
+
+	if resp.StatusCode == http.StatusSwitchingProtocols {
+		return h.handleUpgradeResponse(ctx, rw, req, resp, ro, log)
+	}
+
+	var respBody *xhttp.Body
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		bodySize := opts.MaxBodySize
+		if bodySize <= 0 {
+			bodySize = sniffing.DefaultBodySize
+		}
+		if bodySize > sniffing.MaxBodySize {
+			bodySize = sniffing.MaxBodySize
+		}
+		respBody = xhttp.NewBody(resp.Body, bodySize)
+		resp.Body = respBody
+	}
+
+	if err = resp.Write(rw); err != nil {
+		return fmt.Errorf("write response: %v", err)
+	}
+
+	if respBody != nil {
+		ro.HTTP.Response.Body = respBody.Content()
+		ro.HTTP.Response.ContentLength = respBody.Length()
+	}
+
+	return
+}
+
+func (h *httpHandler) dial(ctx context.Context, network, addr string) (conn net.Conn, err error) {
+	switch h.md.hash {
+	case "host":
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
+	}
+
+	if log := ctxvalue.LoggerFromContext(ctx); log != nil {
+		log.Debugf("dial: new connection to host %s", addr)
+	}
+
+	var buf bytes.Buffer
+	conn, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, addr)
+	if ro := ctx_internal.RecorderObjectFromContext(ctx); ro != nil {
+		ro.Route = buf.String()
+	}
+
+	return
+}
+
+func upgradeType(h http.Header) string {
+	if !httpguts.HeaderValuesContainsToken(h["Connection"], "Upgrade") {
+		return ""
+	}
+	return h.Get("Upgrade")
+}
+
+func (h *httpHandler) handleUpgradeResponse(ctx context.Context, rw io.ReadWriter, req *http.Request, res *http.Response, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	reqUpType := upgradeType(req.Header)
+	resUpType := upgradeType(res.Header)
+	if !strings.EqualFold(reqUpType, resUpType) {
+		return fmt.Errorf("backend tried to switch protocol %q when %q was requested", resUpType, reqUpType)
+	}
+
+	backConn, ok := res.Body.(io.ReadWriteCloser)
+	if !ok {
+		return fmt.Errorf("internal error: 101 switching protocols response with non-writable body")
+	}
+
+	res.Body = nil
+	if err := res.Write(rw); err != nil {
+		return fmt.Errorf("response write: %v", err)
+	}
+
+	if reqUpType == "websocket" && h.md.sniffingWebsocket {
+		return h.sniffingWebsocketFrame(ctx, rw, backConn, ro, log)
+	}
+
+	return xnet.Transport(rw, backConn)
+}
+
+func (h *httpHandler) sniffingWebsocketFrame(ctx context.Context, rw, cc io.ReadWriter, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
+	errc := make(chan error, 1)
+
+	sampleRate := h.md.sniffingWebsocketSampleRate
+	if sampleRate == 0 {
+		sampleRate = sniffing.DefaultSampleRate
+	}
+	d := time.Duration(1 / sampleRate * 1e9)
+
+	go func() {
+		ro2 := &xrecorder.HandlerRecorderObject{}
+		*ro2 = *ro
+		ro = ro2
+
+		ticker := &time.Ticker{}
+		if d > 0 {
+			ticker = time.NewTicker(d)
+			defer ticker.Stop()
+		} else {
+			tc := make(chan time.Time)
+			close(tc)
+			ticker.C = tc
+		}
+
+		buf := &bytes.Buffer{}
+		for {
+			start := time.Now()
+
+			err := h.copyWebsocketFrame(cc, rw, buf, "client", ro)
+			select {
+			case <-ticker.C:
+				if err != nil {
+					ro.Err = err.Error()
+				}
+				ro.Duration = time.Since(start)
+				ro.Time = time.Now()
+				if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+					log.Errorf("record: %v", err)
+				}
+			default:
+			}
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	go func() {
+		ro2 := &xrecorder.HandlerRecorderObject{}
+		*ro2 = *ro
+		ro = ro2
+
+		ticker := &time.Ticker{}
+		if d > 0 {
+			ticker = time.NewTicker(d)
+			defer ticker.Stop()
+		} else {
+			tc := make(chan time.Time)
+			close(tc)
+			ticker.C = tc
+		}
+
+		buf := &bytes.Buffer{}
+		for {
+			start := time.Now()
+
+			err := h.copyWebsocketFrame(rw, cc, buf, "server", ro)
+			select {
+			case <-ticker.C:
+				if err != nil {
+					ro.Err = err.Error()
+				}
+				ro.Duration = time.Since(start)
+				ro.Time = time.Now()
+				if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+					log.Errorf("record: %v", err)
+				}
+			default:
+			}
+
+			if err != nil {
+				errc <- err
+				return
+			}
+		}
+	}()
+
+	<-errc
+	return nil
+}
+
+func (h *httpHandler) copyWebsocketFrame(w io.Writer, r io.Reader, buf *bytes.Buffer, from string, ro *xrecorder.HandlerRecorderObject) (err error) {
+	fr := ws_util.Frame{}
+	if _, err = fr.ReadFrom(r); err != nil {
+		return err
+	}
+
+	ws := &xrecorder.WebsocketRecorderObject{
+		From:    from,
+		Fin:     fr.Header.Fin,
+		Rsv1:    fr.Header.Rsv1,
+		Rsv2:    fr.Header.Rsv2,
+		Rsv3:    fr.Header.Rsv3,
+		OpCode:  int(fr.Header.OpCode),
+		Masked:  fr.Header.Masked,
+		MaskKey: fr.Header.MaskKey,
+		Length:  fr.Header.PayloadLength,
+	}
+	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
+		bodySize := opts.MaxBodySize
+		if bodySize <= 0 {
+			bodySize = sniffing.DefaultBodySize
+		}
+		if bodySize > sniffing.MaxBodySize {
+			bodySize = sniffing.MaxBodySize
+		}
+
+		buf.Reset()
+		if _, err := io.Copy(buf, io.LimitReader(fr.Data, int64(bodySize))); err != nil {
+			return err
+		}
+		ws.Payload = buf.Bytes()
+	}
+
+	ro.Websocket = ws
+	length := uint64(fr.Header.Length()) + uint64(fr.Header.PayloadLength)
+	if from == "client" {
+		ro.InputBytes = length
+		ro.OutputBytes = 0
+	} else {
+		ro.InputBytes = 0
+		ro.OutputBytes = length
+	}
+
+	fr.Data = io.MultiReader(bytes.NewReader(buf.Bytes()), fr.Data)
+	if _, err := fr.WriteTo(w); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (h *httpHandler) decodeServerName(s string) (string, error) {
 	b, err := base64.RawURLEncoding.DecodeString(s)
 	if err != nil {
@@ -533,7 +890,7 @@ func (h *httpHandler) authenticate(ctx context.Context, conn net.Conn, req *http
 			defer cc.Close()
 
 			req.Write(cc)
-			netpkg.Transport(conn, cc)
+			xnet.Transport(conn, cc)
 			return
 		case "file":
 			f, _ := os.Open(pr.Value)

handler/http/metadata.go

@@ -1,12 +1,17 @@
 package http
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"net/http"
 	"strings"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 const (
@@ -15,6 +20,8 @@ const (
 )
 
 type metadata struct {
+	readTimeout     time.Duration
+	keepalive       bool
 	probeResistance *probeResistance
 	enableUDP       bool
 	header          http.Header
@@ -22,9 +29,24 @@ type metadata struct {
 	authBasicRealm  string
 	observePeriod   time.Duration
 	proxyAgent      string
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *httpHandler) parseMetadata(md mdata.Metadata) error {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
 	if m := mdutil.GetStringMapString(md, "http.header", "header"); len(m) > 0 {
 		hd := http.Header{}
 		for k, v := range m {
@@ -33,6 +55,11 @@ func (h *httpHandler) parseMetadata(md mdata.Metadata) error {
 		h.md.header = hd
 	}
 
+	h.md.keepalive = true
+	if mdutil.IsExists(md, "http.keepalive", "keepalive") {
+		h.md.keepalive = mdutil.GetBool(md, "http.keepalive", "keepalive")
+	}
+
 	if pr := mdutil.GetString(md, "probeResist", "probe_resist"); pr != "" {
 		if ss := strings.SplitN(pr, ":", 2); len(ss) == 2 {
 			h.md.probeResistance = &probeResistance{
@@ -53,6 +80,27 @@ func (h *httpHandler) parseMetadata(md mdata.Metadata) error {
 		h.md.proxyAgent = defaultProxyAgent
 	}
 
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return nil
 }
 

handler/http/udp.go

@@ -1,6 +1,7 @@
 package http
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"net"
@@ -9,11 +10,13 @@ import (
 	"time"
 
 	"github.com/go-gost/core/logger"
+	ctxvalue "github.com/go-gost/x/ctx"
 	"github.com/go-gost/x/internal/net/udp"
 	"github.com/go-gost/x/internal/util/socks"
+	xrecorder "github.com/go-gost/x/recorder"
 )
 
-func (h *httpHandler) handleUDP(ctx context.Context, conn net.Conn, log logger.Logger) error {
+func (h *httpHandler) handleUDP(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
 	log = log.WithFields(map[string]any{
 		"cmd": "udp",
 	})
@@ -51,7 +54,9 @@ func (h *httpHandler) handleUDP(ctx context.Context, conn net.Conn, log logger.L
 	}
 
 	// obtain a udp connection
-	c, err := h.options.Router.Dial(ctx, "udp", "") // UDP association
+	var buf bytes.Buffer
+	c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		return err

handler/http2/handler.go

@@ -28,7 +28,7 @@ import (
 	xbypass "github.com/go-gost/x/bypass"
 	ctxvalue "github.com/go-gost/x/ctx"
 	xio "github.com/go-gost/x/internal/io"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	xhttp "github.com/go-gost/x/internal/net/http"
 	limiter_util "github.com/go-gost/x/internal/util/limiter"
 	stats_util "github.com/go-gost/x/internal/util/stats"
@@ -171,14 +171,15 @@ func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 		ro.ClientIP = clientIP.String()
 	}
 
-	ro.Host = req.Host
-	addr := req.Host
-	if _, port, _ := net.SplitHostPort(addr); port == "" {
-		addr = net.JoinHostPort(strings.Trim(addr, "[]"), "80")
+	host := req.Host
+	if _, port, _ := net.SplitHostPort(host); port == "" {
+		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
 	}
+	ro.Host = host
 
 	fields := map[string]any{
-		"dst": addr,
+		"dst":  host,
+		"host": host,
 	}
 	if u, _, _ := h.basicProxyAuth(req.Header.Get("Proxy-Authorization")); u != "" {
 		fields["user"] = u
@@ -190,7 +191,7 @@ func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 		dump, _ := httputil.DumpRequest(req, false)
 		log.Trace(string(dump))
 	}
-	log.Debugf("%s >> %s", req.RemoteAddr, addr)
+	log.Debugf("%s >> %s", req.RemoteAddr, host)
 
 	for k := range h.md.header {
 		w.Header().Set(k, h.md.header.Get(k))
@@ -221,14 +222,14 @@ func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 
 	clientID, ok := h.authenticate(ctx, w, req, resp, log)
 	if !ok {
-		return errors.New("authenication failed")
+		return errors.New("authentication failed")
 	}
 	ctx = ctxvalue.ContextWithClientID(ctx, ctxvalue.ClientID(clientID))
 
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", addr) {
+	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", host) {
 		resp.StatusCode = http.StatusForbidden
 		w.WriteHeader(resp.StatusCode)
-		log.Debug("bypass: ", addr)
+		log.Debug("bypass: ", host)
 		return xbypass.ErrBypass
 	}
 
@@ -240,10 +241,12 @@ func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 
 	switch h.md.hash {
 	case "host":
-		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
+		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: host})
 	}
 
-	cc, err := h.options.Router.Dial(ctx, "tcp", addr)
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", host)
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		resp.StatusCode = http.StatusServiceUnavailable
@@ -272,11 +275,11 @@ func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 			defer conn.Close()
 
 			start := time.Now()
-			log.Infof("%s <-> %s", conn.RemoteAddr(), addr)
-			netpkg.Transport(conn, cc)
+			log.Infof("%s <-> %s", conn.RemoteAddr(), host)
+			xnet.Transport(conn, cc)
 			log.WithFields(map[string]any{
 				"duration": time.Since(start),
-			}).Infof("%s >-< %s", conn.RemoteAddr(), addr)
+			}).Infof("%s >-< %s", conn.RemoteAddr(), host)
 
 			return nil
 		}
@@ -288,7 +291,7 @@ func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 			limiter.ScopeOption(limiter.ScopeClient),
 			limiter.ServiceOption(h.options.Service),
 			limiter.NetworkOption("tcp"),
-			limiter.AddrOption(addr),
+			limiter.AddrOption(host),
 			limiter.ClientOption(clientID),
 			limiter.SrcOption(req.RemoteAddr),
 		)
@@ -301,11 +304,11 @@ func (h *http2Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 		}
 
 		start := time.Now()
-		log.Infof("%s <-> %s", req.RemoteAddr, addr)
-		netpkg.Transport(rw, cc)
+		log.Infof("%s <-> %s", req.RemoteAddr, host)
+		xnet.Transport(rw, cc)
 		log.WithFields(map[string]any{
 			"duration": time.Since(start),
-		}).Infof("%s >-< %s", req.RemoteAddr, addr)
+		}).Infof("%s >-< %s", req.RemoteAddr, host)
 		return nil
 	}
 

handler/http2/metadata.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/http3/handler.go

@@ -124,7 +124,8 @@ func (h *http3Handler) roundTrip(ctx context.Context, w http.ResponseWriter, req
 	}
 
 	log = log.WithFields(map[string]any{
-		"dst": fmt.Sprintf("%s/%s", target.Addr, "tcp"),
+		"dst":  fmt.Sprintf("%s/%s", target.Addr, "tcp"),
+		"host": target.Addr,
 	})
 
 	log.Debugf("%s >> %s", req.RemoteAddr, addr)

handler/http3/metadata.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 type metadata struct {

handler/metrics/metadata.go

@@ -2,7 +2,7 @@ package file
 
 import (
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/redirect/tcp/handler.go

@@ -5,27 +5,22 @@ import (
 	"bytes"
 	"context"
 	"crypto/tls"
-	"encoding/binary"
 	"fmt"
-	"io"
 	"net"
-	"net/http"
-	"net/http/httputil"
 	"strings"
 	"time"
 
-	"github.com/go-gost/core/bypass"
 	"github.com/go-gost/core/handler"
-	"github.com/go-gost/core/logger"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
-	dissector "github.com/go-gost/tls-dissector"
 	xbypass "github.com/go-gost/x/bypass"
 	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
-	netpkg "github.com/go-gost/x/internal/net"
-	xhttp "github.com/go-gost/x/internal/net/http"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
@@ -40,6 +35,7 @@ type redirectHandler struct {
 	md       metadata
 	options  handler.Options
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -65,6 +61,10 @@ func (h *redirectHandler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return
 }
 
@@ -88,19 +88,26 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
 	})
-
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
-		if !ro.Time.IsZero() {
-			if err != nil {
-				ro.Err = err.Error()
-			}
-			ro.Duration = time.Since(start)
-			ro.Record(ctx, h.recorder.Recorder)
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
 		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -121,44 +128,107 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 	}
 
 	ro.Host = dstAddr.String()
+	ro.Dst = dstAddr.String()
 
 	log = log.WithFields(map[string]any{
-		"dst": fmt.Sprintf("%s/%s", dstAddr, dstAddr.Network()),
+		"dst":  fmt.Sprintf("%s/%s", dstAddr, dstAddr.Network()),
+		"host": dstAddr.String(),
 	})
 
-	var rw io.ReadWriter = conn
 	if h.md.sniffing {
 		if h.md.sniffingTimeout > 0 {
 			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
 		}
-		// try to sniff TLS traffic
-		var hdr [dissector.RecordHeaderLen]byte
-		n, err := io.ReadFull(rw, hdr[:])
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
 		if h.md.sniffingTimeout > 0 {
 			conn.SetReadDeadline(time.Time{})
 		}
-		rw = xio.NewReadWriter(io.MultiReader(bytes.NewReader(hdr[:n]), rw), rw)
-		tlsVersion := binary.BigEndian.Uint16(hdr[1:3])
-		if err == nil &&
-			hdr[0] == dissector.Handshake &&
-			(tlsVersion >= tls.VersionTLS10 && tlsVersion <= tls.VersionTLS13) {
-			return h.handleHTTPS(ctx, rw, conn.RemoteAddr(), dstAddr, log)
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			var cc net.Conn
+			var err error
+			if address != "" {
+				host, _, _ := net.SplitHostPort(address)
+				if host == "" {
+					host = address
+				}
+				_, port, _ := net.SplitHostPort(dstAddr.String())
+				address = net.JoinHostPort(strings.Trim(host, "[]"), port)
+				ro.Host = address
+
+				var buf bytes.Buffer
+				cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+				ro.Route = buf.String()
+				if err != nil && !h.md.sniffingFallback {
+					return nil, err
+				}
+			}
+
+			if cc == nil {
+				if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", dstAddr.String()) {
+					return nil, xbypass.ErrBypass
+				}
+				var buf bytes.Buffer
+				cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", dstAddr.String())
+				ro.Route = buf.String()
+				ro.Host = dstAddr.String()
+			}
+
+			return cc, err
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return dial(ctx, network, address)
 		}
 
-		// try to sniff HTTP traffic
-		if isHTTP(string(hdr[:])) {
-			return h.handleHTTP(ctx, rw, conn.RemoteAddr(), dstAddr, ro, log)
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithBypass(h.options.Bypass),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithBypass(h.options.Bypass),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
 		}
 	}
 
 	log.Debugf("%s >> %s", conn.RemoteAddr(), dstAddr)
 
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, dstAddr.Network(), dstAddr.String()) {
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, dstAddr.Network(), dstAddr.String()) {
 		log.Debug("bypass: ", dstAddr)
 		return xbypass.ErrBypass
 	}
 
-	cc, err := h.options.Router.Dial(ctx, dstAddr.Network(), dstAddr.String())
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), dstAddr.Network(), dstAddr.String())
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		return err
@@ -167,7 +237,7 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), dstAddr)
-	netpkg.Transport(rw, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), dstAddr)
@@ -175,181 +245,6 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 	return nil
 }
 
-func (h *redirectHandler) handleHTTP(ctx context.Context, rw io.ReadWriter, raddr, dstAddr net.Addr, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
-	req, err := http.ReadRequest(bufio.NewReader(rw))
-	if err != nil {
-		return err
-	}
-
-	ro.HTTP = &xrecorder.HTTPRecorderObject{
-		Host:   req.Host,
-		Proto:  req.Proto,
-		Scheme: req.URL.Scheme,
-		Method: req.Method,
-		URI:    req.RequestURI,
-		Request: xrecorder.HTTPRequestRecorderObject{
-			ContentLength: req.ContentLength,
-			Header:        req.Header,
-		},
-	}
-	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
-		ro.ClientIP = clientIP.String()
-	}
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpRequest(req, false)
-		log.Trace(string(dump))
-	}
-
-	ro.Host = req.Host
-	host := req.Host
-	if _, _, err := net.SplitHostPort(host); err != nil {
-		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
-	}
-	log = log.WithFields(map[string]any{
-		"host": host,
-	})
-
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", host, bypass.WithPathOption(req.RequestURI)) {
-		log.Debugf("bypass: %s %s", host, req.RequestURI)
-		return xbypass.ErrBypass
-	}
-
-	cc, err := h.options.Router.Dial(ctx, "tcp", host)
-	if err != nil {
-		log.Error(err)
-		if !h.md.sniffingFallback {
-			return err
-		}
-	}
-
-	if cc == nil {
-		cc, err = h.options.Router.Dial(ctx, "tcp", dstAddr.String())
-		if err != nil {
-			log.Error(err)
-			return err
-		}
-	}
-	defer cc.Close()
-
-	t := time.Now()
-	log.Infof("%s <-> %s", raddr, host)
-	defer func() {
-		log.WithFields(map[string]any{
-			"duration": time.Since(t),
-		}).Infof("%s >-< %s", raddr, host)
-	}()
-
-	if err := req.Write(cc); err != nil {
-		log.Error(err)
-		return err
-	}
-
-	br := bufio.NewReader(cc)
-	resp, err := http.ReadResponse(br, req)
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-	defer resp.Body.Close()
-
-	ro.HTTP.StatusCode = resp.StatusCode
-	ro.HTTP.Response.ContentLength = resp.ContentLength
-	ro.HTTP.Response.Header = resp.Header
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpResponse(resp, false)
-		log.Trace(string(dump))
-	}
-
-	if err := resp.Write(rw); err != nil {
-		log.Error(err)
-		return err
-	}
-
-	netpkg.Transport(rw, xio.NewReadWriter(br, cc))
-
-	return nil
-}
-
-func (h *redirectHandler) handleHTTPS(ctx context.Context, rw io.ReadWriter, raddr, dstAddr net.Addr, log logger.Logger) error {
-	buf := new(bytes.Buffer)
-	host, err := h.getServerName(ctx, io.TeeReader(rw, buf))
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-
-	var cc io.ReadWriteCloser
-
-	if host != "" {
-		if _, _, err := net.SplitHostPort(host); err != nil {
-			_, port, _ := net.SplitHostPort(dstAddr.String())
-			if port == "" {
-				port = "443"
-			}
-			host = net.JoinHostPort(strings.Trim(host, "[]"), port)
-		}
-		log = log.WithFields(map[string]any{
-			"host": host,
-		})
-
-		if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", host) {
-			log.Debug("bypass: ", host)
-			return nil
-		}
-
-		cc, err = h.options.Router.Dial(ctx, "tcp", host)
-		if err != nil {
-			log.Error(err)
-
-			if !h.md.sniffingFallback {
-				return err
-			}
-		}
-	}
-
-	if cc == nil {
-		cc, err = h.options.Router.Dial(ctx, "tcp", dstAddr.String())
-		if err != nil {
-			log.Error(err)
-			return err
-		}
-	}
-	defer cc.Close()
-
-	t := time.Now()
-	log.Infof("%s <-> %s", raddr, host)
-	netpkg.Transport(xio.NewReadWriter(io.MultiReader(buf, rw), rw), cc)
-	log.WithFields(map[string]any{
-		"duration": time.Since(t),
-	}).Infof("%s >-< %s", raddr, host)
-
-	return nil
-}
-
-func (h *redirectHandler) getServerName(_ context.Context, r io.Reader) (host string, err error) {
-	record, err := dissector.ReadRecord(r)
-	if err != nil {
-		return
-	}
-
-	clientHello := dissector.ClientHelloMsg{}
-	if err = clientHello.Decode(record.Opaque); err != nil {
-		return
-	}
-
-	for _, ext := range clientHello.Extensions {
-		if ext.Type() == dissector.ExtServerName {
-			snExtension := ext.(*dissector.ServerNameExtension)
-			host = snExtension.Name
-			break
-		}
-	}
-
-	return
-}
-
 func (h *redirectHandler) checkRateLimit(addr net.Addr) bool {
 	if h.options.RateLimiter == nil {
 		return true
@@ -361,15 +256,3 @@ func (h *redirectHandler) checkRateLimit(addr net.Addr) bool {
 
 	return true
 }
-
-func isHTTP(s string) bool {
-	return strings.HasPrefix(http.MethodGet, s[:3]) ||
-		strings.HasPrefix(http.MethodPost, s[:4]) ||
-		strings.HasPrefix(http.MethodPut, s[:3]) ||
-		strings.HasPrefix(http.MethodDelete, s) ||
-		strings.HasPrefix(http.MethodOptions, s) ||
-		strings.HasPrefix(http.MethodPatch, s) ||
-		strings.HasPrefix(http.MethodHead, s[:4]) ||
-		strings.HasPrefix(http.MethodConnect, s) ||
-		strings.HasPrefix(http.MethodTrace, s)
-}

handler/redirect/tcp/metadata.go

@@ -1,23 +1,61 @@
 package redirect
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
-	tproxy          bool
-	sniffing        bool
-	sniffingTimeout time.Duration
-	sniffingFallback bool
+	readTimeout time.Duration
+	tproxy      bool
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingFallback            bool
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *redirectHandler) parseMetadata(md mdata.Metadata) (err error) {
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
 	h.md.tproxy = mdutil.GetBool(md, "tproxy")
+
 	h.md.sniffing = mdutil.GetBool(md, "sniffing")
 	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
 	h.md.sniffingFallback = mdutil.GetBool(md, "sniffing.fallback")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return
 }

handler/redirect/udp/handler.go

@@ -1,6 +1,7 @@
 package redirect
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net"
@@ -8,11 +9,13 @@ import (
 
 	"github.com/go-gost/core/handler"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
 	xbypass "github.com/go-gost/x/bypass"
 	ctxvalue "github.com/go-gost/x/ctx"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
@@ -65,6 +68,7 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 		Time:       start,
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
 
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
@@ -73,15 +77,25 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 	})
 
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
 		if err != nil {
 			ro.Err = err.Error()
 		}
 		ro.Duration = time.Since(start)
-		ro.Record(ctx, h.recorder.Recorder)
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Error("record: %v", err)
+		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -94,17 +108,21 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 	ro.Host = dstAddr.String()
 
 	log = log.WithFields(map[string]any{
-		"dst": fmt.Sprintf("%s/%s", dstAddr, dstAddr.Network()),
+		"dst":  fmt.Sprintf("%s/%s", dstAddr, dstAddr.Network()),
+		"host": dstAddr.String(),
 	})
 
 	log.Debugf("%s >> %s", conn.RemoteAddr(), dstAddr)
 
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, dstAddr.Network(), dstAddr.String()) {
+	if h.options.Bypass != nil &&
+		h.options.Bypass.Contains(ctx, dstAddr.Network(), dstAddr.String()) {
 		log.Debug("bypass: ", dstAddr)
 		return xbypass.ErrBypass
 	}
 
-	cc, err := h.options.Router.Dial(ctx, dstAddr.Network(), dstAddr.String())
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), dstAddr.Network(), dstAddr.String())
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		return err
@@ -113,7 +131,7 @@ func (h *redirectHandler) Handle(ctx context.Context, conn net.Conn, opts ...han
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), dstAddr)
-	netpkg.Transport(conn, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), dstAddr)

handler/relay/connect.go

@@ -1,7 +1,10 @@
 package relay
 
 import (
+	"bufio"
+	"bytes"
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
@@ -16,11 +19,13 @@ import (
 	ctxvalue "github.com/go-gost/x/ctx"
 	xnet "github.com/go-gost/x/internal/net"
 	serial "github.com/go-gost/x/internal/util/serial"
+	"github.com/go-gost/x/internal/util/sniffing"
 	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
 	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
 )
 
-func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) (err error) {
+func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) (err error) {
 	if network == "unix" || network == "serial" {
 		if host, _, _ := net.SplitHostPort(address); host != "" {
 			address = host
@@ -28,8 +33,9 @@ func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network
 	}
 
 	log = log.WithFields(map[string]any{
-		"dst": fmt.Sprintf("%s/%s", address, network),
-		"cmd": "connect",
+		"dst":  fmt.Sprintf("%s/%s", address, network),
+		"cmd":  "connect",
+		"host": address,
 	})
 
 	log.Debugf("%s >> %s/%s", conn.RemoteAddr(), address, network)
@@ -59,15 +65,23 @@ func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network
 		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: address})
 	}
 
-	var cc io.ReadWriteCloser
-
+	var cc net.Conn
 	switch network {
 	case "unix":
 		cc, err = (&net.Dialer{}).DialContext(ctx, "unix", address)
 	case "serial":
-		cc, err = serial.OpenPort(serial.ParseConfigFromAddr(address))
+		var port io.ReadWriteCloser
+		port, err = serial.OpenPort(serial.ParseConfigFromAddr(address))
+		if err == nil {
+			cc = &serialConn{
+				ReadWriteCloser: port,
+				port:            address,
+			}
+		}
 	default:
-		cc, err = h.options.Router.Dial(ctx, network, address)
+		var buf bytes.Buffer
+		cc, err = h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, address)
+		ro.Route = buf.String()
 	}
 	if err != nil {
 		resp.Status = relay.StatusNetworkUnreachable
@@ -108,32 +122,128 @@ func (h *relayHandler) handleConnect(ctx context.Context, conn net.Conn, network
 		}
 	}
 
-	clientID := ctxvalue.ClientIDFromContext(ctx)
-	rw := traffic_wrapper.WrapReadWriter(
-		h.limiter,
-		conn,
-		string(clientID),
-		limiter.ScopeOption(limiter.ScopeClient),
-		limiter.ServiceOption(h.options.Service),
-		limiter.NetworkOption(network),
-		limiter.AddrOption(address),
-		limiter.ClientOption(string(clientID)),
-		limiter.SrcOption(conn.RemoteAddr().String()),
-	)
-	if h.options.Observer != nil {
-		pstats := h.stats.Stats(string(clientID))
-		pstats.Add(stats.KindTotalConns, 1)
-		pstats.Add(stats.KindCurrentConns, 1)
-		defer pstats.Add(stats.KindCurrentConns, -1)
-		rw = stats_wrapper.WrapReadWriter(rw, pstats)
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
 	}
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), address)
-	xnet.Transport(rw, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), address)
 
 	return nil
 }
+
+type serialConn struct {
+	io.ReadWriteCloser
+	port string
+}
+
+func (c *serialConn) LocalAddr() net.Addr {
+	return &serialAddr{
+		port: "@",
+	}
+}
+
+func (c *serialConn) RemoteAddr() net.Addr {
+	return &serialAddr{
+		port: c.port,
+	}
+}
+
+func (c *serialConn) SetDeadline(t time.Time) error {
+	return nil
+}
+
+func (c *serialConn) SetReadDeadline(t time.Time) error {
+	return nil
+}
+
+func (c *serialConn) SetWriteDeadline(t time.Time) error {
+	return nil
+}
+
+type serialAddr struct {
+	port string
+}
+
+func (a *serialAddr) Network() string {
+	return "serial"
+}
+
+func (a *serialAddr) String() string {
+	return a.port
+}

handler/relay/forward.go

@@ -12,7 +12,7 @@ import (
 	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/relay"
 	ctxvalue "github.com/go-gost/x/ctx"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	"github.com/go-gost/x/limiter/traffic/wrapper"
 	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 )
@@ -111,7 +111,7 @@ func (h *relayHandler) handleForward(ctx context.Context, conn net.Conn, network
 
 	t := time.Now()
 	log.Debugf("%s <-> %s", conn.RemoteAddr(), target.Addr)
-	netpkg.Transport(rw, cc)
+	xnet.Transport(rw, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Debugf("%s >-< %s", conn.RemoteAddr(), target.Addr)

handler/relay/handler.go

@@ -11,12 +11,15 @@ import (
 	"github.com/go-gost/core/hop"
 	"github.com/go-gost/core/limiter/traffic"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
 	"github.com/go-gost/relay"
 	ctxvalue "github.com/go-gost/x/ctx"
 	limiter_util "github.com/go-gost/x/internal/util/limiter"
 	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
@@ -39,6 +42,7 @@ type relayHandler struct {
 	limiter  traffic.TrafficLimiter
 	cancel   context.CancelFunc
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -76,6 +80,10 @@ func (h *relayHandler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return nil
 }
 
@@ -97,23 +105,41 @@ func (h *relayHandler) Handle(ctx context.Context, conn net.Conn, opts ...handle
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
 
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
 
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
 
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
 		if err != nil {
 			ro.Err = err.Error()
 		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
 		ro.Duration = time.Since(start)
-		ro.Record(ctx, h.recorder.Recorder)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -192,7 +218,7 @@ func (h *relayHandler) Handle(ctx context.Context, conn net.Conn, opts ...handle
 
 	switch req.Cmd & relay.CmdMask {
 	case 0, relay.CmdConnect:
-		return h.handleConnect(ctx, conn, network, address, log)
+		return h.handleConnect(ctx, conn, network, address, ro, log)
 	case relay.CmdBind:
 		return h.handleBind(ctx, conn, network, address, log)
 	default:

handler/relay/metadata.go

@@ -1,12 +1,17 @@
 package relay
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"math"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
@@ -17,10 +22,24 @@ type metadata struct {
 	hash          string
 	muxCfg        *mux.Config
 	observePeriod time.Duration
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *relayHandler) parseMetadata(md mdata.Metadata) (err error) {
 	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
 	h.md.enableBind = mdutil.GetBool(md, "bind")
 	h.md.noDelay = mdutil.GetBool(md, "nodelay")
 
@@ -44,5 +63,26 @@ func (h *relayHandler) parseMetadata(md mdata.Metadata) (err error) {
 
 	h.md.observePeriod = mdutil.GetDuration(md, "observePeriod")
 
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return
 }

handler/serial/metadata.go

@@ -4,7 +4,7 @@ import (
 	"time"
 
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
 )
 
 const (

handler/sni/handler.go

@@ -5,29 +5,20 @@ import (
 	"bytes"
 	"context"
 	"crypto/tls"
-	"encoding/base64"
-	"encoding/binary"
 	"errors"
-	"hash/crc32"
-	"io"
 	"net"
-	"net/http"
-	"net/http/httputil"
-	"strings"
 	"time"
 
-	"github.com/go-gost/core/bypass"
 	"github.com/go-gost/core/handler"
-	"github.com/go-gost/core/logger"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
-	dissector "github.com/go-gost/tls-dissector"
-	xbypass "github.com/go-gost/x/bypass"
 	ctxvalue "github.com/go-gost/x/ctx"
-	xio "github.com/go-gost/x/internal/io"
-	netpkg "github.com/go-gost/x/internal/net"
-	xhttp "github.com/go-gost/x/internal/net/http"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
@@ -40,6 +31,7 @@ type sniHandler struct {
 	md       metadata
 	options  handler.Options
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -67,6 +59,10 @@ func (h *sniHandler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return nil
 }
 
@@ -83,24 +79,41 @@ func (h *sniHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 		Time:       start,
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
-	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
+
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
 
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
-
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
 		if err != nil {
 			ro.Err = err.Error()
 		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
 		ro.Duration = time.Since(start)
-		ro.Record(ctx, h.recorder.Recorder)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -108,216 +121,60 @@ func (h *sniHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 		return rate_limiter.ErrRateLimit
 	}
 
-	var hdr [dissector.RecordHeaderLen]byte
-	if _, err := io.ReadFull(conn, hdr[:]); err != nil {
-		log.Error(err)
-		return err
+	br := bufio.NewReader(conn)
+	proto, _ := sniffing.Sniff(ctx, br)
+	ro.Proto = proto
+
+	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+		var buf bytes.Buffer
+		cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+		ro.Route = buf.String()
+		return cc, err
 	}
-
-	rw := xio.NewReadWriter(io.MultiReader(bytes.NewReader(hdr[:]), conn), conn)
-
-	tlsVersion := binary.BigEndian.Uint16(hdr[1:3])
-	if hdr[0] == dissector.Handshake &&
-		(tlsVersion >= tls.VersionTLS10 && tlsVersion <= tls.VersionTLS13) {
-		return h.handleHTTPS(ctx, rw, conn.RemoteAddr(), ro, log)
-	}
-	return h.handleHTTP(ctx, rw, conn.RemoteAddr(), ro, log)
-}
-
-func (h *sniHandler) handleHTTP(ctx context.Context, rw io.ReadWriter, raddr net.Addr, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
-	req, err := http.ReadRequest(bufio.NewReader(rw))
-	if err != nil {
-		return err
-	}
-
-	ro.HTTP = &xrecorder.HTTPRecorderObject{
-		Host:   req.Host,
-		Proto:  req.Proto,
-		Scheme: req.URL.Scheme,
-		Method: req.Method,
-		URI:    req.RequestURI,
-		Request: xrecorder.HTTPRequestRecorderObject{
-			ContentLength: req.ContentLength,
-			Header:        req.Header,
-		},
-	}
-	if clientIP := xhttp.GetClientIP(req); clientIP != nil {
-		ro.ClientIP = clientIP.String()
-	}
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpRequest(req, false)
-		log.Trace(string(dump))
-	}
-
-	host := req.Host
-	if _, _, err := net.SplitHostPort(host); err != nil {
-		host = net.JoinHostPort(strings.Trim(host, "[]"), "80")
-	}
-
-	ro.Host = req.Host
-
-	log = log.WithFields(map[string]any{
-		"host": host,
-	})
-
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", host, bypass.WithPathOption(req.RequestURI)) {
-		log.Debugf("bypass: %s %s", host, req.RequestURI)
-		return xbypass.ErrBypass
-	}
-
-	switch h.md.hash {
-	case "host":
-		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: host})
-	}
-
-	cc, err := h.options.Router.Dial(ctx, "tcp", host)
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-	defer cc.Close()
-
-	t := time.Now()
-	log.Infof("%s <-> %s", raddr, host)
-	defer func() {
-		log.WithFields(map[string]any{
-			"duration": time.Since(t),
-		}).Infof("%s >-< %s", raddr, host)
-	}()
-
-	if err := req.Write(cc); err != nil {
-		log.Error(err)
-		return err
-	}
-
-	br := bufio.NewReader(cc)
-	resp, err := http.ReadResponse(br, req)
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-	defer resp.Body.Close()
-
-	ro.HTTP.StatusCode = resp.StatusCode
-	ro.HTTP.Response.ContentLength = resp.ContentLength
-	ro.HTTP.Response.Header = resp.Header
-
-	if log.IsLevelEnabled(logger.TraceLevel) {
-		dump, _ := httputil.DumpResponse(resp, false)
-		log.Trace(string(dump))
-	}
-
-	if err := resp.Write(rw); err != nil {
-		log.Error(err)
-		return err
-	}
-
-	netpkg.Transport(rw, xio.NewReadWriter(br, cc))
-
-	return nil
-}
-
-func (h *sniHandler) handleHTTPS(ctx context.Context, rw io.ReadWriter, raddr net.Addr, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
-	buf := new(bytes.Buffer)
-	host, err := h.decodeHost(io.TeeReader(rw, buf))
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-
-	if _, _, err := net.SplitHostPort(host); err != nil {
-		host = net.JoinHostPort(strings.Trim(host, "[]"), "443")
-	}
-
-	ro.Host = host
-
-	log = log.WithFields(map[string]any{
-		"dst": host,
-	})
-	log.Debugf("%s >> %s", raddr, host)
-
-	if h.options.Bypass != nil && h.options.Bypass.Contains(ctx, "tcp", host) {
-		log.Debug("bypass: ", host)
-		return xbypass.ErrBypass
-	}
-
-	switch h.md.hash {
-	case "host":
-		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: host})
-	}
-
-	cc, err := h.options.Router.Dial(ctx, "tcp", host)
-	if err != nil {
-		log.Error(err)
-		return err
-	}
-	defer cc.Close()
-
-	t := time.Now()
-	log.Infof("%s <-> %s", raddr, host)
-	netpkg.Transport(xio.NewReadWriter(io.MultiReader(buf, rw), rw), cc)
-	log.WithFields(map[string]any{
-		"duration": time.Since(t),
-	}).Infof("%s >-< %s", raddr, host)
-
-	return nil
-}
-
-func (h *sniHandler) decodeHost(r io.Reader) (host string, err error) {
-	record, err := dissector.ReadRecord(r)
-	if err != nil {
-		return
-	}
-	clientHello := dissector.ClientHelloMsg{}
-	if err = clientHello.Decode(record.Opaque); err != nil {
-		return
-	}
-
-	var extensions []dissector.Extension
-	for _, ext := range clientHello.Extensions {
-		if ext.Type() == 0xFFFE {
-			b, _ := ext.Encode()
-			if v, err := h.decodeServerName(string(b)); err == nil {
-				host = v
-			}
-			continue
-		}
-		extensions = append(extensions, ext)
-	}
-	clientHello.Extensions = extensions
-
-	for _, ext := range clientHello.Extensions {
-		if ext.Type() == dissector.ExtServerName {
-			snExtension := ext.(*dissector.ServerNameExtension)
-			if host == "" {
-				host = snExtension.Name
-			} else {
-				snExtension.Name = host
-			}
-			break
+	dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+		var buf bytes.Buffer
+		cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", address)
+		ro.Route = buf.String()
+		if err != nil {
+			return nil, err
 		}
+		cc = tls.Client(cc, cfg)
+		return cc, nil
 	}
 
-	return
-}
-
-func (h *sniHandler) decodeServerName(s string) (string, error) {
-	b, err := base64.RawURLEncoding.DecodeString(s)
-	if err != nil {
-		return "", err
+	sniffer := &sniffing.Sniffer{
+		Websocket:           h.md.sniffingWebsocket,
+		WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+		Recorder:            h.recorder.Recorder,
+		RecorderOptions:     h.recorder.Options,
+		Certificate:         h.md.certificate,
+		PrivateKey:          h.md.privateKey,
+		NegotiatedProtocol:  h.md.alpn,
+		CertPool:            h.certPool,
+		MitmBypass:          h.md.mitmBypass,
+		ReadTimeout:         h.md.readTimeout,
 	}
-	if len(b) < 4 {
-		return "", errors.New("invalid name")
+	conn = xnet.NewReadWriteConn(br, conn, conn)
+	switch proto {
+	case sniffing.ProtoHTTP:
+		return sniffer.HandleHTTP(ctx, conn,
+			sniffing.WithDial(dial),
+			sniffing.WithDialTLS(dialTLS),
+			sniffing.WithBypass(h.options.Bypass),
+			sniffing.WithRecorderObject(ro),
+			sniffing.WithLog(log),
+		)
+	case sniffing.ProtoTLS:
+		return sniffer.HandleTLS(ctx, conn,
+			sniffing.WithDial(dial),
+			sniffing.WithDialTLS(dialTLS),
+			sniffing.WithBypass(h.options.Bypass),
+			sniffing.WithRecorderObject(ro),
+			sniffing.WithLog(log),
+		)
+	default:
+		return errors.New("unknown traffic")
 	}
-	v, err := base64.RawURLEncoding.DecodeString(string(b[4:]))
-	if err != nil {
-		return "", err
-	}
-	if crc32.ChecksumIEEE(v) != binary.BigEndian.Uint32(b[:4]) {
-		return "", errors.New("invalid name")
-	}
-	return string(v), nil
 }
 
 func (h *sniHandler) checkRateLimit(addr net.Addr) bool {

handler/sni/metadata.go

@@ -1,24 +1,55 @@
 package sni
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
 	readTimeout time.Duration
 	hash        string
+
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *sniHandler) parseMetadata(md mdata.Metadata) (err error) {
-	const (
-		readTimeout = "readTimeout"
-		hash        = "hash"
-	)
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
 
-	h.md.readTimeout = mdutil.GetDuration(md, readTimeout)
-	h.md.hash = mdutil.GetString(md, hash)
 	return
 }

handler/socks/v4/handler.go

@@ -1,7 +1,10 @@
 package v4
 
 import (
+	"bufio"
+	"bytes"
 	"context"
+	"crypto/tls"
 	"errors"
 	"net"
 	"time"
@@ -15,9 +18,11 @@ import (
 	"github.com/go-gost/core/recorder"
 	"github.com/go-gost/gosocks4"
 	ctxvalue "github.com/go-gost/x/ctx"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
 	limiter_util "github.com/go-gost/x/internal/util/limiter"
+	"github.com/go-gost/x/internal/util/sniffing"
 	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
 	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
 	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
@@ -42,6 +47,7 @@ type socks4Handler struct {
 	limiter  traffic.TrafficLimiter
 	cancel   context.CancelFunc
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -79,6 +85,10 @@ func (h *socks4Handler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return nil
 }
 
@@ -96,22 +106,40 @@ func (h *socks4Handler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
 
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
-
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
 		if err != nil {
 			ro.Err = err.Error()
 		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
 		ro.Duration = time.Since(start)
-		ro.Record(ctx, h.recorder.Recorder)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -147,7 +175,7 @@ func (h *socks4Handler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 
 	switch req.Cmd {
 	case gosocks4.CmdConnect:
-		return h.handleConnect(ctx, conn, req, log)
+		return h.handleConnect(ctx, conn, req, ro, log)
 	case gosocks4.CmdBind:
 		return h.handleBind(ctx, conn, req)
 	default:
@@ -164,11 +192,12 @@ func (h *socks4Handler) Close() error {
 	return nil
 }
 
-func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *gosocks4.Request, log logger.Logger) error {
+func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *gosocks4.Request, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
 	addr := req.Addr.String()
 
 	log = log.WithFields(map[string]any{
-		"dst": addr,
+		"dst":  addr,
+		"host": addr,
 	})
 	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
 
@@ -184,14 +213,15 @@ func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *g
 		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr})
 	}
 
-	cc, err := h.options.Router.Dial(ctx, "tcp", addr)
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", addr)
+	ro.Route = buf.String()
 	if err != nil {
 		resp := gosocks4.NewReply(gosocks4.Failed, nil)
 		log.Trace(resp)
 		resp.Write(conn)
 		return err
 	}
-
 	defer cc.Close()
 
 	resp := gosocks4.NewReply(gosocks4.Granted, nil)
@@ -201,32 +231,87 @@ func (h *socks4Handler) handleConnect(ctx context.Context, conn net.Conn, req *g
 		return err
 	}
 
-	clientID := ctxvalue.ClientIDFromContext(ctx)
-	rw := traffic_wrapper.WrapReadWriter(
-		h.limiter,
-		conn,
-		string(clientID),
-		limiter.ScopeOption(limiter.ScopeClient),
-		limiter.ServiceOption(h.options.Service),
-		limiter.NetworkOption("tcp"),
-		limiter.AddrOption(addr),
-		limiter.ClientOption(string(clientID)),
-		limiter.SrcOption(conn.RemoteAddr().String()),
-	)
-	if h.options.Observer != nil {
-		pstats := h.stats.Stats(string(clientID))
-		pstats.Add(stats.KindTotalConns, 1)
-		pstats.Add(stats.KindCurrentConns, 1)
-		defer pstats.Add(stats.KindCurrentConns, -1)
-		rw = stats_wrapper.WrapReadWriter(rw, pstats)
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.ServiceOption(h.options.Service),
+			limiter.NetworkOption("tcp"),
+			limiter.AddrOption(addr),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
 	}
 
 	t := time.Now()
-	log.Infof("%s <-> %s", conn.RemoteAddr(), addr)
-	netpkg.Transport(rw, cc)
+	log.Infof("%s <-> %s", conn.RemoteAddr(), ro.Host)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
-	}).Infof("%s >-< %s", conn.RemoteAddr(), addr)
+	}).Infof("%s >-< %s", conn.RemoteAddr(), ro.Host)
 
 	return nil
 }

handler/socks/v4/metadata.go

@@ -1,21 +1,62 @@
 package v4
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
 	readTimeout   time.Duration
 	hash          string
 	observePeriod time.Duration
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *socks4Handler) parseMetadata(md mdata.Metadata) (err error) {
 	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
 	h.md.hash = mdutil.GetString(md, "hash")
 	h.md.observePeriod = mdutil.GetDuration(md, "observePeriod")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return
 }

handler/socks/v5/bind.go

@@ -8,7 +8,6 @@ import (
 
 	"github.com/go-gost/core/logger"
 	"github.com/go-gost/gosocks5"
-	netpkg "github.com/go-gost/x/internal/net"
 	xnet "github.com/go-gost/x/internal/net"
 )
 
@@ -139,7 +138,7 @@ func (h *socks5Handler) serveBind(ctx context.Context, conn net.Conn, ln net.Lis
 
 		start := time.Now()
 		log.Debugf("%s <-> %s", rc.LocalAddr(), rc.RemoteAddr())
-		netpkg.Transport(pc2, rc)
+		xnet.Transport(pc2, rc)
 		log.WithFields(map[string]any{"duration": time.Since(start)}).
 			Debugf("%s >-< %s", rc.LocalAddr(), rc.RemoteAddr())
 

handler/socks/v5/connect.go

@@ -1,7 +1,10 @@
 package v5
 
 import (
+	"bufio"
+	"bytes"
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
 	"time"
@@ -11,15 +14,18 @@ import (
 	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/gosocks5"
 	ctxvalue "github.com/go-gost/x/ctx"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
 	traffic_wrapper "github.com/go-gost/x/limiter/traffic/wrapper"
 	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
 )
 
-func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
 	log = log.WithFields(map[string]any{
-		"dst": fmt.Sprintf("%s/%s", address, network),
-		"cmd": "connect",
+		"dst":  fmt.Sprintf("%s/%s", address, network),
+		"cmd":  "connect",
+		"host": address,
 	})
 	log.Debugf("%s >> %s", conn.RemoteAddr(), address)
 
@@ -35,14 +41,15 @@ func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, networ
 		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: address})
 	}
 
-	cc, err := h.options.Router.Dial(ctx, network, address)
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), network, address)
+	ro.Route = buf.String()
 	if err != nil {
 		resp := gosocks5.NewReply(gosocks5.NetUnreachable, nil)
 		log.Trace(resp)
 		resp.Write(conn)
 		return err
 	}
-
 	defer cc.Close()
 
 	resp := gosocks5.NewReply(gosocks5.Succeeded, nil)
@@ -52,29 +59,84 @@ func (h *socks5Handler) handleConnect(ctx context.Context, conn net.Conn, networ
 		return err
 	}
 
-	clientID := ctxvalue.ClientIDFromContext(ctx)
-	rw := traffic_wrapper.WrapReadWriter(
-		h.limiter,
-		conn,
-		string(clientID),
-		limiter.ServiceOption(h.options.Service),
-		limiter.ScopeOption(limiter.ScopeClient),
-		limiter.NetworkOption(network),
-		limiter.AddrOption(address),
-		limiter.ClientOption(string(clientID)),
-		limiter.SrcOption(conn.RemoteAddr().String()),
-	)
-	if h.options.Observer != nil {
-		pstats := h.stats.Stats(string(clientID))
-		pstats.Add(stats.KindTotalConns, 1)
-		pstats.Add(stats.KindCurrentConns, 1)
-		defer pstats.Add(stats.KindCurrentConns, -1)
-		rw = stats_wrapper.WrapReadWriter(rw, pstats)
+	{
+		clientID := ctxvalue.ClientIDFromContext(ctx)
+		rw := traffic_wrapper.WrapReadWriter(
+			h.limiter,
+			conn,
+			string(clientID),
+			limiter.ServiceOption(h.options.Service),
+			limiter.ScopeOption(limiter.ScopeClient),
+			limiter.NetworkOption(network),
+			limiter.AddrOption(address),
+			limiter.ClientOption(string(clientID)),
+			limiter.SrcOption(conn.RemoteAddr().String()),
+		)
+		if h.options.Observer != nil {
+			pstats := h.stats.Stats(string(clientID))
+			pstats.Add(stats.KindTotalConns, 1)
+			pstats.Add(stats.KindCurrentConns, 1)
+			defer pstats.Add(stats.KindCurrentConns, -1)
+			rw = stats_wrapper.WrapReadWriter(rw, pstats)
+		}
+
+		conn = xnet.NewReadWriteConn(rw, rw, conn)
+	}
+
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
 	}
 
 	t := time.Now()
 	log.Infof("%s <-> %s", conn.RemoteAddr(), address)
-	netpkg.Transport(rw, cc)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
 	}).Infof("%s >-< %s", conn.RemoteAddr(), address)

handler/socks/v5/handler.go

@@ -9,13 +9,16 @@ import (
 	"github.com/go-gost/core/handler"
 	"github.com/go-gost/core/limiter/traffic"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
 	"github.com/go-gost/gosocks5"
 	ctxvalue "github.com/go-gost/x/ctx"
 	limiter_util "github.com/go-gost/x/internal/util/limiter"
 	"github.com/go-gost/x/internal/util/socks"
 	stats_util "github.com/go-gost/x/internal/util/stats"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 )
@@ -37,6 +40,7 @@ type socks5Handler struct {
 	limiter  traffic.TrafficLimiter
 	cancel   context.CancelFunc
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -81,6 +85,10 @@ func (h *socks5Handler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return
 }
 
@@ -98,22 +106,40 @@ func (h *socks5Handler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
 
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
-
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
 		if err != nil {
 			ro.Err = err.Error()
 		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
 		ro.Duration = time.Since(start)
-		ro.Record(ctx, h.recorder.Recorder)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
+		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -121,9 +147,7 @@ func (h *socks5Handler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 		return rate_limiter.ErrRateLimit
 	}
 
-	if h.md.readTimeout > 0 {
-		conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
-	}
+	conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
 
 	sc := gosocks5.ServerConn(conn, h.selector)
 	req, err := gosocks5.ReadRequest(sc)
@@ -147,17 +171,17 @@ func (h *socks5Handler) Handle(ctx context.Context, conn net.Conn, opts ...handl
 
 	switch req.Cmd {
 	case gosocks5.CmdConnect:
-		return h.handleConnect(ctx, conn, "tcp", address, log)
+		return h.handleConnect(ctx, conn, "tcp", address, ro, log)
 	case gosocks5.CmdBind:
 		return h.handleBind(ctx, conn, "tcp", address, log)
 	case socks.CmdMuxBind:
 		return h.handleMuxBind(ctx, conn, "tcp", address, log)
 	case gosocks5.CmdUdp:
 		ro.Network = "udp"
-		return h.handleUDP(ctx, conn, log)
+		return h.handleUDP(ctx, conn, ro, log)
 	case socks.CmdUDPTun:
 		ro.Network = "udp"
-		return h.handleUDPTun(ctx, conn, "udp", address, log)
+		return h.handleUDPTun(ctx, conn, "udp", address, ro, log)
 	default:
 		err = ErrUnknownCmd
 		log.Error(err)

handler/socks/v5/metadata.go

@@ -1,12 +1,17 @@
 package v5
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"math"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
 	"github.com/go-gost/x/internal/util/mux"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
@@ -19,10 +24,24 @@ type metadata struct {
 	hash              string
 	muxCfg            *mux.Config
 	observePeriod     time.Duration
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *socks5Handler) parseMetadata(md mdata.Metadata) (err error) {
 	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
+
 	h.md.noTLS = mdutil.GetBool(md, "notls")
 	h.md.enableBind = mdutil.GetBool(md, "bind")
 	h.md.enableUDP = mdutil.GetBool(md, "udp")
@@ -48,5 +67,26 @@ func (h *socks5Handler) parseMetadata(md mdata.Metadata) (err error) {
 
 	h.md.observePeriod = mdutil.GetDuration(md, "observePeriod")
 
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
+
 	return nil
 }

handler/socks/v5/udp.go

@@ -1,6 +1,7 @@
 package v5
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
@@ -16,9 +17,10 @@ import (
 	"github.com/go-gost/x/internal/net/udp"
 	"github.com/go-gost/x/internal/util/socks"
 	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
 )
 
-func (h *socks5Handler) handleUDP(ctx context.Context, conn net.Conn, log logger.Logger) error {
+func (h *socks5Handler) handleUDP(ctx context.Context, conn net.Conn, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
 	log = log.WithFields(map[string]any{
 		"cmd": "udp",
 	})
@@ -59,7 +61,9 @@ func (h *socks5Handler) handleUDP(ctx context.Context, conn net.Conn, log logger
 	log.Debugf("bind on %s OK", cc.LocalAddr())
 
 	// obtain a udp connection
-	c, err := h.options.Router.Dial(ctx, "udp", "") // UDP association
+	var buf bytes.Buffer
+	c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		return err

handler/socks/v5/udp_tun.go

@@ -1,6 +1,7 @@
 package v5
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"net"
@@ -14,9 +15,10 @@ import (
 	"github.com/go-gost/x/internal/net/udp"
 	"github.com/go-gost/x/internal/util/socks"
 	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
+	xrecorder "github.com/go-gost/x/recorder"
 )
 
-func (h *socks5Handler) handleUDPTun(ctx context.Context, conn net.Conn, network, address string, log logger.Logger) error {
+func (h *socks5Handler) handleUDPTun(ctx context.Context, conn net.Conn, network, address string, ro *xrecorder.HandlerRecorderObject, log logger.Logger) error {
 	log = log.WithFields(map[string]any{
 		"cmd": "udp-tun",
 	})
@@ -37,7 +39,9 @@ func (h *socks5Handler) handleUDPTun(ctx context.Context, conn net.Conn, network
 		}
 
 		// obtain a udp connection
-		c, err := h.options.Router.Dial(ctx, "udp", "") // UDP association
+		var buf bytes.Buffer
+		c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+		ro.Route = buf.String()
 		if err != nil {
 			log.Error(err)
 			return err

handler/ss/handler.go

@@ -1,19 +1,26 @@
 package ss
 
 import (
+	"bufio"
+	"bytes"
 	"context"
+	"crypto/tls"
 	"io"
 	"net"
 	"time"
 
 	"github.com/go-gost/core/handler"
 	md "github.com/go-gost/core/metadata"
+	"github.com/go-gost/core/observer/stats"
 	"github.com/go-gost/core/recorder"
 	"github.com/go-gost/gosocks5"
 	ctxvalue "github.com/go-gost/x/ctx"
-	netpkg "github.com/go-gost/x/internal/net"
+	xnet "github.com/go-gost/x/internal/net"
+	"github.com/go-gost/x/internal/util/sniffing"
 	"github.com/go-gost/x/internal/util/ss"
+	tls_util "github.com/go-gost/x/internal/util/tls"
 	rate_limiter "github.com/go-gost/x/limiter/rate"
+	stats_wrapper "github.com/go-gost/x/observer/stats/wrapper"
 	xrecorder "github.com/go-gost/x/recorder"
 	"github.com/go-gost/x/registry"
 	"github.com/shadowsocks/go-shadowsocks2/core"
@@ -28,6 +35,7 @@ type ssHandler struct {
 	md       metadata
 	options  handler.Options
 	recorder recorder.RecorderObject
+	certPool tls_util.CertPool
 }
 
 func NewHandler(opts ...handler.Option) handler.Handler {
@@ -61,6 +69,10 @@ func (h *ssHandler) Init(md md.Metadata) (err error) {
 		}
 	}
 
+	if h.md.certificate != nil && h.md.privateKey != nil {
+		h.certPool = tls_util.NewMemoryCertPool()
+	}
+
 	return
 }
 
@@ -78,24 +90,40 @@ func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.H
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
 
+	ro.ClientIP = conn.RemoteAddr().String()
+	if clientAddr := ctxvalue.ClientAddrFromContext(ctx); clientAddr != "" {
+		ro.ClientIP = string(clientAddr)
+	}
+	if h, _, _ := net.SplitHostPort(ro.ClientIP); h != "" {
+		ro.ClientIP = h
+	}
+
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
 		"local":  conn.LocalAddr().String(),
 		"sid":    ctxvalue.SidFromContext(ctx),
+		"client": ro.ClientIP,
 	})
-
 	log.Infof("%s <> %s", conn.RemoteAddr(), conn.LocalAddr())
+
+	pStats := stats.Stats{}
+	conn = stats_wrapper.WrapConn(conn, &pStats)
+
 	defer func() {
-		if !ro.Time.IsZero() {
-			if err != nil {
-				ro.Err = err.Error()
-			}
-			ro.Duration = time.Since(start)
-			ro.Record(ctx, h.recorder.Recorder)
+		if err != nil {
+			ro.Err = err.Error()
+		}
+		ro.InputBytes = pStats.Get(stats.KindInputBytes)
+		ro.OutputBytes = pStats.Get(stats.KindOutputBytes)
+		ro.Duration = time.Since(start)
+		if err := ro.Record(ctx, h.recorder.Recorder); err != nil {
+			log.Errorf("record: %v", err)
 		}
 
 		log.WithFields(map[string]any{
-			"duration": time.Since(start),
+			"duration":    time.Since(start),
+			"inputBytes":  ro.InputBytes,
+			"outputBytes": ro.OutputBytes,
 		}).Infof("%s >< %s", conn.RemoteAddr(), conn.LocalAddr())
 	}()
 
@@ -107,9 +135,7 @@ func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.H
 		conn = ss.ShadowConn(h.cipher.StreamConn(conn), nil)
 	}
 
-	if h.md.readTimeout > 0 {
-		conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
-	}
+	conn.SetReadDeadline(time.Now().Add(h.md.readTimeout))
 
 	addr := &gosocks5.Addr{}
 	if _, err := addr.ReadFrom(conn); err != nil {
@@ -119,8 +145,11 @@ func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.H
 	}
 	ro.Host = addr.String()
 
+	conn.SetReadDeadline(time.Time{})
+
 	log = log.WithFields(map[string]any{
-		"dst": addr.String(),
+		"dst":  addr.String(),
+		"host": addr.String(),
 	})
 
 	log.Debugf("%s >> %s", conn.RemoteAddr(), addr)
@@ -135,18 +164,71 @@ func (h *ssHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.H
 		ctx = ctxvalue.ContextWithHash(ctx, &ctxvalue.Hash{Source: addr.String()})
 	}
 
-	cc, err := h.options.Router.Dial(ctx, "tcp", addr.String())
+	var buf bytes.Buffer
+	cc, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "tcp", addr.String())
+	ro.Route = buf.String()
 	if err != nil {
 		return err
 	}
 	defer cc.Close()
 
+	if h.md.sniffing {
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Now().Add(h.md.sniffingTimeout))
+		}
+
+		br := bufio.NewReader(conn)
+		proto, _ := sniffing.Sniff(ctx, br)
+		ro.Proto = proto
+
+		if h.md.sniffingTimeout > 0 {
+			conn.SetReadDeadline(time.Time{})
+		}
+
+		dial := func(ctx context.Context, network, address string) (net.Conn, error) {
+			return cc, nil
+		}
+		dialTLS := func(ctx context.Context, network, address string, cfg *tls.Config) (net.Conn, error) {
+			return cc, nil
+		}
+		sniffer := &sniffing.Sniffer{
+			Websocket:           h.md.sniffingWebsocket,
+			WebsocketSampleRate: h.md.sniffingWebsocketSampleRate,
+			Recorder:            h.recorder.Recorder,
+			RecorderOptions:     h.recorder.Options,
+			Certificate:         h.md.certificate,
+			PrivateKey:          h.md.privateKey,
+			NegotiatedProtocol:  h.md.alpn,
+			CertPool:            h.certPool,
+			MitmBypass:          h.md.mitmBypass,
+			ReadTimeout:         h.md.readTimeout,
+		}
+
+		conn = xnet.NewReadWriteConn(br, conn, conn)
+		switch proto {
+		case sniffing.ProtoHTTP:
+			return sniffer.HandleHTTP(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		case sniffing.ProtoTLS:
+			return sniffer.HandleTLS(ctx, conn,
+				sniffing.WithDial(dial),
+				sniffing.WithDialTLS(dialTLS),
+				sniffing.WithRecorderObject(ro),
+				sniffing.WithLog(log),
+			)
+		}
+	}
+
 	t := time.Now()
-	log.Infof("%s <-> %s", conn.RemoteAddr(), addr)
-	netpkg.Transport(conn, cc)
+	log.Infof("%s <-> %s", conn.RemoteAddr(), ro.Host)
+	xnet.Transport(conn, cc)
 	log.WithFields(map[string]any{
 		"duration": time.Since(t),
-	}).Infof("%s >-< %s", conn.RemoteAddr(), addr)
+	}).Infof("%s >-< %s", conn.RemoteAddr(), ro.Host)
 
 	return nil
 }

handler/ss/metadata.go

@@ -1,28 +1,62 @@
 package ss
 
 import (
+	"crypto"
+	"crypto/tls"
+	"crypto/x509"
 	"time"
 
+	"github.com/go-gost/core/bypass"
 	mdata "github.com/go-gost/core/metadata"
-	mdutil "github.com/go-gost/core/metadata/util"
+	mdutil "github.com/go-gost/x/metadata/util"
+	"github.com/go-gost/x/registry"
 )
 
 type metadata struct {
 	key         string
-	readTimeout time.Duration
 	hash        string
+	readTimeout time.Duration
+
+	sniffing                    bool
+	sniffingTimeout             time.Duration
+	sniffingWebsocket           bool
+	sniffingWebsocketSampleRate float64
+
+	certificate *x509.Certificate
+	privateKey  crypto.PrivateKey
+	alpn        string
+	mitmBypass  bypass.Bypass
 }
 
 func (h *ssHandler) parseMetadata(md mdata.Metadata) (err error) {
-	const (
-		key         = "key"
-		readTimeout = "readTimeout"
-		hash        = "hash"
-	)
+	h.md.readTimeout = mdutil.GetDuration(md, "readTimeout")
+	if h.md.readTimeout <= 0 {
+		h.md.readTimeout = 15 * time.Second
+	}
 
-	h.md.key = mdutil.GetString(md, key)
-	h.md.readTimeout = mdutil.GetDuration(md, readTimeout)
-	h.md.hash = mdutil.GetString(md, hash)
+	h.md.key = mdutil.GetString(md, "key")
+	h.md.hash = mdutil.GetString(md, "hash")
+
+	h.md.sniffing = mdutil.GetBool(md, "sniffing")
+	h.md.sniffingTimeout = mdutil.GetDuration(md, "sniffing.timeout")
+	h.md.sniffingWebsocket = mdutil.GetBool(md, "sniffing.websocket")
+	h.md.sniffingWebsocketSampleRate = mdutil.GetFloat(md, "sniffing.websocket.sampleRate")
+
+	certFile := mdutil.GetString(md, "mitm.certFile", "mitm.caCertFile")
+	keyFile := mdutil.GetString(md, "mitm.keyFile", "mitm.caKeyFile")
+	if certFile != "" && keyFile != "" {
+		tlsCert, err := tls.LoadX509KeyPair(certFile, keyFile)
+		if err != nil {
+			return err
+		}
+		h.md.certificate, err = x509.ParseCertificate(tlsCert.Certificate[0])
+		if err != nil {
+			return err
+		}
+		h.md.privateKey = tlsCert.PrivateKey
+	}
+	h.md.alpn = mdutil.GetString(md, "mitm.alpn")
+	h.md.mitmBypass = registry.BypassRegistry().Get(mdutil.GetString(md, "mitm.bypass"))
 
 	return
 }

handler/ss/udp/handler.go

@@ -1,6 +1,7 @@
 package ss
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"net"
@@ -79,6 +80,7 @@ func (h *ssuHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 		Time:       start,
 		SID:        string(ctxvalue.SidFromContext(ctx)),
 	}
+	ro.ClientIP, _, _ = net.SplitHostPort(conn.RemoteAddr().String())
 
 	log := h.options.Logger.WithFields(map[string]any{
 		"remote": conn.RemoteAddr().String(),
@@ -119,7 +121,9 @@ func (h *ssuHandler) Handle(ctx context.Context, conn net.Conn, opts ...handler.
 	}
 
 	// obtain a udp connection
-	c, err := h.options.Router.Dial(ctx, "udp", "") // UDP association
+	var buf bytes.Buffer
+	c, err := h.options.Router.Dial(ctxvalue.ContextWithBuffer(ctx, &buf), "udp", "") // UDP association
+	ro.Route = buf.String()
 	if err != nil {
 		log.Error(err)
 		return err