feat: support http(s)_proxy

feat: add dns.serve_6 flag
feat: multi ips, change default config
2026-10-19 16:14:33 +00:00 · 2024-09-10 07:40:08 +08:00 · 2024-05-25 23:06:17 +08:00 · 2024-05-14 14:06:46 +08:00 · 2024-05-14 13:23:25 +08:00 · 2024-05-08 13:36:21 +08:00
28 changed files with 786 additions and 694 deletions
@@ -1,3 +1,4 @@
+# 远程、上游连接方式
 remote {
    type = "sower"
    addr = "proxy.com"
@@ -7,19 +8,32 @@ remote {
 }

 dns {
-    serve = "127.0.0.1"
+    disable = false
+    # 监听该 IP 的 UDP(53)、TCP(80、443) 端口，DNS 会将请求导向这个地址
+    serve_ips = ["127.0.0.1"]
+    # 监听的网络接口
+    serve_iface = "lo"
+    # 必填，优先使用 DHCP 中的 DNS 服务器，如果没有则使用该地址
    fallback = "223.5.5.5"
 }

 socks_5 {
-    addr = ":1080"
+    disable = false
+    # 不写 IP 则监听所有 IP
+    addr = "127.0.0.1:1080"
 }

+# 路由规则，各规则优先级:
+# 禁止访问规则 > 直接访问规则 > 代理访问规则 > GEOIP 规则
+# file 字段可填 URL 或本地文件路径，URL 将通过代理请求
+
+# 禁止访问规则。被命中的请求，将被禁止访问。可用于广告过滤之类的目的
 router "block" {
    file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/adlist/adlist.txt"
    rules = []
 }

+# 直接访问规则。被命中的请求，将被直接访问，不再通过代理
 router "direct" {
    file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/chinalist/chinalist.txt"
    rules = [
@@ -35,6 +49,7 @@ router "direct" {
      ]
 }

+# 代理访问规则。被命中的请求，将通过代理进行转发
 router "proxy" {
    file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/gfwlist/gfwlist.txt"
    rules = [
@@ -65,8 +80,11 @@ router "proxy" {
    ]
 }

+# GEOIP 规则。大陆境内的 IP，将直接访问。
+# 非大陆境内的 IP，将通过另一套检测逻辑，确定是否需要进行代理。
+# 为避免误伤一些非标页面端口(除 80/443 外)，该规则只在 Socks5 模式下生效
 router "country" {
-    mmdb = "Country.mmdb"  # https://github.com/alecthw/mmdb_china_ip_list
+    // mmdb = "Country.mmdb"  # https://github.com/alecthw/mmdb_china_ip_list
    file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/chnroute/chnroute.txt"
    rules = [
        "127.0.0.0/8",
@@ -15,6 +15,6 @@
 		<key>RunAtLoad</key>
            <true/>
        <key>WorkingDirectory</key>
-            <string>/usr/local/etc</string>
+            <string>/usr/local/etc/sower</string>
 	</dict>
 </plist>
@@ -6,6 +6,8 @@ After=network.target
 Type=simple
 WorkingDirectory=/etc/sower
 ExecStart=/usr/local/bin/sower -f /etc/sower/sower.hcl
+Restart=on-failure
+RestartSec=1min

 [Install]
 WantedBy=multi-user.target
@@ -0,0 +1,92 @@
+[remote] # 远程、上游连接方式
+type = "sower"
+addr = "proxy.com"
+password = "I_am_Passw0rd"
+# type: "socks5"
+# addr: "127.0.0.1:7890"
+
+[dns]
+disable = false
+# 监听该 IP 的 UDP(53)、TCP(80、443) 端口，DNS 会将请求导向这个地址
+serve_ips = ["127.0.0.1"]
+# 监听的网络接口
+# serve_iface = "lo"
+
+# 必填，优先使用 DHCP 中的 DNS 服务器，如果没有则使用该地址
+fallback = "223.5.5.5"
+
+[socks_5]
+disable = false
+# 不写 IP 则监听所有 IP
+addr = "127.0.0.1:1080"
+
+# 路由规则，各规则优先级:
+# 禁止访问规则 > 直接访问规则 > 代理访问规则 > GEOIP 规则
+# file 字段可填 URL 或本地文件路径，URL 将通过代理请求
+
+# 禁止访问规则。被命中的请求，将被禁止访问。可用于广告过滤之类的目的
+[router.block]
+file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/adlist/adlist.txt"
+rules = []
+
+# 直接访问规则。被命中的请求，将被直接访问，不再通过代理
+[router.direct]
+file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/chinalist/chinalist.txt"
+rules = [
+  "imap.*.*",
+  "imap.*.*.*",
+  "smtp.*.*",
+  "smtp.*.*.*",
+  "pop.*.*",
+  "pop.*.*.*",
+  "pop3.*.*",
+  "pop3.*.*.*",
+  "**.cn",
+]
+
+# 代理访问规则。被命中的请求，将通过代理进行转发
+[router.proxy]
+file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/gfwlist/gfwlist.txt"
+rules = [
+  "**.google.*",
+  "**.goo.gl",
+  "**.googleusercontent.com",
+  "**.googleapis.com",
+  "*.googlesource.com",
+  "**.youtube.com",
+  "**.ytimg.com",
+  "**.ggpht.com",
+  "**.googlevideo.com",
+  "**.facebook.com",
+  "**.fbcdn.net",
+  "**.twitter.com",
+  "**.twimg.com",
+  "**.blogspot.com",
+  "**.appspot.com",
+  "**.wikipedia.org",
+  "**.wikimedia.org",
+  "*.cloudfront.net",
+  "**.amazon.com",
+  "**.amazonaws.com",
+  "*.githubusercontent.com",
+  "*.githubassets.com",
+  "*.github.*",
+  "lookup-api.apple.com",
+]
+
+# GEOIP 规则。大陆境内的 IP，将直接访问。
+# 非大陆境内的 IP，将通过另一套检测逻辑，确定是否需要进行代理。
+# 为避免误伤一些非标页面端口(除 80/443 外)，该规则只在 Socks5 模式下生效
+[router.country]
+mmdb = "Country.mmdb" # https://github.com/alecthw/mmdb_china_ip_list
+file = "https://raw.githubusercontent.com/pexcn/daily/gh-pages/chnroute/chnroute.txt"
+rules = [
+  "127.0.0.0/8",
+  "172.16.0.0/12",
+  "192.168.0.0/16",
+  "10.0.0.0/8",
+  "17.0.0.0/8",
+  "100.64.0.0/10",
+  "224.0.0.0/4",
+  "fe80::/10",
+]
@@ -0,0 +1,89 @@
+remote: # 远程、上游连接方式
+  type: "sower"
+  addr: "proxy.com"
+  password: "I_am_Passw0rd"
+  # type: "socks5"
+  # addr: "127.0.0.1:7890"
+
+dns:
+  disable: false
+  # 监听该 IP 的 UDP(53)、TCP(80、443) 端口，DNS 会将请求导向这个地址
+  serve_ips: 
+    - "127.0.0.1"
+  # 监听的网络接口
+  serve_iface: "lo"
+  # 必填，优先使用 DHCP 中的 DNS 服务器，如果没有则使用该地址
+  fallback: "223.5.5.5"
+
+socks_5:
+  disable: false
+  # 不写 IP 则监听所有 IP
+  addr: "127.0.0.1:1080"
+
+# 路由规则，各规则优先级:
+# 禁止访问规则 > 直接访问规则 > 代理访问规则 > GEOIP 规则
+# file 字段可填 URL 或本地文件路径，URL 将通过代理请求
+router:
+  # 禁止访问规则。被命中的请求，将被禁止访问。可用于广告过滤之类的目的
+  block:
+    file: "https://raw.githubusercontent.com/pexcn/daily/gh-pages/adlist/adlist.txt"
+    rules: []
+
+  # 直接访问规则。被命中的请求，将被直接访问，不再通过代理
+  direct:
+    file: "https://raw.githubusercontent.com/pexcn/daily/gh-pages/chinalist/chinalist.txt"
+    rules:
+      - "imap.*.*"
+      - "imap.*.*.*"
+      - "smtp.*.*"
+      - "smtp.*.*.*"
+      - "pop.*.*"
+      - "pop.*.*.*"
+      - "pop3.*.*"
+      - "pop3.*.*.*"
+      - "**.cn"
+
+  # 代理访问规则。被命中的请求，将通过代理进行转发
+  proxy:
+    file: "https://raw.githubusercontent.com/pexcn/daily/gh-pages/gfwlist/gfwlist.txt"
+    rules:
+      - "**.google.*"
+      - "**.goo.gl"
+      - "**.googleusercontent.com"
+      - "**.googleapis.com"
+      - "*.googlesource.com"
+      - "**.youtube.com"
+      - "**.ytimg.com"
+      - "**.ggpht.com"
+      - "**.googlevideo.com"
+      - "**.facebook.com"
+      - "**.fbcdn.net"
+      - "**.twitter.com"
+      - "**.twimg.com"
+      - "**.blogspot.com"
+      - "**.appspot.com"
+      - "**.wikipedia.org"
+      - "**.wikimedia.org"
+      - "*.cloudfront.net"
+      - "**.amazon.com"
+      - "**.amazonaws.com"
+      - "*.githubusercontent.com"
+      - "*.githubassets.com"
+      - "*.github.*"
+      - "lookup-api.apple.com"
+
+  # GEOIP 规则。大陆境内的 IP，将直接访问。
+  # 非大陆境内的 IP，将通过另一套检测逻辑，确定是否需要进行代理。
+  # 为避免误伤一些非标页面端口(除 80/443 外)，该规则只在 Socks5 模式下生效
+  country:
+    mmdb: "Country.mmdb" # https://github.com/alecthw/mmdb_china_ip_list
+    file: "https://raw.githubusercontent.com/pexcn/daily/gh-pages/chnroute/chnroute.txt"
+    rules:
+      - "127.0.0.0/8"
+      - "172.16.0.0/12"
+      - "192.168.0.0/16"
+      - "10.0.0.0/8"
+      - "17.0.0.0/8"
+      - "100.64.0.0/10"
+      - "224.0.0.0/4"
+      - "fe80::/10"
@@ -7,6 +7,8 @@ Type=simple
 ExecStart=/usr/local/bin/sowerd
 Environment="FAKE_SITE=127.0.0.1:8080"
 Environment="PASSWORD=I_am_Passw0rd"
+Restart=on-failure
+RestartSec=1min

 [Install]
 WantedBy=multi-user.target
@@ -10,7 +10,7 @@ jobs:
    steps:
      - uses: actions/setup-go@v2
        with:
-          go-version: ^1.17
+          go-version: ^1.18
      - uses: actions/checkout@v2

      - name: build matrix
@@ -18,32 +18,32 @@ jobs:
          mv .github/* . || true

          make build GO='GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go'
-          tar czvf sower-linux-amd64.tar.gz sower sowerd sower.hcl sower.service sowerd.service
+          tar czvf sower-linux-amd64.tar.gz sower sowerd sower.hcl sower.yaml sower.toml sower.service sowerd.service
          make clean
          make build GO='GOOS=linux GOARCH=arm CGO_ENABLED=0 go'
-          tar czvf sower-linux-arm.tar.gz sower sowerd sower.hcl sower.service sowerd.service
+          tar czvf sower-linux-arm.tar.gz sower sowerd sower.hcl sower.yaml sower.toml sower.service sowerd.service
          make clean
          make build GO='GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go'
-          tar czvf sower-linux-arm64.tar.gz sower sowerd sower.hcl sower.service sowerd.service
+          tar czvf sower-linux-arm64.tar.gz sower sowerd sower.hcl sower.yaml sower.toml sower.service sowerd.service
          make clean
          make build GO='GOOS=linux GOARCH=mips CGO_ENABLED=0 go'
-          tar czvf sower-linux-mips.tar.gz sower sowerd sower.hcl sower.service sowerd.service
+          tar czvf sower-linux-mips.tar.gz sower sowerd sower.hcl sower.yaml sower.toml sower.service sowerd.service
          make clean
          make build GO='GOOS=linux GOARCH=mipsle CGO_ENABLED=0 go'
-          tar czvf sower-linux-mipsle.tar.gz sower sowerd sower.hcl sower.service sowerd.service
+          tar czvf sower-linux-mipsle.tar.gz sower sowerd sower.hcl sower.yaml sower.toml sower.service sowerd.service
          make clean

          make build GO='GOOS=darwin GOARCH=amd64 CGO_ENABLED=0 go'
-          tar czvf sower-darwin-amd64.tar.gz sower sowerd sower.hcl sower.plist
+          tar czvf sower-darwin-amd64.tar.gz sower sowerd sower.hcl sower.yaml sower.toml sower.plist
          make clean
          make build GO='GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go'
-          tar czvf sower-darwin-arm64.tar.gz sower sowerd sower.hcl sower.plist
+          tar czvf sower-darwin-arm64.tar.gz sower sowerd sower.hcl sower.yaml sower.toml sower.plist
          make clean

          make build GO='GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go'
          mv sower sower.exe
          mv sowerd sowerd.exe
-          tar czvf sower-windows-amd64.tar.gz sower.exe sowerd.exe sower.hcl sower_run.vbs
+          tar czvf sower-windows-amd64.tar.gz sower.exe sowerd.exe sower.hcl sower.yaml sower.toml sower_run.vbs
          make clean

      - uses: ncipollo/release-action@v1
@@ -18,6 +18,7 @@
 .vscode
 .idea
 **.env
+/bin


 **.mmdb
@@ -8,31 +8,31 @@

 中文介绍见 [Wiki](https://github.com/wweir/sower/wiki)

-The sower is a cross-platform intelligent transparent proxy tool. It provide both socks5 proxy and DNS-based proxy. All these kinds of proxy support intelligent router.
+Sower is a cross-platform intelligent transparent proxy tool. It provides both socks5 proxy and DNS-based proxy. All these kinds of proxies support intelligent routing.

-If you already have another proxy solution, you can use it's socks5(h) service as a parent proxy to enjoy the sower's intelligent router.
+If you already have another proxy solution, you can use its socks5(h) service as a parent proxy to enjoy sower's intelligent routing.

 ## Installation

-To enjoy the sower, you need to deploy sower on both server-side(sowerd) and client-side(sower).
+To enjoy sower, you need to deploy sower on both server-side(sowerd) and client-side(sower).

 ## Sowerd

-_If you wanna use sower as secondary proxy to provide intelligent router, you can skip sowerd._
+_If you want to use sower as a secondary proxy to provide intelligent routing, you can skip sowerd._

-At the server-side, the sowerd runs just like a web server proxy. It will occupy two ports `80` / `443`.
+On the server-side, sowerd runs just like a web server proxy. It will bind two ports `80` / `443`.

-You can use your own certificate or the certificate automatically applied for by the sowerd from [`Let's Encrypt`](https://letsencrypt.org/).
+You can use your own certificate or the certificate automatically applied for by sowerd from [`Let's Encrypt`](https://letsencrypt.org/).

 There are two ways to run the sowerd service:

-1. run the shell command with root permission
+1. Run the command with root permission

   ```shell
   # sowerd -password XXX -fake_site 127.0.0.1:8080
   ```

-2. install as a systemd service
+2. Install as a systemd service

   ```service
   [Unit]
@@ -51,20 +51,21 @@ There are two ways to run the sowerd service:

 ## Sower

-A config file is required in sower client side. [Here](https://github.com/wweir/sower/wiki/sower.hcl) is an usable example in China.
+A config file is required on the sower client side. [Here](https://github.com/wweir/sower/wiki/sower.hcl) is a usable example in China.

-`Sower` will take 4 port by default with root permission. They are: `udp(53)` / `tcp(80)` / `tcp(443)` / `tcp(1080)`.
+`Sower` will bind 4 ports by default with root permission. They are: `udp(53)` / `tcp(80)` / `tcp(443)` / `tcp(1080)`.

-After do the next three step, you can enjoy the intelligent transparent proxy solution:
+After doing the next three steps, you can enjoy the intelligent transparent proxy solution:

-1. run the command line with root permission:
+1. Run the command with root permission:

   ```shell
   # sower -f sower.hcl
   ```

-2. changing your DNS server to `127.0.0.1` and
-3. setting your proxy to `socks5h://127.0.0.1:1080`.
+2. Change your DNS server to `127.0.0.1`.
+
+3. Set your proxy to `socks5h://127.0.0.1:1080`.

 ## Architecture

@@ -2,11 +2,12 @@ package main

 import (
 	"bufio"
+	"compress/gzip"
 	"io"
 	"net"
 	"net/http"
-	"net/url"
 	"os"
+	"runtime"
 	"strconv"
 	"strings"
 	"time"
@@ -17,7 +18,8 @@ import (
 	"github.com/cristalhq/aconfig/aconfigyaml"
 	"github.com/miekg/dns"
 	"github.com/pkg/errors"
-	"github.com/wweir/deferlog/log"
+	"github.com/sower-proxy/deferlog/log"
+	"github.com/wweir/sower/pkg/suffixtree"
 	"github.com/wweir/sower/router"
 )

@@ -32,13 +34,15 @@ var (
 		}

 		DNS struct {
-			Disable  bool   `default:"false" usage:"disable DNS proxy"`
-			Serve    string `default:"127.0.0.1" required:"true" usage:"dns server ip"`
-			Fallback string `default:"223.5.5.5" usage:"fallback dns server"`
+			Disable    bool   `default:"false" usage:"disable DNS proxy"`
+			Serve      string `default:"127.0.0.1" required:"true" usage:"dns server ip"`
+			Serve6     string `usage:"dns server ipv6, eg: ::1"`
+			ServeIface string `usage:"use the IP in the net interface, if serve ip not setted. eg: eth0"`
+			Fallback   string `default:"223.5.5.5" required:"true" usage:"fallback dns server"`
 		}
 		Socks5 struct {
 			Disable bool   `default:"false" usage:"disable sock5 proxy"`
-			Addr    string `default:":1080" usage:"socks5 listen address"`
+			Addr    string `default:"127.0.0.1:1080" usage:"socks5 listen address"`
 		} `flag:"socks5"`

 		Router struct {
@@ -84,6 +88,25 @@ func init() {
 			Msg("Load config")
 	}

+	if conf.DNS.ServeIface != "" {
+		iface, err := net.InterfaceByName(conf.DNS.ServeIface)
+		log.DebugFatal(err).Str("iface", conf.DNS.ServeIface).Msg("get iface")
+		addrs, err := iface.Addrs()
+		log.InfoFatal(err).Str("iface", conf.DNS.ServeIface).Msg("get iface addrs")
+		for _, addr := range addrs {
+			ip, _, err := net.ParseCIDR(addr.String())
+			log.InfoFatal(err).Str("iface", conf.DNS.ServeIface).
+				Msg("parse iface addr: " + addr.String())
+
+			if ip.To4() != nil && conf.DNS.Serve == "" {
+				conf.DNS.Serve = ip.String()
+			}
+			if ip.To16() != nil && conf.DNS.Serve6 == "" {
+				conf.DNS.Serve = ip.String()
+			}
+		}
+	}
+
 	conf.Router.Direct.Rules = append(conf.Router.Direct.Rules,
 		conf.Remote.Addr, "**.in-addr.arpa", "**.ip6.arpa")
 	log.Info().
@@ -94,36 +117,38 @@ func init() {
 }

 func main() {
-	proxtDial := GenProxyDial(conf.Remote.Type, conf.Remote.Addr, conf.Remote.Password)
-	r := router.NewRouter(conf.DNS.Serve, conf.DNS.Fallback, conf.Router.Country.MMDB, proxtDial)
-	r.SetRules(conf.Router.Block.Rules, conf.Router.Direct.Rules, conf.Router.Proxy.Rules,
-		conf.Router.Country.Rules)
+	proxyDial := GenProxyDial(conf.Remote.Type, conf.Remote.Addr, conf.Remote.Password)
+	r := router.NewRouter(conf.DNS.Serve, conf.DNS.Fallback, conf.Router.Country.MMDB, proxyDial)
+	r.BlockRule = suffixtree.NewNodeFromRules(conf.Router.Block.Rules...)
+	r.DirectRule = suffixtree.NewNodeFromRules(conf.Router.Direct.Rules...)
+	r.ProxyRule = suffixtree.NewNodeFromRules(conf.Router.Proxy.Rules...)
+	r.AddCountryCIDRs(conf.Router.Country.Rules...)

-	go func() {
-		if conf.DNS.Disable {
-			log.Info().Msg("DNS proxy disabled")
-			return
+	if conf.DNS.Disable {
+		log.Info().Msg("DNS proxy disabled")
+	} else {
+		ips := make([]string, 0, 2)
+		if strings.TrimSpace(conf.DNS.Serve) != "" {
+			ips = append(ips, conf.DNS.Serve)
 		}
+		if strings.TrimSpace(conf.DNS.Serve6) != "" {
+			ips = append(ips, conf.DNS.Serve6)
+		}
+		for _, ip := range ips {
+			lnHTTP, err := net.Listen("tcp", net.JoinHostPort(ip, "80"))
+			log.DebugFatal(err).Str("listen_on", ip).Msg("listen port 80")
+			go ServeHTTP(lnHTTP, r)

-		lnHTTP, err := net.Listen("tcp", net.JoinHostPort(conf.DNS.Serve, "80"))
-		if err != nil {
-			log.Fatal().Err(err).Msg("listen port")
-		}
-		go ServeHTTP(lnHTTP, r)
+			lnHTTPS, err := net.Listen("tcp", net.JoinHostPort(ip, "443"))
+			log.DebugFatal(err).Str("listen_on", ip).Msg("listen port 443")
+			go ServeHTTPS(lnHTTPS, r)

-		lnHTTPS, err := net.Listen("tcp", net.JoinHostPort(conf.DNS.Serve, "443"))
-		if err != nil {
-			log.Fatal().Err(err).Msg("listen port")
+			go func(ip string) {
+				err := dns.ListenAndServe(net.JoinHostPort(ip, "53"), "udp", r)
+				log.InfoFatal(err).Str("listen_on", ip).Msg("serve dns")
+			}(ip)
 		}
-		go ServeHTTPS(lnHTTPS, r)
-
-		log.Info().
-			Str("listen_on", conf.DNS.Serve).
-			Msg("DNS proxy started")
-		if err := dns.ListenAndServe(net.JoinHostPort(conf.DNS.Serve, "53"), "udp", r); err != nil {
-			log.Fatal().Err(err).Msg("serve dns")
-		}
-	}()
+	}

 	go func() {
 		if conf.Socks5.Disable {
@@ -140,30 +165,42 @@ func main() {
 	}()

 	start := time.Now()
-	conf.Router.Block.Rules = append(conf.Router.Block.Rules,
-		loadRules(proxtDial, conf.Router.Block.File, conf.Router.Block.FilePrefix)...)
-	conf.Router.Direct.Rules = append(conf.Router.Direct.Rules,
-		loadRules(proxtDial, conf.Router.Direct.File, conf.Router.Direct.FilePrefix)...)
-	conf.Router.Proxy.Rules = append(conf.Router.Proxy.Rules,
-		loadRules(proxtDial, conf.Router.Proxy.File, conf.Router.Proxy.FilePrefix)...)
-	conf.Router.Country.Rules = append(conf.Router.Country.Rules,
-		loadRules(proxtDial, conf.Router.Country.File, conf.Router.Country.FilePrefix)...)
-	r.SetRules(conf.Router.Block.Rules, conf.Router.Direct.Rules, conf.Router.Proxy.Rules,
-		conf.Router.Country.Rules)
+	loadRule(r.BlockRule, proxyDial, conf.Router.Block.File, conf.Router.Block.FilePrefix)
+	loadRule(r.DirectRule, proxyDial, conf.Router.Direct.File, conf.Router.Direct.FilePrefix)
+	loadRule(r.ProxyRule, proxyDial, conf.Router.Proxy.File, conf.Router.Proxy.FilePrefix)
+	for line := range fetchRuleFile(proxyDial, conf.Router.Country.File) {
+		r.AddCountryCIDRs(line)
+	}

 	log.Info().
-		Dur("spend", time.Since(start)).
-		Int("blockRule", len(conf.Router.Block.Rules)).
-		Int("directRule", len(conf.Router.Direct.Rules)).
-		Int("proxyRule", len(conf.Router.Proxy.Rules)).
-		Int("countryRule", len(conf.Router.Country.Rules)).
+		Dur("took", time.Since(start)).
+		Uint64("blockRule", r.BlockRule.Count).
+		Uint64("directRule", r.DirectRule.Count).
+		Uint64("proxyRule", r.ProxyRule.Count).
 		Msg("Loaded rules, proxy started")
+	runtime.GC()
 	select {}
 }

-func loadRules(proxyDial router.ProxyDialFn, file, linePrefix string) []string {
+func loadRule(rule *suffixtree.Node, proxyDial router.ProxyDialFn, file, linePrefix string) {
+	for line := range fetchRuleFile(proxyDial, file) {
+		rule.Add(linePrefix + line)
+	}
+	rule.GC()
+}
+
+func fetchRuleFile(proxyDial router.ProxyDialFn, file string) <-chan string {
+	if file == "" {
+		return make(chan string)
+	}
+
 	var loadFn func() (io.ReadCloser, error)
-	if _, err := url.Parse(file); err == nil {
+	if _, err := os.Stat(file); err == nil {
+		// load rule file from local file
+		loadFn = func() (io.ReadCloser, error) {
+			return os.Open(file)
+		}
+	} else {
 		// load rule file from remote by HTTP
 		client := &http.Client{
 			Transport: &http.Transport{
@@ -176,7 +213,9 @@ func loadRules(proxyDial router.ProxyDialFn, file, linePrefix string) []string {
 		}

 		loadFn = func() (io.ReadCloser, error) {
-			resp, err := client.Get(file)
+			req, _ := http.NewRequest(http.MethodGet, file, nil)
+			req.Header.Add("Accept-Encoding", "gzip")
+			resp, err := client.Do(req)
 			if err != nil {
 				return nil, err
 			}
@@ -188,12 +227,6 @@ func loadRules(proxyDial router.ProxyDialFn, file, linePrefix string) []string {

 			return resp.Body, nil
 		}
-
-	} else {
-		// load rule file from local file
-		loadFn = func() (io.ReadCloser, error) {
-			return os.Open(file)
-		}
 	}

 	// load rule file, retry 10 times
@@ -207,34 +240,38 @@ func loadRules(proxyDial router.ProxyDialFn, file, linePrefix string) []string {
 		time.Sleep(i * i * 100 * time.Millisecond)
 		rc, err = loadFn()
 	}
-	if err != nil {
-		log.Fatal().Err(err).
-			Str("file", file).
-			Msg("load config file")
-	}
-	defer rc.Close()
+	log.InfoFatal(err).
+		Str("file", file).
+		Msg("fetch rule file")

-	// parse rule file into rule tree
-	var lines []string
-	br := bufio.NewReader(rc)
-	for {
-		line, _, err := br.ReadLine()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			log.Error().Err(err).
-				Str("file", file).
-				Msg("read line")
-			return nil
+	ch := make(chan string, 100)
+	go func() {
+		defer rc.Close()
+		defer close(ch)
+		if gr, err := gzip.NewReader(rc); err == nil {
+			rc = gr
+			defer gr.Close()
 		}

-		if strings.TrimSpace(string(line)) == "" {
-			continue
+		br := bufio.NewReader(rc)
+		for {
+			line, _, err := br.ReadLine()
+			if err == io.EOF {
+				return
+			} else if err != nil {
+				log.Error().Err(err).
+					Str("file", file).
+					Msg("read line")
+				return
+			}
+
+			if strings.TrimSpace(string(line)) == "" {
+				continue
+			}
+
+			ch <- string(line)
 		}
+	}()

-		// use line content as suffix
-		lines = append(lines, linePrefix+string(line))
-	}
-
-	return lines
+	return ch
 }
@@ -8,14 +8,14 @@ import (
 	"time"

 	"github.com/pkg/errors"
-	"github.com/wweir/deferlog/log"
-	"github.com/wweir/sower/pkg/teeconn"
+	"github.com/sower-proxy/conns/relay"
+	"github.com/sower-proxy/conns/teeconn"
+	"github.com/sower-proxy/deferlog/log"
 	"github.com/wweir/sower/router"
 	"github.com/wweir/sower/transport"
 	"github.com/wweir/sower/transport/socks5"
 	"github.com/wweir/sower/transport/sower"
 	"github.com/wweir/sower/transport/trojan"
-	"github.com/wweir/sower/util"
 )

 func GenProxyDial(proxyType, proxyHost, proxyPassword string) router.ProxyDialFn {
@@ -97,8 +97,8 @@ func ServeHTTP(ln net.Listener, r *router.Router) {
 	defer rc.Close()

 	teeconn.Stop().Reread()
-	util.Relay(teeconn, rc)
-	log.Debug().
+	err = relay.Relay(teeconn, rc)
+	log.DebugWarn(err).
 		Str("host", req.Host).
 		Dur("spend", time.Since(start)).
 		Msg("serve http")
@@ -134,8 +134,8 @@ func ServeHTTPS(ln net.Listener, r *router.Router) {
 	defer rc.Close()

 	teeconn.Stop().Reread()
-	util.Relay(teeconn, rc)
-	log.Debug().
+	err = relay.Relay(teeconn, rc)
+	log.DebugWarn(err).
 		Str("host", domain).
 		Dur("spend", time.Since(start)).
 		Msg("serve http")
@@ -150,7 +150,23 @@ func ServeSocks5(ln net.Listener, r *router.Router) {
 	go ServeSocks5(ln, r)
 	defer conn.Close()

-	addr, err := socks5.New().Unwrap(conn)
+	teeConn := teeconn.New(conn)
+
+	buf1 := make([]byte, 1)
+	if _, err := teeConn.Read(buf1); err != nil {
+		log.Warn().Err(err).
+			Msg("read socks5 version")
+		return
+	}
+
+	if buf1[0] != 5 {
+		teeConn.Reread()
+		serveHttpProxy(teeConn, r)
+		return
+	}
+
+	teeConn.Stop().Reread()
+	addr, err := socks5.New().Unwrap(teeConn)
 	if err != nil {
 		log.Warn().Err(err).
 			Msgf("parse socks5 target: %s", addr)
@@ -158,5 +174,46 @@ func ServeSocks5(ln net.Listener, r *router.Router) {
 	}

 	host, port := addr.(*socks5.AddrHead).Addr()
-	r.RouteHandle(conn, host, port)
+	r.RouteHandle(teeConn, host, port)
+}
+
+func serveHttpProxy(teeConn *teeconn.Conn, r *router.Router) {
+	req, err := http.ReadRequest(bufio.NewReader(teeConn))
+	if err != nil {
+		log.Warn().Err(err).
+			Msg("read http request")
+		return
+	}
+
+	teeConn.Stop()
+	switch req.Method {
+	case "CONNECT":
+		if _, err := teeConn.Write([]byte(req.Proto + " 200 Connection established\r\n\r\n")); err != nil {
+			log.Warn().Err(err).
+				Msg("write https proxy response")
+			return
+		}
+
+		host, port, err := router.ParseHostPort(req.Host, 443)
+		if err != nil {
+			log.Warn().Err(err).
+				Msg("parse https_proxy target")
+			return
+		}
+
+		rc, err := r.ProxyDial("tcp", host, port)
+		if err != nil {
+			log.Warn().Err(err).
+				Str("host", host).
+				Msg("dial proxy")
+			return
+		}
+		defer rc.Close()
+
+		relay.Relay(teeConn, rc)
+
+	default:
+		teeConn.Reread()
+		r.RouteHandle(teeConn, req.Host, 80)
+	}
 }
@@ -9,12 +9,12 @@ import (
 	"time"

 	"github.com/cristalhq/aconfig"
-	"github.com/wweir/deferlog"
-	"github.com/wweir/deferlog/log"
-	"github.com/wweir/sower/pkg/teeconn"
+	"github.com/sower-proxy/conns/relay"
+	"github.com/sower-proxy/conns/teeconn"
+	"github.com/sower-proxy/deferlog"
+	"github.com/sower-proxy/deferlog/log"
 	"github.com/wweir/sower/transport/sower"
 	"github.com/wweir/sower/transport/trojan"
-	"github.com/wweir/sower/util"
 	"golang.org/x/crypto/acme/autocert"
 )

@@ -24,7 +24,7 @@ var (
 	conf = struct {
 		ServeIP  string `usage:"listen to port 80 443 of this IP, eg: 0.0.0.0"`
 		Password string `required:"true"`
-		FakeSite string `required:"true" default:"127.0.0.1:8080" usage:"fake site address"`
+		FakeSite string `default:"127.0.0.1:8080" usage:"fake site address or directoy"`

 		Cert struct {
 			Email string
@@ -87,7 +87,12 @@ func main() {
 		Str("IP", conf.ServeIP).
 		Msg("Start listen HTTPS service")

-	go serve443(ln, conf.FakeSite, sower.New(conf.Password), trojan.New(conf.Password))
+	if si, err := os.Stat(conf.FakeSite); err == nil && si.IsDir() {
+		http.NewFileTransport(http.Dir(conf.FakeSite))
+	} else if _, _, err := net.SplitHostPort(conf.FakeSite); err == nil {
+		go serve443(ln, conf.FakeSite, sower.New(conf.Password), trojan.New(conf.Password))
+	}
+
 	select {}
 }

@@ -124,7 +129,7 @@ func serve443(ln net.Listener, fakeSite string, sower *sower.Sower, trojan *troj
 	if addr, err = sower.Unwrap(teeconn); err == nil {
 		teeconn.Stop()

-		dur, err = util.RelayTo(teeconn, addr.String())
+		dur, err = relay.RelayTo(teeconn, addr.String())
 		return
 	}

@@ -133,11 +138,11 @@ func serve443(ln net.Listener, fakeSite string, sower *sower.Sower, trojan *troj
 	if addr, err = trojan.Unwrap(teeconn); err == nil {
 		teeconn.Stop()

-		dur, err = util.RelayTo(teeconn, addr.String())
+		dur, err = relay.RelayTo(teeconn, addr.String())
 		return
 	}

 	// 3. fallback to fake site
 	teeconn.Stop().Reread()
-	dur, err = util.RelayTo(teeconn, fakeSite)
+	dur, err = relay.RelayTo(teeconn, fakeSite)
 }
@@ -1,29 +1,37 @@
 module github.com/wweir/sower

-go 1.17
+go 1.22
+
+toolchain go1.22.3

 require (
-	github.com/cristalhq/aconfig v0.16.8
-	github.com/cristalhq/aconfig/aconfighcl v0.16.1
-	github.com/cristalhq/aconfig/aconfigtoml v0.16.1
-	github.com/cristalhq/aconfig/aconfigyaml v0.16.1
+	github.com/cristalhq/aconfig v0.18.5
+	github.com/cristalhq/aconfig/aconfighcl v0.17.1
+	github.com/cristalhq/aconfig/aconfigtoml v0.17.1
+	github.com/cristalhq/aconfig/aconfigyaml v0.17.1
 	github.com/krolaw/dhcp4 v0.0.0-20190909130307-a50d88189771
-	github.com/libp2p/go-reuseport v0.1.0
-	github.com/miekg/dns v1.1.43
-	github.com/oschwald/geoip2-golang v1.5.0
+	github.com/libp2p/go-reuseport v0.4.0
+	github.com/miekg/dns v1.1.59
+	github.com/oschwald/geoip2-golang v1.9.0
 	github.com/pkg/errors v0.9.1
-	github.com/ulule/deepcopier v0.0.0-20200430083143-45decc6639b6
-	github.com/wweir/deferlog v0.1.0
-	golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa
+	github.com/sower-proxy/conns v0.0.3
+	github.com/sower-proxy/deferlog v1.0.7
+	github.com/sower-proxy/mem v0.0.3
+	golang.org/x/crypto v0.23.0
 )

 require (
-	github.com/BurntSushi/toml v0.4.1 // indirect
+	github.com/BurntSushi/toml v1.3.2 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/oschwald/maxminddb-golang v1.8.0 // indirect
-	github.com/rs/zerolog v1.23.0 // indirect
-	golang.org/x/net v0.0.0-20211109214657-ef0fda0de508 // indirect
-	golang.org/x/sys v0.0.0-20211109184856-51b60fd695b3 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/oschwald/maxminddb-golang v1.12.0 // indirect
+	github.com/rs/zerolog v1.32.0 // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
+	golang.org/x/tools v0.21.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -1,17 +1,16 @@
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v0.4.1 h1:GaI7EiDXDRfa8VshkTj7Fym7ha+y8/XxIgD2okUIjLw=
-github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/cristalhq/aconfig v0.16.1/go.mod h1:NXaRp+1e6bkO4dJn+wZ71xyaihMDYPtCSvEhMTm/H3E=
-github.com/cristalhq/aconfig v0.16.8 h1:lg8i0XHgfhvsnjNM5q/ou6jIHDRXlbBybjRP9t2fWuw=
-github.com/cristalhq/aconfig v0.16.8/go.mod h1:NXaRp+1e6bkO4dJn+wZ71xyaihMDYPtCSvEhMTm/H3E=
-github.com/cristalhq/aconfig/aconfighcl v0.16.1 h1:RiziovFKOwB6+H1LCD7DXxrFgoKDEJxxYLSsAOsj+vQ=
-github.com/cristalhq/aconfig/aconfighcl v0.16.1/go.mod h1:YvZyVGtty/7yIdyOPPl68u7ENaUMq6ybZAph+n3g4II=
-github.com/cristalhq/aconfig/aconfigtoml v0.16.1 h1:q9DJfJqdLvZj7vL3bOIR6QM0ySpA0i6X8CZ8FNob6nc=
-github.com/cristalhq/aconfig/aconfigtoml v0.16.1/go.mod h1:VfRDnJBq09TZXiQdnnd4CBsNyj4s7AEDJlCxDSDt5DI=
-github.com/cristalhq/aconfig/aconfigyaml v0.16.1 h1:ghmzWFolCuja6BzBvHkNAn2Qsewu6xqdAXQyWnXjvZw=
-github.com/cristalhq/aconfig/aconfigyaml v0.16.1/go.mod h1:UgM0LkO4TKbC0s/oUP2p5POM6QiQwNvOFXostf6con0=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/BurntSushi/toml v1.1.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cristalhq/aconfig v0.17.0/go.mod h1:NXaRp+1e6bkO4dJn+wZ71xyaihMDYPtCSvEhMTm/H3E=
+github.com/cristalhq/aconfig v0.18.5 h1:QqXH/Gy2c4QUQJTV2BN8UAuL/rqZ3IwhvxeC8OgzquA=
+github.com/cristalhq/aconfig v0.18.5/go.mod h1:NXaRp+1e6bkO4dJn+wZ71xyaihMDYPtCSvEhMTm/H3E=
+github.com/cristalhq/aconfig/aconfighcl v0.17.1 h1:/hJvmmoP3akvjY8qARiXgN30m/WXeBvpQdQ8v4DE8W8=
+github.com/cristalhq/aconfig/aconfighcl v0.17.1/go.mod h1:oOPqMmdUjVW6pKKO1zkOwQKHSUD0rlu8F5do+pylOQc=
+github.com/cristalhq/aconfig/aconfigtoml v0.17.1 h1:TA3xH8mALD8YeULsr4v87cMbKGBma35lWeRga4Xn11Q=
+github.com/cristalhq/aconfig/aconfigtoml v0.17.1/go.mod h1:xt4kCEjhgvHWO/oDGJHQHrW5CnvSEoBjJhRXVBdYbhQ=
+github.com/cristalhq/aconfig/aconfigyaml v0.17.1 h1:xCCbRKVmKrft9gQj3gHOq6U5PduasvlXEIsxtyzmFZ0=
+github.com/cristalhq/aconfig/aconfigyaml v0.17.1/go.mod h1:5DTsjHkvQ6hfbyxfG32roB1lF0U82rROtFaLxibL8V8=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -19,74 +18,53 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/krolaw/dhcp4 v0.0.0-20190909130307-a50d88189771 h1:t2c2B9g1ZVhMYduqmANSEGVD3/1WlsrEYNPtVoFlENk=
 github.com/krolaw/dhcp4 v0.0.0-20190909130307-a50d88189771/go.mod h1:0AqAH3ZogsCrvrtUpvc6EtVKbc3w6xwZhkvGLuqyi3o=
-github.com/libp2p/go-reuseport v0.1.0 h1:0ooKOx2iwyIkf339WCZ2HN3ujTDbkK0PjC7JVoP1AiM=
-github.com/libp2p/go-reuseport v0.1.0/go.mod h1:bQVn9hmfcTaoo0c9v5pBhOarsU1eNOBZdaAd2hzXRKU=
-github.com/miekg/dns v1.1.43 h1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=
-github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
-github.com/oschwald/geoip2-golang v1.5.0 h1:igg2yQIrrcRccB1ytFXqBfOHCjXWIoMv85lVJ1ONZzw=
-github.com/oschwald/geoip2-golang v1.5.0/go.mod h1:xdvYt5xQzB8ORWFqPnqMwZpCpgNagttWdoZLlJQzg7s=
-github.com/oschwald/maxminddb-golang v1.8.0 h1:Uh/DSnGoxsyp/KYbY1AuP0tYEwfs0sCph9p/UMXK/Hk=
-github.com/oschwald/maxminddb-golang v1.8.0/go.mod h1:RXZtst0N6+FY/3qCNmZMBApR19cdQj43/NM9VkrNAis=
+github.com/libp2p/go-reuseport v0.4.0 h1:nR5KU7hD0WxXCJbmw7r2rhRYruNRl2koHw8fQscQm2s=
+github.com/libp2p/go-reuseport v0.4.0/go.mod h1:ZtI03j/wO5hZVDFo2jKywN6bYKWLOy8Se6DrI2E1cLU=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/miekg/dns v1.1.59 h1:C9EXc/UToRwKLhK5wKU/I4QVsBUc8kE6MkHBkeypWZs=
+github.com/miekg/dns v1.1.59/go.mod h1:nZpewl5p6IvctfgrckopVx2OlSEHPRO/U4SYkRklrEk=
+github.com/oschwald/geoip2-golang v1.9.0 h1:uvD3O6fXAXs+usU+UGExshpdP13GAqp4GBrzN7IgKZc=
+github.com/oschwald/geoip2-golang v1.9.0/go.mod h1:BHK6TvDyATVQhKNbQBdrj9eAvuwOMi2zSFXizL3K81Y=
+github.com/oschwald/maxminddb-golang v1.12.0 h1:9FnTOD0YOhP7DGxGsq4glzpGy5+w7pq50AS6wALUMYs=
+github.com/oschwald/maxminddb-golang v1.12.0/go.mod h1:q0Nob5lTCqyQ8WT6FYgS1L7PXKVVbgiymefNwIjPzgY=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
-github.com/rs/zerolog v1.23.0 h1:UskrK+saS9P9Y789yNNulYKdARjPZuS35B8gJF2x60g=
-github.com/rs/zerolog v1.23.0/go.mod h1:6c7hFfxPOy7TacJc4Fcdi24/J0NKYGzjG8FWRI916Qo=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/ulule/deepcopier v0.0.0-20200430083143-45decc6639b6 h1:TtyC78WMafNW8QFfv3TeP3yWNDG+uxNkk9vOrnDu6JA=
-github.com/ulule/deepcopier v0.0.0-20200430083143-45decc6639b6/go.mod h1:h8272+G2omSmi30fBXiZDMkmHuOgonplfKIKjQWzlfs=
-github.com/wweir/deferlog v0.1.0 h1:jzVo2Toct+0Ei29P3BpjVJpNgCLyyMZYhi+zr7L0bLw=
-github.com/wweir/deferlog v0.1.0/go.mod h1:cHSuGypQc2+yDurLohzOdJ2TpaQqGNm/6EhzskmBGZM=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa h1:idItI2DDfCokpg0N51B2VtiLdJ4vAuXC9fnCb2gACo4=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20211109214657-ef0fda0de508 h1:v3NKo+t/Kc3EASxaKZ82lwK6mCf4ZeObQBduYFZHo7c=
-golang.org/x/net v0.0.0-20211109214657-ef0fda0de508/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190228124157-a34e9553db1e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191224085550-c709ea063b76/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211109184856-51b60fd695b3 h1:T6tyxxvHMj2L1R2kZg0uNMpS8ZhB9lRa9XRGTCSA65w=
-golang.org/x/sys v0.0.0-20211109184856-51b60fd695b3/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.32.0 h1:keLypqrlIjaFsbmJOBdB/qvyF8KEtCWHwobLp5l/mQ0=
+github.com/rs/zerolog v1.32.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/sower-proxy/conns v0.0.3 h1:3jbkvPhDwC+ph/NZi7Gywks9WakHK4ept7CkjTiNUJ8=
+github.com/sower-proxy/conns v0.0.3/go.mod h1:p3ZM/8MolzW4TN0LaiPJnwnhhif3y9sBi2vQEWHvwhg=
+github.com/sower-proxy/deferlog v1.0.7 h1:2gRkdTeSHPhnAj6uwBJ74ufqEmn1spT5o1Y3jGXY9zU=
+github.com/sower-proxy/deferlog v1.0.7/go.mod h1:TVXk/Pm7TAs1ZqayZfrxSbwCl+SSm7+p1xcEPkKHWvQ=
+github.com/sower-proxy/mem v0.0.3 h1:JK86etQ2QxRUXhs9JhoKYz5p3pFBSrI3UXVhwm44OzM=
+github.com/sower-proxy/mem v0.0.3/go.mod h1:tM3P+gCAZMVBnOixGVAHS34si9Iwj2HU6M4IVEv4rK0=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.21.0 h1:qc0xYgIbsSDt9EyWz05J5wfa7LOVW0YTLOXrqdLAWIw=
+golang.org/x/tools v0.21.0/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -14,10 +14,10 @@ import (
 var xid = make([]byte, 4)
 var broadcastAddr, _ = net.ResolveUDPAddr("udp", "255.255.255.255:67")

-func GetDNSServer() (string, error) {
+func GetDNSServer() ([]string, error) {
 	iface, err := PickInternetInterface()
 	if err != nil {
-		return "", errors.Wrap(err, "pick interface")
+		return nil, errors.Wrap(err, "pick interface")
 	}

 	rand.Read(xid)
@@ -29,31 +29,36 @@ func GetDNSServer() (string, error) {
 	var conn net.PacketConn
 	if runtime.GOOS == "windows" {
 		if conn, err = reuseport.ListenPacket("udp4", iface.IP.String()+":68"); err != nil {
-			return "", errors.Wrap(err, "listen dhcp")
+			return nil, errors.Wrap(err, "listen dhcp")
 		}
 	} else {
 		if conn, err = reuseport.ListenPacket("udp4", "0.0.0.0:68"); err != nil {
-			return "", errors.Wrap(err, "listen dhcp")
+			return nil, errors.Wrap(err, "listen dhcp")
 		}
 	}
 	defer conn.Close()
 	conn.SetDeadline(time.Now().Add(3 * time.Second))

 	if _, err := conn.WriteTo([]byte(pack), broadcastAddr); err != nil {
-		return "", errors.Wrap(err, "write broadcast")
+		return nil, errors.Wrap(err, "write broadcast")
 	}

 	buf := make([]byte, 1500 /*MTU*/)
 	n, _, err := conn.ReadFrom(buf)
 	if err != nil {
-		return "", errors.Wrap(err, "read dhcp offer")
+		return nil, errors.Wrap(err, "read dhcp offer")
 	}

 	pack = dhcp4.Packet(buf[:n])
 	dnsBytes := pack.ParseOptions()[dhcp4.OptionDomainNameServer]
-	if len(dnsBytes) < 4 {
-		return "", errors.New("no DNS setting in upstream network device")
+	if len(dnsBytes) < 4 || len(dnsBytes)%4 != 0 {
+		return nil, errors.New("invalid DNS setting in upstream network device")
 	}

-	return net.IPv4(dnsBytes[0], dnsBytes[1], dnsBytes[2], dnsBytes[3]).String(), nil
+	ips := []string{}
+	for i := 0; i < len(dnsBytes); i += 4 {
+		ips = append(ips, net.IP(dnsBytes[i:i+4]).String())
+	}
+
+	return ips, nil
 }
@@ -1,139 +0,0 @@
-package mem
-
-import (
-	"errors"
-	"reflect"
-	"sync"
-	"time"
-
-	"github.com/ulule/deepcopier"
-)
-
-// Data define the type which can speed up by mem cache
-type Data interface {
-	Fulfill(key string) (err error)
-}
-
-// Cache is the definition of cache, be careful of the memory usage
-type Cache struct {
-	old     *sync.Map
-	now     *sync.Map
-	barrier *sync.Map
-	rotate  <-chan time.Time
-	rwmutex *sync.RWMutex
-}
-
-// DefaultCache is default cache for surge
-var DefaultCache = New(time.Minute)
-
-// Remember is a surge, it provides a quite simple way to use cache
-func Remember(dst Data, key string) error {
-	return DefaultCache.Remember(dst, key)
-}
-
-// Delete is a surge, it delete a specified data in DefaultCache
-func Delete(dst Data, key string) {
-	DefaultCache.Delete(dst, key)
-}
-
-// New create a cache entity with a custom expiration time
-func New(rotateInterval time.Duration) *Cache {
-	return &Cache{
-		old:     &sync.Map{},
-		now:     &sync.Map{},
-		barrier: &sync.Map{},
-		rotate:  time.NewTicker(rotateInterval).C,
-		rwmutex: &sync.RWMutex{},
-	}
-}
-
-// Remember automatically save and retrieve data from a cache entity
-func (c *Cache) Remember(dst Data, key string) error {
-	rv := reflect.ValueOf(dst)
-	if rv.Kind() != reflect.Ptr {
-		panic("invalid not pointor type: " + reflect.TypeOf(dst).Name())
-	} else if rv.IsNil() {
-		return errors.New("invalid nil pointor")
-	}
-
-	c.rwmutex.RLock()
-	defer c.rwmutex.RUnlock()
-
-	// rotate logic, rwlock just protect fields in Cache, but not field content.
-	// So that, write lock just take a very short time, and simple read lock is
-	// just an atomic action, do not care the performance
-	select {
-	case <-c.rotate:
-		c.old = c.now
-		c.now = &sync.Map{}
-		c.barrier = &sync.Map{}
-	default:
-	}
-
-	// First: load from cache
-	if val, ok := c.now.Load(key); ok {
-		return deepcopier.Copy(val).To(dst)
-	}
-
-	// Second: load from old cache, or waitting the sigle groutine getting data
-	ch := make(chan struct{})
-	if chVal, ok := c.barrier.LoadOrStore(key, ch); ok {
-		close(ch) // the ch is not used
-
-		if val, ok := c.old.Load(key); ok {
-			return deepcopier.Copy(val).To(dst)
-		}
-
-		// type chan:  wait the sigle groutine getting data
-		// type error: already failed
-		if ch, ok = chVal.(chan struct{}); ok {
-			<-ch
-			if val, ok := c.now.Load(key); ok {
-				return deepcopier.Copy(val).To(dst)
-			}
-		}
-
-		val, _ := c.barrier.Load(key)
-		if err, ok := val.(error); ok {
-			return err
-		}
-
-		panic("new value lost, please report a bug")
-	}
-
-	// Third: getting data from CacheType, maybe from db
-	err := dst.Fulfill(key)
-	if err != nil {
-		c.barrier.Store(key, err)
-		return err
-	}
-
-	c.now.Store(key, dst)
-	close(ch) // broadcast, wakeup all waiting groutine
-
-	return nil
-}
-
-// Delete immediately specified the cached content to expire
-func (c *Cache) Delete(dst Data, key string) {
-	c.rwmutex.Lock()
-	defer c.rwmutex.Unlock()
-
-	c.old.Delete(key)
-	c.now.Delete(key)
-	c.barrier.Store(key, errors.New(key+" is deleted"))
-}
-
-// Rotate force refresh cached data
-func (c *Cache) Rotate(reset bool) {
-	c.rwmutex.Lock()
-	defer c.rwmutex.Unlock()
-
-	if reset {
-		c.old = &sync.Map{}
-	} else {
-		c.old = c.now
-	}
-	c.now = &sync.Map{}
-	c.barrier = &sync.Map{}
-}
@@ -0,0 +1,143 @@
+package suffixtree
+
+import (
+	"strings"
+)
+
+type Node struct {
+	*node
+	sep   string
+	Count uint64
+}
+type node struct {
+	secs     []string
+	subNodes []*node
+}
+
+func NewNodeFromRules(rules ...string) *Node {
+	n := &Node{&node{}, ".", 0}
+	for i := range rules {
+		n.Add(rules[i])
+	}
+
+	n.GC()
+	return n
+}
+
+func (n *node) GC() {
+	if n == nil {
+		return
+	}
+
+	n.secs = GCSlice(n.secs)
+	n.subNodes = GCSlice(n.subNodes)
+	for i := range n.subNodes {
+		n.subNodes[i].GC()
+	}
+}
+
+func (n *Node) String() string {
+	return n.string("", "     ")
+}
+func (n *node) string(prefix, indent string) (out string) {
+	if n == nil {
+		return
+	}
+	for key, val := range n.subNodes {
+		out += prefix + n.secs[key] + "\n" + val.string(prefix+indent, indent)
+	}
+	return
+}
+
+func (n *Node) trim(item string) string {
+	return strings.TrimSuffix(item, n.sep)
+}
+
+func (n *Node) Add(item string) {
+	n.Count++
+	n.add(strings.Split(n.trim(item), n.sep))
+}
+func (n *node) add(secs []string) {
+	length := len(secs)
+	switch length {
+	case 0:
+	case 1:
+		sec := secs[length-1]
+		switch sec {
+		case "", "*", "**":
+			n.secs = append([]string{sec}, n.secs...)
+			n.subNodes = append([]*node{nil}, n.subNodes...)
+		default:
+			n.secs = append(n.secs, sec)
+			n.subNodes = append(n.subNodes, nil)
+		}
+	default:
+		sec := secs[length-1]
+		if sec == "**" { // ** is only allowed in the last sec
+			sec = "*"
+		}
+
+		idx := n.index(sec)
+		if idx == -1 {
+			switch sec {
+			case "", "*", "**":
+				idx = 0
+				n.secs = append([]string{sec}, n.secs...)
+				n.subNodes = append([]*node{{}}, n.subNodes...)
+			default:
+				idx = len(n.secs)
+				n.secs = append(n.secs, sec)
+				n.subNodes = append(n.subNodes, &node{})
+			}
+
+		} else if n.subNodes[idx] == nil {
+			n.subNodes[idx] = &node{}
+			n.subNodes[idx].add([]string{""})
+		}
+
+		n.subNodes[idx].add(secs[:length-1])
+	}
+}
+
+func (n *Node) Match(item string) bool {
+	if n == nil {
+		return false
+	}
+
+	return n.matchSecs(strings.Split(n.trim(item), n.sep), false)
+}
+
+func (n *node) matchSecs(secs []string, fuzzNode bool) bool {
+	length := len(secs)
+	if length == 0 {
+		if n == nil {
+			return true
+		}
+		return n.index("") != -1 || n.index("**") != -1
+	}
+
+	if idx := n.index(secs[length-1]); idx >= 0 {
+		if n.subNodes[idx].matchSecs(secs[:length-1], false) {
+			return true
+		}
+	}
+	if idx := n.index("*"); idx >= 0 {
+		if n.subNodes[idx].matchSecs(secs[:length-1], true) {
+			return true
+		}
+	}
+	return n.index("**") >= 0
+}
+
+// index return the sec index in node, or -1 if not found
+func (n *node) index(sec string) int {
+	if n == nil {
+		return -1
+	}
+	for s := range n.secs {
+		if n.secs[s] == sec {
+			return s
+		}
+	}
+	return -1
+}
@@ -1,9 +1,9 @@
-package util_test
+package suffixtree_test

 import (
 	"testing"

-	"github.com/wweir/sower/util"
+	"github.com/wweir/sower/pkg/suffixtree"
 )

 func TestNode_Match(t *testing.T) {
@@ -13,18 +13,18 @@ func TestNode_Match(t *testing.T) {
 	}
 	tests := []struct {
 		name  string
-		node  *util.Node
+		node  *suffixtree.Node
 		tests []test
 	}{{
 		"simple",
-		util.NewNodeFromRules("a.wweir.cc", "b.wweir.cc"),
+		suffixtree.NewNodeFromRules("a.wweir.cc", "b.wweir.cc"),
 		[]test{
 			{"a.wweir.cc", true},
 			{"b.wweir.cc", true},
 		},
 	}, {
 		"parent",
-		util.NewNodeFromRules("wweir.cc", "a.wweir.cc"),
+		suffixtree.NewNodeFromRules("wweir.cc", "a.wweir.cc"),
 		[]test{
 			{"wweir.cc", true},
 			{"a.wweir.cc", true},
@@ -32,7 +32,7 @@ func TestNode_Match(t *testing.T) {
 		},
 	}, {
 		"fuzz1",
-		util.NewNodeFromRules("wweir.cc", "a.wweir.cc", "*.wweir.cc"),
+		suffixtree.NewNodeFromRules("wweir.cc", "a.wweir.cc", "*.wweir.cc"),
 		[]test{
 			{"wweir.cc", true},
 			{"a.wweir.cc", true},
@@ -41,7 +41,7 @@ func TestNode_Match(t *testing.T) {
 		},
 	}, {
 		"fuzz2",
-		util.NewNodeFromRules("a.*.cc", "c.wweir.*"),
+		suffixtree.NewNodeFromRules("a.*.cc", "c.wweir.*"),
 		[]test{
 			{"wweir.cc", false},
 			{"a.wweir.cc", true},
@@ -50,7 +50,7 @@ func TestNode_Match(t *testing.T) {
 		},
 	}, {
 		"fuzz3",
-		util.NewNodeFromRules("*.*.cc", "iamp.*.*"),
+		suffixtree.NewNodeFromRules("*.*.cc", "iamp.*.*"),
 		[]test{
 			{"wweir.cc", false},
 			{"a.wweir.cc", true},
@@ -59,7 +59,7 @@ func TestNode_Match(t *testing.T) {
 		},
 	}, {
 		"fuzz4",
-		util.NewNodeFromRules("**.cc", "a.**.com", "**.wweir.*"),
+		suffixtree.NewNodeFromRules("**.cc", "a.**.com", "**.wweir.*"),
 		[]test{
 			{"wweir.cc", true},
 			{"a.wweir.cc", true},
@@ -68,6 +68,12 @@ func TestNode_Match(t *testing.T) {
 			{"b.fuzz.com", false},
 			{"www.wweir.com", true},
 		},
+	}, {
+		"github",
+		suffixtree.NewNodeFromRules("**.github.com"),
+		[]test{
+			{"github.com", true},
+		},
 	}}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -0,0 +1,6 @@
+package suffixtree
+
+func GCSlice[T any](arr []T) []T {
+	old := arr
+	return append(make([]T, 0, len(old)), old...)
+}
@@ -1,56 +0,0 @@
-package teeconn
-
-import (
-	"io"
-	"net"
-)
-
-type Conn struct {
-	net.Conn
-
-	buf    []byte
-	offset int
-	stop   bool // read
-	err    error
-}
-
-func New(c net.Conn) *Conn {
-	return &Conn{Conn: c}
-}
-
-func (t *Conn) Reread() {
-	t.offset = 0
-}
-func (t *Conn) Reset() {
-	t.buf = []byte{}
-	t.offset = 0
-}
-func (t *Conn) Stop() *Conn {
-	t.stop = true
-	return t
-}
-
-func (t *Conn) Read(b []byte) (n int, err error) {
-	length := len(t.buf) - t.offset
-	if length > 0 {
-		n = copy(b, t.buf[t.offset:])
-		t.offset += n
-		return n, t.err
-	}
-
-	n, t.err = t.Conn.Read(b)
-	if !t.stop {
-		t.buf = append(t.buf, b[:n]...)
-		t.offset += n
-	}
-
-	return n, t.err
-}
-
-func (t *Conn) Write(b []byte) (n int, err error) {
-	if t.stop {
-		return t.Conn.Write(b)
-	}
-
-	return 0, io.ErrShortWrite
-}
@@ -5,7 +5,7 @@ import (
 	"net"
 	"time"

-	"github.com/wweir/deferlog/log"
+	"github.com/sower-proxy/deferlog/log"
 )

 func (r *Router) localSite(domain string) bool {
@@ -2,10 +2,10 @@ package router

 import (
 	"net"
-	"time"

 	"github.com/miekg/dns"
-	"github.com/wweir/deferlog/log"
+	"github.com/sower-proxy/deferlog/log"
+	"github.com/wweir/sower/pkg/dhcp"
 )

 func (r *Router) ServeDNS(w dns.ResponseWriter, req *dns.Msg) {
@@ -18,32 +18,31 @@ func (r *Router) ServeDNS(w dns.ResponseWriter, req *dns.Msg) {
 	domain := req.Question[0].Name
 	// 1. rule_based( block > direct > proxy )
 	switch {
-	case r.blockRule.Match(domain):
+	case r.BlockRule.Match(domain):
 		_ = w.WriteMsg(r.dnsFail(req, dns.RcodeNameError))
 		return

-	case r.directRule.Match(domain):
+	case r.DirectRule.Match(domain):

-	case r.proxyRule.Match(domain):
-		_ = w.WriteMsg(r.dnsProxyA(domain, r.dns.serveIP, req))
+	case r.ProxyRule.Match(domain):
+		host, _, err := net.SplitHostPort(w.LocalAddr().String())
+		log.DebugWarn(err).Str("host", host).Msg("proxy dns")
+		_ = w.WriteMsg(r.dnsProxyA(domain, net.ParseIP(host), req))
 		return
 	}

 	// 2. direct with cache, do not fallback to proxy to avoid side-effect
-	c := &dnsCache{Router: r, Req: req}
-	if err := r.dns.cache.Remember(c, req.Question[0].String()); err != nil {
+	resp, err := r.Exchange(req)
+	if err != nil {
 		_ = w.WriteMsg(r.dnsFail(req, dns.RcodeServerFailure))
-		return
+	} else {
+		_ = w.WriteMsg(resp)
 	}
-
-	c.Resp.SetReply(req)
-	c.Resp.Compress = true
-	_ = w.WriteMsg(c.Resp)
 }

 func (r *Router) dnsFail(req *dns.Msg, rcode int) *dns.Msg {
 	m := new(dns.Msg)
-	m.SetRcode(req, dns.RcodeServerFailure)
+	m.SetRcode(req, rcode)
 	return m
 }

@@ -66,28 +65,41 @@ func (r *Router) dnsProxyA(domain string, localIP net.IP, req *dns.Msg) *dns.Msg
 	return m
 }

-type dnsCache struct {
-	*Router
-	Req, Resp *dns.Msg
-}
+var upstreamAddrs []string
+var upstreamIndex = -1
+var queryCount = 0

-func (r *dnsCache) Fulfill(question string) (err error) {
-	conn := <-r.dns.connCh
+func (r *Router) Exchange(req *dns.Msg) (_ *dns.Msg, err error) {
+	queryCount++
+	if upstreamIndex < 0 {
+		dnsIPs, err := dhcp.GetDNSServer()
+		log.Err(err).
+			Int("queryCount", queryCount).
+			Strs("dns", dnsIPs).
+			Msg("get dns server")

-	var rtt time.Duration
-	r.Resp, rtt, err = r.dns.ExchangeWithConn(r.Req, conn)
+		addrs := make([]string, 0, len(dnsIPs)+1)
+		for _, ip := range dnsIPs {
+			if ip != string(r.dns.serveIP) {
+				addrs = append(addrs, net.JoinHostPort(ip, "53"))
+			}
+		}
+		if len(addrs) == 0 {
+			addrs = append(addrs, net.JoinHostPort(r.dns.fallbackDNS, "53"))
+		}
+
+		queryCount = 0
+		upstreamAddrs = addrs
+		upstreamIndex = len(addrs) - 1
+	}
+
+	resp, err := dns.Exchange(req, upstreamAddrs[upstreamIndex])
 	if err != nil {
-		r.Resp, rtt, err = r.dns.ExchangeWithConn(r.Req, conn)
+		upstreamIndex--
+		if upstreamIndex >= 0 {
+			resp, err = dns.Exchange(req, upstreamAddrs[upstreamIndex])
+		}
 	}
-	log.DebugWarn(err).
-		Dur("rtt", rtt).
-		Str("question", question).
-		Msg("exchange dns record")

-	select {
-	case r.dns.connCh <- conn:
-	default:
-		conn.Close()
-	}
-	return err
+	return resp, err
 }
@@ -5,12 +5,11 @@ import (
 	"sync"
 	"time"

-	"github.com/wweir/deferlog/log"
+	"github.com/sower-proxy/deferlog/log"
+	"github.com/sower-proxy/mem"
 )

-var pingClient = http.Client{
-	Timeout: 2 * time.Second,
-}
+var accessCache = mem.NewRotateCache(time.Hour, httpPing)

 func (r *Router) isAccess(domain string, port uint16) bool {
 	switch port {
@@ -20,16 +19,15 @@ func (r *Router) isAccess(domain string, port uint16) bool {
 		return false
 	}

-	p := &ping{}
-	_ = r.accessCache.Remember(p, domain)
-	return p.isAccess
+	ok, _ := accessCache.Get(domain)
+	return ok
 }

-type ping struct {
-	isAccess bool
+var pingClient = http.Client{
+	Timeout: 2 * time.Second,
 }

-func (p *ping) Fulfill(key string) error {
+func httpPing(key string) (bool, error) {
 	wg := sync.WaitGroup{}
 	wg.Add(2)
 	var err80, err443 error
@@ -49,6 +47,5 @@ func (p *ping) Fulfill(key string) error {
 			Msg("Failed to ping")
 	}

-	p.isAccess = (err80 == nil && err443 == nil)
-	return nil
+	return err80 == nil && err443 == nil, nil
 }
@@ -8,27 +8,23 @@ import (
 	"github.com/miekg/dns"
 	geoip2 "github.com/oschwald/geoip2-golang"
 	"github.com/pkg/errors"
-	"github.com/wweir/deferlog"
-	"github.com/wweir/deferlog/log"
-	"github.com/wweir/sower/pkg/dhcp"
-	"github.com/wweir/sower/pkg/mem"
-	"github.com/wweir/sower/util"
+	"github.com/sower-proxy/conns/relay"
+	"github.com/sower-proxy/deferlog"
+	"github.com/sower-proxy/deferlog/log"
+	"github.com/wweir/sower/pkg/suffixtree"
 )

 type ProxyDialFn func(network, host string, port uint16) (net.Conn, error)
 type Router struct {
-	blockRule   *util.Node
-	directRule  *util.Node
-	proxyRule   *util.Node
-	ProxyDial   ProxyDialFn
-	accessCache *mem.Cache
+	BlockRule  *suffixtree.Node
+	DirectRule *suffixtree.Node
+	ProxyRule  *suffixtree.Node
+	ProxyDial  ProxyDialFn

 	dns struct {
 		dns.Client
 		fallbackDNS string
 		serveIP     net.IP
-		connCh      chan *dns.Conn
-		cache       *mem.Cache
 	}

 	country struct {
@@ -39,15 +35,11 @@ type Router struct {

 func NewRouter(serveIP, fallbackDNS, mmdbFile string, proxyDial ProxyDialFn) *Router {
 	r := Router{
-		ProxyDial:   proxyDial,
-		accessCache: mem.New(time.Hour), // TODO: config
+		ProxyDial: proxyDial,
 	}

 	r.dns.serveIP = net.ParseIP(serveIP)
 	r.dns.fallbackDNS = fallbackDNS
-	r.dns.connCh = make(chan *dns.Conn, 1)
-	r.dns.cache = mem.New(5 * time.Minute) // Tll: 10 minutes
-	go r.dialDNSConn()

 	var err error
 	r.country.Reader, err = geoip2.Open(mmdbFile)
@@ -56,43 +48,15 @@ func NewRouter(serveIP, fallbackDNS, mmdbFile string, proxyDial ProxyDialFn) *Ro
 	return &r
 }

-func (r *Router) SetRules(blockList, directList, proxyList, directCIDRs []string) {
-
-	r.blockRule = util.NewNodeFromRules(blockList...)
-	r.directRule = util.NewNodeFromRules(directList...)
-	r.proxyRule = util.NewNodeFromRules(proxyList...)
-
-	r.country.cidrs = make([]*net.IPNet, 0, len(directCIDRs))
-	for _, cidr := range directCIDRs {
+func (r *Router) AddCountryCIDRs(cidrs ...string) {
+	for _, cidr := range cidrs {
 		_, ipnet, err := net.ParseCIDR(cidr)
 		if err != nil {
 			log.Error().Err(err).Msg("Failed to parse CIDR")
 		}
 		r.country.cidrs = append(r.country.cidrs, ipnet)
 	}
-}
-
-func (r *Router) dialDNSConn() {
-	for {
-		server, err := dhcp.GetDNSServer()
-		log.Err(err).
-			Str("DNS", server).
-			Str("fallback", r.dns.fallbackDNS).
-			Msg("get DNS server")
-		if server == "" {
-			server = r.dns.fallbackDNS
-		}
-
-		for {
-			conn, err := dns.DialTimeout("udp", net.JoinHostPort(server, "53"), time.Second)
-			if err != nil {
-				log.Error().Err(err).Str("ip", server).Msg("dial dns server")
-				break
-			}
-
-			r.dns.connCh <- conn
-		}
-	}
+	r.country.cidrs = suffixtree.GCSlice(r.country.cidrs)
 }

 func (r *Router) RouteHandle(conn net.Conn, domain string, port uint16) (err error) {
@@ -111,13 +75,13 @@ func (r *Router) RouteHandle(conn net.Conn, domain string, port uint16) (err err
 	// 2. detect_based( CN IP || access site )
 	// 3. fallback( proxy )
 	switch {
-	case r.blockRule.Match(domain):
+	case r.BlockRule.Match(domain):
 		return nil

-	case r.directRule.Match(domain):
+	case r.DirectRule.Match(domain):
 		return r.DirectHandle(conn, addr)

-	case r.proxyRule.Match(domain):
+	case r.ProxyRule.Match(domain):
 		return r.ProxyHandle(conn, domain, port)

 	case r.localSite(domain), r.isAccess(domain, port):
@@ -135,11 +99,11 @@ func (r *Router) ProxyHandle(conn net.Conn, domain string, port uint16) error {
 	}
 	defer rc.Close()

-	util.Relay(conn, rc)
+	_ = relay.Relay(conn, rc)
 	return nil
 }

 func (r *Router) DirectHandle(conn net.Conn, addr string) error {
-	dur, err := util.RelayTo(conn, addr)
+	dur, err := relay.RelayTo(conn, addr)
 	return errors.Wrapf(err, "spend (%s)", dur)
 }
@@ -0,0 +1,22 @@
+package router
+
+import (
+	"net"
+	"strconv"
+)
+
+func ParseHostPort(hostport string, defaultPort uint16) (string, uint16, error) {
+	host, port, err := net.SplitHostPort(hostport)
+	if err != nil {
+		return "", 0, err
+	}
+	if port == "" {
+		return host, defaultPort, nil
+	}
+
+	portInt, err := strconv.ParseUint(port, 10, 16)
+	if err != nil {
+		return "", 0, err
+	}
+	return host, uint16(portInt), nil
+}
@@ -5,8 +5,8 @@ import (
 	"strings"
 	"testing"

-	"github.com/wweir/deferlog/log"
-	"github.com/wweir/sower/pkg/teeconn"
+	"github.com/sower-proxy/conns/teeconn"
+	"github.com/sower-proxy/deferlog/log"
 	"github.com/wweir/sower/transport/sower"
 	"github.com/wweir/sower/transport/trojan"
 )
@@ -1,50 +0,0 @@
-package util
-
-import (
-	"io"
-	"net"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/pkg/errors"
-)
-
-func RelayTo(conn net.Conn, addr string) (dur time.Duration, err error) {
-	if _, _, err := net.SplitHostPort(addr); err != nil {
-		addr = net.JoinHostPort(addr, "80")
-	}
-
-	start := time.Now()
-	rc, err := net.DialTimeout("tcp", addr, 5*time.Second)
-	if err != nil {
-		return time.Since(start), errors.WithStack(err)
-	}
-	defer rc.Close()
-
-	Relay(conn, rc)
-	return time.Since(start), nil
-}
-
-func Relay(conn1, conn2 net.Conn) {
-	wg := &sync.WaitGroup{}
-	exitFlag := new(int32)
-	wg.Add(2)
-	go redirect(conn2, conn1, wg, exitFlag)
-	redirect(conn1, conn2, wg, exitFlag)
-	wg.Wait()
-}
-func redirect(dst, src net.Conn, wg *sync.WaitGroup, exitFlag *int32) {
-
-	// io.Copy(dst, io.TeeReader(src, os.Stdout))
-	io.Copy(dst, src)
-
-	if atomic.CompareAndSwapInt32(exitFlag, 0, 1) {
-		// wakeup blocked goroutine
-		now := time.Now()
-		src.SetDeadline(now)
-		dst.SetDeadline(now)
-	}
-
-	wg.Done()
-}
@@ -1,108 +0,0 @@
-package util
-
-import (
-	"strings"
-	"sync"
-)
-
-type Node struct {
-	node
-	sep string
-	*sync.RWMutex
-}
-type node struct {
-	node map[string]*node
-}
-
-func NewNodeFromRules(rules ...string) *Node {
-	n := &Node{node{node: map[string]*node{}}, ".", &sync.RWMutex{}}
-	for i := range rules {
-		n.Add(rules[i])
-	}
-	return n
-}
-
-func (n *Node) String() string {
-	n.RLock()
-	defer n.RUnlock()
-	return n.string("", "     ")
-}
-func (n *node) string(prefix, indent string) (out string) {
-	for key, val := range n.node {
-		out += prefix + key + "\n" + val.string(prefix+indent, indent)
-	}
-	return
-}
-
-func (n *Node) trim(item string) string {
-	return strings.TrimSuffix(item, n.sep)
-}
-
-func (n *Node) Add(item string) {
-	n.Lock()
-	defer n.Unlock()
-	n.add(strings.Split(n.trim(item), n.sep))
-}
-func (n *node) add(secs []string) {
-	length := len(secs)
-	switch length {
-	case 0:
-		return
-	case 1:
-		n.node[secs[length-1]] = &node{node: map[string]*node{"": {}}}
-	default:
-		sec := secs[length-1]
-		if sec == "**" {
-			sec = "*"
-		}
-
-		subNode, ok := n.node[sec]
-		if !ok {
-			subNode = &node{node: map[string]*node{}}
-			n.node[sec] = subNode
-		}
-		subNode.add(secs[:length-1])
-	}
-}
-
-func (n *Node) Match(item string) bool {
-	if n == nil {
-		return false
-	}
-
-	n.RLock()
-	defer n.RUnlock()
-	return n.matchSecs(strings.Split(n.trim(item), n.sep), false)
-}
-
-func (n *node) matchSecs(secs []string, fuzzNode bool) bool {
-	length := len(secs)
-	if length == 0 {
-		if _, ok := n.node[""]; ok {
-			return true
-		}
-		if _, ok := n.node["**"]; ok {
-			return true
-		}
-		if _, ok := n.node["*"]; ok {
-			return !fuzzNode
-		}
-		return false
-	}
-
-	if n, ok := n.node[secs[length-1]]; ok {
-		if n.matchSecs(secs[:length-1], false) {
-			return true
-		}
-	}
-	if n, ok := n.node["*"]; ok {
-		if n.matchSecs(secs[:length-1], true) {
-			return true
-		}
-	}
-	if _, ok := n.node["**"]; ok {
-		return true
-	}
-
-	return false
-}
Author	SHA1	Message	Date
wweir	3d6ee5e376	feat: support http(s)_proxy	2024-09-10 07:40:08 +08:00
wweir	c0f704a5ad	feat: add dns.serve_6 flag	2024-05-25 23:06:17 +08:00
wweir	ac09663bc4	feat: multi ips, change default config	2024-05-14 14:06:46 +08:00
wweir	45c9eea6e6	feat: support listen on multi ip	2024-05-14 13:23:25 +08:00
wweir	0c83462b91	chore: update dependencies	2024-05-08 13:36:21 +08:00
wweir	15c02b55d8	feat: optimize for network changed case	2023-04-24 10:44:37 +08:00
wweir	aca4636433	Merge pull request #27 from sower-proxy/dependabot/go_modules/golang.org/x/net-0.7.0 Bump golang.org/x/net from 0.0.0-20220531201128-c960675eff93 to 0.7.0	2023-03-08 19:06:59 +08:00
dependabot[bot]	d0d635f8b0	Bump golang.org/x/net from 0.0.0-20220531201128-c960675eff93 to 0.7.0 Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20220531201128-c960675eff93 to 0.7.0. - [Release notes](https://github.com/golang/net/releases) - [Commits](https://github.com/golang/net/commits/v0.7.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2023-03-08 11:06:47 +00:00
wweir	bde3b1bfa4	Merge pull request #26 from sower-proxy/dependabot/go_modules/golang.org/x/text-0.3.8 Bump golang.org/x/text from 0.3.7 to 0.3.8	2023-03-08 19:06:10 +08:00
dependabot[bot]	5dfefdf117	Bump golang.org/x/text from 0.3.7 to 0.3.8 Bumps [golang.org/x/text](https://github.com/golang/text) from 0.3.7 to 0.3.8. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.3.7...v0.3.8) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2023-02-23 08:47:32 +00:00
wweir	3f63038631	fix: file based rules parser	2022-07-15 15:15:02 +08:00
wweir	8d18bd6c5b	feat: support do not config block rules	2022-07-14 19:55:20 +08:00
wweir	98a5f5702c	feat: update dependency, avoid github warning	2022-06-03 08:23:14 +08:00
wweir	2948ffb7db	feat: add yaml example config	2022-06-03 08:18:13 +08:00
wweir	b85c3a63d7	Merge pull request #24 from wangtz0607/master Update README.md	2022-06-03 07:01:29 +08:00
wtz	47e8076c06	Update README.md	2022-05-29 21:00:53 +08:00
wtz	10dc20e9e8	Update README.md	2022-05-29 20:56:26 +08:00
wweir	19dcf8e0d7	fix: dns proxy hang case	2022-05-29 12:43:48 +08:00
wweir	795bf73fb2	fix: DNS upstream connection close	2022-05-19 15:29:35 +08:00
wweir	3412643b6e	feat: add restart policy	2022-05-16 07:28:29 +08:00
wweir	6fc97a3c9f	feat: optimize code with 1.18 generic	2022-05-01 22:53:51 +08:00
wweir	78d36b0c19	feat: change default config for safety	2022-04-30 16:13:53 +08:00
wweir	5ebd33b0d7	feat: migrate to golang 1.18	2022-04-30 14:33:54 +08:00
wweir	b1f152cc0c	fix: dns upstream lookback case	2022-04-05 23:42:33 +08:00
wweir	c0b77da05a	fix(#22 ): ** preifx match none	2022-02-21 08:38:13 +08:00
wweir	bad7ae702a	chore: separate packages	2021-12-06 14:44:24 +08:00
wweir	05a1a3249a	chore: update dependency	2021-12-03 11:01:45 +08:00
wweir	0f029f8c15	refactor: reduce memory usage	2021-11-15 14:21:23 +08:00
wweir	8c9a0bc1dd	refactor: reduce memory usage	2021-11-15 11:33:15 +08:00
wweir	465ff316fd	refactor: refactor suffix tree to reduce memory usage	2021-11-15 09:18:02 +08:00