Add PPP over Hysteria2

Author: luunarrr

app/cmd/client.go

@@ -37,6 +37,7 @@ import (
 	"github.com/apernet/hysteria/app/v2/internal/url"
 	"github.com/apernet/hysteria/app/v2/internal/utils"
 	"github.com/apernet/hysteria/core/v2/client"
+	coreErrs "github.com/apernet/hysteria/core/v2/errors"
 	"github.com/apernet/hysteria/extras/v2/correctnet"
 	"github.com/apernet/hysteria/extras/v2/obfs"
 	"github.com/apernet/hysteria/extras/v2/realm"
@@ -90,6 +91,28 @@ type clientConfig struct {
 	UDPTProxy     *udpTProxyConfig       `mapstructure:"udpTProxy"`
 	TCPRedirect   *tcpRedirectConfig     `mapstructure:"tcpRedirect"`
 	TUN           *tunConfig             `mapstructure:"tun"`
+	PPP           *pppConfig             `mapstructure:"ppp"`
+}
+
+type pppSSTPConfig struct {
+	BinaryPath  string `mapstructure:"binaryPath"`
+	Listen      string `mapstructure:"listen"`
+	CertDir     string `mapstructure:"certDir"`
+	Endpoint    string `mapstructure:"endpoint"`
+	User        string `mapstructure:"user"`
+	Password    string `mapstructure:"password"`
+	MSSClamp    *int   `mapstructure:"mssClamp"` // nil=auto, 0=off, >0=forced
+	ServerRoute *bool  `mapstructure:"serverRoute"`
+	LogLevel    string `mapstructure:"logLevel"`
+}
+
+type pppConfig struct {
+	Mode        string         `mapstructure:"mode"`
+	MTU         uint32         `mapstructure:"mtu"`
+	PPPDPath    string         `mapstructure:"pppdPath"`
+	PPPDArgs    []string       `mapstructure:"pppdArgs"`
+	DataStreams int            `mapstructure:"dataStreams"`
+	SSTP        *pppSSTPConfig `mapstructure:"sstp"`
 }
 
 type clientConfigRealm struct {
@@ -618,6 +641,9 @@ func (c *clientConfig) Config() (*client.Config, error) {
 			return nil, err
 		}
 	}
+	if c.PPP != nil && c.PPP.DataStreams == 0 {
+		hyConfig.PPPMode = true
+	}
 	return hyConfig, nil
 }
 
@@ -810,29 +836,69 @@ func runClientCmd(cmd *cobra.Command, args []string) {
 	runClient(defaultViper)
 }
 
+// authRetryDelay is how long to wait before asking a second time about a refused
+// password. Short enough to stay inside the restart floor that is being spent
+// anyway, long enough to outlast the momentary gap it exists to tolerate.
+const authRetryDelay = 2 * time.Second
+
+// connectClient builds the client, and when the server refuses the password asks
+// once more before believing it.
+//
+// AuthError carries no more meaning than "the server answered with something
+// other than 233". A server whose auth backend is momentarily unavailable serves
+// the request through its masquerade handler instead -- a 404 -- which is the
+// same answer a genuinely wrong password gets, and the client cannot tell them
+// apart. With lazy off this handshake is a single un-retried attempt, and the
+// caller turns an AuthError into a status file that makes the netifd handler
+// call proto_block_restart. One unlucky moment would then hold the WAN down
+// until somebody logged in and ran ifup, where before it recovered by itself.
+//
+// Asking twice separates the two: a wrong password is refused both times, a gap
+// almost never lasts across the delay. Only an auth failure is retried -- every
+// other error is already treated as retryable and is left to netifd.
+func connectClient(config clientConfig, connected func(client.Client, *client.HandshakeInfo, int)) (client.Client, error) {
+	c, err := client.NewReconnectableClient(config.Config, connected, config.Lazy)
+	var authErr coreErrs.AuthError
+	if err == nil || !errors.As(err, &authErr) {
+		return c, err
+	}
+	logger.Warn("server refused the password, confirming before reporting it as final",
+		zap.Int("status", authErr.StatusCode))
+	time.Sleep(authRetryDelay)
+	return client.NewReconnectableClient(config.Config, connected, config.Lazy)
+}
+
 func runClient(v *viper.Viper) {
 	if err := v.ReadInConfig(); err != nil {
+		holdPPPRestart()
 		logger.Fatal("failed to read client config", zap.Error(err))
 	}
 	var config clientConfig
 	if err := v.Unmarshal(&config); err != nil {
+		holdPPPRestart()
 		logger.Fatal("failed to parse client config", zap.Error(err))
 	}
 
-	c, err := client.NewReconnectableClient(
-		config.Config,
-		func(c client.Client, info *client.HandshakeInfo, count int) {
-			connectLog(info, count)
-			// On the client side, we start checking for updates after we successfully connect
-			// to the server, which, depending on whether lazy mode is enabled, may or may not
-			// be immediately after the client starts. We don't want the update check request
-			// to interfere with the lazy mode option.
-			if count == 1 && !disableUpdateCheck {
-				go runCheckUpdateClient(c)
-			}
-		}, config.Lazy,
-	)
+	connected := func(c client.Client, info *client.HandshakeInfo, count int) {
+		connectLog(info, count)
+		// On the client side, we start checking for updates after we successfully connect
+		// to the server, which, depending on whether lazy mode is enabled, may or may not
+		// be immediately after the client starts. We don't want the update check request
+		// to interfere with the lazy mode option.
+		if count == 1 && !disableUpdateCheck {
+			go runCheckUpdateClient(c)
+		}
+	}
+
+	c, err := connectClient(config, connected)
 	if err != nil {
+		// Two unrelated things share this line. The status write is where a
+		// refused Hysteria2 password is reported from: with lazy off the
+		// handshake has already happened here, so it never reaches the runner
+		// below. The hold is for the opposite case -- a dropped upstream fails
+		// this dial in microseconds, and without it that becomes a restart loop.
+		writePPPStatus(err)
+		holdPPPRestart()
 		logger.Fatal("failed to initialize client", zap.Error(err))
 	}
 	defer c.Close()
@@ -887,6 +953,11 @@ func runClient(v *viper.Viper) {
 			return clientTUN(*config.TUN, c)
 		})
 	}
+	if config.PPP != nil {
+		runner.Add("PPP", func() error {
+			return clientPPP(*config.PPP, c, strings.EqualFold(config.Obfs.Type, "salamander"))
+		})
+	}
 
 	signalChan := make(chan os.Signal, 1)
 	signal.Notify(signalChan, os.Interrupt, syscall.SIGTERM)
@@ -904,7 +975,30 @@ func runClient(v *viper.Viper) {
 		if r.OK {
 			logger.Info(r.Msg)
 		} else {
+			// A connect that fails only reaches here in lazy mode, where the
+			// handshake is deferred until PPP mode asks for the conn. With lazy
+			// off -- which is what the OpenWrt handler generates, since it never
+			// writes the key -- the handshake has already happened above, and a
+			// refused password fails there instead. Both sites write the status.
+			writePPPStatus(r.Err)
 			_ = c.Close() // Close the client here as Fatal will exit the program without running defer
+			// Hand SIGTERM back to the runtime before holding. The deferred Stop
+			// never runs -- Fatal exits -- so without this an ifdown arriving
+			// during the hold would sit unread in signalChan and be ignored for
+			// the length of it, keeping netifd waiting on a process that has
+			// already decided to die.
+			signal.Stop(signalChan)
+			// Stop only restores the default disposition for signals still to
+			// come. One that arrived while this select was being decided is
+			// already buffered, and the select is free to have picked the runner
+			// case instead -- so it has to be looked for, not waited for. Finding
+			// one means an ifdown is in progress and nothing is going to restart
+			// us, which is exactly when holding is pure delay.
+			select {
+			case <-signalChan:
+			default:
+				holdPPPRestart()
+			}
 			if r.Err != nil {
 				logger.Fatal(r.Msg, zap.Error(r.Err))
 			} else {

app/cmd/client_ppp.go

@@ -0,0 +1,183 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+
+	"go.uber.org/zap"
+
+	"github.com/apernet/hysteria/app/v2/internal/ppp"
+	"github.com/apernet/hysteria/core/v2/client"
+	"github.com/apernet/hysteria/extras/v2/pppbridge"
+)
+
+// pppdInvocation is everything clientPPP decides before anything is spawned:
+// which program to run, with what arguments, and whether to route the server's
+// address around the tunnel.
+//
+// Separated from clientPPP because the decision is where all the branching is --
+// nospawn, SSTP, an explicit MTU or a measured one -- while what follows it is a
+// Serve loop that blocks until the process ends. Kept together they could only
+// be checked by running a real pppd.
+type pppdInvocation struct {
+	path        string
+	args        []string
+	serverRoute bool
+	noSpawn     bool
+}
+
+func clientPPP(config pppConfig, c client.Client, salamander bool) error {
+	inv, err := clientPPPDInvocation(config, c.RemoteAddr(), salamander)
+	if err != nil {
+		return err
+	}
+
+	if inv.noSpawn {
+		logger.Info("PPP mode starting",
+			zap.String("mode", "nospawn"),
+			zap.Int("dataStreams", config.DataStreams))
+		s := &ppp.Server{
+			HyClient:    c,
+			Logger:      logger,
+			DataStreams: config.DataStreams,
+			NoSpawn:     true,
+			// Whatever started pppd chose its MRU; ppp.mtu is how it tells us. Left
+			// unset the transport is measured instead, which still works -- pppd
+			// simply never learns the answer -- but costs a dial's latency for
+			// nothing. The netifd handler always sets it.
+			LinkMRU: int(config.MTU),
+		}
+		err := s.Serve()
+		writePPPStatus(err)
+		return err
+	}
+
+	logger.Info("PPP mode starting",
+		zap.String("pppdPath", inv.path),
+		zap.Strings("pppdArgs", inv.args),
+		zap.Int("dataStreams", config.DataStreams),
+		zap.Bool("serverRoute", inv.serverRoute))
+
+	s := &ppp.Server{
+		HyClient:    c,
+		Logger:      logger,
+		PPPDPath:    inv.path,
+		PPPDArgs:    inv.args,
+		DataStreams: config.DataStreams,
+		ServerRoute: inv.serverRoute,
+	}
+
+	return s.Serve()
+}
+
+func clientPPPDInvocation(config pppConfig, remoteAddr net.Addr, salamander bool) (pppdInvocation, error) {
+	noSpawn := false
+	switch strings.ToLower(config.Mode) {
+	case "", "local":
+	case "nospawn":
+		noSpawn = true
+	default:
+		return pppdInvocation{}, configError{Field: "ppp.mode", Err: fmt.Errorf("unsupported mode %q (must be \"local\" or \"nospawn\")", config.Mode)}
+	}
+
+	if noSpawn {
+		if config.SSTP != nil {
+			return pppdInvocation{}, configError{Field: "ppp.mode", Err: errors.New("nospawn mode cannot be combined with ppp.sstp")}
+		}
+		return pppdInvocation{noSpawn: true}, nil
+	}
+
+	pppdPath := config.PPPDPath
+	pppdArgs := config.PPPDArgs
+
+	if len(pppdArgs) == 0 {
+		// LCP echo is the only thing that notices a link which is nominally up but
+		// silently dropping frames -- an MTU black hole, a stale NAT binding, a
+		// middlebox eating large UDP. It travels the same transport as user data,
+		// so it genuinely probes the path the data takes. Adaptive keeps it quiet
+		// while traffic is flowing; 3 misses at 5s gives ~15s to detection, well
+		// inside the 30s QUIC idle timeout.
+		pppdArgs = []string{
+			"nodetach", "local", "+ipv6", "multilink",
+			"lcp-echo-interval", "5", "lcp-echo-failure", "3", "lcp-echo-adaptive",
+		}
+		if config.MTU > 0 {
+			s := strconv.Itoa(int(config.MTU))
+			pppdArgs = append(pppdArgs, "mtu", s, "mru", s)
+		} else {
+			linkMRU := pppbridge.AutoPPPMTU(pppbridge.MTUParams{
+				RemoteAddr:  remoteAddr,
+				Salamander:  salamander,
+				DataStreams: config.DataStreams,
+			})
+			vpnMTU := linkMRU - pppbridge.MLPPPOverhead
+			if config.SSTP != nil {
+				s := strconv.Itoa(linkMRU)
+				pppdArgs = append(pppdArgs, "mtu", s, "mru", s)
+			} else {
+				pppdArgs = append(pppdArgs, "mtu", strconv.Itoa(vpnMTU), "mru", strconv.Itoa(linkMRU))
+			}
+		}
+	}
+
+	serverRoute := false
+	if config.SSTP != nil {
+		if config.SSTP.LogLevel == "" {
+			config.SSTP.LogLevel = logLevel
+		}
+
+		if pppdPath == "" {
+			if config.SSTP.BinaryPath != "" {
+				pppdPath = config.SSTP.BinaryPath
+			} else {
+				pppdPath = "ppp-sstp"
+			}
+		}
+
+		sstpArgs := buildSSTPArgs(config.SSTP)
+		pppdArgs = append(sstpArgs, pppdArgs...)
+
+		serverRoute = true
+		if config.SSTP.ServerRoute != nil {
+			serverRoute = *config.SSTP.ServerRoute
+		}
+	} else if pppdPath == "" {
+		pppdPath = "pppd"
+	}
+
+	return pppdInvocation{path: pppdPath, args: pppdArgs, serverRoute: serverRoute}, nil
+}
+
+// buildSSTPArgs generates command-line arguments for the ppp-sstp binary.
+func buildSSTPArgs(cfg *pppSSTPConfig) []string {
+	var args []string
+	if cfg.LogLevel != "" {
+		args = append(args, "-l", cfg.LogLevel)
+	}
+
+	listen := cfg.Listen
+	if listen == "" {
+		listen = "127.0.0.1:8443"
+	}
+	args = append(args, "listen", listen)
+
+	if cfg.CertDir != "" {
+		args = append(args, "cert-dir", cfg.CertDir)
+	}
+	if cfg.Endpoint != "" {
+		args = append(args, "endpoint", cfg.Endpoint)
+	}
+	if cfg.User != "" {
+		args = append(args, "user", cfg.User)
+	}
+	if cfg.Password != "" {
+		args = append(args, "password", cfg.Password)
+	}
+	if cfg.MSSClamp != nil {
+		args = append(args, "mss-clamp", strconv.Itoa(*cfg.MSSClamp))
+	}
+	return args
+}