Feat: transparent proxy support (linux only)

clash/tests/data/config/tproxy.yaml

@@ -0,0 +1,4 @@
+tproxy-port: 7893
+external-controller: 127.0.0.1:9090
+mode: global
+log-level: debug

clash_lib/Cargo.toml

@@ -37,6 +37,8 @@ base64 = "0.22"
 uuid = { version = "1.8.0", features = ["v4", "fast-rng", "macro-diagnostics", "serde"] }
 boring = "4.5.0"
 boring-sys = "4.5.0"
+unix-udp-sock = { git = "https://github.com/Watfaq/unix-udp-sock.git", rev = "cd3e4eca43e6f3be82a2703c3d711b7e18fbfd18"}
+cmd_lib = "1.9.3"
 
 ip_network_table-deps-treebitmap = "0.5.0"
 once_cell = "1.18.0"

clash_lib/src/app/dispatcher/dispatcher_impl.rs

@@ -181,6 +181,7 @@ impl Dispatcher {
 
     /// Dispatch a UDP packet to outbound handler
     /// returns the close sender
+    /// will ignore the source and destination in `Session`
     #[instrument]
     pub fn dispatch_datagram(
         &self,

clash_lib/src/app/inbound/manager.rs

@@ -88,7 +88,7 @@ impl InboundManager {
         };
         self.network_listeners
             .values()
-            .for_each(|x| match x.listener_type {
+            .for_each(|x: &NetworkInboundListener| match x.listener_type {
                 ListenerType::Http => {
                     ports.port = Some(x.port);
                 }
@@ -98,6 +98,9 @@ impl InboundManager {
                 ListenerType::Mixed => {
                     ports.mixed_port = Some(x.port);
                 }
+                ListenerType::TProxy => {
+                    ports.tproxy_port = Some(x.port);
+                }
             });
 
         ports
@@ -147,6 +150,20 @@ impl InboundManager {
             );
         }
 
+        if let Some(tproxy_port) = ports.tproxy_port {
+            network_listeners.insert(
+                ListenerType::TProxy,
+                NetworkInboundListener {
+                    name: "TProxy".to_string(),
+                    bind_addr: self.bind_address.clone(),
+                    port: tproxy_port,
+                    listener_type: ListenerType::TProxy,
+                    dispatcher: self.dispatcher.clone(),
+                    authenticator: self.authenticator.clone(),
+                },
+            );
+        }
+
         self.network_listeners = network_listeners;
     }
 }

clash_lib/src/app/inbound/network_listener.rs

@@ -1,7 +1,7 @@
 use crate::common::auth::ThreadSafeAuthenticator;
 use crate::config::internal::config::BindAddress;
 
-use crate::proxy::{http, mixed, socks, AnyInboundListener};
+use crate::proxy::{http, mixed, socks, tproxy, AnyInboundListener};
 
 use crate::proxy::utils::Interface;
 use crate::{Dispatcher, Error, Runner};
@@ -17,6 +17,7 @@ pub enum ListenerType {
     Http,
     Socks5,
     Mixed,
+    TProxy,
 }
 
 pub struct NetworkInboundListener {
@@ -111,6 +112,17 @@ impl NetworkInboundListener {
                 self.dispatcher.clone(),
                 self.authenticator.clone(),
             ),
+
+            ListenerType::TProxy => {
+                #[cfg(any(target_os = "linux", target_os = "android"))]
+                {
+                    tproxy::TProxyListener::new((ip, self.port).into(), self.dispatcher.clone())
+                }
+                #[cfg(not(target_os = "linux"))]
+                {
+                    warn!("tproxy only support linux and android, ignore this config");
+                }
+            }
         };
 
         if listener.handle_tcp() {

clash_lib/src/common/cmd.rs

@@ -0,0 +1 @@
+

clash_lib/src/common/mod.rs

@@ -1,4 +1,5 @@
 pub mod auth;
+pub mod cmd;
 pub mod crypto;
 pub mod errors;
 pub mod http;
@@ -7,4 +8,5 @@ pub mod mmdb;
 pub mod timed_future;
 pub mod tls;
 pub mod trie;
+pub mod tunnel_datagram;
 pub mod utils;

clash_lib/src/proxy/tun/datagram.rs → clash_lib/src/common/tunnel_datagram.rs

@@ -1,4 +1,4 @@
-use std::{net::SocketAddr, task::Poll};
+use std::task::Poll;
 
 use futures::{ready, Sink, Stream};
 
@@ -8,38 +8,33 @@ use crate::{
 };
 
 #[derive(Debug)]
-pub struct TunDatagram {
+pub struct TunnelDatagram {
+    // send to tproxy/tun, used for `Stream`
     rx: tokio::sync::mpsc::Receiver<UdpPacket>,
+    // receive from tproxy/tun, used for `Sink`
     tx: tokio::sync::mpsc::Sender<UdpPacket>,
 
     pkt: Option<UdpPacket>,
     flushed: bool,
-    #[allow(unused)]
-    local_addr: SocketAddr,
 }
 
-impl TunDatagram {
+impl TunnelDatagram {
     pub fn new(
-        // send to tun
         tx: tokio::sync::mpsc::Sender<UdpPacket>,
-        // receive from tun
         rx: tokio::sync::mpsc::Receiver<UdpPacket>,
-        // the address of the tun udp socket
-        local_addr: SocketAddr,
     ) -> Self {
         Self {
             rx,
             tx,
             pkt: None,
             flushed: true,
-            local_addr,
         }
     }
 }
 
-impl InboundDatagram<UdpPacket> for TunDatagram {}
+impl InboundDatagram<UdpPacket> for TunnelDatagram {}
 
-impl Stream for TunDatagram {
+impl Stream for TunnelDatagram {
     type Item = UdpPacket;
 
     fn poll_next(
@@ -50,7 +45,7 @@ impl Stream for TunDatagram {
     }
 }
 
-impl Sink<UdpPacket> for TunDatagram {
+impl Sink<UdpPacket> for TunnelDatagram {
     type Error = std::io::Error;
 
     fn poll_ready(