feat: add Docker image and GHCR workflow (#3)

.dockerignore

@@ -0,0 +1,13 @@
+.git
+.github
+.gitignore
+.DS_Store
+
+config.yaml
+config.yml
+
+build
+dist
+tmp
+*.log
+*.out

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@master
         with:
-          go-version: ^1.23
+          go-version: ^1.25
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@master
@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@master
         with:
-          go-version: ^1.23
+          go-version: ^1.25
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@master
@@ -44,3 +44,4 @@ jobs:
         uses: golangci/golangci-lint-action@master
         with:
           version: latest
+          install-mode: goinstall

.github/workflows/docker.yml

@@ -0,0 +1,109 @@
+name: docker
+
+on:
+  pull_request:
+  push:
+    branches:
+      - "**"
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  docker-ci:
+    name: Build Docker image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build test image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          load: true
+          tags: wiregold:test
+          build-args: |
+            VERSION=ci-${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Smoke test help output
+        run: docker run --rm wiregold:test -h
+
+      - name: Smoke test key generation
+        run: docker run --rm wiregold:test -g
+
+      - name: Smoke test preshared key generation
+        run: docker run --rm wiregold:test -pg
+
+      - name: Smoke test missing TUN message
+        run: |
+          set -euo pipefail
+          output="$(docker run --rm wiregold:test 2>&1 || true)"
+          printf '%s\n' "$output"
+          printf '%s' "$output" | grep -F "WireGold requires /dev/net/tun inside the container."
+
+  docker-publish:
+    name: Publish GHCR image
+    runs-on: ubuntu-latest
+    needs: docker-ci
+    if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == format('refs/heads/{0}', github.event.repository.default_branch))
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') || github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+          labels: |
+            org.opencontainers.image.title=WireGold
+            org.opencontainers.image.description=Container image for WireGold, a pure-Go Layer 3 VPN inspired by WireGuard.
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+          build-args: |
+            VERSION=${{ steps.meta.outputs.version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release.yml

@@ -6,52 +6,69 @@ on:
 
 env:
   GITHUB_TOKEN: ${{ github.token }}
+  CGO_ENABLED: 0
+  LDFLAGS: -s -w -checklinkname=0
+  VERSION_PKG: github.com/fumiama/WireGold/config
 
 jobs:
-  my-job:
-    name: Build WireGold on Push Tag 🚀
+  build:
+    name: Build ${{ matrix.name }}
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - { name: linux-x64,              goos: linux,   goarch: amd64  }
+          - { name: linux-x86,              goos: linux,   goarch: "386"  }
+          - { name: windows-x64,            goos: windows, goarch: amd64, ext: .exe }
+          - { name: windows-x86,            goos: windows, goarch: "386", ext: .exe }
+          - { name: linux-arm64,            goos: linux,   goarch: arm64, goarm: "7" }
+          - { name: linux-armv6,            goos: linux,   goarch: arm,   goarm: "6" }
+          - { name: linux-mips,             goos: linux,   goarch: mips   }
+          - { name: linux-mips-softfloat,   goos: linux,   goarch: mips,   gomips: softfloat }
+          - { name: linux-mipsel,           goos: linux,   goarch: mipsle }
+          - { name: linux-mipsel-softfloat, goos: linux,   goarch: mipsle, gomips: softfloat }
+    env:
+      GOOS: ${{ matrix.goos }}
+      GOARCH: ${{ matrix.goarch }}
+      GOARM: ${{ matrix.goarm }}
+      GOMIPS: ${{ matrix.gomips }}
     steps:
-
       - name: Set up Go
         uses: actions/setup-go@master
         with:
-          go-version: ^1.23
+          go-version: ^1.25
 
-      - name: Check out code into the Go module directory
+      - name: Check out code
         uses: actions/checkout@master
 
       - name: Cache Go
-        id: cache
         uses: actions/cache@v4
         with:
-          # A list of files, directories, and wildcard patterns to cache and restore
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-build-${{ hashFiles('**/go.sum') }}
 
       - name: Tidy Go modules
         run: go mod tidy
 
-      - name: Build linux-x64
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-x64 -trimpath
-      - name: Build linux-x86
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=386 go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-x86 -trimpath
-      - name: Build windows-x64
-        run: CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-windows-x64.exe -trimpath
-      - name: Build windows-x86
-        run: CGO_ENABLED=0 GOOS=windows GOARCH=386 go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-windows-x86.exe -trimpath
-      - name: Build arm64
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm64 GOARM=7 go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-arm64 -trimpath
-      - name: Build armv6
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=6 go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-armv6 -trimpath
-      - name: Build mips
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=mips go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-mips -trimpath
-      - name: Build mips-softfloat
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=mips GOMIPS=softfloat go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-mips-softfloat -trimpath
-      - name: Build mipsel
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=mipsle go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-mipsel -trimpath
-      - name: Build mipsel-softfloat
-        run: CGO_ENABLED=0 GOOS=linux GOARCH=mipsle GOMIPS=softfloat go build -ldflags="-s -w -checklinkname=0" -o artifacts/wg-linux-mipsel-softfloat -trimpath
+      - name: Build
+        run: go build -ldflags="${LDFLAGS} -X ${VERSION_PKG}.Version=${GITHUB_REF_NAME#v}" -o wg-${{ matrix.name }}${{ matrix.ext }} -trimpath
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: wg-${{ matrix.name }}
+          path: wg-${{ matrix.name }}${{ matrix.ext }}
+
+  release:
+    name: Upload Release 🚀
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
 
       - name: Upload binaries to release
         uses: svenstaro/upload-release-action@v2
@@ -60,4 +77,4 @@ jobs:
           file: artifacts/wg-*
           tag: ${{ github.ref }}
           overwrite: true
-          file_glob: true
+          file_glob: true

.gitignore

@@ -15,5 +15,5 @@
 # vendor/
 
 .DS_Store
-config.yaml
+/*.yaml
 WireGold

.golangci.yml

@@ -4,8 +4,8 @@ linters-settings:
     ignoretests: true
     exclude-functions:
       - (*os.File).Write
-      - (*github.com/fumiama/WireGold/helper.Writer).Write
-      - (*github.com/fumiama/WireGold/helper.Writer).WriteByte
+      - (*github.com/fumiama/WireGold/internal/bin.Writer).Write
+      - (*github.com/fumiama/WireGold/internal/bin.Writer).WriteByte
       - (*github.com/fumiama/WireGold/upper/services/tunnel.Tunnel).Write
       - (*github.com/fumiama/WireGold/upper/services/tunnel.Tunnel).Read
 

Dockerfile

@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1.7
+
+FROM --platform=$TARGETPLATFORM golang:1.25.0-bookworm AS build
+
+ARG VERSION=dev
+
+WORKDIR /src
+
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+
+COPY . .
+
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go build -trimpath -ldflags="-s -w -checklinkname=0 -X github.com/fumiama/WireGold/config.Version=${VERSION}" \
+    -o /out/wg .
+
+FROM debian:bookworm-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+LABEL org.opencontainers.image.title="WireGold" \
+      org.opencontainers.image.description="Container image for WireGold, a pure-Go Layer 3 VPN inspired by WireGuard." \
+      org.opencontainers.image.source="https://github.com/fumiama/WireGold"
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates iproute2 tini \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /config
+
+COPY --from=build /out/wg /usr/local/bin/wg
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+
+RUN chmod +x /usr/local/bin/wg /usr/local/bin/docker-entrypoint.sh \
+    && mkdir -p /config
+
+VOLUME ["/config"]
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"]
+CMD ["-c", "/config/config.yaml"]

README.md

@@ -4,16 +4,38 @@
   </a><br>
   <h1>WireGold</h1>
   Wire Golang Guard = WireGold<br><br>
+
+  English | [中文](README_ZH.md)
 </div>
 
-## Usage
-> If you are running in windows, remember to select the `wintun.dll` of your arch in `lower/wintun` and place it alongside the compiled exe
+## Overview
+
+WireGold is a pure Go Layer 3 VPN inspired by WireGuard.
+
+### Features
+
+- **Encryption**: XChaCha20-Poly1305 (AEAD) + Curve25519 key exchange + BLAKE2B integrity check
+- **Transport**: UDP / UDP-Lite / TCP / Raw IP / ICMP
+- **Encoding**: Optional Base16384 encoding to traverse text-only filters
+- **Anti-censorship**: XOR mask header obfuscation + randomized MTU scaling + optional double-send
+- **Compression**: Optional Zstd payload compression
+- **NAT traversal**: Built-in Hello/Query/Notify protocol for keepalive and hole punching
+- **Routing**: Multi-hop forwarding with TTL decrement and routing table management
+- **Key rotation**: 32 preshared key slots with random index selection per packet
+
+
+## Usage
+
+> On Windows, place the `wintun.dll` matching your architecture (from `lower/wintun/`) alongside the executable.
+
+> For high-latency lossy links, consider pairing with [UDPspeeder](https://github.com/wangyu-/UDPspeeder).
 
-> It is highly recommanded to use [UDPspeeder](https://github.com/wangyu-/UDPspeeder) together if you are using a High-latency Lossy Link
 ```bash
 wg [-c config.yaml] [-d|w] [-g] [-h] [-p] [-l log.txt]
 ```
-#### Instructions
+
+#### Flags
+
 ```bash
   -c string
         specify conf file (default "config.yaml")
@@ -28,18 +50,21 @@ wg [-c config.yaml] [-d|w] [-g] [-h] [-p] [-l log.txt]
   -w    only show logs above warn level
 ```
 
-## Config file example
+## Configuration
 
-- **macos mojave**: max mtu (under ipv4 endpoint) is `9159`
-- **ipv6 endpoint**: the recommand mtu is `1280~1500` to prevent the big segments from being dropped
+- **macOS Mojave**: max MTU (IPv4 endpoint) is `9159`
+- **IPv6 endpoint**: recommended MTU `1280–1500` to avoid oversized segment drops
+- **ICMP / Raw IP endpoint**: use bare IP address without port (e.g. `0.0.0.0`), requires root/admin privileges
 
 ```yaml
 IP: 192.168.233.1
 SubNet: 192.168.233.0/24
 PrivateKey: 暲菉斂狧污爉窫擸紈卆帞蔩慈睠庮扝憚瞼縀
+Network: udp  # udp (default), udplite, tcp, ip, icmp
 EndPoint: 0.0.0.0:56789
 MTU: 1504
 SpeedLoop: 4096
+MaxTTL: 64
 Mask: 0x1234567890abcdef
 Base14: true
 Peers:
@@ -68,130 +93,163 @@ Peers:
     AllowTrans: false
 ```
 
-## Benckmark on localhost
-> This benckmark is tested on Mac Book Air M1 within battery mode.
+### Configuration Reference
 
-### UDP MTU 4096
-```bash
+| Field | Description |
+|-------|-------------|
+| `Network` | Transport protocol: `udp` (default), `udplite`, `tcp`, `ip`, `icmp` |
+| `MaxTTL` | Initial TTL for outgoing packets; default `64` |
+| `SpeedLoop` | Log receive throughput statistics every N packets; default `4096` |
+| `AllowedIPs` | Prefix `x` to accept packets from the subnet without creating a system route; prefix `y` to add an internal route table entry only |
+| `Mask` | XOR mask for header obfuscation |
+| `Base14` | Enable Base16384 encoding |
+| `MTURandomRange` | Randomly shrink MTU by up to this value (never grows), adding traffic fingerprint randomness |
+| `DoublePacket` | Send every packet twice to counter heavy packet loss |
+| `KeepAliveSeconds` | NAT keepalive interval in seconds; 0 disables keepalive |
+| `QueryList` | Peer IPs to query for NAT traversal |
+| `UseZstd` | Enable Zstd compression |
+| `AllowTrans` | Allow this peer to relay traffic for other peers |
+
+## Benchmark (localhost)
+
+> MacBook Air M1, battery mode
+
+<details>
+<summary>UDP MTU 4096</summary>
+
+```
 goos: darwin
 goarch: arm64
 pkg: github.com/fumiama/WireGold/upper/services/tunnel
 cpu: Apple M1
-BenchmarkTunnelUDP/1024-plain-nob14-8               4753            250629 ns/op           4.09 MB/s     3570503 B/op        117 allocs/op
-BenchmarkTunnelUDP/1024-normal-nob14-8              4473            261136 ns/op           3.92 MB/s     3570565 B/op        118 allocs/op
-BenchmarkTunnelUDP/1024-plain-b14-8                 4250            275495 ns/op           3.72 MB/s     3575369 B/op        121 allocs/op
-BenchmarkTunnelUDP/1024-normal-b14-8                4204            278062 ns/op           3.68 MB/s     3575844 B/op        122 allocs/op
-BenchmarkTunnelUDP/1024-preshared-nob14-8           4196            282707 ns/op           3.62 MB/s     3570427 B/op        118 allocs/op
-BenchmarkTunnelUDP/1024-preshared-b14-8             4130            290609 ns/op           3.52 MB/s     3575814 B/op        121 allocs/op
-BenchmarkTunnelUDP/2048-plain-nob14-8               4162            280754 ns/op           7.29 MB/s     3578825 B/op        117 allocs/op
-BenchmarkTunnelUDP/2048-normal-nob14-8              4088            292733 ns/op           7.00 MB/s     3578858 B/op        118 allocs/op
-BenchmarkTunnelUDP/2048-plain-b14-8                 4023            290264 ns/op           7.06 MB/s     3589002 B/op        121 allocs/op
-BenchmarkTunnelUDP/2048-normal-b14-8                3904            298841 ns/op           6.85 MB/s     3589116 B/op        122 allocs/op
-BenchmarkTunnelUDP/2048-preshared-nob14-8           3861            285661 ns/op           7.17 MB/s     3578690 B/op        117 allocs/op
-BenchmarkTunnelUDP/2048-preshared-b14-8             4344            273054 ns/op           7.50 MB/s     3589101 B/op        122 allocs/op
-BenchmarkTunnelUDP/3072-plain-nob14-8               4293            273633 ns/op          11.23 MB/s     3582928 B/op        121 allocs/op
-BenchmarkTunnelUDP/3072-normal-nob14-8              4086            287291 ns/op          10.69 MB/s     3583011 B/op        122 allocs/op
-BenchmarkTunnelUDP/3072-plain-b14-8                 4144            295141 ns/op          10.41 MB/s     3600854 B/op        128 allocs/op
-BenchmarkTunnelUDP/3072-normal-b14-8                3759            310645 ns/op           9.89 MB/s     3601217 B/op        130 allocs/op
-BenchmarkTunnelUDP/3072-preshared-nob14-8           3805            305162 ns/op          10.07 MB/s     3583013 B/op        122 allocs/op
-BenchmarkTunnelUDP/3072-preshared-b14-8             3574            320329 ns/op           9.59 MB/s     3601409 B/op        130 allocs/op
-BenchmarkTunnelUDP/4096-plain-nob14-8               2448            482246 ns/op           8.49 MB/s     7157679 B/op        241 allocs/op
-BenchmarkTunnelUDP/4096-normal-nob14-8              2328            508454 ns/op           8.06 MB/s     7158430 B/op        244 allocs/op
-BenchmarkTunnelUDP/4096-plain-b14-8                 2290            527956 ns/op           7.76 MB/s     7181296 B/op        254 allocs/op
-BenchmarkTunnelUDP/4096-normal-b14-8                2276            528681 ns/op           7.75 MB/s     7181960 B/op        256 allocs/op
-BenchmarkTunnelUDP/4096-preshared-nob14-8           2284            515491 ns/op           7.95 MB/s     7158606 B/op        243 allocs/op
-BenchmarkTunnelUDP/4096-preshared-b14-8             2026            560506 ns/op           7.31 MB/s     7181980 B/op        256 allocs/op
+BenchmarkTunnelUDP/1024-plain-nob14-8               4938            228283 ns/op           4.49 MB/s     3642671 B/op        149 allocs/op
+BenchmarkTunnelUDP/1024-normal-nob14-8              5100            234118 ns/op           4.37 MB/s     3642409 B/op        147 allocs/op
+BenchmarkTunnelUDP/1024-plain-b14-8                 4528            249429 ns/op           4.11 MB/s     3825461 B/op        179 allocs/op
+BenchmarkTunnelUDP/1024-normal-b14-8                4885            242048 ns/op           4.23 MB/s     3818262 B/op        175 allocs/op
+BenchmarkTunnelUDP/1024-preshared-nob14-8           4833            242460 ns/op           4.22 MB/s     3632537 B/op        144 allocs/op
+BenchmarkTunnelUDP/1024-preshared-b14-8             4348            239630 ns/op           4.27 MB/s     3820118 B/op        174 allocs/op
+BenchmarkTunnelUDP/2048-plain-nob14-8               4766            280419 ns/op           7.30 MB/s     3656588 B/op        148 allocs/op
+BenchmarkTunnelUDP/2048-normal-nob14-8              4353            250150 ns/op           8.19 MB/s     3639053 B/op        145 allocs/op
+BenchmarkTunnelUDP/2048-plain-b14-8                 4136            278223 ns/op           7.36 MB/s     3848032 B/op        178 allocs/op
+BenchmarkTunnelUDP/2048-normal-b14-8                4264            268694 ns/op           7.62 MB/s     3842609 B/op        176 allocs/op
+BenchmarkTunnelUDP/2048-preshared-nob14-8           4154            262575 ns/op           7.80 MB/s     3640443 B/op        144 allocs/op
+BenchmarkTunnelUDP/2048-preshared-b14-8             3932            287082 ns/op           7.13 MB/s     3846167 B/op        176 allocs/op
+BenchmarkTunnelUDP/3072-plain-nob14-8               4006            267281 ns/op          11.49 MB/s     3690985 B/op        164 allocs/op
+BenchmarkTunnelUDP/3072-normal-nob14-8              3942            271832 ns/op          11.30 MB/s     3670827 B/op        162 allocs/op
+BenchmarkTunnelUDP/3072-plain-b14-8                 3529            291120 ns/op          10.55 MB/s     3993371 B/op        211 allocs/op
+BenchmarkTunnelUDP/3072-normal-b14-8                3614            298778 ns/op          10.28 MB/s     3994267 B/op        211 allocs/op
+BenchmarkTunnelUDP/3072-preshared-nob14-8           4036            297819 ns/op          10.31 MB/s     3674026 B/op        162 allocs/op
+BenchmarkTunnelUDP/3072-preshared-b14-8             3705            300820 ns/op          10.21 MB/s     3989965 B/op        210 allocs/op
+BenchmarkTunnelUDP/4096-plain-nob14-8               2604            398308 ns/op          10.28 MB/s     7389986 B/op        320 allocs/op
+BenchmarkTunnelUDP/4096-normal-nob14-8              2744            399739 ns/op          10.25 MB/s     7348911 B/op        316 allocs/op
+BenchmarkTunnelUDP/4096-plain-b14-8                 2788            430813 ns/op           9.51 MB/s     7965100 B/op        410 allocs/op
+BenchmarkTunnelUDP/4096-normal-b14-8                2620            432984 ns/op           9.46 MB/s     7957374 B/op        407 allocs/op
+BenchmarkTunnelUDP/4096-preshared-nob14-8           2750            395736 ns/op          10.35 MB/s     7348747 B/op        315 allocs/op
+BenchmarkTunnelUDP/4096-preshared-b14-8             2628            431785 ns/op           9.49 MB/s     7961597 B/op        407 allocs/op
+```
+</details>
+
+<details>
+<summary>UDP MTU 1024</summary>
+
 ```
-### UDP MTU 1024
-```bash
 goos: darwin
 goarch: arm64
 pkg: github.com/fumiama/WireGold/upper/services/tunnel
 cpu: Apple M1
-BenchmarkTunnelUDPSmallMTU/1024-plain-nob14-8       3766            326631 ns/op           3.14 MB/s     3568299 B/op        126 allocs/op
-BenchmarkTunnelUDPSmallMTU/1024-normal-nob14-8      3728            319552 ns/op           3.20 MB/s     3568454 B/op        128 allocs/op
-BenchmarkTunnelUDPSmallMTU/1024-plain-b14-8         3625            323816 ns/op           3.16 MB/s     3575638 B/op        137 allocs/op
-BenchmarkTunnelUDPSmallMTU/1024-normal-b14-8        3446            333510 ns/op           3.07 MB/s     3575925 B/op        138 allocs/op
-BenchmarkTunnelUDPSmallMTU/1024-preshared-nob14-8   3537            335220 ns/op           3.05 MB/s     3568481 B/op        128 allocs/op
-BenchmarkTunnelUDPSmallMTU/1024-preshared-b14-8     3486            337967 ns/op           3.03 MB/s     3575890 B/op        138 allocs/op
-BenchmarkTunnelUDPSmallMTU/2048-plain-nob14-8       3303            349278 ns/op           5.86 MB/s     3592804 B/op        140 allocs/op
-BenchmarkTunnelUDPSmallMTU/2048-normal-nob14-8      3331            376226 ns/op           5.44 MB/s     3593065 B/op        142 allocs/op
-BenchmarkTunnelUDPSmallMTU/2048-plain-b14-8         3116            421630 ns/op           4.86 MB/s     3605117 B/op        157 allocs/op
-BenchmarkTunnelUDPSmallMTU/2048-normal-b14-8        2634            381676 ns/op           5.37 MB/s     3606455 B/op        158 allocs/op
-BenchmarkTunnelUDPSmallMTU/2048-preshared-nob14-8   3138            391760 ns/op           5.23 MB/s     3591788 B/op        142 allocs/op
-BenchmarkTunnelUDPSmallMTU/2048-preshared-b14-8     2959            391663 ns/op           5.23 MB/s     3605364 B/op        158 allocs/op
-BenchmarkTunnelUDPSmallMTU/3072-plain-nob14-8       3046            421705 ns/op           7.28 MB/s     3620443 B/op        156 allocs/op
-BenchmarkTunnelUDPSmallMTU/3072-normal-nob14-8      3001            413043 ns/op           7.44 MB/s     3631990 B/op        157 allocs/op
-BenchmarkTunnelUDPSmallMTU/3072-plain-b14-8         2503            406906 ns/op           7.55 MB/s     3640574 B/op        177 allocs/op
-BenchmarkTunnelUDPSmallMTU/3072-normal-b14-8        2776            416946 ns/op           7.37 MB/s     3643066 B/op        179 allocs/op
-BenchmarkTunnelUDPSmallMTU/3072-preshared-nob14-8   2947            422378 ns/op           7.27 MB/s     3626004 B/op        157 allocs/op
-BenchmarkTunnelUDPSmallMTU/3072-preshared-b14-8     2547            459951 ns/op           6.68 MB/s     3648033 B/op        179 allocs/op
-BenchmarkTunnelUDPSmallMTU/4096-plain-nob14-8       1776            628904 ns/op           6.51 MB/s     7232490 B/op        285 allocs/op
-BenchmarkTunnelUDPSmallMTU/4096-normal-nob14-8      1782            643967 ns/op           6.36 MB/s     7238574 B/op        288 allocs/op
-BenchmarkTunnelUDPSmallMTU/4096-plain-b14-8         1549            674359 ns/op           6.07 MB/s     7262233 B/op        317 allocs/op
-BenchmarkTunnelUDPSmallMTU/4096-normal-b14-8        1826            690961 ns/op           5.93 MB/s     7260027 B/op        319 allocs/op
-BenchmarkTunnelUDPSmallMTU/4096-preshared-nob14-8   1868            649732 ns/op           6.30 MB/s     7242787 B/op        288 allocs/op
-BenchmarkTunnelUDPSmallMTU/4096-preshared-b14-8     1654            682244 ns/op           6.00 MB/s     7255985 B/op        318 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-plain-nob14-8       4770            256794 ns/op           3.99 MB/s     3715458 B/op        193 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-normal-nob14-8      4945            242538 ns/op           4.22 MB/s     3681420 B/op        188 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-plain-b14-8         4137            269202 ns/op           3.80 MB/s     4101089 B/op        254 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-normal-b14-8        4592            253461 ns/op           4.04 MB/s     4109262 B/op        253 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-preshared-nob14-8   4764            243752 ns/op           4.20 MB/s     3675691 B/op        186 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-preshared-b14-8     4086            282682 ns/op           3.62 MB/s     4107240 B/op        253 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-plain-nob14-8       4728            252759 ns/op           8.10 MB/s     3762231 B/op        234 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-normal-nob14-8      4245            257036 ns/op           7.97 MB/s     3729842 B/op        232 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-plain-b14-8         3615            308642 ns/op           6.64 MB/s     4469625 B/op        342 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-normal-b14-8        3624            311780 ns/op           6.57 MB/s     4487346 B/op        345 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-preshared-nob14-8   3999            260043 ns/op           7.88 MB/s     3723444 B/op        231 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-preshared-b14-8     3558            315744 ns/op           6.49 MB/s     4476565 B/op        343 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-plain-nob14-8       3814            265654 ns/op          11.56 MB/s     3802900 B/op        280 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-normal-nob14-8      4380            291992 ns/op          10.52 MB/s     3760254 B/op        276 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-plain-b14-8         3340            338760 ns/op           9.07 MB/s     4849826 B/op        434 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-normal-b14-8        3302            345620 ns/op           8.89 MB/s     4852322 B/op        434 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-preshared-nob14-8   4424            265290 ns/op          11.58 MB/s     3761816 B/op        277 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-preshared-b14-8     3148            344490 ns/op           8.92 MB/s     4849613 B/op        434 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-plain-nob14-8       2586            399489 ns/op          10.25 MB/s     7570823 B/op        467 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-normal-nob14-8      2576            402297 ns/op          10.18 MB/s     7504731 B/op        464 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-plain-b14-8         2240            484812 ns/op           8.45 MB/s     9081331 B/op        696 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-normal-b14-8        2240            504749 ns/op           8.11 MB/s     9069168 B/op        693 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-preshared-nob14-8   2594            392716 ns/op          10.43 MB/s     7480678 B/op        460 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-preshared-b14-8     2234            506134 ns/op           8.09 MB/s     9066223 B/op        691 allocs/op
+```
+</details>
+
+<details>
+<summary>TCP MTU 4096</summary>
+
 ```
-### TCP MTU 4096
-```bash
 goos: darwin
 goarch: arm64
 pkg: github.com/fumiama/WireGold/upper/services/tunnel
 cpu: Apple M1
-BenchmarkTunnelTCP/1024-plain-nob14-8               2323            459188 ns/op           2.23 MB/s     3576540 B/op        166 allocs/op
-BenchmarkTunnelTCP/1024-normal-nob14-8              2472            438347 ns/op           2.34 MB/s     3576692 B/op        168 allocs/op
-BenchmarkTunnelTCP/1024-plain-b14-8                 2728            418395 ns/op           2.45 MB/s     3583603 B/op        171 allocs/op
-BenchmarkTunnelTCP/1024-normal-b14-8                2668            463060 ns/op           2.21 MB/s     3584519 B/op        172 allocs/op
-BenchmarkTunnelTCP/1024-preshared-nob14-8           2660            454945 ns/op           2.25 MB/s     3576708 B/op        168 allocs/op
-BenchmarkTunnelTCP/1024-preshared-b14-8             2690            437373 ns/op           2.34 MB/s     3584515 B/op        172 allocs/op
-BenchmarkTunnelTCP/2048-plain-nob14-8               2580            455416 ns/op           4.50 MB/s     3590368 B/op        168 allocs/op
-BenchmarkTunnelTCP/2048-normal-nob14-8              2294            458178 ns/op           4.47 MB/s     3590512 B/op        171 allocs/op
-BenchmarkTunnelTCP/2048-plain-b14-8                 2414            462412 ns/op           4.43 MB/s     3605344 B/op        174 allocs/op
-BenchmarkTunnelTCP/2048-normal-b14-8                2511            508527 ns/op           4.03 MB/s     3605658 B/op        177 allocs/op
-BenchmarkTunnelTCP/2048-preshared-nob14-8           2433            482086 ns/op           4.25 MB/s     3590571 B/op        171 allocs/op
-BenchmarkTunnelTCP/2048-preshared-b14-8             2361            494409 ns/op           4.14 MB/s     3605739 B/op        177 allocs/op
-BenchmarkTunnelTCP/3072-plain-nob14-8               2487            498395 ns/op           6.16 MB/s     3600311 B/op        199 allocs/op
-BenchmarkTunnelTCP/3072-normal-nob14-8              2170            542424 ns/op           5.66 MB/s     3600596 B/op        202 allocs/op
-BenchmarkTunnelTCP/3072-plain-b14-8                 2259            524854 ns/op           5.85 MB/s     3621274 B/op        205 allocs/op
-BenchmarkTunnelTCP/3072-normal-b14-8                2307            537656 ns/op           5.71 MB/s     3621514 B/op        209 allocs/op
-BenchmarkTunnelTCP/3072-preshared-nob14-8           1855            545493 ns/op           5.63 MB/s     3600418 B/op        201 allocs/op
-BenchmarkTunnelTCP/3072-preshared-b14-8             2198            535328 ns/op           5.74 MB/s     3621536 B/op        208 allocs/op
-BenchmarkTunnelTCP/4096-plain-nob14-8               2043            587272 ns/op           6.97 MB/s     7181814 B/op        391 allocs/op
-BenchmarkTunnelTCP/4096-normal-nob14-8              1832            609909 ns/op           6.72 MB/s     7182940 B/op        394 allocs/op
-BenchmarkTunnelTCP/4096-plain-b14-8                 2044            572149 ns/op           7.16 MB/s     7209279 B/op        405 allocs/op
-BenchmarkTunnelTCP/4096-normal-b14-8                2019            655180 ns/op           6.25 MB/s     7210261 B/op        409 allocs/op
-BenchmarkTunnelTCP/4096-preshared-nob14-8           1652            636402 ns/op           6.44 MB/s     7182914 B/op        394 allocs/op
-BenchmarkTunnelTCP/4096-preshared-b14-8             1885            624237 ns/op           6.56 MB/s     7210327 B/op        408 allocs/op
+BenchmarkTunnelTCP/1024-plain-nob14-8               4627            246837 ns/op           4.15 MB/s     3684040 B/op        201 allocs/op
+BenchmarkTunnelTCP/1024-normal-nob14-8              4833            257150 ns/op           3.98 MB/s     3682260 B/op        199 allocs/op
+BenchmarkTunnelTCP/1024-plain-b14-8                 4396            272838 ns/op           3.75 MB/s     3850134 B/op        231 allocs/op
+BenchmarkTunnelTCP/1024-normal-b14-8                4104            252293 ns/op           4.06 MB/s     3844674 B/op        226 allocs/op
+BenchmarkTunnelTCP/1024-preshared-nob14-8           4530            264767 ns/op           3.87 MB/s     3680243 B/op        197 allocs/op
+BenchmarkTunnelTCP/1024-preshared-b14-8             4231            287111 ns/op           3.57 MB/s     3847164 B/op        227 allocs/op
+BenchmarkTunnelTCP/2048-plain-nob14-8               4275            276425 ns/op           7.41 MB/s     3698728 B/op        200 allocs/op
+BenchmarkTunnelTCP/2048-normal-nob14-8              4033            261234 ns/op           7.84 MB/s     3701433 B/op        200 allocs/op
+BenchmarkTunnelTCP/2048-plain-b14-8                 3680            303246 ns/op           6.75 MB/s     3875541 B/op        231 allocs/op
+BenchmarkTunnelTCP/2048-normal-b14-8                3626            288219 ns/op           7.11 MB/s     3878505 B/op        230 allocs/op
+BenchmarkTunnelTCP/2048-preshared-nob14-8           3868            287679 ns/op           7.12 MB/s     3696931 B/op        200 allocs/op
+BenchmarkTunnelTCP/2048-preshared-b14-8             3586            305008 ns/op           6.71 MB/s     3878416 B/op        230 allocs/op
+BenchmarkTunnelTCP/3072-plain-nob14-8               3666            298452 ns/op          10.29 MB/s     3767509 B/op        246 allocs/op
+BenchmarkTunnelTCP/3072-normal-nob14-8              3450            304848 ns/op          10.08 MB/s     3761811 B/op        246 allocs/op
+BenchmarkTunnelTCP/3072-plain-b14-8                 3549            315641 ns/op           9.73 MB/s     4032830 B/op        291 allocs/op
+BenchmarkTunnelTCP/3072-normal-b14-8                3440            327234 ns/op           9.39 MB/s     4038470 B/op        292 allocs/op
+BenchmarkTunnelTCP/3072-preshared-nob14-8           3522            302663 ns/op          10.15 MB/s     3760304 B/op        245 allocs/op
+BenchmarkTunnelTCP/3072-preshared-b14-8             3390            326384 ns/op           9.41 MB/s     4040489 B/op        293 allocs/op
+BenchmarkTunnelTCP/4096-plain-nob14-8               2431            435457 ns/op           9.41 MB/s     7515476 B/op        480 allocs/op
+BenchmarkTunnelTCP/4096-normal-nob14-8              2500            433178 ns/op           9.46 MB/s     7511114 B/op        478 allocs/op
+BenchmarkTunnelTCP/4096-plain-b14-8                 2337            457177 ns/op           8.96 MB/s     8033760 B/op        568 allocs/op
+BenchmarkTunnelTCP/4096-normal-b14-8                2374            465704 ns/op           8.80 MB/s     8040812 B/op        567 allocs/op
+BenchmarkTunnelTCP/4096-preshared-nob14-8           2532            436310 ns/op           9.39 MB/s     7510565 B/op        477 allocs/op
+BenchmarkTunnelTCP/4096-preshared-b14-8             2360            459261 ns/op           8.92 MB/s     8037878 B/op        566 allocs/op
+```
+</details>
+
+<details>
+<summary>TCP MTU 1024</summary>
+
 ```
-### TCP MTU 1024
-```bash
 goos: darwin
 goarch: arm64
 pkg: github.com/fumiama/WireGold/upper/services/tunnel
 cpu: Apple M1
-BenchmarkTunnelTCPSmallMTU/1024-plain-nob14-8       2061            582289 ns/op           1.76 MB/s     3577539 B/op        234 allocs/op
-BenchmarkTunnelTCPSmallMTU/1024-normal-nob14-8      2172            561002 ns/op           1.83 MB/s     3577725 B/op        237 allocs/op
-BenchmarkTunnelTCPSmallMTU/1024-plain-b14-8         2002            625224 ns/op           1.64 MB/s     3584694 B/op        244 allocs/op
-BenchmarkTunnelTCPSmallMTU/1024-normal-b14-8        1957            590091 ns/op           1.74 MB/s     3585060 B/op        247 allocs/op
-BenchmarkTunnelTCPSmallMTU/1024-preshared-nob14-8   2127            552614 ns/op           1.85 MB/s     3577669 B/op        236 allocs/op
-BenchmarkTunnelTCPSmallMTU/1024-preshared-b14-8     2084            602128 ns/op           1.70 MB/s     3585057 B/op        247 allocs/op
-BenchmarkTunnelTCPSmallMTU/2048-plain-nob14-8       1899            595303 ns/op           3.44 MB/s     3596277 B/op        320 allocs/op
-BenchmarkTunnelTCPSmallMTU/2048-normal-nob14-8      1656            604450 ns/op           3.39 MB/s     3596115 B/op        323 allocs/op
-BenchmarkTunnelTCPSmallMTU/2048-plain-b14-8         1729            624733 ns/op           3.28 MB/s     3610414 B/op        339 allocs/op
-BenchmarkTunnelTCPSmallMTU/2048-normal-b14-8        1568            653317 ns/op           3.13 MB/s     3611234 B/op        342 allocs/op
-BenchmarkTunnelTCPSmallMTU/2048-preshared-nob14-8   1858            664597 ns/op           3.08 MB/s     3595764 B/op        322 allocs/op
-BenchmarkTunnelTCPSmallMTU/2048-preshared-b14-8     1404            767077 ns/op           2.67 MB/s     3609789 B/op        339 allocs/op
-BenchmarkTunnelTCPSmallMTU/3072-plain-nob14-8       1761            846583 ns/op           3.63 MB/s     3614569 B/op        410 allocs/op
-BenchmarkTunnelTCPSmallMTU/3072-normal-nob14-8      1887            743407 ns/op           4.13 MB/s     3612869 B/op        411 allocs/op
-BenchmarkTunnelTCPSmallMTU/3072-plain-b14-8         1582            679431 ns/op           4.52 MB/s     3639650 B/op        435 allocs/op
-BenchmarkTunnelTCPSmallMTU/3072-normal-b14-8        1688            720574 ns/op           4.26 MB/s     3634744 B/op        435 allocs/op
-BenchmarkTunnelTCPSmallMTU/3072-preshared-nob14-8   1762            731901 ns/op           4.20 MB/s     3616570 B/op        414 allocs/op
-BenchmarkTunnelTCPSmallMTU/3072-preshared-b14-8     1656            716281 ns/op           4.29 MB/s     3636078 B/op        434 allocs/op
-BenchmarkTunnelTCPSmallMTU/4096-plain-nob14-8       1482            847378 ns/op           4.83 MB/s     7214173 B/op        666 allocs/op
-BenchmarkTunnelTCPSmallMTU/4096-normal-nob14-8      1354            818199 ns/op           5.01 MB/s     7219760 B/op        665 allocs/op
-BenchmarkTunnelTCPSmallMTU/4096-plain-b14-8         1557            784260 ns/op           5.22 MB/s     7243407 B/op        697 allocs/op
-BenchmarkTunnelTCPSmallMTU/4096-normal-b14-8        1316            811760 ns/op           5.05 MB/s     7241275 B/op        699 allocs/op
-BenchmarkTunnelTCPSmallMTU/4096-preshared-nob14-8   1299            806369 ns/op           5.08 MB/s     7216648 B/op        666 allocs/op
-BenchmarkTunnelTCPSmallMTU/4096-preshared-b14-8     1278            858201 ns/op           4.77 MB/s     7242324 B/op        703 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-plain-nob14-8       3318            312084 ns/op           3.28 MB/s     3797015 B/op        307 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-normal-nob14-8      4102            303641 ns/op           3.37 MB/s     3795618 B/op        308 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-plain-b14-8         3746            314102 ns/op           3.26 MB/s     4147318 B/op        368 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-normal-b14-8        3609            315252 ns/op           3.25 MB/s     4152014 B/op        368 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-preshared-nob14-8   3826            300693 ns/op           3.41 MB/s     3793725 B/op        304 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-preshared-b14-8     3628            327852 ns/op           3.12 MB/s     4150869 B/op        367 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-plain-nob14-8       3553            315709 ns/op           6.49 MB/s     3945193 B/op        426 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-normal-nob14-8      3254            329794 ns/op           6.21 MB/s     3933224 B/op        427 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-plain-b14-8         3222            357250 ns/op           5.73 MB/s     4538189 B/op        529 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-normal-b14-8        3080            359401 ns/op           5.70 MB/s     4555108 B/op        535 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-preshared-nob14-8   3463            320078 ns/op           6.40 MB/s     3936771 B/op        426 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-preshared-b14-8     2990            363645 ns/op           5.63 MB/s     4555897 B/op        535 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-plain-nob14-8       3228            336736 ns/op           9.12 MB/s     4090750 B/op        550 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-normal-nob14-8      3076            347067 ns/op           8.85 MB/s     4084480 B/op        554 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-plain-b14-8         2798            395353 ns/op           7.77 MB/s     4952186 B/op        700 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-normal-b14-8        2725            403959 ns/op           7.60 MB/s     4965324 B/op        705 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-preshared-nob14-8   3366            344086 ns/op           8.93 MB/s     4080821 B/op        549 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-preshared-b14-8     2797            403142 ns/op           7.62 MB/s     4962100 B/op        703 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-plain-nob14-8       2360            490867 ns/op           8.34 MB/s     7940290 B/op        871 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-normal-nob14-8      2223            486839 ns/op           8.41 MB/s     7927235 B/op        872 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-plain-b14-8         2002            557560 ns/op           7.35 MB/s     9201342 B/op       1087 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-normal-b14-8        1868            564007 ns/op           7.26 MB/s     9216972 B/op       1091 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-preshared-nob14-8   2263            491698 ns/op           8.33 MB/s     7925404 B/op        869 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-preshared-b14-8     2050            559663 ns/op           7.32 MB/s     9211292 B/op       1086 allocs/op
 ```
+</details>

README_ZH.md

@@ -0,0 +1,254 @@
+<div align="center">
+  <a href="https://crypko.ai/crypko/G39ZPfer7g6rz/">
+    <img src=".github/Maria.png" width = "400" alt="WireGold-Maria">
+  </a><br>
+  <h1>WireGold</h1>
+  Wire Golang Guard = WireGold<br><br>
+
+  [English](README.md) | 中文
+</div>
+
+## 概述
+
+WireGold 是一个纯 Go 实现的第 3 层 VPN，灵感来自 WireGuard。
+
+### 主要特性
+
+- **加密**: XChaCha20-Poly1305 (AEAD) + Curve25519 密钥交换 + BLAKE2B 完整性校验
+- **传输**: 支持 UDP / UDP-Lite / TCP / Raw IP / ICMP 多种底层传输
+- **编码**: 可选 Base16384 编码以穿越文本过滤
+- **抗审查**: XOR 掩码混淆报头 + 随机 MTU 放缩 + 可选双倍发包
+- **压缩**: 可选 Zstd 数据压缩
+- **NAT 穿透**: 内置 Hello/Query/Notify 协议实现 NAT 保活与穿透
+- **路由转发**: 支持多跳转发 (TTL 递减) 与路由表管理
+- **密钥集**: 支持 32 组预共享密钥混合，随机选择密钥索引
+
+## 使用方法
+
+> Windows 用户需将对应架构的 `wintun.dll` (位于 `lower/wintun/`) 放在可执行文件同目录下
+
+> 高延迟有损链路建议配合 [UDPspeeder](https://github.com/wangyu-/UDPspeeder) 使用
+
+```bash
+wg [-c config.yaml] [-d|w] [-g] [-h] [-p] [-l log.txt]
+```
+
+#### 参数说明
+
+```bash
+  -c string
+        指定配置文件 (默认 "config.yaml")
+  -d    输出调试日志
+  -g    生成密钥对
+  -h    显示帮助
+  -l string
+        将日志写入文件 (默认 "-")
+  -p    显示本机公钥
+  -pg
+        生成预共享密钥
+  -w    仅显示 warn 及以上级别日志
+```
+
+## 配置文件示例
+
+- **macOS Mojave**: 最大 MTU (IPv4 endpoint) 为 `9159`
+- **IPv6 endpoint**: 推荐 MTU `1280~1500`，避免大分片被丢弃
+- **ICMP / Raw IP endpoint**: 使用裸 IP 地址，无需端口号 (如 `0.0.0.0`)。需要 root/管理员权限
+
+```yaml
+IP: 192.168.233.1
+SubNet: 192.168.233.0/24
+PrivateKey: 暲菉斂狧污爉窫擸紈卆帞蔩慈睠庮扝憚瞼縀
+Network: udp  # udp (默认), udplite, tcp, ip, icmp
+EndPoint: 0.0.0.0:56789
+MTU: 1504
+SpeedLoop: 4096
+MaxTTL: 64
+Mask: 0x1234567890abcdef
+Base14: true
+Peers:
+  -
+    IP: "192.168.233.2"
+    PublicKey: 徯萃嵾爻燸攗窍褃冔蒔犡緇袿屿組待族砇嘀
+    PresharedKey: 瀸敀爅崾嘊嵜紼樴稍毯攣矐訷蟷扛嬋庩崛昀
+    EndPoint: 1.2.3.4:56789
+    AllowedIPs: ["192.168.233.2/32", "x192.168.233.3/32"]
+    KeepAliveSeconds: 0
+    QueryList: ["192.168.233.3"]
+    MTU: 1400
+    MTURandomRange: 128
+    UseZstd: true
+    QuerySeconds: 10
+    AllowTrans: true
+  -
+    IP: "192.168.233.3"
+    PublicKey: 牢喨粷詸衭譛浾蘹櫠砙杹蟫瑳叩刋橋経挵蘀
+    PresharedKey: 竅琚喫従痸告烈兇厕趭萨假蔛瀇譄施烸蝫瘀
+    EndPoint: ""
+    AllowedIPs: ["192.168.233.3/32", "y192.168.66.1/32"]
+    MTU: 752
+    DoublePacket: true
+    KeepAliveSeconds: 0
+    AllowTrans: false
+```
+
+### 配置字段说明
+
+| 字段 | 说明 |
+|------|------|
+| `Network` | 传输协议: `udp` (默认), `udplite`, `tcp`, `ip`, `icmp` |
+| `MaxTTL` | 发包初始 TTL，默认 `64` |
+| `SpeedLoop` | 每收到 N 个包时输出一次吞吐统计，默认 `4096` |
+| `AllowedIPs` | 前缀 `x` 表示只接受该网段报文但不建系统路由；前缀 `y` 表示只添加内部路由表条目 |
+| `Mask` | XOR 掩码，用于混淆报头 |
+| `Base14` | 启用 Base16384 编码 |
+| `MTURandomRange` | 随机缩小 MTU 的范围 (只减不增)，增加流量特征随机性 |
+| `DoublePacket` | 双倍发包以对抗强丢包链路 |
+| `KeepAliveSeconds` | NAT 保活间隔 (秒)，0 为不保活 |
+| `QueryList` | NAT 穿透时查询的对端 IP 列表 |
+| `UseZstd` | 启用 Zstd 压缩 |
+| `AllowTrans` | 是否允许为其他 Peer 转发流量 |
+
+## 本地基准测试
+
+> Mac Book Air M1，电池供电模式
+
+<details>
+<summary>UDP MTU 4096</summary>
+
+```
+goos: darwin
+goarch: arm64
+pkg: github.com/fumiama/WireGold/upper/services/tunnel
+cpu: Apple M1
+BenchmarkTunnelUDP/1024-plain-nob14-8               4938            228283 ns/op           4.49 MB/s     3642671 B/op        149 allocs/op
+BenchmarkTunnelUDP/1024-normal-nob14-8              5100            234118 ns/op           4.37 MB/s     3642409 B/op        147 allocs/op
+BenchmarkTunnelUDP/1024-plain-b14-8                 4528            249429 ns/op           4.11 MB/s     3825461 B/op        179 allocs/op
+BenchmarkTunnelUDP/1024-normal-b14-8                4885            242048 ns/op           4.23 MB/s     3818262 B/op        175 allocs/op
+BenchmarkTunnelUDP/1024-preshared-nob14-8           4833            242460 ns/op           4.22 MB/s     3632537 B/op        144 allocs/op
+BenchmarkTunnelUDP/1024-preshared-b14-8             4348            239630 ns/op           4.27 MB/s     3820118 B/op        174 allocs/op
+BenchmarkTunnelUDP/2048-plain-nob14-8               4766            280419 ns/op           7.30 MB/s     3656588 B/op        148 allocs/op
+BenchmarkTunnelUDP/2048-normal-nob14-8              4353            250150 ns/op           8.19 MB/s     3639053 B/op        145 allocs/op
+BenchmarkTunnelUDP/2048-plain-b14-8                 4136            278223 ns/op           7.36 MB/s     3848032 B/op        178 allocs/op
+BenchmarkTunnelUDP/2048-normal-b14-8                4264            268694 ns/op           7.62 MB/s     3842609 B/op        176 allocs/op
+BenchmarkTunnelUDP/2048-preshared-nob14-8           4154            262575 ns/op           7.80 MB/s     3640443 B/op        144 allocs/op
+BenchmarkTunnelUDP/2048-preshared-b14-8             3932            287082 ns/op           7.13 MB/s     3846167 B/op        176 allocs/op
+BenchmarkTunnelUDP/3072-plain-nob14-8               4006            267281 ns/op          11.49 MB/s     3690985 B/op        164 allocs/op
+BenchmarkTunnelUDP/3072-normal-nob14-8              3942            271832 ns/op          11.30 MB/s     3670827 B/op        162 allocs/op
+BenchmarkTunnelUDP/3072-plain-b14-8                 3529            291120 ns/op          10.55 MB/s     3993371 B/op        211 allocs/op
+BenchmarkTunnelUDP/3072-normal-b14-8                3614            298778 ns/op          10.28 MB/s     3994267 B/op        211 allocs/op
+BenchmarkTunnelUDP/3072-preshared-nob14-8           4036            297819 ns/op          10.31 MB/s     3674026 B/op        162 allocs/op
+BenchmarkTunnelUDP/3072-preshared-b14-8             3705            300820 ns/op          10.21 MB/s     3989965 B/op        210 allocs/op
+BenchmarkTunnelUDP/4096-plain-nob14-8               2604            398308 ns/op          10.28 MB/s     7389986 B/op        320 allocs/op
+BenchmarkTunnelUDP/4096-normal-nob14-8              2744            399739 ns/op          10.25 MB/s     7348911 B/op        316 allocs/op
+BenchmarkTunnelUDP/4096-plain-b14-8                 2788            430813 ns/op           9.51 MB/s     7965100 B/op        410 allocs/op
+BenchmarkTunnelUDP/4096-normal-b14-8                2620            432984 ns/op           9.46 MB/s     7957374 B/op        407 allocs/op
+BenchmarkTunnelUDP/4096-preshared-nob14-8           2750            395736 ns/op          10.35 MB/s     7348747 B/op        315 allocs/op
+BenchmarkTunnelUDP/4096-preshared-b14-8             2628            431785 ns/op           9.49 MB/s     7961597 B/op        407 allocs/op
+```
+</details>
+
+<details>
+<summary>UDP MTU 1024</summary>
+
+```
+goos: darwin
+goarch: arm64
+pkg: github.com/fumiama/WireGold/upper/services/tunnel
+cpu: Apple M1
+BenchmarkTunnelUDPSmallMTU/1024-plain-nob14-8       4770            256794 ns/op           3.99 MB/s     3715458 B/op        193 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-normal-nob14-8      4945            242538 ns/op           4.22 MB/s     3681420 B/op        188 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-plain-b14-8         4137            269202 ns/op           3.80 MB/s     4101089 B/op        254 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-normal-b14-8        4592            253461 ns/op           4.04 MB/s     4109262 B/op        253 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-preshared-nob14-8   4764            243752 ns/op           4.20 MB/s     3675691 B/op        186 allocs/op
+BenchmarkTunnelUDPSmallMTU/1024-preshared-b14-8     4086            282682 ns/op           3.62 MB/s     4107240 B/op        253 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-plain-nob14-8       4728            252759 ns/op           8.10 MB/s     3762231 B/op        234 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-normal-nob14-8      4245            257036 ns/op           7.97 MB/s     3729842 B/op        232 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-plain-b14-8         3615            308642 ns/op           6.64 MB/s     4469625 B/op        342 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-normal-b14-8        3624            311780 ns/op           6.57 MB/s     4487346 B/op        345 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-preshared-nob14-8   3999            260043 ns/op           7.88 MB/s     3723444 B/op        231 allocs/op
+BenchmarkTunnelUDPSmallMTU/2048-preshared-b14-8     3558            315744 ns/op           6.49 MB/s     4476565 B/op        343 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-plain-nob14-8       3814            265654 ns/op          11.56 MB/s     3802900 B/op        280 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-normal-nob14-8      4380            291992 ns/op          10.52 MB/s     3760254 B/op        276 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-plain-b14-8         3340            338760 ns/op           9.07 MB/s     4849826 B/op        434 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-normal-b14-8        3302            345620 ns/op           8.89 MB/s     4852322 B/op        434 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-preshared-nob14-8   4424            265290 ns/op          11.58 MB/s     3761816 B/op        277 allocs/op
+BenchmarkTunnelUDPSmallMTU/3072-preshared-b14-8     3148            344490 ns/op           8.92 MB/s     4849613 B/op        434 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-plain-nob14-8       2586            399489 ns/op          10.25 MB/s     7570823 B/op        467 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-normal-nob14-8      2576            402297 ns/op          10.18 MB/s     7504731 B/op        464 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-plain-b14-8         2240            484812 ns/op           8.45 MB/s     9081331 B/op        696 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-normal-b14-8        2240            504749 ns/op           8.11 MB/s     9069168 B/op        693 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-preshared-nob14-8   2594            392716 ns/op          10.43 MB/s     7480678 B/op        460 allocs/op
+BenchmarkTunnelUDPSmallMTU/4096-preshared-b14-8     2234            506134 ns/op           8.09 MB/s     9066223 B/op        691 allocs/op
+```
+</details>
+
+<details>
+<summary>TCP MTU 4096</summary>
+
+```
+goos: darwin
+goarch: arm64
+pkg: github.com/fumiama/WireGold/upper/services/tunnel
+cpu: Apple M1
+BenchmarkTunnelTCP/1024-plain-nob14-8               4627            246837 ns/op           4.15 MB/s     3684040 B/op        201 allocs/op
+BenchmarkTunnelTCP/1024-normal-nob14-8              4833            257150 ns/op           3.98 MB/s     3682260 B/op        199 allocs/op
+BenchmarkTunnelTCP/1024-plain-b14-8                 4396            272838 ns/op           3.75 MB/s     3850134 B/op        231 allocs/op
+BenchmarkTunnelTCP/1024-normal-b14-8                4104            252293 ns/op           4.06 MB/s     3844674 B/op        226 allocs/op
+BenchmarkTunnelTCP/1024-preshared-nob14-8           4530            264767 ns/op           3.87 MB/s     3680243 B/op        197 allocs/op
+BenchmarkTunnelTCP/1024-preshared-b14-8             4231            287111 ns/op           3.57 MB/s     3847164 B/op        227 allocs/op
+BenchmarkTunnelTCP/2048-plain-nob14-8               4275            276425 ns/op           7.41 MB/s     3698728 B/op        200 allocs/op
+BenchmarkTunnelTCP/2048-normal-nob14-8              4033            261234 ns/op           7.84 MB/s     3701433 B/op        200 allocs/op
+BenchmarkTunnelTCP/2048-plain-b14-8                 3680            303246 ns/op           6.75 MB/s     3875541 B/op        231 allocs/op
+BenchmarkTunnelTCP/2048-normal-b14-8                3626            288219 ns/op           7.11 MB/s     3878505 B/op        230 allocs/op
+BenchmarkTunnelTCP/2048-preshared-nob14-8           3868            287679 ns/op           7.12 MB/s     3696931 B/op        200 allocs/op
+BenchmarkTunnelTCP/2048-preshared-b14-8             3586            305008 ns/op           6.71 MB/s     3878416 B/op        230 allocs/op
+BenchmarkTunnelTCP/3072-plain-nob14-8               3666            298452 ns/op          10.29 MB/s     3767509 B/op        246 allocs/op
+BenchmarkTunnelTCP/3072-normal-nob14-8              3450            304848 ns/op          10.08 MB/s     3761811 B/op        246 allocs/op
+BenchmarkTunnelTCP/3072-plain-b14-8                 3549            315641 ns/op           9.73 MB/s     4032830 B/op        291 allocs/op
+BenchmarkTunnelTCP/3072-normal-b14-8                3440            327234 ns/op           9.39 MB/s     4038470 B/op        292 allocs/op
+BenchmarkTunnelTCP/3072-preshared-nob14-8           3522            302663 ns/op          10.15 MB/s     3760304 B/op        245 allocs/op
+BenchmarkTunnelTCP/3072-preshared-b14-8             3390            326384 ns/op           9.41 MB/s     4040489 B/op        293 allocs/op
+BenchmarkTunnelTCP/4096-plain-nob14-8               2431            435457 ns/op           9.41 MB/s     7515476 B/op        480 allocs/op
+BenchmarkTunnelTCP/4096-normal-nob14-8              2500            433178 ns/op           9.46 MB/s     7511114 B/op        478 allocs/op
+BenchmarkTunnelTCP/4096-plain-b14-8                 2337            457177 ns/op           8.96 MB/s     8033760 B/op        568 allocs/op
+BenchmarkTunnelTCP/4096-normal-b14-8                2374            465704 ns/op           8.80 MB/s     8040812 B/op        567 allocs/op
+BenchmarkTunnelTCP/4096-preshared-nob14-8           2532            436310 ns/op           9.39 MB/s     7510565 B/op        477 allocs/op
+BenchmarkTunnelTCP/4096-preshared-b14-8             2360            459261 ns/op           8.92 MB/s     8037878 B/op        566 allocs/op
+```
+</details>
+
+<details>
+<summary>TCP MTU 1024</summary>
+
+```
+goos: darwin
+goarch: arm64
+pkg: github.com/fumiama/WireGold/upper/services/tunnel
+cpu: Apple M1
+BenchmarkTunnelTCPSmallMTU/1024-plain-nob14-8       3318            312084 ns/op           3.28 MB/s     3797015 B/op        307 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-normal-nob14-8      4102            303641 ns/op           3.37 MB/s     3795618 B/op        308 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-plain-b14-8         3746            314102 ns/op           3.26 MB/s     4147318 B/op        368 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-normal-b14-8        3609            315252 ns/op           3.25 MB/s     4152014 B/op        368 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-preshared-nob14-8   3826            300693 ns/op           3.41 MB/s     3793725 B/op        304 allocs/op
+BenchmarkTunnelTCPSmallMTU/1024-preshared-b14-8     3628            327852 ns/op           3.12 MB/s     4150869 B/op        367 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-plain-nob14-8       3553            315709 ns/op           6.49 MB/s     3945193 B/op        426 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-normal-nob14-8      3254            329794 ns/op           6.21 MB/s     3933224 B/op        427 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-plain-b14-8         3222            357250 ns/op           5.73 MB/s     4538189 B/op        529 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-normal-b14-8        3080            359401 ns/op           5.70 MB/s     4555108 B/op        535 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-preshared-nob14-8   3463            320078 ns/op           6.40 MB/s     3936771 B/op        426 allocs/op
+BenchmarkTunnelTCPSmallMTU/2048-preshared-b14-8     2990            363645 ns/op           5.63 MB/s     4555897 B/op        535 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-plain-nob14-8       3228            336736 ns/op           9.12 MB/s     4090750 B/op        550 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-normal-nob14-8      3076            347067 ns/op           8.85 MB/s     4084480 B/op        554 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-plain-b14-8         2798            395353 ns/op           7.77 MB/s     4952186 B/op        700 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-normal-b14-8        2725            403959 ns/op           7.60 MB/s     4965324 B/op        705 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-preshared-nob14-8   3366            344086 ns/op           8.93 MB/s     4080821 B/op        549 allocs/op
+BenchmarkTunnelTCPSmallMTU/3072-preshared-b14-8     2797            403142 ns/op           7.62 MB/s     4962100 B/op        703 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-plain-nob14-8       2360            490867 ns/op           8.34 MB/s     7940290 B/op        871 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-normal-nob14-8      2223            486839 ns/op           8.41 MB/s     7927235 B/op        872 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-plain-b14-8         2002            557560 ns/op           7.35 MB/s     9201342 B/op       1087 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-normal-b14-8        1868            564007 ns/op           7.26 MB/s     9216972 B/op       1091 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-preshared-nob14-8   2263            491698 ns/op           8.33 MB/s     7925404 B/op        869 allocs/op
+BenchmarkTunnelTCPSmallMTU/4096-preshared-b14-8     2050            559663 ns/op           7.32 MB/s     9211292 B/op       1086 allocs/op
+```
+</details>

config/cfg.go

@@ -19,6 +19,7 @@ type Config struct {
 	SpeedLoop  uint16 `yaml:"SpeedLoop"`
 	Mask       uint64 `yaml:"Mask"`   // Mask 是异或报文所用掩码, 必须保证各端统一
 	Base14     bool   `yaml:"Base14"` // Base14 是否将最终报文进行 base16384 编码后再发送
+	MaxTTL     uint8  `yaml:"MaxTTL"` // MaxTTL 默认 64
 	Peers      []Peer `yaml:"Peers"`
 }
 

config/global.go

@@ -1,3 +1,16 @@
 package config
 
-const ShowDebugLog = true
+import "time"
+
+// ShowDebugLog turn on to print verbose logs.
+const ShowDebugLog = false
+
+// Version will show in help message to distinguish different builds.
+// Use -ldflags="-X github.com/fumiama/WireGold/config.Version=x.y.z" to override.
+var Version = "dev"
+
+func init() {
+	if Version == "dev" {
+		Version = "dev-" + time.Now().Format(time.DateOnly)
+	}
+}

docker-entrypoint.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -eq 0 ]; then
+    set -- /usr/local/bin/wg -c /config/config.yaml
+elif [ "${1#-}" != "$1" ]; then
+    set -- /usr/local/bin/wg "$@"
+fi
+
+if [ "${1:-}" = "/usr/local/bin/wg" ]; then
+    need_config=1
+    config_path=/config/config.yaml
+    prev=
+
+    for arg in "$@"; do
+        case "$arg" in
+            -g|-pg|-h)
+                need_config=0
+                ;;
+        esac
+
+        if [ "$prev" = "-c" ]; then
+            config_path="$arg"
+        fi
+        prev="$arg"
+    done
+
+    if [ "$need_config" -eq 1 ] && [ ! -c /dev/net/tun ]; then
+        echo "WireGold requires /dev/net/tun inside the container." >&2
+        echo "Run with: --device /dev/net/tun --cap-add NET_ADMIN" >&2
+        echo "If Network is icmp or ip, add --cap-add NET_RAW as well." >&2
+        exit 1
+    fi
+
+    if [ "$need_config" -eq 1 ] && [ ! -f "$config_path" ]; then
+        echo "WireGold config not found: $config_path" >&2
+        echo "Mount your config into /config or override -c." >&2
+        exit 1
+    fi
+fi
+
+exec "$@"

go.mod

@@ -1,22 +1,24 @@
 module github.com/fumiama/WireGold
 
-go 1.20
+go 1.25.0
 
 require (
-	github.com/FloatTech/ttl v0.0.0-20240716161252-965925764562
+	github.com/FloatTech/ttl v0.0.0-20260412050038-bd89b9d66fcd
 	github.com/RomiChan/syncx v0.0.0-20240418144900-b7402ffdebc7
-	github.com/fumiama/blake2b-simd v0.0.0-20220412110131-4481822068bb
-	github.com/fumiama/go-base16384 v1.7.0
+	github.com/fumiama/blake2b-simd v0.0.0-20250228045919-a5dcaba5419a
+	github.com/fumiama/go-base16384 v1.7.1
 	github.com/fumiama/go-x25519 v1.0.0
+	github.com/fumiama/orbyte v0.0.0-20251002065953-3bb358367eb5
 	github.com/fumiama/water v0.0.0-20211231134027-da391938d6ac
-	github.com/klauspost/compress v1.17.9
-	github.com/sirupsen/logrus v1.9.3
-	golang.org/x/crypto v0.25.0
+	github.com/klauspost/compress v1.18.5
+	github.com/sirupsen/logrus v1.9.4
+	golang.org/x/crypto v0.50.0
+	golang.org/x/net v0.53.0
+	golang.org/x/sys v0.43.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	github.com/fumiama/wintun v0.0.0-20211229152851-8bc97c8034c0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 )

go.sum

@@ -1,45 +1,49 @@
-github.com/FloatTech/ttl v0.0.0-20240716161252-965925764562 h1:snfw7FNFym1eNnLrQ/VCf80LiQo9C7jHgrunZDwiRcY=
-github.com/FloatTech/ttl v0.0.0-20240716161252-965925764562/go.mod h1:fHZFWGquNXuHttu9dUYoKuNbm3dzLETnIOnm1muSfDs=
+github.com/FloatTech/ttl v0.0.0-20260412050038-bd89b9d66fcd h1:Dt86dtJ5hPFvDIA8cAFYfO+Vc8ikoGf32ndEhbwjYXM=
+github.com/FloatTech/ttl v0.0.0-20260412050038-bd89b9d66fcd/go.mod h1:fHZFWGquNXuHttu9dUYoKuNbm3dzLETnIOnm1muSfDs=
 github.com/RomiChan/syncx v0.0.0-20240418144900-b7402ffdebc7 h1:S/ferNiehVjNaBMNNBxUjLtVmP/YWD6Yh79RfPv4ehU=
 github.com/RomiChan/syncx v0.0.0-20240418144900-b7402ffdebc7/go.mod h1:vD7Ra3Q9onRtojoY5sMCLQ7JBgjUsrXDnDKyFxqpf9w=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fumiama/blake2b-simd v0.0.0-20220412110131-4481822068bb h1:Gd7gIiR68ErTWtxnl/PCycMog6IRdK1ApxrvoAy0lFY=
-github.com/fumiama/blake2b-simd v0.0.0-20220412110131-4481822068bb/go.mod h1:Olmv2uLdFllRsvwhzOvG/O/Nvgzg0ViokUL4+hiaRSE=
-github.com/fumiama/go-base16384 v1.7.0 h1:6fep7XPQWxRlh4Hu+KsdH+6+YdUp+w6CwRXtMWSsXCA=
-github.com/fumiama/go-base16384 v1.7.0/go.mod h1:OEn+947GV5gsbTAnyuUW/SrfxJYUdYupSIQXOuGOcXM=
+github.com/fumiama/blake2b-simd v0.0.0-20250228045919-a5dcaba5419a h1:hhCWoHNGDATjUitm8rKwrf5xRnuxO7P6UHIusLXuqag=
+github.com/fumiama/blake2b-simd v0.0.0-20250228045919-a5dcaba5419a/go.mod h1:Olmv2uLdFllRsvwhzOvG/O/Nvgzg0ViokUL4+hiaRSE=
+github.com/fumiama/go-base16384 v1.7.1 h1:1P1x6FWRvd7PtbH4idDAGWAjKKcVxggxlROYKRXbw58=
+github.com/fumiama/go-base16384 v1.7.1/go.mod h1:OEn+947GV5gsbTAnyuUW/SrfxJYUdYupSIQXOuGOcXM=
 github.com/fumiama/go-x25519 v1.0.0 h1:hiGg9EhseVmGCc8T1jECVkj8Keu/aJ1ZK05RM8Vuavo=
 github.com/fumiama/go-x25519 v1.0.0/go.mod h1:8VOhfyGZzw4IUs4nCjQFqW9cA3V/QpSCtP3fo2dLNg4=
+github.com/fumiama/orbyte v0.0.0-20251002065953-3bb358367eb5 h1:j9o0XVvdAeLwrBYMnh0SerrMc9CgNU6AGszbsvFzoc0=
+github.com/fumiama/orbyte v0.0.0-20251002065953-3bb358367eb5/go.mod h1:FOjdw7KdCbK2eH3gRPhwFNCoXKpu9sN5vPH4El/8e0c=
 github.com/fumiama/water v0.0.0-20211231134027-da391938d6ac h1:A/5A0rODsg+EQHH61Ew5mMUtDpRXaSNqHhPvW+fN4C4=
 github.com/fumiama/water v0.0.0-20211231134027-da391938d6ac/go.mod h1:BBnNY9PwK+UUn4trAU+H0qsMEypm7+3Bj1bVFuJItlo=
 github.com/fumiama/wintun v0.0.0-20211229152851-8bc97c8034c0 h1:WfrSFlIlCAtg6Rt2IGna0HhJYSDE45YVHiYqO4wwsEw=
 github.com/fumiama/wintun v0.0.0-20211229152851-8bc97c8034c0/go.mod h1:dPOG7Af/ArO62RgBz2JJTNFByBn/IXWLo/1kZKcLSe8=
-github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
-github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
+github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
-golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
-golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

gold/head/box.go

@@ -0,0 +1,89 @@
+package head
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/hex"
+	"unsafe"
+
+	"github.com/fumiama/orbyte/pbuf"
+	"github.com/sirupsen/logrus"
+
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/internal/algo"
+	"github.com/fumiama/WireGold/internal/bin"
+)
+
+// PreCRC64 calculate crc64 checksum without idxdatsz.
+func (p *Packet) PreCRC64() (crc uint64) {
+	w := bin.SelectWriter()
+	// 固定 TTL 为 0, flag 为空 计算
+	if bin.IsLittleEndian {
+		ttl := p.TTL
+		f := p.Proto
+		p.TTL = 0
+		p.Proto &= protobit
+		w.Write((*[PacketHeadNoCRCLen]byte)(
+			(unsafe.Pointer)(p),
+		)[:])
+		p.TTL = ttl
+		p.Proto = f
+	} else {
+		w.WriteUInt32(p.idxdatsz)
+		w.WriteUInt32(uint32(p.randn))
+		w.WriteUInt16(uint16(p.Proto & protobit)) // TTL, flags is set to 0
+		w.WriteUInt16(p.SrcPort)
+		w.WriteUInt16(p.DstPort)
+		w.WriteUInt16(p.Offset)
+		w.Write(p.src[:])
+		w.Write(p.dst[:])
+	}
+	w.P(func(b *pbuf.Buffer) {
+		crc = algo.MD5Hash8(b.Bytes()[PacketHeadPreCRCIdx:])
+		if config.ShowDebugLog {
+			logrus.Debugf(
+				"[box] calc pre-crc64 %016x, dat %s", crc,
+				hex.EncodeToString(b.Bytes()[PacketHeadPreCRCIdx:]),
+			)
+		}
+	})
+	w.Destroy()
+	return
+}
+
+// WriteHeaderTo write header bytes to buf
+// with crc64 checksum.
+func (p *Packet) WriteHeaderTo(buf *bytes.Buffer) {
+	// 固定 TTL 为 0 计算
+	if bin.IsLittleEndian {
+		buf.Write((*[PacketHeadNoCRCLen]byte)(
+			(unsafe.Pointer)(p),
+		)[:])
+		b := make([]byte, buf.Len())
+		copy(b, buf.Bytes())
+		ClearTTL(b)
+		p.md5h8 = algo.MD5Hash8(b)
+		_ = binary.Write(buf, binary.LittleEndian, p.md5h8)
+		return
+	}
+	w := bin.SelectWriter()
+	w.WriteUInt32(p.idxdatsz)
+	w.WriteUInt32(uint32(p.randn))
+	w.WriteUInt16((uint16(p.TTL) << 8) | uint16(p.Proto))
+	w.WriteUInt16(p.SrcPort)
+	w.WriteUInt16(p.DstPort)
+	w.WriteUInt16(p.Offset)
+	w.Write(p.src[:])
+	w.Write(p.dst[:])
+	w.P(func(buf *pbuf.Buffer) {
+		b := make([]byte, buf.Len())
+		copy(b, buf.Bytes())
+		ClearTTL(b)
+		p.md5h8 = algo.MD5Hash8(b)
+	})
+	w.WriteUInt64(p.md5h8)
+	w.P(func(b *pbuf.Buffer) {
+		_, _ = buf.ReadFrom(b)
+	})
+	w.Destroy()
+}

gold/head/builder.go

@@ -0,0 +1,249 @@
+package head
+
+import (
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/binary"
+	"net"
+	"strconv"
+
+	"github.com/fumiama/orbyte/pbuf"
+	"github.com/sirupsen/logrus"
+
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/internal/algo"
+	"github.com/fumiama/WireGold/internal/bin"
+	"github.com/fumiama/WireGold/internal/file"
+)
+
+type (
+	HeaderBuilder PacketItem
+	DataBuilder   PacketItem
+	PacketBuilder PacketItem
+)
+
+func NewPacketBuilder() *HeaderBuilder {
+	p := selectPacket()
+	p.P(func(ub *PacketBuf) {
+		err := binary.Read(
+			rand.Reader, binary.LittleEndian, &ub.DAT.randn,
+		)
+		if err != nil {
+			panic(err)
+		}
+	})
+	return (*HeaderBuilder)(p)
+}
+
+func (pb *HeaderBuilder) p(f func(*PacketBuf)) *HeaderBuilder {
+	(*PacketItem)(pb).P(f)
+	return pb
+}
+
+func (pb *HeaderBuilder) Proto(proto uint8) *HeaderBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		ub.DAT.Proto |= FlagsProto(proto) & protobit
+	})
+}
+
+func (pb *HeaderBuilder) TTL(ttl uint8) *HeaderBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		ub.DAT.TTL = ttl
+	})
+}
+
+func (pb *HeaderBuilder) Src(ip net.IP, p uint16) *HeaderBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		copy(ub.DAT.src[:], ip.To4())
+		ub.DAT.SrcPort = p
+	})
+}
+
+func (pb *HeaderBuilder) Dst(ip net.IP, p uint16) *HeaderBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		copy(ub.DAT.dst[:], ip.To4())
+		ub.DAT.DstPort = p
+	})
+}
+
+func (pb *HeaderBuilder) With(data []byte) *DataBuilder {
+	return (*DataBuilder)(pb.p(func(ub *PacketBuf) {
+		// header crc64 except idxdatasz
+		ub.DAT.md5h8 = ub.DAT.PreCRC64()
+		// plain data
+		ub.Buffer.Write(data)
+		if config.ShowDebugLog {
+			logrus.Debugln(file.Header(), strconv.FormatUint(ub.DAT.md5h8, 16), "build with data", file.ToLimitHexString(data, 64))
+		}
+	}))
+}
+
+func (pb *DataBuilder) p(f func(*PacketBuf)) *DataBuilder {
+	(*PacketItem)(pb).P(f)
+	return pb
+}
+
+func (pb *DataBuilder) Zstd() *DataBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		data := algo.EncodeZstd(ub.Bytes())
+		ub.Reset()
+		ub.Write(data)
+		if config.ShowDebugLog {
+			logrus.Debugln(file.Header(), strconv.FormatUint(ub.DAT.md5h8, 16), "data after zstd", file.ToLimitHexString(ub.Bytes(), 64))
+		}
+	})
+}
+
+func (pb *DataBuilder) Hash() *DataBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		ub.DAT.hashrem = int64(algo.Blake2bHash8(
+			ub.DAT.md5h8, ub.Bytes(),
+		))
+	})
+}
+
+func (pb *DataBuilder) tea(typ uint8) *DataBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		ub.DAT.idxdatsz |= (uint32(typ) << 27)
+	})
+}
+
+func (pb *DataBuilder) additional(additional uint16) *DataBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		ub.DAT.idxdatsz |= (uint32(additional&0x07ff) << 16)
+	})
+}
+
+func (pb *DataBuilder) Seal(aead cipher.AEAD, teatyp uint8, additional uint16) *PacketBuilder {
+	return (*PacketBuilder)(pb.tea(teatyp).additional(additional).
+		p(func(ub *PacketBuf) {
+			// encrypted data: chacha20(hash + plain)
+			w := bin.SelectWriter()
+			w.WriteUInt64(uint64(ub.DAT.hashrem))
+			w.Write(ub.Bytes())
+			w.P(func(b *pbuf.Buffer) {
+				data := algo.EncodeAEAD(aead, additional, b.Bytes())
+				ub.Reset()
+				ub.Write(data)
+			})
+			w.Destroy()
+		}))
+}
+
+func (pb *DataBuilder) Plain(teatyp uint8, additional uint16) *PacketBuilder {
+	return (*PacketBuilder)(pb.tea(teatyp).additional(additional).
+		p(func(ub *PacketBuf) {
+			w := bin.SelectWriter()
+			w.WriteUInt64(uint64(ub.DAT.hashrem))
+			w.Write(ub.Bytes())
+			w.P(func(b *pbuf.Buffer) {
+				ub.Reset()
+				_, _ = ub.ReadFrom(b)
+			})
+			w.Destroy()
+		}))
+}
+
+func (pb *DataBuilder) Trans(teatyp uint8, additional uint16) *PacketBuilder {
+	return (*PacketBuilder)(pb.tea(teatyp).additional(additional))
+}
+
+func (pb *PacketBuilder) copy() *PacketBuilder {
+	return (*PacketBuilder)((*PacketItem)(pb).Copy())
+}
+
+func (pb *PacketBuilder) p(f func(*PacketBuf)) *PacketBuilder {
+	(*PacketItem)(pb).P(f)
+	return pb
+}
+
+// datasize fill encrypted datasize by calling data.Len().
+func (pb *PacketBuilder) datasize() *PacketBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		l := uint32(ub.Len()) & 0xffff
+		ub.DAT.idxdatsz |= l
+	})
+}
+
+func (pb *PacketBuilder) noFrag(on bool) *PacketBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		if on {
+			ub.DAT.Proto |= nofragbit
+		} else {
+			ub.DAT.Proto &= ^nofragbit
+		}
+	})
+}
+
+func (pb *PacketBuilder) hasMore(on bool) *PacketBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		if on {
+			ub.DAT.Proto |= hasmorebit
+		} else {
+			ub.DAT.Proto &= ^hasmorebit
+		}
+	})
+}
+
+func (pb *PacketBuilder) offset(off uint16) *PacketBuilder {
+	return pb.p(func(ub *PacketBuf) {
+		ub.DAT.Offset = off
+	})
+}
+
+// Split mtu based on the total len, which includes
+// header and body and padding after outer xor.
+func (pb *PacketBuilder) Split(mtu int, nofrag bool) (pbs []PacketBytes) {
+	pb.datasize().p(func(ub *PacketBuf) {
+		bodylen := ub.Len()
+		datalen := bodylen + int(PacketHeadLen)
+		udplen := algo.EncodeXORLen(datalen)
+		if udplen <= mtu { // can be sent in a single packet
+			pbs = []PacketBytes{
+				pbuf.BufferItemToBytes((*PacketItem)(
+					pb.copy().noFrag(nofrag).hasMore(false).offset(0),
+				)).Ignore(),
+			}
+			return
+		}
+		if nofrag { // drop oversized packet
+			return
+		}
+		pb.noFrag(false).hasMore(true)
+		datalim := mtu - 9 - int(PacketHeadLen)
+		n := bodylen / datalim
+		r := bodylen % datalim
+		if r > 0 {
+			n++
+		}
+		pbs = make([]PacketBytes, n)
+		for i := 0; i < n; i++ {
+			a, b := i*datalim, (i+1)*datalim
+			if b > bodylen {
+				b = bodylen
+			}
+			pbs[i] = pbuf.BufferItemToBytes((*PacketItem)(
+				pb.copy().offset(uint16(i*datalim)),
+			)).Ignore().Slice(a, b)
+		}
+	})
+	return
+}
+
+// Destroy call this once no one use it.
+func (pb *PacketBuilder) Destroy() {
+	(*PacketItem)(pb).ManualDestroy()
+}
+
+func BuildPacketFromBytes(pb PacketBytes) pbuf.Bytes {
+	w := bin.SelectWriter()
+	pb.B(func(_ []byte, p *Packet) {
+		w.P(func(b *pbuf.Buffer) {
+			p.WriteHeaderTo(&b.Buffer)
+		})
+	})
+	pb.V(func(b []byte) {
+		w.Write(b)
+	})
+	return w.ToBytes()
+}

gold/head/flags.go

@@ -1,34 +1,37 @@
 package head
 
-import "encoding/binary"
+import (
+	"fmt"
+)
 
-type PacketFlags uint16
+const (
+	hasmorebit FlagsProto = 0x20 << iota
+	nofragbit
+	topbit
+)
 
-func (pf PacketFlags) IsValid() bool {
-	return pf&0x8000 == 0
+const (
+	impossiblebit = hasmorebit | nofragbit
+	flagsbit      = topbit | impossiblebit
+	protobit      = ^flagsbit
+)
+
+type FlagsProto uint8
+
+func (pf FlagsProto) String() string {
+	return fmt.Sprintf("%02x", uint8(pf))
 }
 
-func (pf PacketFlags) DontFrag() bool {
-	return pf&0x4000 == 0x4000
+func (pf FlagsProto) IsValid() bool {
+	return pf&topbit == 0 &&
+		pf&impossiblebit != impossiblebit &&
+		pf.Proto() < ProtoTop
 }
 
-func (pf PacketFlags) NoFrag() bool {
-	return pf == 0x4000
+func (pf FlagsProto) HasMore() bool {
+	return pf&hasmorebit != 0
 }
 
-func (pf PacketFlags) IsSingle() bool {
-	return pf == 0
-}
-
-func (pf PacketFlags) ZeroOffset() bool {
-	return pf&0x1fff == 0
-}
-
-func (pf PacketFlags) Offset() uint16 {
-	return uint16(pf << 3)
-}
-
-// Flags extract flags from raw data
-func Flags(data []byte) PacketFlags {
-	return PacketFlags(binary.LittleEndian.Uint16(data[10:12]))
+func (pf FlagsProto) NoFrag() bool {
+	return pf&nofragbit != 0
 }

gold/head/hello.go

@@ -1,8 +0,0 @@
-package head
-
-type Hello uint8
-
-const (
-	HelloPing Hello = iota
-	HelloPong
-)

gold/head/nat.go

@@ -1,7 +0,0 @@
-package head
-
-// Notify 是 map[peerip]{network, endpoint}
-type Notify = map[string][2]string
-
-// Query 是 peerips 组成的数组
-type Query = []string

gold/head/packet.go

@@ -1,198 +1,78 @@
 package head
 
 import (
-	"encoding/binary"
-	"encoding/hex"
 	"errors"
 	"net"
+	"sync/atomic"
+	"unsafe"
 
-	blake2b "github.com/fumiama/blake2b-simd"
-	"github.com/sirupsen/logrus"
-
-	"github.com/fumiama/WireGold/config"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/orbyte"
+	"github.com/fumiama/orbyte/pbuf"
 )
 
-const PacketHeadLen = 60
+const (
+	// PacketHeadPreCRCIdx skip idxdatsz, which will be set at Seal().
+	PacketHeadPreCRCIdx = unsafe.Offsetof(Packet{}.randn)
+	// PacketHeadNoCRCLen without final crc
+	PacketHeadNoCRCLen = unsafe.Offsetof(Packet{}.md5h8)
+	PacketHeadLen      = unsafe.Offsetof(Packet{}.hashrem)
+)
 
 var (
-	ErrBadCRCChecksum = errors.New("bad crc checksum")
-	ErrDataLenLT60    = errors.New("data len < 60")
+	ErrBadCRCChecksum  = errors.New("bad crc checksum")
+	ErrDataLenLEHeader = errors.New("data len <= header len")
+	ErrInvalidOffset   = errors.New("invalid offset")
+)
+
+type (
+	PacketBuf   = pbuf.UserBuffer[Packet]
+	PacketItem  = orbyte.Item[PacketBuf]
+	PacketBytes = pbuf.UserBytes[Packet]
 )
 
 // Packet 是发送和接收的最小单位
 type Packet struct {
-	// idxdatsz len(Data)
+	// idxdatsz
+	//
+	// idx
 	// 高 5 位指定加密所用 key index
 	// 高 5-16 位是递增值, 用于 xchacha20 验证 additionalData
+	//
+	// datsz
 	// 不得超过 65507-head 字节
 	idxdatsz uint32
-	// Proto 详见 head
-	Proto uint8
+	// randn
+	// 在发送报文时填入随机值.
+	randn int32
+	// Proto 高3位为标志(xDM)，低5位为协议类型
+	Proto FlagsProto
 	// TTL is time to live
 	TTL uint8
 	// SrcPort 源端口
 	SrcPort uint16
 	// DstPort 目的端口
 	DstPort uint16
-	// Flags 高3位为标志(xDM)，低13位为分片偏移
-	Flags PacketFlags
-	// Src 源 ip (ipv4)
-	Src net.IP
-	// Dst 目的 ip (ipv4)
-	Dst net.IP
-	// Hash 使用 BLAKE2 生成加密前 Packet 的摘要
-	// 生成时 Hash 全 0
+	// Offset 分片偏移量
+	Offset uint16
+	// src 源 ip (ipv4)
+	src [4]byte
+	// dst 目的 ip (ipv4)
+	dst [4]byte
+	// md5h8 发送时记录包头字段除自身外的 checksum 值.
+	//
+	// 可以认为在一定时间内唯一 (现已更改算法为 md5 但名字未变)。
+	md5h8 uint64
+
+	// 以下字段为包体, 与 data 一起加密
+
+	// hashrem 使用 BLAKE2B 生成加密前 packet data+crc64 的摘要,
+	// 取其前 8 字节, 小端序读写. 接收时记录剩余字节数.
+	//
 	// https://github.com/fumiama/blake2b-simd
-	Hash [32]byte
-	// crc64 包头字段的 checksum 值，可以认为在一定时间内唯一 (现已更改算法为 md5 但名字未变)
-	crc64 uint64
-	// data 承载的数据
-	data []byte
-	// Data 当前的偏移
-	a, b int
-	// 记录还有多少字节未到达
-	rembytes int
-	// 是否经由 helper.MakeBytes 创建 Data
-	buffered bool
-}
+	hashrem int64
 
-// NewPacket 生成一个新包
-func NewPacket(proto uint8, srcPort uint16, dst net.IP, dstPort uint16, data []byte) (p *Packet) {
-	p = SelectPacket()
-	p.Proto = proto
-	p.TTL = 16
-	p.SrcPort = srcPort
-	p.DstPort = dstPort
-	p.Dst = dst
-	p.data = data
-	p.b = len(data)
-	return
-}
-
-// Unmarshal 将 data 的数据解码到自身
-func (p *Packet) Unmarshal(data []byte) (complete bool, err error) {
-	if len(data) < 60 {
-		err = ErrDataLenLT60
-		return
-	}
-	p.crc64 = CRC64(data)
-	if CalcCRC64(data) != p.crc64 {
-		err = ErrBadCRCChecksum
-		return
-	}
-
-	sz := p.Len()
-	if sz == 0 && len(p.data) == 0 {
-		p.idxdatsz = binary.LittleEndian.Uint32(data[:4])
-		sz = p.Len()
-		if sz+52 == len(data) {
-			p.data = data[52:]
-			p.b = len(p.data)
-			p.rembytes = 0
-		} else {
-			p.data = helper.MakeBytes(sz)
-			p.buffered = true
-			p.b = sz
-			p.rembytes = sz
-		}
-		pt := binary.LittleEndian.Uint16(data[4:6])
-		p.Proto = uint8(pt)
-		p.TTL = uint8(pt >> 8)
-		p.SrcPort = binary.LittleEndian.Uint16(data[6:8])
-		p.DstPort = binary.LittleEndian.Uint16(data[8:10])
-	}
-
-	flags := PacketFlags(binary.LittleEndian.Uint16(data[10:12]))
-
-	if flags.ZeroOffset() {
-		p.Flags = flags
-		p.Src = make(net.IP, 4)
-		copy(p.Src, data[12:16])
-		p.Dst = make(net.IP, 4)
-		copy(p.Dst, data[16:20])
-		copy(p.Hash[:], data[20:52])
-	}
-
-	if p.rembytes > 0 {
-		p.rembytes -= copy(p.data[flags.Offset():], data[PacketHeadLen:])
-		if config.ShowDebugLog {
-			logrus.Debugln("[packet] copied frag", hex.EncodeToString(p.Hash[:]), "rembytes:", p.rembytes)
-		}
-	}
-
-	complete = p.rembytes == 0
-
-	return
-}
-
-// DecreaseAndGetTTL TTL 自减后返回
-func (p *Packet) DecreaseAndGetTTL() uint8 {
-	p.TTL--
-	return p.TTL
-}
-
-// Marshal 将自身数据编码为 []byte
-// offset 必须为 8 的倍数，表示偏移的 8 位
-func (p *Packet) Marshal(src net.IP, teatype uint8, additional uint16, datasz uint32, offset uint16, dontfrag, hasmore bool) ([]byte, func()) {
-	if src != nil {
-		p.Src = src
-		p.idxdatsz = (uint32(teatype) << 27) | (uint32(additional&0x07ff) << 16) | datasz&0xffff
-	}
-
-	offset &= 0x1fff
-	if dontfrag {
-		offset |= 0x4000
-	}
-	if hasmore {
-		offset |= 0x2000
-	}
-	p.Flags = PacketFlags(offset)
-
-	return helper.OpenWriterF(func(w *helper.Writer) {
-		w.WriteUInt32(p.idxdatsz)
-		w.WriteUInt16((uint16(p.TTL) << 8) | uint16(p.Proto))
-		w.WriteUInt16(p.SrcPort)
-		w.WriteUInt16(p.DstPort)
-		w.WriteUInt16(uint16(p.Flags))
-		w.Write(p.Src.To4())
-		w.Write(p.Dst.To4())
-		w.Write(p.Hash[:])
-		p.crc64 = CalcCRC64(w.Bytes())
-		w.WriteUInt64(p.crc64)
-		w.Write(p.Body())
-	})
-}
-
-// FillHash 生成 p.Data 的 Hash
-func (p *Packet) FillHash() {
-	h := blake2b.New256()
-	_, err := h.Write(p.Body())
-	if err != nil {
-		logrus.Errorln("[packet] err when fill hash:", err)
-		return
-	}
-	hsh := h.Sum(p.Hash[:0])
-	if config.ShowDebugLog {
-		logrus.Debugln("[packet] sum calulated:", hex.EncodeToString(hsh))
-	}
-}
-
-// IsVaildHash 验证 packet 合法性
-func (p *Packet) IsVaildHash() bool {
-	h := blake2b.New256()
-	_, err := h.Write(p.Body())
-	if err != nil {
-		logrus.Errorln("[packet] err when check hash:", err)
-		return false
-	}
-	var sum [32]byte
-	_ = h.Sum(sum[:0])
-	if config.ShowDebugLog {
-		logrus.Debugln("[packet] sum calulated:", hex.EncodeToString(sum[:]))
-		logrus.Debugln("[packet] sum in packet:", hex.EncodeToString(p.Hash[:]))
-	}
-	return sum == p.Hash
+	// Buffer 用于 builder with 暂存原始包体数据
+	// 以及接收时保存 body, 通过 PacketBytes 截取偏移.
 }
 
 // AdditionalData 获得 packet 的 additionalData
@@ -206,66 +86,23 @@ func (p *Packet) CipherIndex() uint8 {
 }
 
 // Len is packet size
-func (p *Packet) Len() int {
+func (p *Packet) Size() int {
 	return int(p.idxdatsz & 0xffff)
 }
 
-// Put 将自己放回池中
-func (p *Packet) Put() {
-	PutPacket(p)
-}
-
+// CRC64 extract md5h8rem field
 func (p *Packet) CRC64() uint64 {
-	return p.crc64
+	return p.md5h8
 }
 
-// Body returns data
-func (p *Packet) Body() []byte {
-	return p.data[p.a:p.b]
+func (p *Packet) Src() net.IP {
+	return append(net.IP{}, p.src[:]...)
 }
 
-func (p *Packet) BodyLen() int {
-	return p.b - p.a
+func (p *Packet) Dst() net.IP {
+	return append(net.IP{}, p.dst[:]...)
 }
 
-func (p *Packet) SetBody(b []byte, buffered bool) {
-	p.a = 0
-	p.b = len(b)
-	if len(b) <= cap(p.data) {
-		p.data = p.data[:len(b)]
-		copy(p.data, b)
-		if buffered {
-			helper.PutBytes(b)
-		}
-		return
-	}
-	if p.buffered {
-		helper.PutBytes(p.data)
-	}
-	p.data = b
-	p.buffered = buffered
-}
-
-func (p *Packet) CropBody(a, b int) {
-	if b > len(p.data) {
-		b = len(p.data)
-	}
-	if a < 0 || b < 0 || a > b {
-		return
-	}
-	p.a, p.b = a, b
-}
-
-func (p *Packet) Copy() *Packet {
-	newp := SelectPacket()
-	*newp = *p
-	newp.buffered = false
-	return newp
-}
-
-func (p *Packet) CopyWithBody() *Packet {
-	newp := p.Copy()
-	newp.data = helper.MakeBytes(len(p.data))
-	copy(newp.data, p.data)
-	return newp
+func (p *Packet) HasFinished() bool {
+	return atomic.LoadInt64(&p.hashrem) <= 0
 }

gold/head/packet_test.go

@@ -1,25 +1,157 @@
 package head
 
 import (
+	"bytes"
 	crand "crypto/rand"
+	"encoding/hex"
 	"math/rand"
 	"net"
+	"runtime"
+	"sync"
 	"testing"
+
+	"github.com/fumiama/WireGold/internal/algo"
+	"github.com/fumiama/WireGold/internal/bin"
 )
 
+func TestBuilderNative(t *testing.T) {
+	wg := sync.WaitGroup{}
+	wg.Add(4096)
+	for i := 0; i < 4096; i++ {
+		go func(i int) {
+			defer runtime.GC()
+			defer wg.Done()
+			dat := BuildPacketFromBytes(NewPacketBuilder().Proto(3).TTL(0xff).
+				Src(net.IPv4(1, 2, 3, 4), 5).Dst(net.IPv4(6, 7, 8, 9), 10).
+				With([]byte("0123456789")).Hash().Plain(0x12, 0x0345).
+				Split(16384, false)[0]).Trans()
+			s := hex.EncodeToString(dat)
+			if s[:8] != "12004593" {
+				panic(s[:8])
+			}
+			if s[16:48] != "03ff05000a0000000102030406070809" {
+				panic(s[16:48])
+			}
+			if s[80:] != "30313233343536373839" {
+				panic(s[80:])
+			}
+			p, err := ParsePacketHeader(dat)
+			if err != nil {
+				panic(err)
+			}
+			p.B(func(buf []byte, p *Packet) {
+				ok := p.WriteDataSegment(dat, buf)
+				if !ok {
+					panic(i)
+				}
+				if !algo.IsVaildBlake2bHash8(p.PreCRC64(), buf) {
+					panic(i)
+				}
+				if p.Proto != 3 {
+					panic(i)
+				}
+				if p.CipherIndex() != 0x12 {
+					panic(i)
+				}
+				if p.SrcPort != 5 {
+					panic(i)
+				}
+				if p.DstPort != 10 {
+					panic(i)
+				}
+				if !bytes.Equal(p.src[:], net.IPv4(1, 2, 3, 4).To4()) {
+					panic(i)
+				}
+				if !bytes.Equal(p.dst[:], net.IPv4(6, 7, 8, 9).To4()) {
+					panic(i)
+				}
+				if p.AdditionalData() != 0x0345 {
+					panic(i)
+				}
+			})
+		}(i)
+	}
+	wg.Wait()
+}
+
+func TestBuilderBE(t *testing.T) {
+	wg := sync.WaitGroup{}
+	wg.Add(4096)
+	bin.IsLittleEndian = false
+	for i := 0; i < 4096; i++ {
+		go func(i int) {
+			defer runtime.GC()
+			defer wg.Done()
+			dat := BuildPacketFromBytes(NewPacketBuilder().Proto(3).TTL(0xff).
+				Src(net.IPv4(1, 2, 3, 4), 5).Dst(net.IPv4(6, 7, 8, 9), 10).
+				With([]byte("0123456789")).Hash().Plain(0x12, 0x0345).
+				Split(16384, false)[0]).Trans()
+			s := hex.EncodeToString(dat)
+			if s[:8] != "12004593" {
+				panic(s[:8])
+			}
+			if s[16:48] != "03ff05000a0000000102030406070809" {
+				panic(s[16:48])
+			}
+			if s[80:] != "30313233343536373839" {
+				panic(s[80:])
+			}
+			p, err := ParsePacketHeader(dat)
+			if err != nil {
+				panic(err)
+			}
+			p.B(func(buf []byte, p *Packet) {
+				ok := p.WriteDataSegment(dat, buf)
+				if !ok {
+					panic(i)
+				}
+				if !algo.IsVaildBlake2bHash8(p.PreCRC64(), buf) {
+					panic(i)
+				}
+				if p.Proto != 3 {
+					panic(i)
+				}
+				if p.CipherIndex() != 0x12 {
+					panic(i)
+				}
+				if p.SrcPort != 5 {
+					panic(i)
+				}
+				if p.DstPort != 10 {
+					panic(i)
+				}
+				if !bytes.Equal(p.src[:], net.IPv4(1, 2, 3, 4).To4()) {
+					panic(i)
+				}
+				if !bytes.Equal(p.dst[:], net.IPv4(6, 7, 8, 9).To4()) {
+					panic(i)
+				}
+				if p.AdditionalData() != 0x0345 {
+					panic(i)
+				}
+			})
+		}(i)
+	}
+	wg.Wait()
+}
+
 func TestMarshalUnmarshal(t *testing.T) {
+	// logrus.SetLevel(logrus.DebugLevel)
 	data := make([]byte, 4096)
-	_, err := crand.Read(data)
+	n, err := crand.Read(data)
+	if n != 4096 {
+		t.Fatal("unexpected")
+	}
 	if err != nil {
 		t.Fatal(err)
 	}
-	for i := 0; i < 0x7ff; i++ {
-		proto := uint8(rand.Intn(255))
+	for i := 0; i < 4096; i++ {
+		proto := uint8(rand.Intn(int(ProtoTop)))
 		teatype := uint8(rand.Intn(32))
 		srcPort := uint16(rand.Intn(65535))
 		dstPort := uint16(rand.Intn(65535))
 		src := make(net.IP, 4)
-		_, err = crand.Read(src)
+		_, err := crand.Read(src)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -28,41 +160,47 @@ func TestMarshalUnmarshal(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		p := NewPacket(proto, srcPort, dst, dstPort, data)
-		p.FillHash()
-		d, cl := p.Marshal(src, teatype, uint16(i), uint32(len(data)), 0, true, false)
-		p = SelectPacket()
-		ok, err := p.Unmarshal(d)
-		cl()
-		if !ok {
-			t.Fatal("index", i)
-		}
+		dat := BuildPacketFromBytes(NewPacketBuilder().Proto(proto).
+			Src(src, srcPort).Dst(dst, dstPort).
+			With(data[:i]).Hash().Plain(teatype, uint16(i&0x7ff)).
+			Split(16384, false)[0]).Trans()
+		t.Log("pkt:", hex.EncodeToString(dat))
+		p, err := ParsePacketHeader(dat)
 		if err != nil {
-			t.Fatal(err)
-		}
-		if !p.IsVaildHash() {
-			t.Fatal("index", i)
-		}
-		if p.Proto != proto {
-			t.Fatal("index", i)
-		}
-		if p.CipherIndex() != teatype {
-			t.Fatal("index", i, "expect", teatype, "got", p.CipherIndex())
-		}
-		if p.SrcPort != srcPort {
-			t.Fatal("index", i)
-		}
-		if p.DstPort != dstPort {
-			t.Fatal("index", i)
-		}
-		if !p.Src.Equal(src) {
-			t.Fatal("index", i)
-		}
-		if !p.Dst.Equal(dst) {
-			t.Fatal("index", i)
-		}
-		if p.AdditionalData() != uint16(i) {
-			t.Fatal("index", i)
+			t.Fatal("index", i, err)
 		}
+		p.B(func(buf []byte, p *Packet) {
+			ok := p.WriteDataSegment(dat, buf)
+			if !ok {
+				t.Fatal("index", i)
+			}
+			if !algo.IsVaildBlake2bHash8(p.PreCRC64(), buf) {
+				t.Fatal("index", i, "expect body", hex.EncodeToString(data[:i]), "got", hex.EncodeToString(buf[8:]))
+			}
+			if p.Proto != FlagsProto(proto) {
+				t.Fatal("index", i)
+			}
+			if p.CipherIndex() != teatype {
+				t.Fatal("index", i, "expect", teatype, "got", p.CipherIndex())
+			}
+			if p.SrcPort != srcPort {
+				t.Fatal("index", i)
+			}
+			if p.DstPort != dstPort {
+				t.Fatal("index", i)
+			}
+			if !bytes.Equal(p.src[:], src) {
+				t.Fatal("index", i)
+			}
+			if !bytes.Equal(p.dst[:], dst) {
+				t.Fatal("index", i)
+			}
+			if p.AdditionalData() != uint16(i&0x7ff) {
+				t.Fatal("index", i)
+			}
+			if !bytes.Equal(buf[8:], data[:i]) {
+				t.Fatal("index", i)
+			}
+		})
 	}
 }

gold/head/pool.go

@@ -1,31 +1,36 @@
 package head
 
 import (
-	"sync"
+	"time"
 
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/internal/file"
+	"github.com/fumiama/orbyte/pbuf"
+	"github.com/sirupsen/logrus"
 )
 
-var packetPool = sync.Pool{
-	New: func() interface{} {
-		return new(Packet)
-	},
-}
+var packetPool = pbuf.NewBufferPool[Packet]()
 
-// SelectPacket 从池中取出一个 Packet
-func SelectPacket() *Packet {
-	return packetPool.Get().(*Packet)
-}
-
-// PutPacket 将 Packet 放回池中
-func PutPacket(p *Packet) {
-	p.idxdatsz = 0
-	if p.buffered {
-		helper.PutBytes(p.data)
-		p.buffered = false
+func init() {
+	packetPool.LimitInput(256)
+	packetPool.LimitOutput(256)
+	pbuf.LimitInput(256)
+	pbuf.LimitOutput(256)
+	if config.ShowDebugLog {
+		go status()
+	}
+}
+
+// selectPacket 从池中取出一个 Packet
+func selectPacket(buf ...byte) *PacketItem {
+	return packetPool.NewBuffer(buf)
+}
+
+func status() {
+	for range time.NewTicker(time.Minute).C {
+		out, in := packetPool.CountItems()
+		logrus.Infoln(file.Header(), "packet outside:", out, "inside:", in)
+		out, in = pbuf.CountItems()
+		logrus.Infoln(file.Header(), "default outside:", out, "inside:", in)
 	}
-	p.a, p.b = 0, 0
-	p.data = nil
-	p.rembytes = 0
-	packetPool.Put(p)
 }

gold/head/protos.go

@@ -6,4 +6,24 @@ const (
 	ProtoNotify
 	ProtoQuery
 	ProtoData
+	ProtoTrans
 )
+
+const ProtoTop = uint8(protobit + 1)
+
+func (pf FlagsProto) Proto() uint8 {
+	return uint8(pf & protobit)
+}
+
+type Hello uint8
+
+const (
+	HelloPing Hello = iota
+	HelloPong
+)
+
+// Notify 是 map[peerip]{network, endpoint}
+type Notify = map[string][2]string
+
+// Query 是 peerips 组成的数组
+type Query = []string

gold/head/raw.go

@@ -1,22 +1,20 @@
 package head
 
 import (
-	"crypto/md5"
-	"encoding/binary"
+	"unsafe"
 )
 
-// CRC64 extract packet header checksum
-func CRC64(data []byte) uint64 {
-	return binary.LittleEndian.Uint64(data[52:PacketHeadLen])
+const (
+	ttloffset = unsafe.Offsetof(Packet{}.TTL)
+)
+
+// ClearTTL for hash use
+func ClearTTL(data []byte) {
+	data[ttloffset] = 0
 }
 
-// CalcCRC64 calculate packet header checksum
-func CalcCRC64(data []byte) uint64 {
-	m := md5.Sum(data[:52])
-	return binary.LittleEndian.Uint64(m[:8])
-}
-
-// Hash extract 32 bytes blake2b hash from raw bytes
-func Hash(data []byte) []byte {
-	return data[20:52]
+// DecTTL on transferring
+func DecTTL(data []byte) (drop bool) {
+	data[ttloffset]--
+	return data[ttloffset] == 0
 }

gold/head/unbox.go

@@ -0,0 +1,126 @@
+package head
+
+import (
+	"encoding/binary"
+	"errors"
+	"sync/atomic"
+	"unsafe"
+
+	"github.com/sirupsen/logrus"
+
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/internal/algo"
+	"github.com/fumiama/WireGold/internal/bin"
+	"github.com/fumiama/orbyte/pbuf"
+)
+
+func ParsePacketHeader(data []byte) (pbytes PacketBytes, err error) {
+	if len(data) <= int(PacketHeadLen) {
+		err = ErrDataLenLEHeader
+		return
+	}
+	p := selectPacket()
+	sz := 0
+	p.P(func(pb *PacketBuf) {
+		if bin.IsLittleEndian {
+			copy((*[PacketHeadLen]byte)(
+				(unsafe.Pointer)(&pb.DAT),
+			)[:], data)
+		} else {
+			pb.DAT.idxdatsz = binary.LittleEndian.Uint32(data[:4])
+			pb.DAT.randn = int32(binary.LittleEndian.Uint32(data[4:8]))
+			pt := binary.LittleEndian.Uint16(data[8:10])
+			pb.DAT.Proto = FlagsProto(pt)
+			pb.DAT.TTL = uint8(pt >> 8)
+			pb.DAT.SrcPort = binary.LittleEndian.Uint16(data[10:12])
+			pb.DAT.DstPort = binary.LittleEndian.Uint16(data[12:14])
+			pb.DAT.Offset = binary.LittleEndian.Uint16(data[14:16])
+			copy(pb.DAT.src[:], data[16:20])
+			copy(pb.DAT.dst[:], data[20:24])
+			pb.DAT.md5h8 = binary.LittleEndian.Uint64(data[24:32])
+		}
+		sz = pb.DAT.Size()
+		if !pb.DAT.Proto.IsValid() {
+			err = errors.New("invalid proto " + pb.DAT.Proto.String())
+			return
+		}
+		if (!pb.DAT.Proto.HasMore() && (pb.DAT.Offset != 0 ||
+			sz+int(PacketHeadLen) != len(data))) ||
+			(pb.DAT.Proto.HasMore() && pb.DAT.Offset+
+				uint16(len(data[PacketHeadLen:])) > uint16(sz)) {
+			err = ErrInvalidOffset
+			if config.ShowDebugLog {
+				logrus.Warnf("[unbox] invalid offset %04x size %04x", pb.DAT.Offset, sz)
+			}
+			return
+		}
+		var crc uint64
+		var b [PacketHeadNoCRCLen]byte
+		copy(b[:], data[:PacketHeadNoCRCLen])
+		ClearTTL(b[:])
+		crc = algo.MD5Hash8(b[:])
+		if crc != pb.DAT.md5h8 {
+			err = ErrBadCRCChecksum
+			if config.ShowDebugLog {
+				logrus.Warnf("[unbox] exp crc %016x but got %016x", pb.DAT.md5h8, crc)
+			}
+			return
+		}
+		if config.ShowDebugLog {
+			logrus.Debugln("[unbox] header data len", sz, "read data len", len(data)-int(PacketHeadLen))
+		}
+		if sz+int(PacketHeadLen) == len(data) {
+			pb.Buffer.Write(data[PacketHeadLen:])
+			pb.DAT.hashrem = -1
+			return
+		}
+		pb.Buffer.Grow(sz)
+		pb.Buffer.Write(make([]byte, sz))
+		pb.DAT.hashrem = int64(sz)
+	})
+	if err != nil {
+		p.ManualDestroy()
+		return
+	}
+	pbytes = pbuf.BufferItemToBytes(p).Ignore()
+	return
+}
+
+// WriteDataSegment 将 data 的数据并发解码到自身 buf.
+//
+// 必须先调用 ParsePacketHeader 获得 packet.
+//
+// return: complete.
+func (p *Packet) WriteDataSegment(data, buf []byte) bool {
+	if p.HasFinished() {
+		return true
+	}
+
+	flags := FlagsProto(data[8])
+	offset := binary.LittleEndian.Uint16(data[14:16])
+	if config.ShowDebugLog {
+		logrus.Debugln("[unbox] parse data flags", flags, "off", offset)
+	}
+
+	if offset == 0 {
+		p.randn = int32(binary.LittleEndian.Uint32(data[4:8]))
+		p.Proto = flags
+		p.TTL = data[9]
+		p.Offset = 0
+		p.md5h8 = binary.LittleEndian.Uint64(data[24:32])
+		if config.ShowDebugLog {
+			logrus.Debugln("[unbox] parse data set zero offset flags", flags)
+		}
+	}
+
+	rembytes := atomic.LoadInt64(&p.hashrem)
+	if rembytes > 0 {
+		n := int64(copy(buf[offset:], data[PacketHeadLen:]))
+		newrem := rembytes - n
+		for !atomic.CompareAndSwapInt64(&p.hashrem, rembytes, newrem) {
+			rembytes = atomic.LoadInt64(&p.hashrem)
+			newrem = rembytes - n
+		}
+	}
+	return p.HasFinished()
+}

gold/link/crypto.go

@@ -1,167 +1,54 @@
 package link
 
 import (
-	"crypto/cipher"
-	"crypto/rand"
-	"encoding/binary"
-	"errors"
-	"math/bits"
-	mrand "math/rand"
+	"encoding/hex"
 
-	"github.com/fumiama/WireGold/helper"
 	"github.com/sirupsen/logrus"
-)
 
-var (
-	ErrCipherTextTooShort = errors.New("ciphertext too short")
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/internal/algo"
+	"github.com/fumiama/WireGold/internal/file"
 )
 
 func (l *Link) randkeyidx() uint8 {
 	if l.keys[1] == nil {
 		return 0
 	}
-	return uint8(mrand.Intn(32))
+	return algo.RandKeyIndex()
 }
 
-func mixkeys(k1, k2 []byte) []byte {
-	if len(k1) != 32 || len(k2) != 32 {
-		panic("unexpected key len")
-	}
-	k := make([]byte, 64)
-	for i := range k1 {
-		k1i, k2i := i, 31-i
-		k1v, k2v := k1[k1i], k2[k2i]
-		binary.LittleEndian.PutUint16(
-			k[i*2:(i+1)*2],
-			expandkeyunit(k1v, k2v),
-		)
-	}
-	return k
-}
-
-func expandkeyunit(v1, v2 byte) (v uint16) {
-	v1s, v2s := uint16(v1), uint16(bits.Reverse8(v2))
-	for i := 0; i < 8; i++ {
-		v |= v1s & (1 << (i * 2))
-		v1s <<= 1
-	}
-	for i := 0; i < 8; i++ {
-		v2s <<= 1
-		v |= v2s & (2 << (i * 2))
-	}
-	return
-}
-
-// Encode by aead and put b into pool
-func (l *Link) Encode(teatype uint8, additional uint16, b []byte) (eb []byte) {
+// decode by aead and put b into pool
+func (l *Link) decode(teatype uint8, additional uint16, b []byte) (db []byte, err error) {
 	if len(b) == 0 || teatype >= 32 {
 		return
 	}
 	if l.keys[0] == nil {
-		eb = helper.MakeBytes(len(b))
-		copy(eb, b)
-		return
-	}
-	aead := l.keys[teatype]
-	if aead == nil {
-		logrus.Warnln("[crypto] cipher key at index", teatype, "is empty")
-		return
-	}
-	eb = encode(aead, additional, b)
-	return
-}
-
-// Decode by aead and put b into pool
-func (l *Link) Decode(teatype uint8, additional uint16, b []byte) (db []byte, err error) {
-	if len(b) == 0 || teatype >= 32 {
-		return
-	}
-	if l.keys[0] == nil {
-		db = helper.MakeBytes(len(b))
+		if config.ShowDebugLog {
+			n := len(b)
+			endl := "."
+			if n > 64 {
+				n = 64
+				endl = "..."
+			}
+			logrus.Debugln(file.Header(), "copy plain text", hex.EncodeToString(b[:n]), endl)
+		}
+		db = make([]byte, len(b))
 		copy(db, b)
 		return
 	}
 	aead := l.keys[teatype]
 	if aead == nil {
-		return
+		panic("unexpected empty aead")
 	}
-	return decode(aead, additional, b)
-}
-
-func encode(aead cipher.AEAD, additional uint16, b []byte) []byte {
-	nsz := aead.NonceSize()
-	// Accocate capacity for all the stuffs.
-	buf := helper.MakeBytes(2 + nsz + len(b) + aead.Overhead())
-	binary.LittleEndian.PutUint16(buf[:2], additional)
-	nonce := buf[2 : 2+nsz]
-	// Select a random nonce
-	_, err := rand.Read(nonce)
-	if err != nil {
-		panic(err)
-	}
-	// Encrypt the message and append the ciphertext to the nonce.
-	eb := aead.Seal(nonce[nsz:nsz], nonce, b, buf[:2])
-	return nonce[:nsz+len(eb)]
-}
-
-func decode(aead cipher.AEAD, additional uint16, b []byte) ([]byte, error) {
-	nsz := aead.NonceSize()
-	if len(b) < nsz {
-		return nil, ErrCipherTextTooShort
-	}
-	// Split nonce and ciphertext.
-	nonce, ciphertext := b[:nsz], b[nsz:]
-	if len(ciphertext) == 0 {
-		return nil, nil
-	}
-	// Decrypt the message and check it wasn't tampered with.
-	var buf [2]byte
-	binary.LittleEndian.PutUint16(buf[:], additional)
-	return aead.Open(helper.SelectWriter().Bytes(), nonce, ciphertext, buf[:])
+	return algo.DecodeAEAD(aead, additional, b)
 }
 
 // xorenc 按 8 字节, 以初始 m.mask 循环异或编码 data
 func (m *Me) xorenc(data []byte, seq uint32) []byte {
-	batchsz := len(data) / 8
-	remain := len(data) % 8
-	sum := m.mask
-	newdat := helper.MakeBytes(8 + batchsz*8 + 8) // seqrand dat tail
-	binary.LittleEndian.PutUint32(newdat[:4], seq)
-	_, _ = rand.Read(newdat[4:8])                 // seqrand
-	sum ^= binary.LittleEndian.Uint64(newdat[:8]) // init from seqrand
-	binary.LittleEndian.PutUint64(newdat[:8], sum)
-	for i := 0; i < batchsz; i++ { // range on batch data
-		a := i * 8
-		b := (i + 1) * 8
-		sum ^= binary.LittleEndian.Uint64(data[a:b])
-		binary.LittleEndian.PutUint64(newdat[a+8:b+8], sum)
-	}
-	p := batchsz * 8
-	copy(newdat[8+p:], data[p:])
-	newdat[len(newdat)-1] = byte(remain)
-	sum ^= binary.LittleEndian.Uint64(newdat[8+p:])
-	binary.LittleEndian.PutUint64(newdat[8+p:], sum)
-	return newdat
+	return algo.EncodeXOR(data, m.mask, seq)
 }
 
 // xordec 按 8 字节, 以初始 m.mask 循环异或解码 data
 func (m *Me) xordec(data []byte) (uint32, []byte) {
-	if len(data) < 16 || len(data)%8 != 0 {
-		return 0, nil
-	}
-	batchsz := len(data) / 8
-	sum := m.mask
-	for i := 0; i < batchsz; i++ {
-		a := i * 8
-		b := (i + 1) * 8
-		x := binary.LittleEndian.Uint64(data[a:b])
-		sum ^= x
-		binary.LittleEndian.PutUint64(data[a:b], sum)
-		sum = x
-	}
-	remain := data[len(data)-1]
-	if remain >= 8 {
-		return 0, nil
-	}
-	return binary.LittleEndian.Uint32(data[:4]), data[8 : len(data)-8+int(remain)]
+	return algo.DecodeXOR(data, m.mask)
 }

gold/link/event.go

@@ -0,0 +1,21 @@
+package link
+
+import (
+	"github.com/RomiChan/syncx"
+	"github.com/fumiama/WireGold/gold/head"
+)
+
+// 事件分发器
+var dispachers syncx.Map[uint8, Dispacher]
+
+type Dispacher func(header *head.Packet, peer *Link, data []byte)
+
+// RegisterDispacher of proto
+func RegisterDispacher(p uint8, d Dispacher) (actual Dispacher, hasexist bool) {
+	return dispachers.LoadOrStore(p, d)
+}
+
+// GetDispacher fn, ok
+func GetDispacher(p uint8) (Dispacher, bool) {
+	return dispachers.Load(p)
+}

gold/link/link.go

@@ -5,18 +5,24 @@ import (
 	"errors"
 	"net"
 	"sync/atomic"
-	"time"
 
+	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/head"
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/bin"
 	base14 "github.com/fumiama/go-base16384"
+	"github.com/sirupsen/logrus"
 )
 
 var (
 	ErrPerrNotExist = errors.New("peer not exist")
 )
 
+type LinkData struct {
+	H head.Packet
+	D []byte
+}
+
 // Link 是本机到 peer 的连接抽象
 type Link struct {
 	// peer 的公钥
@@ -26,7 +32,7 @@ type Link struct {
 	// 收到的包的队列
 	// 没有下层 nic 时
 	// 包会分发到此
-	pipe chan *head.Packet
+	pipe chan LinkData
 	// peer 的虚拟 ip
 	peerip net.IP
 	// peer 的公网 endpoint
@@ -39,8 +45,8 @@ type Link struct {
 	keys [32]cipher.AEAD
 	// 本机信息
 	me *Me
-	// 最后一次收到报文的时间
-	lastalive *time.Time
+	// 最后一次收到报文的时间 (UnixNano)
+	lastalive atomic.Int64
 	// 是否允许转发
 	allowtrans bool
 	// 是否对数据进行 zstd 压缩
@@ -62,11 +68,54 @@ func (m *Me) Connect(peer string) (*Link, error) {
 	return nil, ErrPerrNotExist
 }
 
+func (l *Link) ToLower(header *head.Packet, data []byte) {
+	if l.pipe != nil {
+		d := make([]byte, len(data))
+		copy(d, data)
+		l.pipe <- LinkData{
+			H: *header,
+			D: d,
+		}
+		if config.ShowDebugLog {
+			logrus.Debugln("[listen] deliver to pipe of", l.peerip)
+		}
+		return
+	}
+	_, err := l.me.nic.Write(data)
+	if err != nil {
+		logrus.Errorln("[listen] deliver", len(data), "bytes data to nic err:", err)
+	} else if config.ShowDebugLog {
+		logrus.Debugln("[listen] deliver", len(data), "bytes data to nic")
+	}
+}
+
 // Close 关闭到 peer 的连接
 func (l *Link) Close() {
 	l.Destroy()
 }
 
+// IP is wiregold peer ip
+func (l *Link) IP() net.IP {
+	return l.peerip
+}
+
+// RawEndPoint is initial ep in cfg
+func (l *Link) RawEndPoint() string {
+	return l.rawep
+}
+
+func (l *Link) EndPoint() p2p.EndPoint {
+	return l.endpoint
+}
+
+func (l *Link) SetEndPoint(ep p2p.EndPoint) {
+	l.endpoint = ep
+}
+
+func (l *Link) Me() *Me {
+	return l.me
+}
+
 // Destroy 从 connections 移除 peer
 func (l *Link) Destroy() {
 	l.me.connmapmu.Lock()
@@ -79,7 +128,7 @@ func (l *Link) String() (n string) {
 	if l.pubk != nil {
 		b, err := base14.UTF16BE2UTF8(base14.Encode(l.pubk[:7]))
 		if err == nil {
-			n = helper.BytesToString(b)
+			n = bin.BytesToString(b)
 		} else {
 			n = err.Error()
 		}

gold/link/listen.go

@@ -1,71 +1,48 @@
 package link
 
 import (
-	"bytes"
 	"errors"
-	"io"
 	"net"
 	"runtime"
 	"strconv"
-	"sync"
 	"sync/atomic"
 	"time"
-	"unsafe"
 
-	"github.com/klauspost/compress/zstd"
 	"github.com/sirupsen/logrus"
 
 	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/head"
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/algo"
+	"github.com/fumiama/WireGold/internal/file"
+	"github.com/fumiama/orbyte/pbuf"
 )
 
 const lstnbufgragsz = 65536
 
-type lstnq struct {
-	index int
-	addr  p2p.EndPoint
-	buf   []byte
+type job struct {
+	addr p2p.EndPoint
+	buf  pbuf.Bytes
+	n    int
+	fil  *uintptr
 }
 
-type listenqueue chan lstnq
-
-func (q listenqueue) listen(m *Me, hasntfinished []sync.Mutex) {
-	recvtotlcnt := uint64(0)
-	recvloopcnt := uint16(0)
-	recvlooptime := time.Now().UnixMilli()
-	for lstn := range q {
-		recvtotlcnt += uint64(len(lstn.buf))
-		recvloopcnt++
-		if recvloopcnt%m.speedloop == 0 {
-			now := time.Now().UnixMilli()
-			logrus.Infof("[listen] queue recv avg speed: %.2f KB/s", float64(recvtotlcnt)/float64(now-recvlooptime))
-			recvtotlcnt = 0
-			recvlooptime = now
-		}
-		packet := m.wait(lstn.buf[:len(lstn.buf):lstnbufgragsz])
-		if packet == nil {
-			if lstn.index < 0 {
+func (m *Me) runworkers() {
+	ncpu := runtime.NumCPU()
+	m.jobs = make([]chan job, ncpu)
+	for i := 0; i < ncpu; i++ {
+		m.jobs[i] = make(chan job, 4096)
+		go func(i int, jobs <-chan job) {
+			for jb := range jobs {
 				if config.ShowDebugLog {
-					logrus.Debugln("[listen] queue waiting")
+					logrus.Debugln("[listen] job thread", i, "call waitordispatch")
+				}
+				m.waitordispatch(jb.addr, jb.buf, jb.n, jb.fil)
+				if config.ShowDebugLog {
+					logrus.Debugln("[listen] job thread", i, "fin waitordispatch")
 				}
-				helper.PutBytes(lstn.buf)
-				continue
 			}
-			if config.ShowDebugLog {
-				logrus.Debugln("[listen] queue waiting, unlock index", lstn.index)
-			}
-			hasntfinished[lstn.index].Unlock()
-			continue
-		}
-		if lstn.index >= 0 {
-			go m.dispatch(packet, lstn.addr, lstn.index, hasntfinished[lstn.index].Unlock)
-		} else {
-			go m.dispatch(packet, lstn.addr, lstn.index, func() {
-				helper.PutBytes(lstn.buf)
-			})
-		}
+		}(i, m.jobs[i])
 	}
 }
 
@@ -77,41 +54,40 @@ func (m *Me) listen() (conn p2p.Conn, err error) {
 	}
 	m.ep = conn.LocalAddr()
 	logrus.Infoln("[listen] at", m.ep)
+	ncpu := runtime.NumCPU()
+	bufs := make([]byte, lstnbufgragsz*ncpu)
+	fils := make([]uintptr, ncpu)
+	go m.runworkers()
 	go func() {
-		n := uint(runtime.NumCPU())
-		if n > 64 {
-			n = 64 // 只用最多 64 核
-		}
-		logrus.Infoln("[listen] use cpu num:", n)
-		listenbuf := make([]byte, lstnbufgragsz*n)
-		hasntfinished := make([]sync.Mutex, n)
-		q := make(listenqueue, n)
-		defer close(q)
-		go q.listen(m, hasntfinished)
+		var (
+			n    int
+			addr p2p.EndPoint
+			err  error
+		)
 		for {
-			usenewbuf := false
-			i := uint(0)
-			for !hasntfinished[i].TryLock() {
-				i++
-				i %= n
-				if i == 0 { // looked up a full round, make a new buf
-					usenewbuf = true
-					if config.ShowDebugLog {
-						logrus.Debugln("[listen] use new buf")
-					}
-					break
+			idx := -1
+			for i := 0; i < ncpu; i++ {
+				if !atomic.CompareAndSwapUintptr(&fils[i], 0, 1) {
+					continue
 				}
+				idx = i
+				break
 			}
-			if config.ShowDebugLog && !usenewbuf {
-				logrus.Debugln("[listen] lock index", i)
-			}
-			var lbf []byte
-			if usenewbuf {
-				lbf = helper.MakeBytes(lstnbufgragsz)
+
+			var (
+				lbf pbuf.Bytes
+				fil *uintptr
+			)
+			if idx < 0 {
+				lbf = pbuf.NewLargeBytes(lstnbufgragsz)
 			} else {
-				lbf = listenbuf[i*lstnbufgragsz : (i+1)*lstnbufgragsz]
+				lbf = pbuf.ParseBytes(bufs[idx*lstnbufgragsz : (idx+1)*lstnbufgragsz : (idx+1)*lstnbufgragsz]...).Ignore()
+				fil = &fils[idx]
 			}
-			n, addr, err := conn.ReadFromPeer(lbf)
+
+			lbf.V(func(b []byte) {
+				n, addr, err = conn.ReadFromPeer(b)
+			})
 			if m.connections == nil || errors.Is(err, net.ErrClosed) {
 				logrus.Warnln("[listen] quit listening")
 				return
@@ -123,13 +99,6 @@ func (m *Me) listen() (conn p2p.Conn, err error) {
 					logrus.Errorln("[listen] reconnect udp err:", err)
 					return
 				}
-				if !usenewbuf {
-					if config.ShowDebugLog {
-						logrus.Debugln("[listen] unlock index", i)
-					}
-					hasntfinished[i].Unlock()
-					i--
-				}
 				continue
 			}
 			if n <= 0 {
@@ -138,158 +107,130 @@ func (m *Me) listen() (conn p2p.Conn, err error) {
 				}
 				continue
 			}
-			lq := lstnq{
-				index: -1,
-				addr:  addr,
-				buf:   lbf[:n],
+			if idx < 0 {
+				if config.ShowDebugLog {
+					logrus.Infoln("[listen] go dispatch")
+				}
+				go m.waitordispatch(addr, lbf, n, fil)
+			} else {
+				if config.ShowDebugLog {
+					logrus.Debugln("[listen] send dispatch to cpu", idx)
+				}
+				m.jobs[idx] <- job{addr: addr, buf: lbf, n: n, fil: fil}
 			}
-			if !usenewbuf {
-				lq.index = int(i)
-			}
-			q <- lq
 		}
 	}()
 	return
 }
 
-func (m *Me) dispatch(packet *head.Packet, addr p2p.EndPoint, index int, finish func()) {
-	defer finish()
-	if config.ShowDebugLog {
-		defer logrus.Debugln("[listen] dispatched, unlock index", index)
-		logrus.Debugln("[listen] start dispatching index", index)
-	}
-	r := packet.Len() - packet.BodyLen()
-	if r > 0 {
-		logrus.Warnln("[listen] @", index, "packet from endpoint", addr, "len", packet.BodyLen(), "is smaller than it declared len", packet.Len(), ", drop it")
-		packet.Put()
-		return
-	}
-	p, ok := m.IsInPeer(packet.Src.String())
-	if config.ShowDebugLog {
-		logrus.Debugln("[listen] @", index, "recv from endpoint", addr, "src", packet.Src, "dst", packet.Dst)
-	}
-	if !ok {
-		logrus.Warnln("[listen] @", index, "packet from", packet.Src, "to", packet.Dst, "is refused")
-		packet.Put()
-		return
-	}
-	if helper.IsNilInterface(p.endpoint) || !p.endpoint.Euqal(addr) {
-		if m.ep.Network() == "tcp" && !addr.Euqal(p.endpoint) {
-			logrus.Infoln("[listen] @", index, "set endpoint of peer", p.peerip, "to", addr.String())
-			p.endpoint = addr
-		} else { // others are all no status link
-			logrus.Infoln("[listen] @", index, "set endpoint of peer", p.peerip, "to", addr.String())
-			p.endpoint = addr
+func (m *Me) waitordispatch(addr p2p.EndPoint, buf pbuf.Bytes, n int, fil *uintptr) {
+	defer func() {
+		buf.ManualDestroy()
+		if fil != nil {
+			atomic.StoreUintptr(fil, 0)
 		}
+	}()
+
+	recvtotlcnt := atomic.AddUint64(&m.recvtotlcnt, uint64(n))
+	recvloopcnt := atomic.AddUintptr(&m.recvloopcnt, 1)
+	recvlooptime := atomic.LoadInt64(&m.recvlooptime)
+	if recvloopcnt%uintptr(m.speedloop) == 0 {
+		now := time.Now().UnixMilli()
+		kb := float64(recvtotlcnt) / float64(now-recvlooptime)
+		if kb < 1024 {
+			logrus.Infof("[listen] queue recv avg speed: %.2f KB/s", kb)
+		} else {
+			kb /= 1024
+			if kb < 1024 {
+				logrus.Infof("[listen] queue recv avg speed: %.2f MB/s", kb)
+			} else {
+				logrus.Infof("[listen] queue recv avg speed: %.2f GB/s", kb/1024)
+			}
+		}
+		atomic.StoreUint64(&m.recvtotlcnt, 0)
+		atomic.StoreInt64(&m.recvlooptime, now)
 	}
-	now := time.Now()
-	atomic.StorePointer((*unsafe.Pointer)(unsafe.Pointer(&p.lastalive)), unsafe.Pointer(&now))
-	switch {
-	case p.IsToMe(packet.Dst):
-		if !p.Accept(packet.Src) {
-			logrus.Warnln("[listen] @", index, "refused packet from", packet.Src.String()+":"+strconv.Itoa(int(packet.SrcPort)))
-			packet.Put()
+	buf.V(func(b []byte) {
+		h := m.wait(b[:n], addr)
+		if !h.HasInit() {
+			if config.ShowDebugLog {
+				logrus.Debugln("[listen] queue waiting")
+			}
 			return
 		}
-		addt := packet.AdditionalData()
-		var err error
-		data, err := p.Decode(packet.CipherIndex(), addt, packet.Body())
+		h.B(func(b []byte, p *head.Packet) {
+			if config.ShowDebugLog {
+				logrus.Debugln("[listen] dispatch", len(b), "bytes packet")
+			}
+			if !p.HasFinished() {
+				panic("unexpected unfinished")
+			}
+			m.dispatch(p, b, addr)
+		})
+		h.ManualDestroy()
+	})
+}
+
+func (m *Me) dispatch(header *head.Packet, body []byte, addr p2p.EndPoint) {
+	r := header.Size() - len(body)
+	if r > 0 {
+		logrus.Warnln("[listen] packet from endpoint", addr, "len", len(body), "is smaller than it declared len", header.Size(), ", drop it")
+		return
+	}
+	srcip := header.Src()
+	dstip := header.Dst()
+	p := m.extractPeer(srcip, dstip, addr)
+	if p == nil {
+		return
+	}
+	if !p.Accept(srcip) {
+		logrus.Warnln("[listen] refused packet from", srcip.String()+":"+strconv.Itoa(int(header.SrcPort)))
+		return
+	}
+	if !p.IsToMe(dstip) {
+		logrus.Warnln("[listen] unhandled trans packet from", srcip.String()+":"+strconv.Itoa(int(header.SrcPort)))
+		return
+	}
+	addt := header.AdditionalData()
+	var err error
+	data, err := p.decode(header.CipherIndex(), addt, body)
+	if err != nil {
+		if config.ShowDebugLog {
+			logrus.Debugln("[listen] drop invalid packet key idx:", header.CipherIndex(), "addt:", addt, "err:", err)
+		}
+		return
+	}
+	if len(data) < 8 {
+		if config.ShowDebugLog {
+			logrus.Debugln("[listen] drop invalid data len packet key idx:", header.CipherIndex(), "addt:", addt, "len", len(data))
+		}
+		return
+	}
+	ok := false
+	ok = algo.IsVaildBlake2bHash8(header.PreCRC64(), data)
+	if !ok {
+		if config.ShowDebugLog {
+			logrus.Debugln("[listen] drop invalid hash packet")
+		}
+		return
+	}
+	data = data[8:]
+	if p.usezstd {
+		data, err = algo.DecodeZstd(data) // skip hash
 		if err != nil {
 			if config.ShowDebugLog {
-				logrus.Debugln("[listen] @", index, "drop invalid packet key idx:", packet.CipherIndex(), "addt:", addt, "err:", err)
+				logrus.Debugln("[listen] drop invalid zstd packet:", err)
 			}
-			packet.Put()
 			return
 		}
-		packet.SetBody(data, true)
-		if p.usezstd {
-			dec, _ := zstd.NewReader(bytes.NewReader(packet.Body()))
-			var err error
-			w := helper.SelectWriter()
-			_, err = io.Copy(w, dec)
-			dec.Close()
-			if err != nil {
-				if config.ShowDebugLog {
-					logrus.Debugln("[listen] @", index, "drop invalid zstd packet:", err)
-				}
-				packet.Put()
-				return
-			}
-			packet.SetBody(w.Bytes(), true)
+		if config.ShowDebugLog {
+			logrus.Debugln("[listen] zstd decoded len:", len(data))
 		}
-		if !packet.IsVaildHash() {
-			if config.ShowDebugLog {
-				logrus.Debugln("[listen] @", index, "drop invalid hash packet")
-			}
-			packet.Put()
-			return
-		}
-		switch packet.Proto {
-		case head.ProtoHello:
-			switch {
-			case len(packet.Body()) == 0:
-				logrus.Warnln("[listen] @", index, "recv old hello packet, do nothing")
-			case packet.Body()[0] == byte(head.HelloPing):
-				n, err := p.WriteAndPut(head.NewPacket(head.ProtoHello, m.SrcPort(), p.peerip, m.DstPort(), []byte{byte(head.HelloPong)}), false)
-				if err == nil {
-					logrus.Infoln("[listen] @", index, "recv hello, send", n, "bytes hello ack packet")
-				} else {
-					logrus.Errorln("[listen] @", index, "send hello ack packet error:", err)
-				}
-			default:
-				logrus.Infoln("[listen] @", index, "recv hello ack packet, do nothing")
-			}
-			packet.Put()
-		case head.ProtoNotify:
-			logrus.Infoln("[listen] @", index, "recv notify from", packet.Src)
-			go p.onNotify(packet.Body())
-			packet.Put()
-		case head.ProtoQuery:
-			logrus.Infoln("[listen] @", index, "recv query from", packet.Src)
-			go p.onQuery(packet.Body())
-			packet.Put()
-		case head.ProtoData:
-			if p.pipe != nil {
-				p.pipe <- packet.CopyWithBody()
-				if config.ShowDebugLog {
-					logrus.Debugln("[listen] @", index, "deliver to pipe of", p.peerip)
-				}
-			} else {
-				_, err := m.nic.Write(packet.Body())
-				if err != nil {
-					logrus.Errorln("[listen] @", index, "deliver", packet.BodyLen(), "bytes data to nic err:", err)
-				} else if config.ShowDebugLog {
-					logrus.Debugln("[listen] @", index, "deliver", packet.BodyLen(), "bytes data to nic")
-				}
-			}
-			packet.Put()
-		default:
-			logrus.Warnln("[listen] @", index, "recv unknown proto:", packet.Proto)
-			packet.Put()
-		}
-	case p.Accept(packet.Dst):
-		if !p.allowtrans {
-			logrus.Warnln("[listen] @", index, "refused to trans packet to", packet.Dst.String()+":"+strconv.Itoa(int(packet.DstPort)))
-			packet.Put()
-			return
-		}
-		// 转发
-		lnk := m.router.NextHop(packet.Dst.String())
-		if lnk == nil {
-			logrus.Warnln("[listen] @", index, "transfer drop packet: nil nexthop")
-			packet.Put()
-			return
-		}
-		n, err := lnk.WriteAndPut(packet, true)
-		if err == nil {
-			if config.ShowDebugLog {
-				logrus.Debugln("[listen] @", index, "trans", n, "bytes packet to", packet.Dst.String()+":"+strconv.Itoa(int(packet.DstPort)))
-			}
-		} else {
-			logrus.Errorln("[listen] @", index, "trans packet to", packet.Dst.String()+":"+strconv.Itoa(int(packet.DstPort)), "err:", err)
-		}
-	default:
-		logrus.Warnln("[listen] @", index, "packet dst", packet.Dst.String()+":"+strconv.Itoa(int(packet.DstPort)), "is not in peers")
-		packet.Put()
 	}
+	fn, ok := GetDispacher(header.Proto.Proto())
+	if !ok {
+		logrus.Warnln(file.Header(), "unsupported proto", header.Proto.Proto())
+		return
+	}
+	fn(header, p, data)
 }

gold/link/me.go

@@ -16,19 +16,42 @@ import (
 	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/head"
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/bin"
 	"github.com/fumiama/WireGold/lower"
 )
 
 // Me 是本机的抽象
 type Me struct {
-	// 用于自我重连
-	cfg *MyConfig
+	// 读写同步锁
+	connmapmu sync.RWMutex
+	// 本机总接收字节数
+	recvtotlcnt uint64
+	// 上一次触发循环计数时间
+	recvlooptime int64
 	// 本机私钥
 	// 利用 Curve25519 生成
 	// https://pkg.go.dev/golang.org/x/crypto/curve25519
 	// https://www.zhihu.com/question/266758647
 	privKey [32]byte
+	// 本机上层配置
+	srcport, dstport, mtu, speedloop uint16
+	// 报头掩码
+	mask uint64
+	// 本机总接收数据包计数
+	recvloopcnt uintptr
+	// 用于自我重连
+	cfg *MyConfig
+	// 本机网卡
+	nic *lower.NICIO
+	// 本机路由表
+	router *Router
+	// 本机未接收完全分片池
+	recving *ttl.Cache[uint16, head.PacketBytes]
+	// 抗重放攻击记录池
+	recved *ttl.Cache[uint64, struct{}]
+
+	// 以上为64位对齐, 修改时注意保持
+
 	// 本机虚拟 ip
 	me net.IP
 	// 本机子网
@@ -37,24 +60,14 @@ type Me struct {
 	ep p2p.EndPoint
 	// 本机活跃的所有连接
 	connections map[string]*Link
-	// 读写同步锁
-	connmapmu sync.RWMutex
 	// 本机监听的连接端点, 也用于向对端直接发送报文
 	conn p2p.Conn
-	// 本机网卡
-	nic *lower.NICIO
-	// 本机路由表
-	router *Router
-	// 本机未接收完全分片池
-	recving *ttl.Cache[uint64, *head.Packet]
-	// 抗重放攻击记录池
-	recved *ttl.Cache[uint64, bool]
-	// 本机上层配置
-	srcport, dstport, mtu, speedloop uint16
-	// 报头掩码
-	mask uint64
+	// 供内部使用的包分发任务列
+	jobs []chan job
 	// 是否进行 base16384 编码
 	base14 bool
+	// 本机初始 ttl
+	ttl uint8
 	// 本机网络端点初始化配置
 	networkconfigs []any
 }
@@ -69,6 +82,7 @@ type MyConfig struct {
 	SrcPort, DstPort, MTU, SpeedLoop uint16
 	Mask                             uint64
 	Base14                           bool
+	MaxTTL                           uint8
 }
 
 type NICConfig struct {
@@ -114,28 +128,37 @@ func NewMe(cfg *MyConfig) (m Me) {
 	m.router.SetDefault(nil)
 	m.srcport = cfg.SrcPort
 	m.dstport = cfg.DstPort
-	m.mtu = (cfg.MTU - head.PacketHeadLen) & 0xfff8
+	m.mtu = cfg.MTU
 	if cfg.NICConfig != nil {
 		m.nic = lower.NewNIC(
 			cfg.NICConfig.IP, cfg.NICConfig.SubNet,
-			strconv.FormatUint(uint64(m.MTU()), 10), cfg.NICConfig.CIDRs...,
+			strconv.FormatUint(uint64(m.mtu), 10), cfg.NICConfig.CIDRs...,
 		)
 	}
 	m.mask = cfg.Mask
+	m.recvlooptime = time.Now().UnixMilli()
 	m.base14 = cfg.Base14
+	if cfg.MaxTTL == 0 {
+		m.ttl = 64
+	} else {
+		m.ttl = cfg.MaxTTL
+	}
 	var buf [8]byte
 	binary.BigEndian.PutUint64(buf[:], m.mask)
 	logrus.Infoln("[me] xor mask", hex.EncodeToString(buf[:]))
-	m.recving = ttl.NewCache[uint64, *head.Packet](time.Second * 30)
-	m.recved = ttl.NewCache[uint64, bool](time.Second * 30)
+	m.recving = ttl.NewCache[uint16, head.PacketBytes](time.Second * 10)
+	m.recved = ttl.NewCache[uint64, struct{}](time.Minute)
 	return
 }
 
 // Restart 重新连接
 func (m *Me) Restart() error {
+	for i := 0; i < len(m.jobs); i++ {
+		close(m.jobs[i])
+	}
 	oldconn := m.conn
 	m.conn = nil
-	if helper.IsNonNilInterface(oldconn) {
+	if bin.IsNonNilInterface(oldconn) {
 		_ = oldconn.Close()
 	}
 	var err error
@@ -154,6 +177,7 @@ func (m *Me) Restart() error {
 	}
 	m.me = ip
 	m.subnet = *cidr
+	m.recvlooptime = time.Now().UnixMilli()
 	m.conn, err = m.listen()
 	return err
 }
@@ -170,13 +194,27 @@ func (m *Me) MTU() uint16 {
 	return m.mtu
 }
 
+func (m *Me) TTL() uint8 {
+	return m.ttl
+}
+
 func (m *Me) EndPoint() p2p.EndPoint {
 	return m.ep
 }
 
+func (m *Me) NetworkConfigs() []any {
+	return m.networkconfigs
+}
+
 func (m *Me) Close() error {
+	for i := 0; i < len(m.jobs); i++ {
+		jb := m.jobs[i]
+		if jb != nil {
+			close(jb)
+		}
+	}
 	m.connections = nil
-	if helper.IsNonNilInterface(m.conn) {
+	if bin.IsNonNilInterface(m.conn) {
 		_ = m.conn.Close()
 		m.conn = nil
 	}
@@ -280,14 +318,6 @@ func (m *Me) sendAllSameDst(packet []byte) (n int) {
 		logrus.Warnln("[me] drop packet to", dst.String()+":"+strconv.Itoa(int(m.DstPort())), ": nil nexthop")
 		return
 	}
-	pcp := helper.MakeBytes(len(packet))
-	copy(pcp, packet)
-	go func(packet []byte) {
-		defer helper.PutBytes(packet)
-		_, err := lnk.WriteAndPut(head.NewPacket(head.ProtoData, m.SrcPort(), lnk.peerip, m.DstPort(), packet), false)
-		if err != nil {
-			logrus.Warnln("[me] write to peer", lnk.peerip, "err:", err)
-		}
-	}(pcp)
+	lnk.WritePacket(head.ProtoData, packet, lnk.me.ttl)
 	return
 }

gold/link/nat.go

@@ -2,16 +2,12 @@ package link
 
 import (
 	"encoding/json"
-	"sync/atomic"
 	"time"
-	"unsafe"
 
 	"github.com/sirupsen/logrus"
 
-	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/head"
-	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/file"
 )
 
 // 保持 NAT
@@ -19,129 +15,30 @@ import (
 // 以秒为单位，小于等于 0 不发送
 func (l *Link) keepAlive(dur int64) {
 	if dur > 0 {
-		logrus.Infoln("[nat] start to keep alive")
+		logrus.Infoln(file.Header(), "start to keep alive")
 		t := time.NewTicker(time.Second * time.Duration(dur))
 		for range t.C {
 			if l.me.connections == nil {
 				return
 			}
-			la := (*time.Time)(atomic.LoadPointer((*unsafe.Pointer)(unsafe.Pointer(&l.lastalive))))
-			if la != nil && time.Since(*la) > 10*time.Second*time.Duration(dur) { // 可能已经被阻断， 断开重连
-				logrus.Warnln("[nat] no response after 10 keep alive tries, re-connecting...")
+			la := l.lastalive.Load()
+			if la != 0 && time.Since(time.Unix(0, la)) > 10*time.Second*time.Duration(dur) { // 可能已经被阻断， 断开重连
+				logrus.Warnln(file.Header(), "no response after 10 keep alive tries, re-connecting...")
 				err := l.me.Restart()
 				if err != nil {
-					logrus.Errorln("[nat] re-connect me err:", err)
+					logrus.Errorln(file.Header(), "re-connect me err:", err)
 				} else {
-					logrus.Infoln("[nat] re-connect me succeeded")
+					logrus.Infoln(file.Header(), "re-connect me succeeded")
 				}
 			}
-			n, err := l.WriteAndPut(head.NewPacket(head.ProtoHello, l.me.srcport, l.peerip, l.me.dstport, []byte{byte(head.HelloPing)}), false)
-			if err == nil {
-				logrus.Infoln("[nat] send", n, "bytes keep alive packet")
-			} else {
-				logrus.Warnln("[nat] send keep alive packet error:", err)
-			}
+			l.WritePacket(head.ProtoHello, []byte{byte(head.HelloPing)}, 64)
+			logrus.Infoln(file.Header(), "send keep alive to", l.peerip)
 		}
 	}
 }
 
-// 收到通告包的处理函数
-func (l *Link) onNotify(packet []byte) {
-	// TODO: 完成data解包与endpoint注册
-	// 1. Data 解包
-	// ---- 使用 head.Notify 解释 packet
-	notify := make(head.Notify, 32)
-	err := json.Unmarshal(packet, &notify)
-	if err != nil {
-		logrus.Errorln("[nat] notify json unmarshal err:", err)
-		return
-	}
-	// 2. endpoint注册
-	// ---- 遍历 Notify，注册对方的 endpoint 到
-	// ---- connections，注意使用读写锁connmapmu
-	for peer, ep := range notify {
-		nw, epstr := ep[0], ep[1]
-		if nw != l.me.ep.Network() {
-			logrus.Warnln("[nat] ignore different network notify", nw, "addr", epstr)
-			continue
-		}
-		addr, err := p2p.NewEndPoint(nw, epstr, l.me.networkconfigs...)
-		if err == nil {
-			p, ok := l.me.IsInPeer(peer)
-			if ok {
-				if helper.IsNilInterface(p.endpoint) || !p.endpoint.Euqal(addr) {
-					p.endpoint = addr
-					logrus.Infoln("[nat] notify set ep of peer", peer, "to", ep)
-				}
-				continue
-			}
-		}
-		if config.ShowDebugLog {
-			logrus.Debugln("[nat] notify drop invalid peer:", peer, "ep:", ep)
-		}
-	}
-}
-
-// 收到询问包的处理函数
-func (l *Link) onQuery(packet []byte) {
-	// 完成data解包与notify分发
-
-	// 1. Data 解包
-	// ---- 使用 head.Query 解释 packet
-	// ---- 根据 Query 确定需要封装的 Notify
-	var peers head.Query
-	err := json.Unmarshal(packet, &peers)
-	if err != nil {
-		logrus.Errorln("[nat] query json unmarshal err:", err)
-		return
-	}
-
-	if l == nil || l.me == nil {
-		logrus.Errorln("[nat] nil link/me")
-		return
-	}
-
-	// 2. notify分发
-	// ---- 封装 Notify 到 新的 packet
-	// ---- 调用 l.Send 发送到对方
-	notify := make(head.Notify, len(peers))
-	for _, p := range peers {
-		lnk, ok := l.me.IsInPeer(p)
-		eps := ""
-		if l.me.ep.Network() == "udp" { // udp has real p2p
-			if helper.IsNilInterface(lnk.endpoint) {
-				continue
-			}
-			eps = lnk.endpoint.String()
-		}
-		if eps == "" {
-			eps = l.rawep // use registered ep only
-		}
-		if eps == "" {
-			continue
-		}
-		if ok && helper.IsNonNilInterface(lnk.endpoint) {
-			notify[p] = [2]string{
-				lnk.endpoint.Network(),
-				eps,
-			}
-		}
-	}
-	if len(notify) > 0 {
-		logrus.Infoln("[nat] query wrap", len(notify), "notify")
-		w := helper.SelectWriter()
-		_ = json.NewEncoder(w).Encode(&notify)
-		_, err = l.WriteAndPut(head.NewPacket(head.ProtoNotify, l.me.srcport, l.peerip, l.me.dstport, w.Bytes()), false)
-		if err != nil {
-			logrus.Errorln("[nat] notify peer", l, "err:", err)
-			return
-		}
-		helper.PutWriter(w)
-	}
-}
-
 // sendquery 主动发起查询，询问对方是否可以到达 peers
-func (l *Link) sendquery(tick time.Duration, peers ...string) {
+func (l *Link) sendQuery(tick time.Duration, peers ...string) {
 	if len(peers) == 0 {
 		return
 	}
@@ -151,10 +48,7 @@ func (l *Link) sendquery(tick time.Duration, peers ...string) {
 	}
 	t := time.NewTicker(tick)
 	for range t.C {
-		logrus.Infoln("[nat] query send query to", l.peerip)
-		_, err = l.WriteAndPut(head.NewPacket(head.ProtoQuery, l.me.srcport, l.peerip, l.me.dstport, data), false)
-		if err != nil {
-			logrus.Errorln("[nat] query write err:", err)
-		}
+		l.WritePacket(head.ProtoQuery, data, l.me.ttl)
+		logrus.Infoln(file.Header(), "send query to", l.peerip)
 	}
 }

gold/link/peer.go

@@ -4,11 +4,15 @@ import (
 	"net"
 	"time"
 
-	"github.com/fumiama/WireGold/gold/head"
-	"github.com/fumiama/WireGold/gold/p2p"
 	curve "github.com/fumiama/go-x25519"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/crypto/chacha20poly1305"
+
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/gold/p2p"
+	"github.com/fumiama/WireGold/internal/algo"
+	"github.com/fumiama/WireGold/internal/bin"
+	"github.com/fumiama/WireGold/internal/file"
 )
 
 type PeerConfig struct {
@@ -49,7 +53,7 @@ func (m *Me) AddPeer(cfg *PeerConfig) (l *Link) {
 	}
 
 	if !cfg.NoPipe {
-		l.pipe = make(chan *head.Packet, 32)
+		l.pipe = make(chan LinkData, 4096)
 	}
 	var k, p []byte
 	if cfg.PubicKey != nil {
@@ -61,7 +65,7 @@ func (m *Me) AddPeer(cfg *PeerConfig) (l *Link) {
 	if len(k) == 32 {
 		var err error
 		if len(p) == 32 {
-			mixk := mixkeys(k, p)
+			mixk := algo.MixKeys(k, p)
 			for i := range k {
 				l.keys[i], err = chacha20poly1305.NewX(mixk[i : i+32])
 				if err != nil {
@@ -112,7 +116,7 @@ func (m *Me) AddPeer(cfg *PeerConfig) (l *Link) {
 	}
 	logrus.Infoln("[peer] add peer:", cfg.PeerIP, "allow:", cfg.AllowedIPs)
 	go l.keepAlive(cfg.KeepAliveDur)
-	go l.sendquery(time.Second*time.Duration(cfg.QueryTick), cfg.Querys...)
+	go l.sendQuery(time.Second*time.Duration(cfg.QueryTick), cfg.Querys...)
 	return
 }
 
@@ -123,3 +127,25 @@ func (m *Me) IsInPeer(peer string) (p *Link, ok bool) {
 	m.connmapmu.RUnlock()
 	return
 }
+
+func (m *Me) extractPeer(srcip, dstip net.IP, addr p2p.EndPoint) *Link {
+	p, ok := m.IsInPeer(srcip.String())
+	if config.ShowDebugLog {
+		logrus.Debugln(file.Header(), "recv from endpoint", addr, "src", srcip, "dst", dstip)
+	}
+	if !ok {
+		logrus.Warnln(file.Header(), "packet from", srcip, "to", dstip, "is refused")
+		return nil
+	}
+	if bin.IsNilInterface(p.endpoint) || !p.endpoint.Equal(addr) {
+		if m.ep.Network() == "tcp" && !addr.Equal(p.endpoint) {
+			logrus.Infoln(file.Header(), "set endpoint of peer", p.peerip, "to", addr.String())
+			p.endpoint = addr
+		} else { // others are all no status link
+			logrus.Infoln(file.Header(), "set endpoint of peer", p.peerip, "to", addr.String())
+			p.endpoint = addr
+		}
+	}
+	p.lastalive.Store(time.Now().UnixNano())
+	return p
+}

gold/link/recv.go

@@ -1,28 +1,31 @@
 package link
 
 import (
-	"encoding/binary"
+	"bytes"
 	"encoding/hex"
-	"hash/crc64"
+	"io"
 	"strconv"
 
 	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/head"
+	"github.com/fumiama/WireGold/gold/p2p"
+	"github.com/fumiama/WireGold/internal/bin"
 	base14 "github.com/fumiama/go-base16384"
+	"github.com/fumiama/orbyte/pbuf"
 	"github.com/sirupsen/logrus"
 )
 
 // Read 从 peer 收包
-func (l *Link) Read() *head.Packet {
+func (l *Link) Read() LinkData {
 	return <-l.pipe
 }
 
-func (m *Me) wait(data []byte) *head.Packet {
-	if len(data) < head.PacketHeadLen { // not a valid packet
+func (m *Me) wait(data []byte, addr p2p.EndPoint) (h head.PacketBytes) {
+	if len(data) < int(head.PacketHeadLen)+8 { // not a valid packet
 		if config.ShowDebugLog {
 			logrus.Debugln("[recv] invalid data len", len(data))
 		}
-		return nil
+		return
 	}
 	bound := 64
 	endl := "..."
@@ -34,7 +37,16 @@ func (m *Me) wait(data []byte) *head.Packet {
 		logrus.Debugln("[recv] data bytes, len", len(data), "val", hex.EncodeToString(data[:bound]), endl)
 	}
 	if m.base14 {
-		data = base14.Decode(data)
+		w := bin.SelectWriter()
+		_, err := io.Copy(w, base14.NewDecoder(bytes.NewReader(data)))
+		if err != nil { // not a valid packet
+			if config.ShowDebugLog {
+				logrus.Debugln("[recv] decode base14 err:", err)
+			}
+			return
+		}
+		data = w.ToBytes().Copy().Trans()
+		w.Destroy()
 		if len(data) < bound {
 			bound = len(data)
 			endl = "."
@@ -42,14 +54,14 @@ func (m *Me) wait(data []byte) *head.Packet {
 		if config.ShowDebugLog {
 			logrus.Debugln("[recv] data b14ed, len", len(data), "val", hex.EncodeToString(data[:bound]), endl)
 		}
-		if len(data) < head.PacketHeadLen { // not a valid packet
+		if len(data) < int(head.PacketHeadLen)+8 { // not a valid packet
 			if config.ShowDebugLog {
 				logrus.Debugln("[recv] invalid data len", len(data))
 			}
-			return nil
+			return
 		}
 	}
-	seq, data := m.xordec(data)
+	seq, data := m.xordec(data) // inplace decoding
 	if len(data) < bound {
 		bound = len(data)
 		endl = "."
@@ -57,81 +69,121 @@ func (m *Me) wait(data []byte) *head.Packet {
 	if config.ShowDebugLog {
 		logrus.Debugln("[recv] data xored, len", len(data), "val", hex.EncodeToString(data[:bound]), endl)
 	}
-	if len(data) < head.PacketHeadLen { // not a valid packet
+	header, err := head.ParsePacketHeader(data)
+	if err != nil { // not a valid packet
 		if config.ShowDebugLog {
-			logrus.Debugln("[recv] invalid data len", len(data))
+			logrus.Debugln("[recv] invalid packet header:", err)
 		}
-		return nil
+		return
 	}
-	flags := head.Flags(data)
-	if !flags.IsValid() {
-		if config.ShowDebugLog {
-			logrus.Debugln("[recv] drop invalid flags packet:", hex.EncodeToString(data[11:12]), hex.EncodeToString(data[10:11]))
-		}
-		return nil
-	}
-	crc := head.CRC64(data)
-	crclog := crc
-	crc ^= (uint64(seq) << 16)
 	if config.ShowDebugLog {
-		logrus.Debugf("[recv] packet crc %016x, seq %08x, xored crc %016x", crclog, seq, crc)
+		logrus.Debugf("[recv] packet seq %08x", seq)
 	}
-	if m.recved.Get(crc) {
+	crc := uint64(0)
+	header.B(func(_ []byte, p *head.Packet) {
+		crc = p.CRC64()
+	})
+	if _, got := m.recved.GetOrSet(uint64(seq)^crc, struct{}{}); got {
 		if config.ShowDebugLog {
-			logrus.Debugln("[recv] ignore duplicated crc packet", strconv.FormatUint(crc, 16))
+			logrus.Debugln("[recv] ignore duplicated seq^crc packet, seq", strconv.FormatUint(uint64(seq), 16), "crc", strconv.FormatUint(crc, 16))
 		}
-		return nil
+		header.ManualDestroy()
+		return
 	}
-	m.recved.Set(crc, true)
 	if config.ShowDebugLog {
-		logrus.Debugln("[recv]", strconv.FormatUint(crc, 16), len(data), "bytes data with flag", hex.EncodeToString(data[11:12]), hex.EncodeToString(data[10:11]))
-	}
-	if flags.IsSingle() || flags.NoFrag() {
-		h := head.SelectPacket()
-		_, err := h.Unmarshal(data)
-		if err != nil {
-			logrus.Errorln("[recv]", strconv.FormatUint(crc, 16), "unmarshal err:", err)
-			return nil
-		}
-		return h
+		header.B(func(_ []byte, p *head.Packet) {
+			logrus.Debugln(
+				"[recv]", strconv.FormatUint(uint64(seq), 16),
+				len(data), "bytes data with protoflag", p.Proto,
+				"offset", p.Offset,
+			)
+		})
 	}
 
-	crchash := crc64.New(crc64.MakeTable(crc64.ISO))
-	_, _ = crchash.Write(head.Hash(data))
-	var buf [4]byte
-	binary.LittleEndian.PutUint32(buf[:], seq)
-	_, _ = crchash.Write(buf[:])
-	hsh := crchash.Sum64()
-	h := m.recving.Get(hsh)
-	if h != nil {
-		if config.ShowDebugLog {
-			logrus.Debugln("[recv]", strconv.FormatUint(crc, 16), "get another frag part of", strconv.FormatUint(hsh, 16))
+	ok := false
+	header.B(func(buf []byte, p *head.Packet) {
+		peer := m.extractPeer(p.Src(), p.Dst(), addr)
+		if peer == nil {
+			ok = true
+			return
 		}
-		ok, err := h.Unmarshal(data)
-		if err == nil {
-			if ok {
-				m.recving.Delete(hsh)
-				if config.ShowDebugLog {
-					logrus.Debugln("[recv]", strconv.FormatUint(crc, 16), "all parts of", strconv.FormatUint(hsh, 16), "has reached")
-				}
-				return h
+		if !peer.IsToMe(p.Dst()) { // 提前处理转发
+			ok = true
+			if !peer.allowtrans {
+				logrus.Warnln("[recv] refused to trans packet to", p.Dst().String()+":"+strconv.Itoa(int(p.DstPort)))
+				return
 			}
-		} else {
-			h.Put()
-			logrus.Errorln("[recv]", strconv.FormatUint(crc, 16), "unmarshal err:", err)
+			// 转发
+			lnk := m.router.NextHop(p.Dst().String())
+			if lnk == nil {
+				logrus.Warnln("[recv] transfer drop packet: nil nexthop")
+				return
+			}
+			if head.DecTTL(data) { // need drop
+				logrus.Warnln("[recv] transfer drop packet: zero ttl")
+				return
+			}
+			go lnk.write2peer(pbuf.ParseBytes(data...).Ignore().Copy(), seq)
+			if config.ShowDebugLog {
+				logrus.Debugln("[listen] trans", len(data), "bytes packet to", p.Dst().String()+":"+strconv.Itoa(int(p.DstPort)))
+			}
+			return
+		}
+		if !p.Proto.HasMore() {
+			ok = true
+			if !p.WriteDataSegment(data, buf) {
+				logrus.Errorln("[recv]", strconv.FormatUint(uint64(seq), 16), "unexpected !ok")
+				return
+			}
+			if config.ShowDebugLog {
+				logrus.Debugln("[recv]", strconv.FormatUint(uint64(seq), 16), len(data), "bytes full data waited")
+			}
+			h = header
+			return
+		}
+	})
+
+	if ok {
+		if !h.HasInit() {
+			header.ManualDestroy()
+		}
+		return
+	}
+
+	h, got := m.recving.GetOrSet(uint16(seq), header)
+	if got {
+		if !h.HasInit() {
+			// GetOrSet found an expired entry: it deleted it and
+			// returned zero-value while reporting got=true, but did
+			// NOT store our header. Re-store it now.
+			m.recving.Set(uint16(seq), header)
+			h = header
+			got = false
+		} else if h == header {
+			panic("unexpected multi-put found")
+		} else {
+			header.ManualDestroy()
 		}
-		return nil
 	}
 	if config.ShowDebugLog {
-		logrus.Debugln("[recv]", strconv.FormatUint(crc, 16), "get new frag part of", strconv.FormatUint(hsh, 16))
+		logrus.Debugln("[recv]", strconv.FormatUint(uint64(seq&0xffff), 16), "get frag part isnew:", !got)
 	}
-	h = head.SelectPacket()
-	_, err := h.Unmarshal(data)
-	if err != nil {
-		h.Put()
-		logrus.Errorln("[recv]", strconv.FormatUint(crc, 16), "unmarshal err:", err)
-		return nil
+	ok = false
+	h.B(func(buf []byte, p *head.Packet) {
+		ok = p.WriteDataSegment(data, buf)
+		if !ok {
+			if config.ShowDebugLog {
+				logrus.Debugln("[recv]", strconv.FormatUint(uint64(seq&0xffff), 16), "wait other frag parts isnew:", !got)
+			}
+			return
+		}
+		m.recving.Delete(uint16(seq))
+		if config.ShowDebugLog {
+			logrus.Debugln("[recv]", strconv.FormatUint(uint64(seq&0xffff), 16), "all parts has reached")
+		}
+	})
+	if !ok {
+		return head.PacketBytes{}
 	}
-	m.recving.Set(hsh, h)
-	return nil
+	return
 }

gold/link/send.go

@@ -1,7 +1,6 @@
 package link
 
 import (
-	"bytes"
 	crand "crypto/rand"
 	"encoding/binary"
 	"encoding/hex"
@@ -10,13 +9,13 @@ import (
 	"io"
 	"math/rand"
 
-	"github.com/klauspost/compress/zstd"
 	"github.com/sirupsen/logrus"
 
 	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/head"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/bin"
 	base14 "github.com/fumiama/go-base16384"
+	"github.com/fumiama/orbyte/pbuf"
 )
 
 var (
@@ -24,141 +23,132 @@ var (
 	ErrTTL                = errors.New("ttl exceeded")
 )
 
-// WriteAndPut 向 peer 发包并将包放回缓存池
-func (l *Link) WriteAndPut(p *head.Packet, istransfer bool) (n int, err error) {
-	defer p.Put()
-	teatype := l.randkeyidx()
-	sndcnt := uint16(l.incgetsndcnt())
+func randseq(i uint16) uint32 {
 	var buf [4]byte
 	_, _ = crand.Read(buf[:2])
-	binary.BigEndian.PutUint16(buf[2:4], sndcnt)
-	seq := binary.BigEndian.Uint32(buf[:])
+	binary.BigEndian.PutUint16(buf[2:4], i)
+	return binary.BigEndian.Uint32(buf[:])
+}
+
+// WritePacket 基于 data 向 peer 发包
+//
+// data 可为空, 因为不保证可达所以不返回错误。
+func (l *Link) WritePacket(proto uint8, data []byte, ttl uint8) {
+	teatype := l.randkeyidx()
+	sndcnt := uint16(l.incgetsndcnt())
 	mtu := l.mtu
 	if l.mturandomrange > 0 {
 		mtu -= uint16(rand.Intn(int(l.mturandomrange)))
 	}
 	if config.ShowDebugLog {
-		logrus.Debugln("[send] mtu:", mtu, ", addt:", sndcnt&0x07ff, ", key index:", teatype)
+		logrus.Debugln("[send] write mtu:", mtu, ", addt:", sndcnt&0x07ff, ", key index:", teatype, ", data len:", len(data))
 	}
-	if !istransfer {
-		l.encrypt(p, sndcnt, teatype)
-	}
-	delta := (int(mtu) - head.PacketHeadLen) & 0x0000fff8
-	if delta <= 0 {
-		logrus.Warnln("[send] reset invalid data frag len", delta, "to 8")
-		delta = 8
-	}
-	remlen := p.BodyLen()
-	if remlen <= delta {
-		return l.write(p, teatype, sndcnt, uint32(remlen), 0, istransfer, false, seq)
-	}
-	if istransfer && p.Flags.DontFrag() && remlen > delta {
-		return 0, ErrDropBigDontFragPkt
-	}
-	ttl := p.TTL
-	totl := uint32(remlen)
-	pos := 0
-	packet := p.Copy()
-	for remlen > delta {
-		remlen -= delta
-		if config.ShowDebugLog {
-			logrus.Debugln("[send] split frag [", pos, "~", pos+delta, "], remain:", remlen)
-		}
-		packet.CropBody(pos, pos+delta)
-		cnt, err := l.write(packet, teatype, sndcnt, totl, uint16(pos>>3), istransfer, true, seq)
-		n += cnt
-		if err != nil {
-			return n, err
-		}
-		packet.TTL = ttl
-		pos += delta
-	}
-	packet.Put()
-	if remlen > 0 {
-		if config.ShowDebugLog {
-			logrus.Debugln("[send] last frag [", pos, "~", pos+remlen, "]")
-		}
-		p.CropBody(pos, pos+remlen)
-		cnt := 0
-		cnt, err = l.write(p, teatype, sndcnt, totl, uint16(pos>>3), istransfer, false, seq)
-		n += cnt
-	}
-	return n, err
-}
-
-func (l *Link) encrypt(p *head.Packet, sndcnt uint16, teatype uint8) {
-	p.FillHash()
-	if config.ShowDebugLog {
-		logrus.Debugln("[send] data len before encrypt:", p.BodyLen())
-	}
-	data := p.Body()
+	pb := head.NewPacketBuilder().
+		Src(l.me.me, l.me.srcport).Dst(l.peerip, l.me.dstport).
+		Proto(proto).TTL(ttl).With(data)
 	if l.usezstd {
-		w := helper.SelectWriter()
-		defer helper.PutWriter(w)
-		enc, _ := zstd.NewWriter(w, zstd.WithEncoderLevel(zstd.SpeedFastest))
-		_, _ = io.Copy(enc, bytes.NewReader(data))
-		enc.Close()
-		data = w.Bytes()
-		if config.ShowDebugLog {
-			logrus.Debugln("[send] data len after zstd:", len(data))
+		pb.Zstd()
+	}
+	pb = pb.Hash()
+	var pktb *head.PacketBuilder
+	if l.keys[0] == nil {
+		pktb = pb.Plain(teatype, sndcnt&0x07ff)
+	} else {
+		pktb = pb.Seal(l.keys[teatype], teatype, sndcnt&0x07ff)
+	}
+	bs := pktb.Split(int(mtu), false)
+	pktb.Destroy()
+	if config.ShowDebugLog {
+		logrus.Debugln("[send] split packet into", len(bs), "parts")
+	}
+	for _, b := range bs { //TODO: impl. nofrag
+		go l.write2peer(head.BuildPacketFromBytes(b), randseq(sndcnt))
+		b.ManualDestroy()
+	}
+}
+
+// write2peer 计算 xor + b14 后向 peer 发包
+//
+// 因为不保证可达所以不返回错误。
+func (l *Link) write2peer(b pbuf.Bytes, seq uint32) {
+	defer b.ManualDestroy()
+	if l.doublepacket {
+		err := l.write2peer1(b, seq)
+		if err != nil {
+			logrus.Warnln("[send] double wr2peer", l.peerip, "err:", err)
 		}
 	}
-	p.SetBody(l.Encode(teatype, sndcnt&0x07ff, data), true)
-	if config.ShowDebugLog {
-		logrus.Debugln("[send] data len after xchacha20:", p.BodyLen(), "addt:", sndcnt)
+	err := l.write2peer1(b, seq)
+	if err != nil {
+		logrus.Warnln("[send] wr2peer", l.peerip, "err:", err)
 	}
 }
 
-// write 向 peer 发包
-func (l *Link) write(p *head.Packet, teatype uint8, additional uint16, datasz uint32, offset uint16, istransfer, hasmore bool, seq uint32) (int, error) {
-	if p.DecreaseAndGetTTL() <= 0 {
-		return 0, ErrTTL
-	}
-	if l.doublepacket {
-		_, _ = l.writeonce(p, teatype, additional, datasz, offset, istransfer, hasmore, seq)
-	}
-	return l.writeonce(p, teatype, additional, datasz, offset, istransfer, hasmore, seq)
-}
-
-// write 向 peer 发一个包
-func (l *Link) writeonce(p *head.Packet, teatype uint8, additional uint16, datasz uint32, offset uint16, istransfer, hasmore bool, seq uint32) (int, error) {
+// write2peer1 计算 xor + b14 后向 peer 发一个包
+func (l *Link) write2peer1(b pbuf.Bytes, seq uint32) (err error) {
 	peerep := l.endpoint
-	if helper.IsNilInterface(peerep) {
-		return 0, errors.New("nil endpoint of " + p.Dst.String())
+	if bin.IsNilInterface(peerep) {
+		return errors.New("nil endpoint of " + l.peerip.String())
 	}
 
-	var d []byte
-	var cl func()
-	// TODO: now all packet allow frag, adapt to DF
-	if istransfer {
-		d, cl = p.Marshal(nil, 0, 0, 0, offset, false, hasmore)
-	} else {
-		d, cl = p.Marshal(l.me.me, teatype, additional, datasz, offset, false, hasmore)
-	}
-	defer cl()
-
-	bound := 64
-	endl := "..."
-	if len(d) < bound {
-		bound = len(d)
-		endl = "."
-	}
 	conn := l.me.conn
 	if conn == nil {
-		return 0, io.ErrClosedPipe
+		return io.ErrClosedPipe
 	}
+	isnewb := false
+	b.V(func(data []byte) {
+		if config.ShowDebugLog {
+			bound := 64
+			endl := "..."
+			if len(data) < bound {
+				bound = len(data)
+				endl = "."
+			}
+			logrus.Debugln("[send] crc seq", fmt.Sprintf("%08x", seq), "raw data bytes", hex.EncodeToString(data[:bound]), endl)
+		}
+		b = pbuf.ParseBytes(l.me.xorenc(data, seq)...).Ignore()
+		isnewb = true
+	})
 	if config.ShowDebugLog {
-
-		logrus.Debugln("[send] write", len(d), "bytes data from ep", conn.LocalAddr(), "to", peerep, "offset", fmt.Sprintf("%04x", offset), "crc", fmt.Sprintf("%016x", p.CRC64()))
-		logrus.Debugln("[send] data bytes", hex.EncodeToString(d[:bound]), endl)
+		bound := 64
+		endl := "..."
+		if b.Len() < bound {
+			bound = b.Len()
+			endl = "."
+		}
+		b.V(func(b []byte) {
+			logrus.Debugln("[send] crc seq", fmt.Sprintf("%08x", seq), "xored data bytes", hex.EncodeToString(b[:bound]), endl)
+		})
 	}
-	d = l.me.xorenc(d, seq)
 	if l.me.base14 {
-		d = base14.Encode(d)
+		b.V(func(data []byte) {
+			old := b
+			b = pbuf.ParseBytes(base14.Encode(data)...).Ignore()
+			if isnewb {
+				old.ManualDestroy()
+			}
+			isnewb = true
+			if config.ShowDebugLog {
+				bound := 64
+				endl := "..."
+				if b.Len() < bound {
+					bound = b.Len()
+					endl = "."
+				}
+				b.V(func(b []byte) {
+					logrus.Debugln("[send] crc seq", fmt.Sprintf("%08x", seq), "b14ed data bytes", hex.EncodeToString(b[:bound]), endl)
+				})
+			}
+		})
 	}
-	if config.ShowDebugLog {
-		logrus.Debugln("[send] data xored", hex.EncodeToString(d[:bound]), endl)
+	b.V(func(b []byte) {
+		if config.ShowDebugLog {
+			logrus.Debugln("[send] crc seq", fmt.Sprintf("%08x", seq), "write", len(b), "bytes data from ep", conn.LocalAddr(), "to", peerep)
+		}
+		_, err = conn.WriteToPeer(b, peerep)
+	})
+	if isnewb {
+		b.ManualDestroy()
 	}
-	defer helper.PutBytes(d)
-	return conn.WriteToPeer(d, peerep)
+	return
 }

gold/p2p/define.go

@@ -23,7 +23,7 @@ func Register(network string, initializer Initializer) (actual Initializer, hase
 type EndPoint interface {
 	fmt.Stringer
 	Network() string
-	Euqal(EndPoint) bool
+	Equal(EndPoint) bool
 	Listen() (Conn, error)
 }
 

gold/p2p/icmp/icmp.go

@@ -0,0 +1,295 @@
+package icmp
+
+import (
+	"errors"
+	"net"
+	"net/netip"
+	"os"
+	"sync"
+	"sync/atomic"
+
+	"github.com/RomiChan/syncx"
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/gold/p2p"
+	"github.com/fumiama/orbyte/pbuf"
+	"github.com/sirupsen/logrus"
+
+	"golang.org/x/net/icmp"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+)
+
+var (
+	ErrInvalidBodyType = errors.New("invalid body type")
+)
+
+var (
+	echoid = os.Getpid()
+)
+
+// seqFIFO is a FIFO queue that generates new sequence numbers when empty.
+type seqFIFO struct {
+	mu   sync.Mutex
+	q    []uintptr
+	next *atomic.Uintptr
+}
+
+func (f *seqFIFO) Get() uintptr {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.q) > 0 {
+		v := f.q[0]
+		copy(f.q, f.q[1:])
+		f.q = f.q[:len(f.q)-1]
+		return v
+	}
+	return f.next.Add(1)
+}
+
+func (f *seqFIFO) Put(v uintptr) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if len(f.q) == 0 {
+		f.q = make([]uintptr, 1, 128)
+		f.q[0] = v
+		return
+	}
+	if len(f.q) < cap(f.q) {
+		f.q = append(f.q, v)
+		return
+	}
+	copy(f.q, f.q[1:])
+	f.q[len(f.q)-1] = v
+}
+
+// peerState holds per-peer ICMP echo state within a Conn.
+type peerState struct {
+	id      int
+	seq     atomic.Uintptr
+	seqfifo seqFIFO
+}
+
+func newPeerState() *peerState {
+	ps := &peerState{}
+	ps.seqfifo.next = &ps.seq
+	return ps
+}
+
+type EndPoint netip.Addr
+
+func (ep *EndPoint) String() string {
+	return (*netip.Addr)(ep).String()
+}
+
+func (ep *EndPoint) Network() string {
+	return "icmp"
+}
+
+func (ep *EndPoint) Equal(ep2 p2p.EndPoint) bool {
+	if ep == nil || ep2 == nil {
+		return ep == nil && ep2 == nil
+	}
+	ipep2, ok := ep2.(*EndPoint)
+	if !ok {
+		return false
+	}
+	ipep1 := ep
+	return (*netip.Addr)(ipep1).Compare(*(*netip.Addr)(ipep2)) == 0
+}
+
+// network get ipv4/ipv6 info and choose different options.
+func (ep *EndPoint) network() (string, *netip.Addr) {
+	nw := "ip4:icmp"
+	if (*netip.Addr)(ep).Is6() {
+		nw = "ip6:ipv6-icmp"
+	}
+	return nw, (*netip.Addr)(ep)
+}
+
+func (ep *EndPoint) Listen() (p2p.Conn, error) {
+	nw, addr := ep.network()
+	conn, err := icmp.ListenPacket(nw, addr.String())
+	if err != nil {
+		return nil, err
+	}
+	return &Conn{inner: conn}, nil
+}
+
+type Conn struct {
+	inner *icmp.PacketConn
+	peers syncx.Map[netip.Addr, *peerState]
+}
+
+func (conn *Conn) getOrCreatePeerState(addr netip.Addr) *peerState {
+	if ps, ok := conn.peers.Load(addr); ok {
+		return ps
+	}
+	ps := newPeerState()
+	actual, _ := conn.peers.LoadOrStore(addr, ps)
+	return actual
+}
+
+func (conn *Conn) Close() error {
+	return conn.inner.Close()
+}
+
+func (conn *Conn) String() string {
+	return conn.inner.LocalAddr().String()
+}
+
+func (conn *Conn) LocalAddr() p2p.EndPoint {
+	eps := conn.inner.LocalAddr().String()
+	addr, err := netip.ParseAddrPort(eps)
+	if err == nil {
+		eps = addr.Addr().String()
+	}
+	ep, _ := NewEndpoint(eps)
+	return ep
+}
+
+func (conn *Conn) ReadFromPeer(b []byte) (n int, ep p2p.EndPoint, err error) {
+	buf := pbuf.NewBytes(8192)
+	defer buf.ManualDestroy()
+	var ipaddr netip.Addr
+	buf.V(func(data []byte) {
+		ok := false
+		var msg *icmp.Message
+		for !ok {
+			var (
+				cnt  int
+				addr net.Addr
+			)
+			cnt, addr, err = conn.inner.ReadFrom(data)
+			if err != nil {
+				if config.ShowDebugLog {
+					logrus.Debugln("[icmp] recv ReadFrom err:", err)
+				}
+				return
+			}
+			ipaddr, err = netip.ParseAddr(addr.String())
+			if err != nil {
+				if config.ShowDebugLog {
+					logrus.Debugln("[icmp] recv ParseAddr err:", err, ", addr:", addr)
+				}
+				return
+			}
+			ep, err = NewEndpoint(ipaddr.String())
+			if err != nil {
+				if config.ShowDebugLog {
+					logrus.Debugln("[icmp] recv NewEndpoint err:", err, ", addr:", addr)
+				}
+				return
+			}
+			proton := ipv4.ICMPTypeEcho.Protocol()
+			if ipaddr.Is6() {
+				proton = ipv6.ICMPTypeEchoRequest.Protocol()
+			}
+
+			msg, err = icmp.ParseMessage(proton, data[:cnt])
+			if err != nil {
+				if config.ShowDebugLog {
+					logrus.Debugln("[icmp] recv ParseMessage err:", err, ", addr:", addr)
+				}
+				return
+			}
+
+			ok = msg.Type == ipv4.ICMPTypeEcho || msg.Type == ipv4.ICMPTypeEchoReply
+			if ipaddr.Is6() {
+				ok = msg.Type == ipv6.ICMPTypeEchoRequest || msg.Type == ipv6.ICMPTypeEchoReply
+			}
+			ok = ok && msg.Code == 1
+			if config.ShowDebugLog {
+				logrus.Debugln("[icmp] recv from", ipaddr, ", is valid:", ok)
+			}
+		}
+		body, okk := msg.Body.(*icmp.Echo)
+		if !okk {
+			err = ErrInvalidBodyType
+			return
+		}
+		if msg.Type == ipv4.ICMPTypeEcho || msg.Type == ipv6.ICMPTypeEchoRequest {
+			ps := conn.getOrCreatePeerState(ipaddr)
+			ps.id = body.ID
+			ps.seq.Store(uintptr(body.Seq))
+			ps.seqfifo.Put(uintptr(body.Seq))
+		}
+		n = copy(b, body.Data)
+		if config.ShowDebugLog {
+			logrus.Debugln("[icmp] recv", n, "bytes data from", ipaddr)
+		}
+	})
+	return
+}
+
+func (conn *Conn) WriteToPeer(b []byte, ep p2p.EndPoint) (int, error) {
+	icmpep, ok := ep.(*EndPoint)
+	if !ok {
+		return 0, p2p.ErrEndpointTypeMistatch
+	}
+	addr := (*netip.Addr)(icmpep)
+	ps := conn.getOrCreatePeerState(*addr)
+	seq := int(ps.seqfifo.Get())
+	id := ps.id
+	isrequest := id == 0
+	if isrequest {
+		id = echoid
+	}
+	var (
+		ip  net.IP
+		msg icmp.Message
+	)
+	if addr.Is4() {
+		x := addr.As4()
+		ip = x[:]
+		msg = icmp.Message{
+			Code: 1,
+			Body: &icmp.Echo{
+				ID:   id,
+				Seq:  seq,
+				Data: b,
+			},
+		}
+		if isrequest {
+			msg.Type = ipv4.ICMPTypeEcho
+		} else {
+			msg.Type = ipv4.ICMPTypeEchoReply
+		}
+	} else {
+		x := addr.As16()
+		ip = x[:]
+		msg = icmp.Message{
+			Code: 1,
+			Body: &icmp.Echo{
+				ID:   id,
+				Seq:  seq,
+				Data: b,
+			},
+		}
+		if isrequest {
+			msg.Type = ipv6.ICMPTypeEchoRequest
+		} else {
+			msg.Type = ipv6.ICMPTypeEchoReply
+		}
+	}
+	buf := pbuf.NewBytes(8192)
+	defer buf.ManualDestroy()
+	var (
+		data []byte
+		err  error
+		n    int
+	)
+	buf.V(func(bin []byte) {
+		data, err = msg.Marshal(bin[:0])
+		if err != nil {
+			return
+		}
+		_, err = conn.inner.WriteTo(data, &net.IPAddr{
+			IP:   ip,
+			Zone: addr.Zone(),
+		})
+		if err == nil {
+			n = len(b)
+		}
+	})
+	return n, err
+}

gold/p2p/icmp/init.go

@@ -0,0 +1,26 @@
+// Package icmp for non-privileged datagram-oriented ICMP endpoints,
+// currently only Darwin and Linux support this.
+package icmp
+
+import (
+	"net/netip"
+
+	"github.com/fumiama/WireGold/gold/p2p"
+	"github.com/fumiama/WireGold/internal/file"
+)
+
+func NewEndpoint(endpoint string, _ ...any) (p2p.EndPoint, error) {
+	addr, err := netip.ParseAddr(endpoint)
+	if err != nil {
+		return nil, err
+	}
+	return (*EndPoint)(&addr), nil
+}
+
+func init() {
+	name := file.FolderName()
+	_, hasexist := p2p.Register(name, NewEndpoint)
+	if hasexist {
+		panic("network " + name + " has been registered")
+	}
+}

gold/p2p/ip/init.go

@@ -5,7 +5,7 @@ import (
 	"net/netip"
 
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/file"
 )
 
 func NewEndpoint(endpoint string, configs ...any) (p2p.EndPoint, error) {
@@ -27,7 +27,7 @@ func NewEndpoint(endpoint string, configs ...any) (p2p.EndPoint, error) {
 }
 
 func init() {
-	name := helper.FolderName()
+	name := file.FolderName()
 	_, hasexist := p2p.Register(name, NewEndpoint)
 	if hasexist {
 		panic("network " + name + " has been registered")

gold/p2p/ip/ip.go

@@ -20,7 +20,7 @@ func (ep *EndPoint) Network() string {
 	return ep.addr.Network()
 }
 
-func (ep *EndPoint) Euqal(ep2 p2p.EndPoint) bool {
+func (ep *EndPoint) Equal(ep2 p2p.EndPoint) bool {
 	if ep == nil || ep2 == nil {
 		return ep == nil && ep2 == nil
 	}
@@ -64,6 +64,9 @@ func (conn *Conn) LocalAddr() p2p.EndPoint {
 
 func (conn *Conn) ReadFromPeer(b []byte) (int, p2p.EndPoint, error) {
 	n, addr, err := conn.conn.ReadFromIP(b)
+	if err != nil {
+		return 0, nil, err
+	}
 	return n, &EndPoint{
 		addr: addr,
 		ptcl: conn.ep.ptcl,

gold/p2p/tcp/init.go

@@ -6,7 +6,7 @@ import (
 	"time"
 
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/file"
 )
 
 type Config struct {
@@ -41,7 +41,7 @@ func newEndpoint(endpoint string, configs ...any) (*EndPoint, error) {
 }
 
 func init() {
-	name := helper.FolderName()
+	name := file.FolderName()
 	_, hasexist := p2p.Register(name, NewEndpoint)
 	if hasexist {
 		panic("network " + name + " has been registered")

gold/p2p/tcp/pdu.go

@@ -8,7 +8,7 @@ import (
 	"time"
 
 	"github.com/fumiama/WireGold/config"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/bin"
 	"github.com/sirupsen/logrus"
 )
 
@@ -38,12 +38,11 @@ type packet struct {
 	io.WriterTo
 }
 
-func (p *packet) pack() (net.Buffers, func()) {
-	d, cl := helper.OpenWriterF(func(w *helper.Writer) {
+func (p *packet) pack() *net.Buffers {
+	return &net.Buffers{magicbuf, bin.NewWriterF(func(w *bin.Writer) {
 		w.WriteByte(byte(p.typ))
 		w.WriteUInt16(p.len)
-	})
-	return net.Buffers{magicbuf, d, p.dat}, cl
+	}), p.dat}
 }
 
 func (p *packet) Read(_ []byte) (int, error) {
@@ -75,20 +74,19 @@ func (p *packet) ReadFrom(r io.Reader) (n int64, err error) {
 	}
 	p.typ = packetType(buf[0])
 	p.len = binary.LittleEndian.Uint16(buf[1:3])
-	w := helper.SelectWriter()
+	w := bin.SelectWriter()
 	copied, err := io.CopyN(w, r, int64(p.len))
 	n += copied
 	if err != nil {
 		return
 	}
-	p.dat = w.Bytes()
+	p.dat = w.ToBytes().Copy().Trans()
+	w.Destroy()
 	return
 }
 
 func (p *packet) WriteTo(w io.Writer) (n int64, err error) {
-	buf, cl := p.pack()
-	defer cl()
-	return io.Copy(w, &buf)
+	return io.Copy(w, p.pack())
 }
 
 func isvalid(tcpconn *net.TCPConn, timeout time.Duration) (issub, ok bool) {

gold/p2p/tcp/tcp.go

@@ -14,7 +14,6 @@ import (
 
 	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
 )
 
 type EndPoint struct {
@@ -33,7 +32,7 @@ func (ep *EndPoint) Network() string {
 	return ep.addr.Network()
 }
 
-func (ep *EndPoint) Euqal(ep2 p2p.EndPoint) bool {
+func (ep *EndPoint) Equal(ep2 p2p.EndPoint) bool {
 	if ep == nil || ep2 == nil {
 		return ep == nil && ep2 == nil
 	}
@@ -377,7 +376,6 @@ func (conn *Conn) ReadFromPeer(b []byte) (int, p2p.EndPoint, error) {
 		if p.pckt.typ == packetTypeNormal {
 			break
 		}
-		defer helper.PutBytes(p.pckt.dat)
 	}
 	n := copy(b, p.pckt.dat)
 	return n, p.addr, nil

gold/p2p/udp/init.go

@@ -5,7 +5,7 @@ import (
 	"net/netip"
 
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/file"
 )
 
 func NewEndpoint(endpoint string, _ ...any) (p2p.EndPoint, error) {
@@ -17,7 +17,7 @@ func NewEndpoint(endpoint string, _ ...any) (p2p.EndPoint, error) {
 }
 
 func init() {
-	name := helper.FolderName()
+	name := file.FolderName()
 	_, hasexist := p2p.Register(name, NewEndpoint)
 	if hasexist {
 		panic("network " + name + " has been registered")

gold/p2p/udp/udp.go

@@ -16,7 +16,7 @@ func (ep *EndPoint) Network() string {
 	return (*net.UDPAddr)(ep).Network()
 }
 
-func (ep *EndPoint) Euqal(ep2 p2p.EndPoint) bool {
+func (ep *EndPoint) Equal(ep2 p2p.EndPoint) bool {
 	if ep == nil || ep2 == nil {
 		return ep == nil && ep2 == nil
 	}
@@ -50,6 +50,9 @@ func (conn *Conn) LocalAddr() p2p.EndPoint {
 
 func (conn *Conn) ReadFromPeer(b []byte) (int, p2p.EndPoint, error) {
 	n, addr, err := (*net.UDPConn)(conn).ReadFromUDP(b)
+	if err != nil {
+		return 0, nil, err
+	}
 	return n, (*EndPoint)(addr), err
 }
 

gold/p2p/udplite/init.go

@@ -7,7 +7,7 @@ import (
 	"net/netip"
 
 	"github.com/fumiama/WireGold/gold/p2p"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/file"
 )
 
 func NewEndpoint(endpoint string, _ ...any) (p2p.EndPoint, error) {
@@ -19,7 +19,7 @@ func NewEndpoint(endpoint string, _ ...any) (p2p.EndPoint, error) {
 }
 
 func init() {
-	name := helper.FolderName()
+	name := file.FolderName()
 	_, hasexist := p2p.Register(name, NewEndpoint)
 	if hasexist {
 		panic("network " + name + " has been registered")

gold/p2p/udplite/lite.go

@@ -75,11 +75,11 @@ func listenUDPLite(network string, laddr *net.UDPAddr) (*net.UDPConn, error) {
 	}
 	var errsys error
 	err = rc.Control(func(fd uintptr) {
-		errsys = syscall.SetsockoptInt(int(fd), SOL_UDPLITE, UDPLITE_SEND_CSCOV, head.PacketHeadLen+8) // for xor rand
+		errsys = syscall.SetsockoptInt(int(fd), SOL_UDPLITE, UDPLITE_SEND_CSCOV, int(head.PacketHeadLen)) // for xor rand
 		if errsys != nil {
 			return
 		}
-		errsys = syscall.SetsockoptInt(int(fd), SOL_UDPLITE, UDPLITE_RECV_CSCOV, head.PacketHeadLen+8) // for xor rand
+		errsys = syscall.SetsockoptInt(int(fd), SOL_UDPLITE, UDPLITE_RECV_CSCOV, int(head.PacketHeadLen)) // for xor rand
 	})
 	if err != nil {
 		_ = conn.Close()

gold/p2p/udplite/udp.go

@@ -18,7 +18,7 @@ func (ep *EndPoint) Network() string {
 	return "udplite"
 }
 
-func (ep *EndPoint) Euqal(ep2 p2p.EndPoint) bool {
+func (ep *EndPoint) Equal(ep2 p2p.EndPoint) bool {
 	if ep == nil || ep2 == nil {
 		return ep == nil && ep2 == nil
 	}
@@ -52,6 +52,9 @@ func (conn *Conn) LocalAddr() p2p.EndPoint {
 
 func (conn *Conn) ReadFromPeer(b []byte) (int, p2p.EndPoint, error) {
 	n, addr, err := (*net.UDPConn)(conn).ReadFromUDP(b)
+	if err != nil {
+		return 0, nil, err
+	}
 	return n, (*EndPoint)(addr), err
 }
 

gold/proto/data/data.go

@@ -0,0 +1,12 @@
+package data
+
+import (
+	"github.com/fumiama/WireGold/gold/head"
+	"github.com/fumiama/WireGold/gold/link"
+)
+
+func init() {
+	link.RegisterDispacher(head.ProtoData, func(header *head.Packet, peer *link.Link, data []byte) {
+		peer.ToLower(header, data)
+	})
+}

gold/proto/hello/hello.go

@@ -0,0 +1,23 @@
+package hello
+
+import (
+	"github.com/sirupsen/logrus"
+
+	"github.com/fumiama/WireGold/gold/head"
+	"github.com/fumiama/WireGold/gold/link"
+	"github.com/fumiama/WireGold/internal/file"
+)
+
+func init() {
+	link.RegisterDispacher(head.ProtoHello, func(_ *head.Packet, peer *link.Link, data []byte) {
+		switch {
+		case len(data) == 0:
+			logrus.Warnln(file.Header(), "recv old packet, do nothing")
+		case data[0] == byte(head.HelloPing):
+			go peer.WritePacket(head.ProtoHello, []byte{byte(head.HelloPong)}, peer.Me().TTL())
+			logrus.Infoln(file.Header(), "recv, send ack")
+		default:
+			logrus.Infoln(file.Header(), "recv ack, do nothing")
+		}
+	})
+}

gold/proto/nat/nat.go

@@ -0,0 +1,109 @@
+package nat
+
+import (
+	"encoding/json"
+
+	"github.com/fumiama/orbyte/pbuf"
+	"github.com/sirupsen/logrus"
+
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/WireGold/gold/head"
+	"github.com/fumiama/WireGold/gold/link"
+	"github.com/fumiama/WireGold/gold/p2p"
+
+	"github.com/fumiama/WireGold/internal/bin"
+	"github.com/fumiama/WireGold/internal/file"
+)
+
+func init() {
+	// 收到通告包的处理
+	link.RegisterDispacher(head.ProtoNotify, func(_ *head.Packet, peer *link.Link, data []byte) {
+		// 1. Data 解包
+		// ---- 使用 head.Notify 解释 packet
+		notify := make(head.Notify, 32)
+		err := json.Unmarshal(data, &notify)
+		if err != nil {
+			logrus.Errorln(file.Header(), "notify json unmarshal err:", err)
+			return
+		}
+		// 2. endpoint注册
+		// ---- 遍历 Notify，注册对方的 endpoint 到
+		// ---- connections，注意使用读写锁connmapmu
+		for ps, ep := range notify {
+			nw, epstr := ep[0], ep[1]
+			if nw != peer.Me().EndPoint().Network() {
+				logrus.Warnln(file.Header(), "ignore different network notify", nw, "addr", epstr)
+				continue
+			}
+			addr, err := p2p.NewEndPoint(nw, epstr, peer.Me().NetworkConfigs()...)
+			if err == nil {
+				p, ok := peer.Me().IsInPeer(ps)
+				if ok {
+					if bin.IsNilInterface(p.EndPoint()) || !p.EndPoint().Equal(addr) {
+						p.SetEndPoint(addr)
+						logrus.Infoln(file.Header(), "notify set ep of peer", ps, "to", ep)
+					}
+					continue
+				}
+			}
+			if config.ShowDebugLog {
+				logrus.Debugln(file.Header(), "notify drop invalid peer:", ps, "ep:", ep)
+			}
+		}
+	})
+	// 收到询问包的处理
+	link.RegisterDispacher(head.ProtoQuery, func(_ *head.Packet, peer *link.Link, data []byte) {
+		// 完成data解包与notify分发
+
+		// 1. Data 解包
+		// ---- 使用 head.Query 解释 packet
+		// ---- 根据 Query 确定需要封装的 Notify
+		var peers head.Query
+		err := json.Unmarshal(data, &peers)
+		if err != nil {
+			logrus.Errorln(file.Header(), "query json unmarshal err:", err)
+			return
+		}
+
+		if peer == nil || peer.Me() == nil {
+			logrus.Errorln(file.Header(), "nil link/me")
+			return
+		}
+
+		// 2. notify分发
+		// ---- 封装 Notify 到 新的 packet
+		// ---- 发送到对方
+		notify := make(head.Notify, len(peers))
+		for _, p := range peers {
+			lnk, ok := peer.Me().IsInPeer(p)
+			eps := ""
+			if peer.Me().EndPoint().Network() == "udp" { // udp has real p2p
+				if bin.IsNilInterface(lnk.EndPoint()) {
+					continue
+				}
+				eps = lnk.EndPoint().String()
+			}
+			if eps == "" {
+				eps = peer.RawEndPoint() // use registered ep only
+			}
+			if eps == "" {
+				continue
+			}
+			if ok && bin.IsNonNilInterface(lnk.EndPoint()) {
+				notify[p] = [2]string{
+					lnk.EndPoint().Network(),
+					eps,
+				}
+			}
+		}
+		if len(notify) > 0 {
+			logrus.Infoln(file.Header(), "query wrap", len(notify), "notify")
+			w := bin.SelectWriter()
+			_ = json.NewEncoder(w).Encode(&notify)
+			w.P(func(b *pbuf.Buffer) {
+				peer.WritePacket(head.ProtoNotify, b.Bytes(), peer.Me().TTL())
+			})
+			w.Destroy()
+		}
+	})
+}

helper/pool.go

@@ -1,45 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"sync"
-)
-
-// https://github.com/Mrs4s/MiraiGo/blob/master/binary/pool.go
-
-var bufferPool = sync.Pool{
-	New: func() interface{} {
-		return new(Writer)
-	},
-}
-
-func MakeBytes(sz int) []byte {
-	w := SelectWriter()
-	b := w.Bytes()
-	if cap(b) >= sz {
-		return b[:sz]
-	}
-	return make([]byte, sz)
-}
-
-func PutBytes(b []byte) {
-	PutWriter((*Writer)(bytes.NewBuffer(b)))
-}
-
-// SelectWriter 从池中取出一个 Writer
-func SelectWriter() *Writer {
-	// 因为 bufferPool 定义有 New 函数
-	// 所以 bufferPool.Get() 永不为 nil
-	// 不用判空
-	return bufferPool.Get().(*Writer)
-}
-
-// PutWriter 将 Writer 放回池中
-func PutWriter(w *Writer) {
-	// See https://golang.org/issue/23199
-	const maxSize = 1 << 16
-	if (*bytes.Buffer)(w).Cap() < maxSize { // 对于大Buffer直接丢弃
-		w.Reset()
-		bufferPool.Put(w)
-	}
-}

helper/writer.go

@@ -1,177 +0,0 @@
-package helper
-
-// https://github.com/Mrs4s/MiraiGo/blob/master/binary/writer.go
-
-import (
-	"bytes"
-	"encoding/binary"
-	"encoding/hex"
-	"io"
-	"unsafe"
-)
-
-// Writer 写入
-type Writer bytes.Buffer
-
-func NewWriterF(f func(writer *Writer)) []byte {
-	w := SelectWriter()
-	f(w)
-	b := append([]byte(nil), w.Bytes()...)
-	w.put()
-	return b
-}
-
-// OpenWriterF must call func cl to close
-func OpenWriterF(f func(*Writer)) (b []byte, cl func()) {
-	w := SelectWriter()
-	f(w)
-	return w.Bytes(), w.put
-}
-
-func (w *Writer) FillUInt16() (pos int) {
-	pos = w.Len()
-	(*bytes.Buffer)(w).Write([]byte{0, 0})
-	return
-}
-
-func (w *Writer) WriteUInt16At(pos int, v uint16) {
-	newdata := (*bytes.Buffer)(w).Bytes()[pos:]
-	binary.LittleEndian.PutUint16(newdata, v)
-}
-
-func (w *Writer) FillUInt32() (pos int) {
-	pos = w.Len()
-	(*bytes.Buffer)(w).Write([]byte{0, 0, 0, 0})
-	return
-}
-
-func (w *Writer) WriteUInt32At(pos int, v uint32) {
-	newdata := (*bytes.Buffer)(w).Bytes()[pos:]
-	binary.LittleEndian.PutUint32(newdata, v)
-}
-
-func (w *Writer) Write(b []byte) (n int, err error) {
-	return (*bytes.Buffer)(w).Write(b)
-}
-
-func (w *Writer) WriteHex(h string) {
-	b, _ := hex.DecodeString(h)
-	w.Write(b)
-}
-
-func (w *Writer) WriteByte(b byte) error {
-	return (*bytes.Buffer)(w).WriteByte(b)
-}
-
-func (w *Writer) WriteUInt16(v uint16) {
-	b := make([]byte, 2)
-	binary.LittleEndian.PutUint16(b, v)
-	w.Write(b)
-}
-
-func (w *Writer) WriteUInt32(v uint32) {
-	b := make([]byte, 4)
-	binary.LittleEndian.PutUint32(b, v)
-	w.Write(b)
-}
-
-func (w *Writer) WriteUInt64(v uint64) {
-	b := make([]byte, 8)
-	binary.LittleEndian.PutUint64(b, v)
-	w.Write(b)
-}
-
-func (w *Writer) WriteString(v string) {
-	//w.WriteUInt32(uint32(len(v) + 4))
-	(*bytes.Buffer)(w).WriteString(v)
-}
-
-func (w *Writer) WriteStringShort(v string) {
-	w.WriteUInt16(uint16(len(v)))
-	(*bytes.Buffer)(w).WriteString(v)
-}
-
-func (w *Writer) WriteBool(b bool) {
-	if b {
-		w.WriteByte(0x01)
-	} else {
-		w.WriteByte(0x00)
-	}
-}
-
-func (w *Writer) WriteBytesShort(data []byte) {
-	w.WriteUInt16(uint16(len(data)))
-	w.Write(data)
-}
-
-func (w *Writer) Len() int {
-	return (*bytes.Buffer)(w).Len()
-}
-
-func (w *Writer) Bytes() []byte {
-	return (*bytes.Buffer)(w).Bytes()
-}
-
-func (w *Writer) Reset() {
-	(*bytes.Buffer)(w).Reset()
-}
-
-func (w *Writer) Grow(n int) {
-	(*bytes.Buffer)(w).Grow(n)
-}
-
-func (w *Writer) Skip(n int) (int, error) {
-	b := (*buffer)(unsafe.Pointer(w))
-	b.lastRead = opInvalid
-	if len(b.buf) <= b.off {
-		// Buffer is empty, reset to recover space.
-		w.Reset()
-		if n == 0 {
-			return 0, nil
-		}
-		return 0, io.EOF
-	}
-	n = minnum(n, len(b.buf[b.off:]))
-	b.off += n
-	if n > 0 {
-		b.lastRead = opRead
-	}
-	return n, nil
-}
-
-func (w *Writer) put() {
-	PutWriter(w)
-}
-
-// A Buffer is a variable-sized buffer of bytes with Read and Write methods.
-// The zero value for Buffer is an empty buffer ready to use.
-type buffer struct {
-	buf      []byte // contents are the bytes buf[off : len(buf)]
-	off      int    // read at &buf[off], write at &buf[len(buf)]
-	lastRead readOp // last read operation, so that Unread* can work correctly.
-}
-
-// The readOp constants describe the last action performed on
-// the buffer, so that UnreadRune and UnreadByte can check for
-// invalid usage. opReadRuneX constants are chosen such that
-// converted to int they correspond to the rune size that was read.
-type readOp int8
-
-// Don't use iota for these, as the values need to correspond with the
-// names and comments, which is easier to see when being explicit.
-const (
-	opRead      readOp = -1 // Any other read operation.
-	opInvalid   readOp = 0  // Non-read operation.
-	opReadRune1 readOp = 1  // Read rune of size 1.
-	opReadRune2 readOp = 2  // Read rune of size 2.
-	opReadRune3 readOp = 3  // Read rune of size 3.
-	opReadRune4 readOp = 4  // Read rune of size 4.
-)
-
-// minnum 返回两数最小值，该函数将被内联
-func minnum[T int | int8 | uint8 | int16 | uint16 | int32 | uint32 | int64 | uint64](a, b T) T {
-	if a > b {
-		return b
-	}
-	return a
-}

internal/algo/crypto.go

@@ -0,0 +1,106 @@
+package algo
+
+import (
+	"crypto/cipher"
+	"crypto/rand"
+	"encoding/binary"
+	"errors"
+)
+
+var (
+	ErrCipherTextTooShort = errors.New("ciphertext too short")
+)
+
+func EncodeAEAD(aead cipher.AEAD, additional uint16, b []byte) []byte {
+	nsz := aead.NonceSize()
+	// Accocate capacity for all the stuffs.
+	buf := make([]byte, 2+nsz+len(b)+aead.Overhead())
+	n := 0
+	binary.LittleEndian.PutUint16(buf[:2], additional)
+	nonce := buf[2 : 2+nsz]
+	// Select a random nonce
+	_, err := rand.Read(nonce)
+	if err != nil {
+		panic(err)
+	}
+	// Encrypt the message and append the ciphertext to the nonce.
+	eb := aead.Seal(nonce[nsz:nsz], nonce, b, buf[:2])
+	n = len(eb)
+	return buf[2 : 2+nsz+n]
+}
+
+func DecodeAEAD(aead cipher.AEAD, additional uint16, b []byte) (data []byte, err error) {
+	nsz := aead.NonceSize()
+	if len(b) < nsz {
+		return nil, ErrCipherTextTooShort
+	}
+	// Split nonce and ciphertext.
+	nonce, ciphertext := b[:nsz], b[nsz:]
+	if len(ciphertext) == 0 {
+		return nil, nil
+	}
+	// Decrypt the message and check it wasn't tampered with.
+	var buf [2]byte
+	binary.LittleEndian.PutUint16(buf[:], additional)
+	data = make([]byte, len(ciphertext))
+	n := 0
+	d, err := aead.Open(data[:0], nonce, ciphertext, buf[:])
+	n = len(d)
+	if err != nil {
+		return
+	}
+	return data[:n], nil
+}
+
+func EncodeXORLen(datalen int) int {
+	batchsz := datalen / 8
+	return 8 + batchsz*8 + 8 // seqrand dat tail
+}
+
+// EncodeXOR 按 8 字节, 以初始 mask 循环异或编码 data
+func EncodeXOR(data []byte, mask uint64, seq uint32) []byte {
+	batchsz := len(data) / 8
+	remain := len(data) % 8
+	sum := mask
+	buf := make([]byte, EncodeXORLen(len(data)))
+	binary.LittleEndian.PutUint32(buf[:4], seq)
+	_, _ = rand.Read(buf[4:8])                 // seqrand
+	sum ^= binary.LittleEndian.Uint64(buf[:8]) // init from seqrand
+	binary.LittleEndian.PutUint64(buf[:8], sum)
+	for i := 0; i < batchsz; i++ { // range on batch data
+		a := i * 8
+		b := (i + 1) * 8
+		sum ^= binary.LittleEndian.Uint64(data[a:b])
+		binary.LittleEndian.PutUint64(buf[a+8:b+8], sum)
+	}
+	p := batchsz * 8
+	copy(buf[8+p:], data[p:])
+	buf[len(buf)-1] = byte(remain)
+	sum ^= binary.LittleEndian.Uint64(buf[8+p:])
+	binary.LittleEndian.PutUint64(buf[8+p:], sum)
+	return buf
+}
+
+// DecodeXOR 按 8 字节, 以初始 mask 循环异或解码 data,
+// 解码结果完全覆盖 data.
+func DecodeXOR(data []byte, mask uint64) (uint32, []byte) {
+	if len(data) < 16 || len(data)%8 != 0 {
+		return 0, nil
+	}
+	batchsz := len(data) / 8
+	sum := mask
+	for i := 0; i < batchsz; i++ {
+		a := i * 8
+		b := (i + 1) * 8
+		x := binary.LittleEndian.Uint64(data[a:b])
+		sum ^= x
+		binary.LittleEndian.PutUint64(data[a:b], sum)
+		sum = x
+	}
+	remain := data[len(data)-1]
+	if remain >= 8 {
+		return 0, nil
+	}
+	return binary.LittleEndian.Uint32(data[:4]),
+		data[8 : len(data)-8+int(remain)]
+}

internal/algo/crypto_test.go

@@ -1,4 +1,4 @@
-package link
+package algo
 
 import (
 	"bytes"
@@ -12,9 +12,7 @@ import (
 )
 
 func TestXOR(t *testing.T) {
-	m := Me{
-		mask: 0x12345678_90abcdef,
-	}
+	mask := uint64(0x12345678_90abcdef)
 	buf := make([]byte, 4096)
 	buf2 := make([]byte, 4096)
 	for i := 0; i < 4096; i++ {
@@ -27,7 +25,7 @@ func TestXOR(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		seq, dec := m.xordec(m.xorenc(r1.Bytes(), uint32(i)))
+		seq, dec := DecodeXOR(EncodeXOR(r1.Bytes(), mask, uint32(i)), mask)
 		if !bytes.Equal(dec, r2.Bytes()) {
 			t.Fatal("unexpected xor at", i, "except", hex.EncodeToString(r2.Bytes()), "got", hex.EncodeToString(dec))
 		}
@@ -53,7 +51,7 @@ func TestXChacha20(t *testing.T) {
 		t.Fatal(err)
 	}
 	for i := 0; i < 4096; i++ {
-		db, err := decode(aead, uint16(i), encode(aead, uint16(i), data[:i]))
+		db, err := DecodeAEAD(aead, uint16(i), EncodeAEAD(aead, uint16(i), data[:i]))
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -77,14 +75,14 @@ func TestExpandKeyUnit(t *testing.T) {
 func TestMixKeys(t *testing.T) {
 	k1, _ := hex.DecodeString("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff")
 	k2, _ := hex.DecodeString("0000000000000000000000000000000000000000000000000000000000000000")
-	k := mixkeys(k1, k2)
+	k := MixKeys(k1, k2)
 	kexp, _ := hex.DecodeString("55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555")
 	if !bytes.Equal(k, kexp) {
 		t.Fatal(hex.EncodeToString(k))
 	}
 	k1, _ = hex.DecodeString("1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef")
 	k2, _ = hex.DecodeString("deadbeef1239876540deadbeef1239876540deadbeef1239876540abcdef4567")
-	k = mixkeys(k1, k2)
+	k = MixKeys(k1, k2)
 	kexp, _ = hex.DecodeString("2ca9188d3ebb4a9f22e34d4479d857fca48390253ebbe23f22cbcf6e59507ddc06a9b08794316abfa26b67cedb7a5d542c8912adb493c0352aebe76e73dadf7e")
 	if !bytes.Equal(k, kexp) {
 		t.Fatal(hex.EncodeToString(k))

internal/algo/hash.go

@@ -0,0 +1,48 @@
+package algo
+
+import (
+	"bytes"
+	"crypto/md5"
+	"encoding/binary"
+	"encoding/hex"
+	"fmt"
+
+	"github.com/fumiama/WireGold/config"
+	"github.com/fumiama/blake2b-simd"
+	"github.com/sirupsen/logrus"
+)
+
+// Blake2bHash8 生成 data 的 blake2b hash, 返回前八位
+func Blake2bHash8(precrc64 uint64, data []byte) uint64 {
+	var tgt [32]byte
+	h := blake2b.New256()
+	binary.LittleEndian.PutUint64(tgt[:8], precrc64)
+	_, _ = h.Write(tgt[:8])
+	_, _ = h.Write(data)
+	b := h.Sum(tgt[:0])[:8]
+	if config.ShowDebugLog {
+		logrus.Debugln("[algo] precrc64:", fmt.Sprintf("%04x", precrc64), "blk2b hash:", hex.EncodeToString(b))
+	}
+	return binary.LittleEndian.Uint64(b)
+}
+
+// IsVaildBlake2bHash8 在收齐全部分片并解密后验证 packet 合法性
+func IsVaildBlake2bHash8(precrc64 uint64, hash8data []byte) bool {
+	var tgt [32]byte
+	h := blake2b.New256()
+	binary.LittleEndian.PutUint64(tgt[:8], precrc64)
+	_, _ = h.Write(tgt[:8])
+	_, _ = h.Write(hash8data[8:])
+	b := h.Sum(tgt[:0])[:8]
+	if config.ShowDebugLog {
+		logrus.Debugln("[algo] blk2b sum calulated:", hex.EncodeToString(b))
+		logrus.Debugln("[algo] blk2b sum in packet:", hex.EncodeToString(hash8data[:8]))
+	}
+	return bytes.Equal(b, hash8data[:8])
+}
+
+// MD5Hash8 calculate packet header checksum
+func MD5Hash8(data []byte) uint64 {
+	m := md5.Sum(data)
+	return binary.LittleEndian.Uint64(m[:8])
+}

internal/algo/key.go

@@ -0,0 +1,40 @@
+package algo
+
+import (
+	"encoding/binary"
+	"math/bits"
+	"math/rand"
+)
+
+func RandKeyIndex() uint8 {
+	return uint8(rand.Intn(32))
+}
+
+func MixKeys(k1, k2 []byte) []byte {
+	if len(k1) != 32 || len(k2) != 32 {
+		panic("unexpected key len")
+	}
+	k := make([]byte, 64)
+	for i := range k1 {
+		k1i, k2i := i, 31-i
+		k1v, k2v := k1[k1i], k2[k2i]
+		binary.LittleEndian.PutUint16(
+			k[i*2:(i+1)*2],
+			expandkeyunit(k1v, k2v),
+		)
+	}
+	return k
+}
+
+func expandkeyunit(v1, v2 byte) (v uint16) {
+	v1s, v2s := uint16(v1), uint16(bits.Reverse8(v2))
+	for i := 0; i < 8; i++ {
+		v |= v1s & (1 << (i * 2))
+		v1s <<= 1
+	}
+	for i := 0; i < 8; i++ {
+		v2s <<= 1
+		v |= v2s & (2 << (i * 2))
+	}
+	return
+}

internal/algo/zstd.go

@@ -0,0 +1,41 @@
+package algo
+
+import (
+	"bytes"
+	"io"
+
+	"github.com/fumiama/WireGold/internal/bin"
+	"github.com/fumiama/orbyte/pbuf"
+	"github.com/klauspost/compress/zstd"
+)
+
+func EncodeZstd(data []byte) []byte {
+	return bin.SelectWriter().P(func(w *pbuf.Buffer) {
+		enc, err := zstd.NewWriter(w, zstd.WithEncoderLevel(zstd.SpeedFastest))
+		if err != nil {
+			panic(err)
+		}
+		_, err = io.Copy(enc, bytes.NewReader(data))
+		if err != nil {
+			panic(err)
+		}
+		err = enc.Close()
+		if err != nil {
+			panic(err)
+		}
+	}).ToBytes().Copy().Ignore().Trans()
+}
+
+func DecodeZstd(data []byte) (b []byte, err error) {
+	dec, err := zstd.NewReader(bytes.NewReader(data))
+	if err != nil {
+		return
+	}
+
+	b = bin.SelectWriter().P(func(w *pbuf.Buffer) {
+		_, err = io.Copy(w, dec)
+		dec.Close()
+	}).ToBytes().Copy().Ignore().Trans()
+
+	return
+}

internal/bin/data.go

@@ -1,10 +1,14 @@
-package helper
+package bin
 
 import (
+	"encoding/binary"
 	"reflect"
 	"unsafe"
 )
 
+// IsLittleEndian judge by binary packet.
+var IsLittleEndian = reflect.ValueOf(&binary.NativeEndian).Elem().Field(0).Type().String() == "binary.littleEndian"
+
 // slice is the runtime representation of a slice.
 // It cannot be used safely or portably and its representation may
 // change in a later release.

internal/bin/pool.go

@@ -0,0 +1,12 @@
+package bin
+
+import (
+	"github.com/fumiama/orbyte/pbuf"
+)
+
+// SelectWriter 从池中取出一个 Writer
+//
+// 不要忘记调用 Destroy 以快速回收资源
+func SelectWriter() *Writer {
+	return (*Writer)(pbuf.NewBuffer(nil))
+}

internal/bin/writer.go

@@ -0,0 +1,72 @@
+package bin
+
+// https://github.com/Mrs4s/MiraiGo/blob/master/binary/writer.go
+
+import (
+	"encoding/binary"
+
+	"github.com/fumiama/orbyte/pbuf"
+)
+
+// Writer 写入
+type Writer pbuf.OBuffer
+
+func NewWriterF(f func(writer *Writer)) []byte {
+	w := SelectWriter()
+	f(w)
+	b := w.ToBytes().Copy()
+	w.Destroy()
+	return b.Trans()
+}
+
+func (w *Writer) P(f func(*pbuf.Buffer)) *Writer {
+	(*pbuf.OBuffer)(w).P(f)
+	return w
+}
+
+func (w *Writer) Write(b []byte) (n int, err error) {
+	w.P(func(buf *pbuf.Buffer) {
+		n, err = buf.Write(b)
+	})
+	return
+}
+
+func (w *Writer) WriteByte(b byte) (err error) {
+	w.P(func(buf *pbuf.Buffer) {
+		err = buf.WriteByte(b)
+	})
+	return
+}
+
+func (w *Writer) WriteString(s string) (n int, err error) {
+	w.P(func(buf *pbuf.Buffer) {
+		n, err = buf.WriteString(s)
+	})
+	return
+}
+
+func (w *Writer) WriteUInt16(v uint16) {
+	b := make([]byte, 2)
+	binary.LittleEndian.PutUint16(b, v)
+	w.Write(b)
+}
+
+func (w *Writer) WriteUInt32(v uint32) {
+	b := make([]byte, 4)
+	binary.LittleEndian.PutUint32(b, v)
+	w.Write(b)
+}
+
+func (w *Writer) WriteUInt64(v uint64) {
+	b := make([]byte, 8)
+	binary.LittleEndian.PutUint64(b, v)
+	w.Write(b)
+}
+
+func (w *Writer) ToBytes() pbuf.Bytes {
+	return pbuf.BufferItemToBytes((*pbuf.OBuffer)(w))
+}
+
+func (w *Writer) Destroy() {
+	(*pbuf.OBuffer)(w).ManualDestroy()
+}

internal/file/file.go

@@ -1,4 +1,4 @@
-package helper
+package file
 
 import (
 	"os"

internal/file/log.go

@@ -0,0 +1,52 @@
+package file
+
+import (
+	"encoding/hex"
+	"runtime"
+	"strings"
+)
+
+func Header() string {
+	file, fn := fileFuncName(2)
+	sb := strings.Builder{}
+	sb.WriteString("[")
+	sb.WriteString(file)
+	sb.WriteString("] ")
+	sb.WriteString(fn)
+	return sb.String()
+}
+
+func fileFuncName(skip int) (string, string) {
+	pc, file, _, ok := runtime.Caller(skip)
+	if !ok {
+		return "unknown", "unknown"
+	}
+	fn := runtime.FuncForPC(pc).Name()
+	i := strings.LastIndex(fn, "/")
+	fn = fn[i+1:]
+	i = strings.LastIndex(file, "/")
+	if i < 0 {
+		i = strings.LastIndex(file, "\\")
+		if i < 0 {
+			return file, fn
+		}
+	}
+	nm := file[i+1:]
+	if len(nm) == 0 {
+		return file, fn
+	}
+	i = strings.LastIndex(nm, ".")
+	if i <= 0 {
+		return nm, fn
+	}
+	return nm[:i], fn
+}
+
+func ToLimitHexString(data []byte, bound int) string {
+	endl := "..."
+	if len(data) < bound {
+		bound = len(data)
+		endl = "."
+	}
+	return hex.EncodeToString(data[:bound]) + endl
+}

lower/tun_windows.go

@@ -3,17 +3,24 @@
 
 package lower
 
-import "net"
+import (
+	"net"
+	"strconv"
+)
 
 func (n *NICIO) Up() {
 	execute("cmd", "/c", "netsh interface ip set address name=\""+n.ifce.Name()+"\" source=static addr=\""+n.ip.String()+"\" mask=\""+(net.IP)(n.subnet.Mask).String()+"\" gateway=none")
 	execute("cmd", "/c", "netsh interface ipv4 set subinterface \""+n.ifce.Name()+"\" mtu="+n.mtu)
+	iface, err := net.InterfaceByName(n.ifce.Name())
+	if err != nil {
+		panic(err)
+	}
 	for _, c := range n.cidrs {
 		ip, cidr, err := net.ParseCIDR(c)
 		if err != nil {
 			panic(err)
 		}
-		execute("cmd", "/c", "route ADD "+ip.String()+" MASK "+(net.IP)(cidr.Mask).String()+" "+n.ip.String())
+		execute("cmd", "/c", "route ADD "+ip.String()+" MASK "+(net.IP)(cidr.Mask).String()+" "+n.ip.String()+" IF "+strconv.Itoa(iface.Index))
 	}
 }
 

main.go

@@ -15,8 +15,8 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/fumiama/WireGold/config"
-	"github.com/fumiama/WireGold/gold/head"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/bin"
+	"github.com/fumiama/WireGold/internal/file"
 	"github.com/fumiama/WireGold/upper"
 	"github.com/fumiama/WireGold/upper/services/wg"
 )
@@ -26,7 +26,7 @@ func main() {
 	gen := flag.Bool("g", false, "generate key pair")
 	pshgen := flag.Bool("pg", false, "generate preshared key")
 	showp := flag.Bool("p", false, "show my publickey")
-	file := flag.String("c", "config.yaml", "specify conf file")
+	cfile := flag.String("c", "config.yaml", "specify conf file")
 	debug := flag.Bool("d", false, "print debug logs")
 	warn := flag.Bool("w", false, "only show logs above warn level")
 	logfile := flag.String("l", "-", "write log to file")
@@ -52,8 +52,8 @@ func main() {
 		if err != nil {
 			panic(err)
 		}
-		fmt.Println("PublicKey:", helper.BytesToString(pubk[:57]))
-		fmt.Println("PrivateKey:", helper.BytesToString(prvk[:57]))
+		fmt.Println("PublicKey:", bin.BytesToString(pubk[:57]))
+		fmt.Println("PrivateKey:", bin.BytesToString(prvk[:57]))
 		os.Exit(0)
 	}
 	if *pshgen {
@@ -66,7 +66,7 @@ func main() {
 		if err != nil {
 			panic(err)
 		}
-		fmt.Println("PresharedKey:", helper.BytesToString(pshk[:57]))
+		fmt.Println("PresharedKey:", bin.BytesToString(pshk[:57]))
 		os.Exit(0)
 	}
 	if *logfile != "-" {
@@ -77,7 +77,7 @@ func main() {
 		defer f.Close()
 		logrus.SetOutput(f)
 	}
-	if helper.IsNotExist(*file) {
+	if file.IsNotExist(*cfile) {
 		f := new(bytes.Buffer)
 		var r string
 		fmt.Print("IP: ")
@@ -125,14 +125,14 @@ func main() {
 		f.WriteString("MTU: " + strings.TrimSpace(r) + "\n")
 		r = ""
 
-		cfgf, err := os.Create(*file)
+		cfgf, err := os.Create(*cfile)
 		if err != nil {
 			panic(err)
 		}
 		cfgf.Write(f.Bytes())
 		cfgf.Close()
 	}
-	c := config.Parse(*file)
+	c := config.Parse(*cfile)
 	if c.IP == "" {
 		displayHelp("nil ip")
 	}
@@ -145,7 +145,7 @@ func main() {
 	if c.EndPoint == "" {
 		displayHelp("nil endpoint")
 	}
-	if c.MTU <= head.PacketHeadLen {
+	if c.MTU < 128 {
 		displayHelp("invalid mtu")
 	}
 	w, err := wg.NewWireGold(&c)
@@ -168,7 +168,14 @@ func main() {
 }
 
 func displayHelp(hint string) {
-	fmt.Println(hint)
+	if hint != "" {
+		fmt.Println(hint)
+		fmt.Println("")
+	}
+	fmt.Println("WireGold Version:", config.Version)
+	fmt.Println("Author: Fumiama Minamoto")
+	fmt.Println("Released with GPL-3.0 license")
+	fmt.Println("")
 	flag.Usage()
 	os.Exit(0)
 }

upper/services/tunnel/tunnel.go

@@ -8,10 +8,14 @@ import (
 
 	"github.com/sirupsen/logrus"
 
+	_ "github.com/fumiama/WireGold/gold/p2p/icmp"    // support icmp connection
 	_ "github.com/fumiama/WireGold/gold/p2p/ip"      // support ip connection
 	_ "github.com/fumiama/WireGold/gold/p2p/tcp"     // support tcp connection
 	_ "github.com/fumiama/WireGold/gold/p2p/udp"     // support udp connection
 	_ "github.com/fumiama/WireGold/gold/p2p/udplite" // support udplite connection
+	_ "github.com/fumiama/WireGold/gold/proto/data"  // support data proto
+	_ "github.com/fumiama/WireGold/gold/proto/hello" // support hello proto
+	_ "github.com/fumiama/WireGold/gold/proto/nat"   // support nat proto
 
 	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/head"
@@ -21,7 +25,7 @@ import (
 type Tunnel struct {
 	l        *link.Link
 	in       chan []byte
-	out      chan *head.Packet
+	out      chan link.LinkData
 	outcache []byte
 	peerip   net.IP
 	src      uint16
@@ -33,7 +37,7 @@ func Create(me *link.Me, peer string) (s Tunnel, err error) {
 	s.l, err = me.Connect(peer)
 	if err == nil {
 		s.in = make(chan []byte, 4)
-		s.out = make(chan *head.Packet, 4)
+		s.out = make(chan link.LinkData, 4)
 		s.peerip = net.ParseIP(peer)
 	} else {
 		logrus.Errorln("[tunnel] create err:", err)
@@ -70,15 +74,14 @@ func (s *Tunnel) Read(p []byte) (int, error) {
 		d = s.outcache
 	} else {
 		pkt := <-s.out
-		if pkt == nil {
+		if len(pkt.D) == 0 {
 			return 0, io.EOF
 		}
-		defer pkt.Put()
-		if pkt.BodyLen() < 4 {
-			logrus.Warnln("[tunnel] unexpected packet data len", pkt.BodyLen(), "content", hex.EncodeToString(pkt.Body()))
+		if pkt.H.Size() < 4 {
+			logrus.Warnln("[tunnel] unexpected packet data len", pkt.H.Size(), "content", hex.EncodeToString(pkt.D))
 			return 0, io.EOF
 		}
-		d = pkt.Body()[4:]
+		d = pkt.D[4:]
 	}
 	if d != nil {
 		if len(p) >= len(d) {
@@ -125,37 +128,25 @@ func (s *Tunnel) handleWrite() {
 			binary.LittleEndian.PutUint32(buf[:4], seq)
 			seq++
 			copy(buf[4:], b[:s.mtu-4])
-			_, err := s.l.WriteAndPut(
-				head.NewPacket(head.ProtoData, s.src, s.peerip, s.dest, buf), false,
-			)
-			if err != nil {
-				logrus.Errorln("[tunnel] seq", seq-1, "write err:", err)
-				return
-			}
+			s.l.WritePacket(head.ProtoData, buf, s.l.Me().TTL())
 			if config.ShowDebugLog {
-				logrus.Debugln("[tunnel] seq", seq-1, "write succeeded")
+				logrus.Debugln("[tunnel] seq", seq-1, "written")
 			}
 			b = b[s.mtu-4:]
 		}
 		binary.LittleEndian.PutUint32(buf[:4], seq)
 		seq++
 		copy(buf[4:], b)
-		_, err := s.l.WriteAndPut(
-			head.NewPacket(head.ProtoData, s.src, s.peerip, s.dest, buf[:len(b)+4]), false,
-		)
-		if err != nil {
-			logrus.Errorln("[tunnel] seq", seq-1, "write err:", err)
-			break
-		}
+		s.l.WritePacket(head.ProtoData, buf[:len(b)+4], s.l.Me().TTL())
 		if config.ShowDebugLog {
-			logrus.Debugln("[tunnel] seq", seq-1, "write succeeded")
+			logrus.Debugln("[tunnel] seq", seq-1, "written")
 		}
 	}
 }
 
 func (s *Tunnel) handleRead() {
 	seq := uint32(0)
-	seqmap := make(map[uint32]*head.Packet)
+	seqmap := make(map[uint32]link.LinkData)
 	for {
 		if p, ok := seqmap[seq]; ok {
 			if config.ShowDebugLog {
@@ -167,20 +158,21 @@ func (s *Tunnel) handleRead() {
 			continue
 		}
 		p := s.l.Read()
-		if p == nil {
+		if len(p.D) == 0 {
 			logrus.Errorln("[tunnel] read recv nil")
 			break
 		}
 		end := 64
 		endl := "..."
-		if p.BodyLen() < 64 {
-			end = p.BodyLen()
+		if len(p.D) < 64 {
+			end = len(p.D)
 			endl = "."
 		}
+		var recvseq uint32
 		if config.ShowDebugLog {
-			logrus.Debugln("[tunnel] read recv", hex.EncodeToString(p.Body()[:end]), endl)
+			logrus.Debugln("[tunnel] read recv", hex.EncodeToString(p.D[:end]), endl)
 		}
-		recvseq := binary.LittleEndian.Uint32(p.Body()[:4])
+		recvseq = binary.LittleEndian.Uint32(p.D[:4])
 		if recvseq == seq {
 			if config.ShowDebugLog {
 				logrus.Debugln("[tunnel] dispatch seq", seq)

upper/services/tunnel/tunnel_icmp_test.go

@@ -0,0 +1,466 @@
+//go:build linux
+
+package tunnel
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"runtime"
+	"strconv"
+	"testing"
+	"time"
+
+	curve "github.com/fumiama/go-x25519"
+	"github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
+
+	"github.com/fumiama/WireGold/gold/link"
+)
+
+const (
+	icmpNS1   = "wgtest_ns1"
+	icmpNS2   = "wgtest_ns2"
+	icmpIP1   = "10.0.0.1"
+	icmpIP2   = "10.0.0.2"
+	icmpVeth1 = "veth1"
+	icmpVeth2 = "veth2"
+)
+
+// setupICMPNetns creates two network namespaces connected by a veth pair.
+// It returns a cleanup function. Requires root.
+func setupICMPNetns(t *testing.T) func() {
+	t.Helper()
+
+	cmds := [][]string{
+		{"ip", "netns", "add", icmpNS1},
+		{"ip", "netns", "add", icmpNS2},
+		{"ip", "link", "add", icmpVeth1, "type", "veth", "peer", "name", icmpVeth2},
+		{"ip", "link", "set", icmpVeth1, "netns", icmpNS1},
+		{"ip", "link", "set", icmpVeth2, "netns", icmpNS2},
+		{"ip", "netns", "exec", icmpNS1, "ifconfig", icmpVeth1, icmpIP1, "up"},
+		{"ip", "netns", "exec", icmpNS2, "ifconfig", icmpVeth2, icmpIP2, "up"},
+	}
+
+	for _, args := range cmds {
+		if out, err := exec.Command(args[0], args[1:]...).CombinedOutput(); err != nil {
+			// best-effort cleanup
+			exec.Command("ip", "netns", "del", icmpNS1).Run()
+			exec.Command("ip", "netns", "del", icmpNS2).Run()
+			t.Fatalf("setup netns: %v failed: %v\n%s", args, err, out)
+		}
+	}
+
+	return func() {
+		exec.Command("ip", "netns", "del", icmpNS1).Run()
+		exec.Command("ip", "netns", "del", icmpNS2).Run()
+	}
+}
+
+// enterNetns pins the current goroutine to its OS thread, switches into
+// the named network namespace, and returns a function that restores the
+// original namespace and unlocks the thread.
+func enterNetns(nsName string) (func(), error) {
+	runtime.LockOSThread()
+
+	origFd, err := unix.Open("/proc/self/ns/net", unix.O_RDONLY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		runtime.UnlockOSThread()
+		return nil, fmt.Errorf("open current netns: %w", err)
+	}
+
+	targetFd, err := unix.Open("/var/run/netns/"+nsName, unix.O_RDONLY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		unix.Close(origFd)
+		runtime.UnlockOSThread()
+		return nil, fmt.Errorf("open target netns %s: %w", nsName, err)
+	}
+
+	if err := unix.Setns(targetFd, unix.CLONE_NEWNET); err != nil {
+		unix.Close(targetFd)
+		unix.Close(origFd)
+		runtime.UnlockOSThread()
+		return nil, fmt.Errorf("setns to %s: %w", nsName, err)
+	}
+	unix.Close(targetFd)
+
+	return func() {
+		unix.Setns(origFd, unix.CLONE_NEWNET)
+		unix.Close(origFd)
+		runtime.UnlockOSThread()
+	}, nil
+}
+
+// initMeInNetns initializes a link.Me at dst inside the given network namespace.
+// The underlying socket fd remains bound to that namespace after return.
+func initMeInNetns(t testing.TB, nsName string, cfg *link.MyConfig, dst *link.Me) {
+	t.Helper()
+	var merr any
+	done := make(chan struct{})
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				merr = r
+			}
+			close(done)
+		}()
+		restore, err := enterNetns(nsName)
+		if err != nil {
+			merr = err
+			return
+		}
+		defer restore()
+		*dst = link.NewMe(cfg)
+	}()
+	<-done
+	if merr != nil {
+		t.Fatalf("initMeInNetns(%s): %v", nsName, merr)
+	}
+}
+
+func TestTunnelICMP(t *testing.T) {
+	if os.Getuid() != 0 {
+		t.Skip("skipping ICMP test: requires root")
+	}
+	for i := 1; i <= 4; i++ {
+		sz := 1024 * i
+		if !t.Run(strconv.Itoa(sz), func(t *testing.T) {
+			testTunnelICMP(t, uint16(sz))
+		}) {
+			return
+		}
+	}
+}
+
+func testTunnelICMP(t *testing.T, mtu uint16) {
+	logrus.SetLevel(logrus.DebugLevel)
+	logrus.SetFormatter(&logFormat{enableColor: false})
+
+	cleanup := setupICMPNetns(t)
+	defer cleanup()
+
+	testICMPTunnel(t, true, false, nil, mtu)  // plain text
+	testICMPTunnel(t, false, false, nil, mtu) // normal
+
+	testICMPTunnel(t, true, true, nil, mtu)  // plain text + base14
+	testICMPTunnel(t, false, true, nil, mtu) // normal + base14
+
+	var buf [32]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		t.Fatal(err)
+	}
+	testICMPTunnel(t, false, false, &buf, mtu) // preshared
+	testICMPTunnel(t, false, true, &buf, mtu)  // preshared + base14
+}
+
+func testICMPTunnel(t *testing.T, isplain, isbase14 bool, pshk *[32]byte, mtu uint16) {
+	nw := "icmp"
+	fmt.Println("start", nw, "testing, mtu", mtu, "plain", isplain, "b14", isbase14, "pshk", pshk != nil)
+
+	selfpk, err := curve.New(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	peerpk, err := curve.New(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Log("my priv key:", hex.EncodeToString(selfpk.Private()[:]))
+	t.Log("my publ key:", hex.EncodeToString(selfpk.Public()[:]))
+	t.Log("peer priv key:", hex.EncodeToString(peerpk.Private()[:]))
+	t.Log("peer publ key:", hex.EncodeToString(peerpk.Public()[:]))
+
+	var m link.Me
+	initMeInNetns(t, icmpNS1, &link.MyConfig{
+		MyIPwithMask: "192.168.1.2/32",
+		MyEndpoint:   icmpIP1,
+		Network:      nw,
+		PrivateKey:   selfpk.Private(),
+		SrcPort:      1,
+		DstPort:      1,
+		MTU:          mtu,
+		Base14:       isbase14,
+	}, &m)
+	defer m.Close()
+
+	var p link.Me
+	initMeInNetns(t, icmpNS2, &link.MyConfig{
+		MyIPwithMask: "192.168.1.3/32",
+		MyEndpoint:   icmpIP2,
+		Network:      nw,
+		PrivateKey:   peerpk.Private(),
+		SrcPort:      1,
+		DstPort:      1,
+		MTU:          mtu,
+		Base14:       isbase14,
+	}, &p)
+	defer p.Close()
+
+	ppp := peerpk.Public()
+	spp := selfpk.Public()
+	if isplain {
+		ppp = nil
+		spp = nil
+	}
+
+	m.AddPeer(&link.PeerConfig{
+		PeerIP:         "192.168.1.3",
+		EndPoint:       icmpIP2,
+		AllowedIPs:     []string{"192.168.1.3/32"},
+		PubicKey:       ppp,
+		PresharedKey:   pshk,
+		MTU:            mtu,
+		MTURandomRange: mtu / 2,
+		UseZstd:        true,
+		DoublePacket:   true,
+	})
+	p.AddPeer(&link.PeerConfig{
+		PeerIP:         "192.168.1.2",
+		EndPoint:       icmpIP1,
+		AllowedIPs:     []string{"192.168.1.2/32"},
+		PubicKey:       spp,
+		PresharedKey:   pshk,
+		MTU:            mtu,
+		MTURandomRange: mtu / 2,
+		UseZstd:        true,
+	})
+
+	tunnme, err := Create(&m, "192.168.1.3")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tunnme.Start(1, 1, 4096)
+	tunnpeer, err := Create(&p, "192.168.1.2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tunnpeer.Start(1, 1, 4096)
+
+	time.Sleep(time.Second) // wait link up
+
+	sendb := ([]byte)("1234")
+	go tunnme.Write(sendb)
+	buf := make([]byte, 4)
+	tunnpeer.Read(buf)
+	if string(sendb) != string(buf) {
+		logrus.Errorln("error: recv", buf, "expect", sendb)
+		t.Fail()
+	}
+
+	sendb = make([]byte, mtu+4)
+	for i := 0; i < len(sendb); i++ {
+		sendb[i] = byte(i)
+	}
+
+	for i := 1; i < len(sendb); i++ {
+		rand.Read(sendb[:i])
+		go tunnme.Write(sendb[:i])
+		rbuf := make([]byte, i)
+		_, err = io.ReadFull(&tunnpeer, rbuf)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !bytes.Equal(sendb[:i], rbuf) {
+			t.Fatal("error: recv", i, "bytes data")
+		}
+	}
+
+	for i := 0; i < len(sendb); i++ {
+		sendb[i] = ^byte(i)
+	}
+	tunnme.Write(sendb)
+	rd := bytes.NewBuffer(nil)
+
+	tm := time.AfterFunc(time.Second*2, func() {
+		tunnme.Stop()
+		tunnpeer.Stop()
+	})
+	defer tm.Stop()
+
+	_, err = io.CopyBuffer(rd, &tunnpeer, make([]byte, 200))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(sendb) != rd.String() {
+		t.Fatal("error: recv fragmented data")
+	}
+}
+
+func BenchmarkTunnelICMP(b *testing.B) {
+	if os.Getuid() != 0 {
+		b.Skip("skipping ICMP benchmark: requires root")
+	}
+	benchmarkTunnelNetworkICMP(b, 4096)
+}
+
+func BenchmarkTunnelICMPSmallMTU(b *testing.B) {
+	if os.Getuid() != 0 {
+		b.Skip("skipping ICMP benchmark: requires root")
+	}
+	benchmarkTunnelNetworkICMP(b, 1024)
+}
+
+func benchmarkTunnelNetworkICMP(b *testing.B, mtu uint16) {
+	logrus.SetLevel(logrus.ErrorLevel)
+	logrus.SetFormatter(&logFormat{enableColor: false})
+
+	cleanup := setupICMPBenchNetns(b)
+	defer cleanup()
+
+	for i := 1; i <= 4; i++ {
+		sz := 1024 * i
+		b.Run(fmt.Sprintf("%d-plain-nob14", sz), func(b *testing.B) {
+			benchmarkICMPTunnel(b, sz, true, false, nil, mtu)
+		})
+		b.Run(fmt.Sprintf("%d-normal-nob14", sz), func(b *testing.B) {
+			benchmarkICMPTunnel(b, sz, false, false, nil, mtu)
+		})
+		b.Run(fmt.Sprintf("%d-plain-b14", sz), func(b *testing.B) {
+			benchmarkICMPTunnel(b, sz, true, true, nil, mtu)
+		})
+		b.Run(fmt.Sprintf("%d-normal-b14", sz), func(b *testing.B) {
+			benchmarkICMPTunnel(b, sz, false, true, nil, mtu)
+		})
+		var buf [32]byte
+		if _, err := rand.Read(buf[:]); err != nil {
+			b.Fatal(err)
+		}
+		b.Run(fmt.Sprintf("%d-preshared-nob14", sz), func(b *testing.B) {
+			benchmarkICMPTunnel(b, sz, false, false, &buf, mtu)
+		})
+		b.Run(fmt.Sprintf("%d-preshared-b14", sz), func(b *testing.B) {
+			benchmarkICMPTunnel(b, sz, false, true, &buf, mtu)
+		})
+	}
+}
+
+func setupICMPBenchNetns(b *testing.B) func() {
+	b.Helper()
+
+	cmds := [][]string{
+		{"ip", "netns", "add", icmpNS1},
+		{"ip", "netns", "add", icmpNS2},
+		{"ip", "link", "add", icmpVeth1, "type", "veth", "peer", "name", icmpVeth2},
+		{"ip", "link", "set", icmpVeth1, "netns", icmpNS1},
+		{"ip", "link", "set", icmpVeth2, "netns", icmpNS2},
+		{"ip", "netns", "exec", icmpNS1, "ifconfig", icmpVeth1, icmpIP1, "up"},
+		{"ip", "netns", "exec", icmpNS2, "ifconfig", icmpVeth2, icmpIP2, "up"},
+	}
+
+	for _, args := range cmds {
+		if out, err := exec.Command(args[0], args[1:]...).CombinedOutput(); err != nil {
+			exec.Command("ip", "netns", "del", icmpNS1).Run()
+			exec.Command("ip", "netns", "del", icmpNS2).Run()
+			b.Fatalf("setup netns: %v failed: %v\n%s", args, err, out)
+		}
+	}
+
+	return func() {
+		exec.Command("ip", "netns", "del", icmpNS1).Run()
+		exec.Command("ip", "netns", "del", icmpNS2).Run()
+	}
+}
+
+func benchmarkICMPTunnel(b *testing.B, sz int, isplain, isbase14 bool, pshk *[32]byte, mtu uint16) {
+	nw := "icmp"
+
+	selfpk, err := curve.New(nil)
+	if err != nil {
+		b.Fatal(err)
+	}
+	peerpk, err := curve.New(nil)
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	var m link.Me
+	initMeInNetns(b, icmpNS1, &link.MyConfig{
+		MyIPwithMask: "192.168.1.2/32",
+		MyEndpoint:   icmpIP1,
+		Network:      nw,
+		PrivateKey:   selfpk.Private(),
+		SrcPort:      1,
+		DstPort:      1,
+		MTU:          mtu,
+		Base14:       isbase14,
+	}, &m)
+	defer m.Close()
+
+	var p link.Me
+	initMeInNetns(b, icmpNS2, &link.MyConfig{
+		MyIPwithMask: "192.168.1.3/32",
+		MyEndpoint:   icmpIP2,
+		Network:      nw,
+		PrivateKey:   peerpk.Private(),
+		SrcPort:      1,
+		DstPort:      1,
+		MTU:          mtu,
+		Base14:       isbase14,
+	}, &p)
+	defer p.Close()
+
+	ppp := peerpk.Public()
+	spp := selfpk.Public()
+	if isplain {
+		ppp = nil
+		spp = nil
+	}
+
+	m.AddPeer(&link.PeerConfig{
+		PeerIP:         "192.168.1.3",
+		EndPoint:       icmpIP2,
+		AllowedIPs:     []string{"192.168.1.3/32"},
+		PubicKey:       ppp,
+		PresharedKey:   pshk,
+		MTU:            mtu,
+		MTURandomRange: mtu / 2,
+		UseZstd:        true,
+		DoublePacket:   true,
+	})
+	p.AddPeer(&link.PeerConfig{
+		PeerIP:         "192.168.1.2",
+		EndPoint:       icmpIP1,
+		AllowedIPs:     []string{"192.168.1.2/32"},
+		PubicKey:       spp,
+		PresharedKey:   pshk,
+		MTU:            mtu,
+		MTURandomRange: mtu / 2,
+		UseZstd:        true,
+	})
+
+	tunnme, err := Create(&m, "192.168.1.3")
+	if err != nil {
+		b.Fatal(err)
+	}
+	tunnme.Start(1, 1, 4096)
+	tunnpeer, err := Create(&p, "192.168.1.2")
+	if err != nil {
+		b.Fatal(err)
+	}
+	tunnpeer.Start(1, 1, 4096)
+
+	time.Sleep(time.Second) // wait link up
+
+	b.SetBytes(int64(sz))
+	b.ResetTimer()
+	sendb := make([]byte, sz)
+	for i := 0; i < b.N; i++ {
+		rand.Read(sendb)
+		go tunnme.Write(sendb)
+		buf := make([]byte, sz)
+		_, err = io.ReadFull(&tunnpeer, buf)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+	b.StopTimer()
+
+	time.Sleep(time.Second) // wait packets all received
+
+	tunnme.Stop()
+	tunnpeer.Stop()
+}

upper/services/tunnel/tunnel_test.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"runtime"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -15,45 +16,37 @@ import (
 	"github.com/sirupsen/logrus"
 
 	"github.com/fumiama/WireGold/gold/link"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/bin"
 )
 
-func TestTunnelUDP(t *testing.T) {
-	testTunnelNetwork(t, "udp", 4096)
+func testTunnelMTUsNetwork(t *testing.T, nw string) {
+	for i := 1; i <= 4; i++ {
+		sz := 1024 * i
+		if !t.Run(strconv.Itoa(sz), func(t *testing.T) {
+			testTunnelNetwork(t, nw, uint16(sz))
+		}) {
+			return
+		}
+	}
 }
 
-func TestTunnelUDPSmallMTU(t *testing.T) {
-	testTunnelNetwork(t, "udp", 1024)
+func TestTunnelUDP(t *testing.T) {
+	testTunnelMTUsNetwork(t, "udp")
 }
 
 func TestTunnelUDPLite(t *testing.T) {
 	if runtime.GOOS == "darwin" {
 		return
 	}
-	testTunnelNetwork(t, "udplite", 4096)
-}
-
-func TestTunnelUDPLiteSmallMTU(t *testing.T) {
-	if runtime.GOOS == "darwin" {
-		return
-	}
-	testTunnelNetwork(t, "udplite", 1024)
+	testTunnelMTUsNetwork(t, "udplite")
 }
 
 func TestTunnelTCP(t *testing.T) {
-	testTunnelNetwork(t, "tcp", 4096)
-}
-
-func TestTunnelTCPSmallMTU(t *testing.T) {
-	testTunnelNetwork(t, "tcp", 1024)
+	testTunnelMTUsNetwork(t, "tcp")
 }
 
 func TestTunnelIP(t *testing.T) {
-	testTunnelNetwork(t, "ip", 4096)
-}
-
-func TestTunnelIPSmallMTU(t *testing.T) {
-	testTunnelNetwork(t, "ip", 1024)
+	testTunnelMTUsNetwork(t, "ip")
 }
 
 func BenchmarkTunnelUDP(b *testing.B) {
@@ -95,7 +88,7 @@ func BenchmarkTunnelIPSmallMTU(b *testing.B) {
 }
 
 func testTunnel(t *testing.T, nw string, isplain, isbase14 bool, pshk *[32]byte, mtu uint16) {
-	fmt.Println("start", nw, "testing")
+	fmt.Println("start", nw, "testing, mtu", mtu, "plain", isplain, "b14", isbase14, "pshk", pshk != nil)
 	selfpk, err := curve.New(nil)
 	if err != nil {
 		panic(err)
@@ -110,14 +103,14 @@ func testTunnel(t *testing.T, nw string, isplain, isbase14 bool, pshk *[32]byte,
 	t.Log("peer publ key:", hex.EncodeToString(peerpk.Public()[:]))
 
 	epm := "127.0.0.1"
-	if nw != "ip" {
+	if nw != "ip" && nw != "icmp" {
 		epm += ":0"
 	}
 	// under macos you need to run
 	//
 	// sudo ifconfig lo0 alias 127.0.0.2
 	epp := "127.0.0.2"
-	if nw != "ip" {
+	if nw != "ip" && nw != "icmp" {
 		epp += ":0"
 	}
 
@@ -195,46 +188,27 @@ func testTunnel(t *testing.T, nw string, isplain, isbase14 bool, pshk *[32]byte,
 		t.Fail()
 	}
 
-	sendb = make([]byte, 4096)
-	rand.Read(sendb)
-	go tunnme.Write(sendb)
-	buf = make([]byte, 4096)
-	_, err = io.ReadFull(&tunnpeer, buf)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(sendb) != string(buf) {
-		t.Fatal("error: recv 4096 bytes data")
+	sendb = make([]byte, mtu+4)
+	for i := 0; i < len(sendb); i++ {
+		sendb[i] = byte(i)
 	}
 
-	sendbufs := make(chan []byte, 32)
-
-	go func() {
-		time.Sleep(time.Second)
-		for i := 0; i < 32; i++ {
-			sendb := make([]byte, 65535)
-			rand.Read(sendb)
-			n, _ := tunnme.Write(sendb)
-			sendbufs <- sendb
-			logrus.Debugln("loop", i, "write", n, "bytes")
-		}
-		close(sendbufs)
-	}()
-	buf = make([]byte, 65535)
-	i := 0
-	for sendb := range sendbufs {
-		n, err := io.ReadFull(&tunnpeer, buf)
+	for i := 1; i < len(sendb); i++ {
+		rand.Read(sendb[:i])
+		go tunnme.Write(sendb[:i])
+		buf := make([]byte, i)
+		_, err = io.ReadFull(&tunnpeer, buf)
 		if err != nil {
 			t.Fatal(err)
 		}
-		logrus.Debugln("loop", i, "read", n, "bytes")
-		if string(sendb) != string(buf) {
-			t.Fatal("loop", i, "error: recv 65535 bytes data")
+		if !bytes.Equal(sendb[:i], buf) {
+			t.Fatal("error: recv", i, "bytes data")
 		}
-		i++
 	}
 
-	rand.Read(sendb)
+	for i := 0; i < len(sendb); i++ {
+		sendb[i] = ^byte(i)
+	}
 	tunnme.Write(sendb)
 	rd := bytes.NewBuffer(nil)
 
@@ -249,7 +223,7 @@ func testTunnel(t *testing.T, nw string, isplain, isbase14 bool, pshk *[32]byte,
 		t.Fatal(err)
 	}
 	if string(sendb) != rd.String() {
-		t.Fatal("error: recv fragmented 4096 bytes data")
+		t.Fatal("error: recv fragmented data")
 	}
 }
 
@@ -264,14 +238,14 @@ func benchmarkTunnel(b *testing.B, sz int, nw string, isplain, isbase14 bool, ps
 	}
 
 	epm := "127.0.0.1"
-	if nw != "ip" {
+	if nw != "ip" && nw != "icmp" {
 		epm += ":0"
 	}
 	// under macos you need to run
 	//
 	// sudo ifconfig lo0 alias 127.0.0.2
 	epp := "127.0.0.2"
-	if nw != "ip" {
+	if nw != "ip" && nw != "icmp" {
 		epp += ":0"
 	}
 
@@ -353,6 +327,9 @@ func benchmarkTunnel(b *testing.B, sz int, nw string, isplain, isbase14 bool, ps
 		}
 	}
 	b.StopTimer()
+
+	time.Sleep(time.Second) // wait packets all received
+
 	tunnme.Stop()
 	tunnpeer.Stop()
 }
@@ -420,7 +397,9 @@ type logFormat struct {
 
 // Format implements logrus.Formatter
 func (f logFormat) Format(entry *logrus.Entry) ([]byte, error) {
-	buf := helper.SelectWriter() // this writer will not be put back
+	// this writer will not be put back
+
+	buf := bin.SelectWriter()
 
 	buf.WriteByte('[')
 	if f.enableColor {
@@ -434,7 +413,10 @@ func (f logFormat) Format(entry *logrus.Entry) ([]byte, error) {
 	buf.WriteString(entry.Message)
 	buf.WriteString("\n")
 
-	return buf.Bytes(), nil
+	b := buf.ToBytes().Copy()
+	buf.Destroy()
+
+	return b.Trans(), nil
 }
 
 const (

upper/services/wg/wg.go

@@ -9,14 +9,18 @@ import (
 	curve "github.com/fumiama/go-x25519"
 	"github.com/sirupsen/logrus"
 
+	_ "github.com/fumiama/WireGold/gold/p2p/icmp"    // support icmp connection
 	_ "github.com/fumiama/WireGold/gold/p2p/ip"      // support ip connection
 	_ "github.com/fumiama/WireGold/gold/p2p/tcp"     // support tcp connection
 	_ "github.com/fumiama/WireGold/gold/p2p/udp"     // support udp connection
 	_ "github.com/fumiama/WireGold/gold/p2p/udplite" // support udplite connection
+	_ "github.com/fumiama/WireGold/gold/proto/data"  // support data proto
+	_ "github.com/fumiama/WireGold/gold/proto/hello" // support hello proto
+	_ "github.com/fumiama/WireGold/gold/proto/nat"   // support nat proto
 
 	"github.com/fumiama/WireGold/config"
 	"github.com/fumiama/WireGold/gold/link"
-	"github.com/fumiama/WireGold/helper"
+	"github.com/fumiama/WireGold/internal/bin"
 )
 
 const suffix32 = "㴄"
@@ -32,7 +36,7 @@ func NewWireGold(c *config.Config) (wg WG, err error) {
 	wg.c = c
 
 	var k []byte
-	k, err = base14.UTF82UTF16BE(helper.StringToBytes(c.PrivateKey + suffix32))
+	k, err = base14.UTF82UTF16BE(bin.StringToBytes(c.PrivateKey + suffix32))
 	if err != nil {
 		return
 	}
@@ -47,7 +51,7 @@ func NewWireGold(c *config.Config) (wg WG, err error) {
 	if err != nil {
 		return
 	}
-	wg.PublicKey = helper.BytesToString(pubk[:57])
+	wg.PublicKey = bin.BytesToString(pubk[:57])
 
 	return
 }
@@ -114,11 +118,12 @@ func (wg *WG) init(srcport, dstport uint16) {
 		SpeedLoop: wg.c.SpeedLoop,
 		Mask:      wg.c.Mask,
 		Base14:    wg.c.Base14,
+		MaxTTL:    wg.c.MaxTTL,
 	})
 
 	for _, peer := range wg.c.Peers {
 		var peerkey [32]byte
-		k, err := base14.UTF82UTF16BE(helper.StringToBytes(peer.PublicKey + suffix32))
+		k, err := base14.UTF82UTF16BE(bin.StringToBytes(peer.PublicKey + suffix32))
 		if err != nil {
 			panic(err)
 		}
@@ -128,7 +133,7 @@ func (wg *WG) init(srcport, dstport uint16) {
 		}
 		var pshk *[32]byte
 		if peer.PresharedKey != "" {
-			k, err := base14.UTF82UTF16BE(helper.StringToBytes(peer.PresharedKey + suffix32))
+			k, err := base14.UTF82UTF16BE(bin.StringToBytes(peer.PresharedKey + suffix32))
 			if err != nil {
 				panic(err)
 			}
@@ -141,6 +146,9 @@ func (wg *WG) init(srcport, dstport uint16) {
 		if peer.MTU >= 65535 {
 			panic("peer " + peer.IP + ": MTU too large")
 		}
+		if peer.MTU == 0 {
+			peer.MTU = wg.c.MTU
+		}
 		if peer.MTURandomRange >= peer.MTU/2 {
 			panic("peer " + peer.IP + ": MTURandomRange too large")
 		}