comzyh / clash

A rule-based tunnel in Go.

Clash

A rule-based tunnel in Go.

Features

This is a general overview of the features that comes with Clash.

• Inbound: HTTP, HTTPS, SOCKS5 server, TUN device
• Outbound: Shadowsocks(R), VMess, Trojan, Snell, SOCKS5, HTTP(S), Wireguard
• Rule-based Routing: dynamic scripting, domain, IP addresses, process name and more
• Fake-IP DNS: minimises impact on DNS pollution and improves network performance
• Transparent Proxy: Redirect TCP and TProxy TCP/UDP with automatic route table/rule management
• Proxy Groups: automatic fallback, load balancing or latency testing
• Remote Providers: load remote proxy lists dynamically
• RESTful API: update configuration in-place via a comprehensive API

Some of the features may only be available in the Premium core.

Documentation

You can find the latest documentation at https://dreamacro.github.io/clash/.

Credits

• riobard/go-shadowsocks2
• v2ray/v2ray-core
• WireGuard/wireguard-go

License

This software is released under the GPL-3.0 license.

clash's Issues

[Bug] 运行过程中经常出现panic

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x14 pc=0x4c4f14]

goroutine 80464 [running]:
github.com/Dreamacro/clash/adapters/inbound.NewSocket(0x2c21890, 0x7, 0x7, 0x830718, 0x29c9440, 0x9, 0x2c21890)
F:/projects/myclash3/adapters/inbound/socket.go:26 +0x60
github.com/Dreamacro/clash/proxy/tun.NewTunProxy.func1(0x3516510)
F:/projects/myclash3/proxy/tun/tunproxy.go:94 +0x190
created by gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*Forwarder).HandlePacket
C:/Users/admin/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/transport/tcp/forwarder.go:91 +0x200

[Bug] update gvisor 20210303 版本 ipv6 似乎不工作

日志中大量 warning: Can't create TCP Endpoint in ipstack: no route
相关路由脚本：h0cheung/clash-tun-scripts

tun模式是否支持win系统？

请问该核心的tun在win系统下能否正常使用，我这边尝试过替换，tun模式不工作。

[Bug] Padavan下不能建立tcp endpoint

一直无办法建立连接，显示
Can't create TCP Endpoint in ipstack: operation timed out

[Bug] Panic from Tun DNS server

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x950d92]

goroutine 835 [running]:
github.com/Dreamacro/clash/proxy/tun.(*dnsEndpoint).HandleError(0xc000a92b40, 0xbcf8d8, 0xf64c98, 0xc0007c2280)
        <autogenerated>:1 +0x32
gvisor.dev/gvisor/pkg/tcpip/stack.(*endpointsByNIC).handleError(0xc000a92ba0, 0xc000ad8000, 0x36, 0xc0003140c4, 0x4, 0x3039, 0xc0003140c8, 0x4, 0xbcf8d8, 0xf64c98, ...)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/stack/transport_demuxer.go:202 +0x122
gvisor.dev/gvisor/pkg/tcpip/stack.(*transportDemuxer).deliverError(0xc000302fc0, 0xc000ad8000, 0x1100000800, 0xbcf8d8, 0xf64c98, 0xc0007c2280, 0x36, 0xc0003140c4, 0x4, 0x3039, ...)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/stack/transport_demuxer.go:621 +0x13f
gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverTransportError(0xc000ad8000, 0xc0003140c4, 0x4, 0xc0003140c8, 0x4, 0x1100000800, 0xbcf8d8, 0xf64c98, 0xc0007c2280)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/stack/nic.go:895 +0x1dc
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleControl(0xc0002b0c00, 0xbcf8d8, 0xf64c98, 0xc0007c2280)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/network/ipv4/icmp.go:169 +0x30a
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleICMP(0xc0002b0c00, 0xc0007c2280)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/network/ipv4/icmp.go:342 +0x4d0
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handlePacket(0xc0002b0c00, 0xc0007c2280)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/network/ipv4/ipv4.go:845 +0xbe5
gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).HandlePacket(0xc0002b0c00, 0xc0007c2280)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/network/ipv4/ipv4.go:665 +0x117
gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverNetworkPacket(0xc000ad8000, 0x0, 0x0, 0x0, 0x0, 0x800, 0xc0007c2280)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/stack/nic.go:768 +0x268
gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectLinkAddr(...)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/link/channel/channel.go:190
gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectInbound(...)
        /home/comzyh/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/link/channel/channel.go:185
github.com/Dreamacro/clash/proxy/tun/dev.(*tunLinux).AsLinkEndpoint.func1(0x2328, 0xc0002f8900, 0xc000392340)
        /home/comzyh/Project/clash/proxy/tun/dev/dev_linux.go:106 +0x16e
created by github.com/Dreamacro/clash/proxy/tun/dev.(*tunLinux).AsLinkEndpoint
        /home/comzyh/Project/clash/proxy/tun/dev/dev_linux.go:88 +0x145
exit status 2

For some reason, when a client send a UDP DNS request to tun-dns, the response can not reach the client and tun-dns will get an icmp reply indicate an error has occured.

But HandleError is not implimented by dnsEndpoint.

Panic on latest add-water branch

it panics every few hours randomly with below traceback.

I'm running the build on latest add-water branch

any ideas how to debug/fix this?

thank you in advance.

Feb 11 00:59:49 clash clash[3778]: time="2021-02-11T00:59:49+08:00" level=warning msg="[TCP] dial 🅿️ Select (match DomainKeyword/apple.com.akadns.net) to gs-loc.ls-apple.com.akadns.net error: dial tcp4 17.142.171.8:443: i/o timeout"
Feb 11 02:37:57 clash clash[3778]: time="2021-02-11T02:37:57+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 02:40:42 clash clash[3778]: time="2021-02-11T02:40:42+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 02:40:42 clash clash[3778]: time="2021-02-11T02:40:42+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 03:58:27 clash clash[3778]: time="2021-02-11T03:58:27+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 06:09:14 clash clash[3778]: time="2021-02-11T06:09:14+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 06:10:43 clash clash[3778]: time="2021-02-11T06:10:43+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 08:07:19 clash clash[3778]: time="2021-02-11T08:07:19+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 08:40:46 clash clash[3778]: time="2021-02-11T08:40:46+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 08:55:55 clash clash[3778]: time="2021-02-11T08:55:55+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 09:34:59 clash clash[3778]: time="2021-02-11T09:34:59+08:00" level=warning msg="Can't create TCP Endpoint in ipstack: connection was refused"
Feb 11 10:27:05 clash clash[3778]: panic: runtime error: invalid memory address or nil pointer dereference
Feb 11 10:27:05 clash clash[3778]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0x8ed9f1]
Feb 11 10:27:05 clash clash[3778]: goroutine 397009 [running]:
Feb 11 10:27:05 clash clash[3778]: github.com/Dreamacro/clash/adapters/inbound.NewSocket(0xc000b83760, 0x7, 0x7, 0xd1dbc0, 0xc00021b1a0, 0xa, 0xc000b83760)
Feb 11 10:27:05 clash clash[3778]:         /home/wtf/projects/clash/adapters/inbound/socket.go:16 +0x81
Feb 11 10:27:05 clash clash[3778]: github.com/Dreamacro/clash/proxy/tun.NewTunProxy.func1(0xc000376800)
Feb 11 10:27:05 clash clash[3778]:         /home/wtf/projects/clash/proxy/tun/tunproxy.go:89 +0x20b
Feb 11 10:27:05 clash clash[3778]: created by gvisor.dev/gvisor/pkg/tcpip/transport/tcp.(*Forwarder).HandlePacket
Feb 11 10:27:05 clash clash[3778]:         /home/wtf/go/pkg/mod/github.com/comzyh/[email protected]/pkg/tcpip/transport/tcp/forwarder.go:91 +0x2bd
Feb 11 10:27:05 clash systemd[1]: clash.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Feb 11 10:27:05 clash systemd[1]: clash.service: Failed with result 'exit-code'.
Feb 11 10:27:05 clash systemd[1]: clash.service: Service RestartSec=100ms expired, scheduling restart.
Feb 11 10:27:05 clash systemd[1]: clash.service: Scheduled restart job, restart counter is at 1.
Feb 11 10:27:05 clash systemd[1]: Stopped clash service.
Feb 11 10:27:05 clash systemd[1]: Started clash service.

能否在open tun 之后自动添加路由表呢？

RT, 默认添加 Fake-IP 的网关，可选添加其它网段，如
sudo route -n add -net 1 198.18.0.1
sudo route -n add -net 2/7 198.18.0.1
sudo route -n add -net 4/6 198.18.0.1
sudo route -n add -net 8/5 198.18.0.1
sudo route -n add -net 16/4 198.18.0.1
sudo route -n add -net 32/3 198.18.0.1
sudo route -n add -net 64/2 198.18.0.1
sudo route -n add -net 128.0/1 198.18.0.1

Clash can only accept around 7k connections.

Clash can only accept around 7k connections and then stop to accept a new TCP connection.

Analysis:

Clash set up a Forwarder to accept all new TCP connection
https://github.com/comzyh/clash/blob/ab7da17a75c2626fcd49d3e69080fa6536391ddb/proxy/tun/tunproxy.go#L82-L97

According to gvisor netstack, netstack first check if there is an Endpoint match the incoming packet.
If not, call the Forwarder I write.
https://github.com/google/gvisor/blob/035f7434e978f3f246ae05e9c748e8ca7d8d7fd1/pkg/tcpip/stack/nic.go#L1301-L1311

For some reason, netstack keep the closed endpoint in the Endpoint map for a while after the connection is closed. At this time, if a new incoming connection reuses the same local-port, the TCP connection quadruple(srcIP, dstIP, srcPort, dstPort) matches the endpoints map. Then the Forwarder cannot receive the new incoming connection.

[Feature] 大佬，有空升级一下 gvisor 吗？

Verify steps

• 我已经在 Issue Tracker 中找过我要提出的请求 I have searched on the issue tracker for a related feature request.
• 我已经仔细看过 Documentation 并无法自行解决问题 I have read the documentation and was unable to solve the issue.

Description

新版本 Go 都编译不了这个 clash 了!

Possible Solution

No response

[Bug] inappropriate ioctl for device

Verify steps

• 如果你可以自己 debug 并解决的话，提交 PR 吧 Is this something you can debug and fix? Send a pull request! Bug fixes and documentation fixes are welcome.
• 我已经在 Issue Tracker 中找过我要提出的问题 I have searched on the issue tracker for a related issue.
• 我已经使用 dev 分支版本测试过，问题依旧存在 I have tested using the dev branch, and the issue still exists.
• 我已经仔细看过 Documentation 并无法自行解决问题 I have read the documentation and was unable to solve the issue.
• 这是 Clash 核心的问题，并非我所使用的 Clash 衍生版本（如 OpenClash、KoolClash 等）的特定问题 This is an issue of the Clash core per se, not to the derivatives of Clash, like OpenClash or KoolClash.

Clash version

release最新版(20210310)

What OS are you seeing the problem on?

Linux

Clash config

clash@debian:~$ cat config.yaml
mixed-port: 1080
allow-lan: true
external-controller: 127.0.0.1:9090
secret: ''
tun:
  enable: true
  device-url: dev://ctun
  device-url: fd://5
  dns-listen: 0.0.0.0:53
dns:
  enable: true
  listen: 0.0.0.0:53
  default-nameserver:
    - 114.114.114.114
    - 8.8.8.8
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16

  fake-ip-filter:
    - '*.lan'
    - localhost.ptlogin2.qq.com

  nameserver:
    - 114.114.114.114
    - 8.8.8.8
    - tls://dns.rubyfish.cn:853
    - https://1.1.1.1/dns-query

  fallback:
    - tcp://1.1.1.1
proxies:
...
proxy-groups:
...
rules:
- GEOIP,CN,DIRECT
- MATCH,Proxy

Clash log

clash@debian:~$ ./clash-linux-amd64 -d .
INFO[0000] Start initial compatible provider Proxy
ERRO[0000] Start Tun interface error: can't open tun: inappropriate ioctl for device
INFO[0000] Mixed(http+socks5) proxy listening at: :1080
INFO[0000] RESTful API listening at: 127.0.0.1:9090

Description

我对着教程 敲命令，启动clash时提示标题里的报错(运行的用户也是clash)，可以麻烦帮我看看是哪一部出问题了吗？我的输入顺序如下

ip tuntap add mode tun user clash name ctun
ifconfig ctun up
route add -net 198.18.0.0/16 dev ctun

ipconfig运行结果如下

root@debian:~# ifconfig
ctun: flags=4241<UP,POINTOPOINT,NOARP,MULTICAST>  mtu 1500
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 500  (UNSPEC)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.131  netmask 255.255.255.0  broadcast 192.168.2.255
        inet6 fe80::20c:29ff:fe3f:b2ca  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:3f:b2:ca  txqueuelen 1000  (Ethernet)
        RX packets 32177  bytes 44616187 (42.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8313  bytes 608868 (594.5 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

路由表

root@debian:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.2.2     0.0.0.0         UG    0      0        0 ens33
192.168.2.0     0.0.0.0         255.255.255.0   U     0      0        0 ens33
198.18.0.0      0.0.0.0         255.255.0.0     U     0      0        0 ctun