// model base on commit 5a112a0a0994b8bb834427ac84133501407f6413, time is 2024-10-11 04:49:19 UTC.
// @ts-ignore
import { join } from ‘cloudflare:sockets’;
// Tips on how to generate your personal UUID:
// (Home windows) Press “Win + R”, enter cmd and run: Powershell -NoExit -Command “(guid)::NewGuid()”
let userID = ‘d342d11e-d424-4583-b36e-524ab1f0afa4’;
let proxyIP = ”;
if (!isValidUUID(userID)) {
throw new Error(‘uuid is just not legitimate’);
}
export default {
/**
* @param {import(“@cloudflare/workers-types”).Request} request
* @param {{UUID: string, PROXYIP: string}} env
* @param {import(“@cloudflare/workers-types”).ExecutionContext} ctx
* @returns {Promise
async fetch(request, env, ctx) {
attempt {
userID = env.UUID || userID;
proxyIP = env.PROXYIP || proxyIP;
const upgradeHeader = request.headers.get(‘Improve’);
if (!upgradeHeader || upgradeHeader !== ‘websocket’) {
const url = new URL(request.url);
swap (url.pathname) {
case ‘/’:
return new Response(JSON.stringify(request.cf), { standing: 200 });
case `/${userID}`: {
const vlessConfig = getVLESSConfig(userID, request.headers.get(‘Host’));
return new Response(`${vlessConfig}`, {
standing: 200,
headers: {
“Content material-Sort”: “textual content/plain;charset=utf-8”,
}
});
}
default:
return new Response(‘Not discovered’, { standing: 404 });
}
} else {
return await vlessOverWSHandler(request);
}
} catch (err) {
/** @kind {Error} */ let e = err;
return new Response(e.toString());
}
},
};
/**
*
* @param {import(“@cloudflare/workers-types”).Request} request
*/
async perform vlessOverWSHandler(request) {
/** @kind {import(“@cloudflare/workers-types”).WebSocket()} */
// @ts-ignore
const webSocketPair = new WebSocketPair();
const (consumer, webSocket) = Object.values(webSocketPair);
webSocket.settle for();
let tackle = ”;
let portWithRandomLog = ”;
const log = (/** @kind {string} */ information, /** @kind undefined */ occasion) => {
console.log(`(${tackle}:${portWithRandomLog}) ${information}`, occasion || ”);
};
const earlyDataHeader = request.headers.get(‘sec-websocket-protocol’) || ”;
const readableWebSocketStream = makeReadableWebSocketStream(webSocket, earlyDataHeader, log);
/** @kind { null}*/
let remoteSocketWapper = {
worth: null,
};
let udpStreamWrite = null;
let isDns = false;
// ws –> distant
readableWebSocketStream.pipeTo(new WritableStream({
async write(chunk, controller) {
if (isDns && udpStreamWrite) {
return udpStreamWrite(chunk);
}
if (remoteSocketWapper.worth) {
const author = remoteSocketWapper.worth.writable.getWriter()
await author.write(chunk);
author.releaseLock();
return;
}
const {
hasError,
message,
portRemote = 443,
addressRemote = ”,
rawDataIndex,
vlessVersion = new Uint8Array((0, 0)),
isUDP,
} = processVlessHeader(chunk, userID);
tackle = addressRemote;
portWithRandomLog = `${portRemote}–${Math.random()} ${isUDP ? ‘udp ‘ : ‘tcp ‘
} `;
if (hasError) {
// controller.error(message);
throw new Error(message); // cf appears has bug, controller.error is not going to finish stream
// webSocket.shut(1000, message);
return;
}
// if UDP however port not DNS port, shut it
if (isUDP) {
if (portRemote === 53) {
isDns = true;
} else {
// controller.error(‘UDP proxy solely allow for DNS which is port 53’);
throw new Error(‘UDP proxy solely allow for DNS which is port 53’); // cf appears has bug, controller.error is not going to finish stream
return;
}
}
// (“model”, “附加信息长度 N”)
const vlessResponseHeader = new Uint8Array((vlessVersion(0), 0));
const rawClientData = chunk.slice(rawDataIndex);
// TODO: assist udp right here when cf runtime has udp assist
if (isDns) {
const { write } = await handleUDPOutBound(webSocket, vlessResponseHeader, log);
udpStreamWrite = write;
udpStreamWrite(rawClientData);
return;
}
handleTCPOutBound(remoteSocketWapper, addressRemote, portRemote, rawClientData, webSocket, vlessResponseHeader, log);
},
shut() {
log(`readableWebSocketStream is shut`);
},
abort(purpose) {
log(`readableWebSocketStream is abort`, JSON.stringify(purpose));
},
})).catch((err) => {
log(‘readableWebSocketStream pipeTo error’, err);
});
return new Response(null, {
standing: 101,
// @ts-ignore
webSocket: consumer,
});
}
/**
* Handles outbound TCP connections.
*
* @param {any} remoteSocket
* @param {string} addressRemote The distant tackle to connect with.
* @param {quantity} portRemote The distant port to connect with.
* @param {Uint8Array} rawClientData The uncooked consumer knowledge to jot down.
* @param {import(“@cloudflare/workers-types”).WebSocket} webSocket The WebSocket to cross the distant socket to.
* @param {Uint8Array} vlessResponseHeader The VLESS response header.
* @param {perform} log The logging perform.
* @returns {Promise
async perform handleTCPOutBound(remoteSocket, addressRemote, portRemote, rawClientData, webSocket, vlessResponseHeader, log,) {
async perform connectAndWrite(tackle, port) {
/** @kind {import(“@cloudflare/workers-types”).Socket} */
const tcpSocket = join({
hostname: tackle,
port: port,
});
remoteSocket.worth = tcpSocket;
log(`related to ${tackle}:${port}`);
const author = tcpSocket.writable.getWriter();
await author.write(rawClientData); // first write, nomal is tls consumer good day
author.releaseLock();
return tcpSocket;
}
// if the cf join tcp socket don’t have any incoming knowledge, we retry to redirect ip
async perform retry() {
const tcpSocket = await connectAndWrite(proxyIP || addressRemote, portRemote)
// regardless of retry success or not, shut websocket
tcpSocket.closed.catch(error => {
console.log(‘retry tcpSocket closed error’, error);
}).lastly(() => {
safeCloseWebSocket(webSocket);
})
remoteSocketToWS(tcpSocket, webSocket, vlessResponseHeader, null, log);
}
const tcpSocket = await connectAndWrite(addressRemote, portRemote);
// when remoteSocket is prepared, cross to websocket
// distant–> ws
remoteSocketToWS(tcpSocket, webSocket, vlessResponseHeader, retry, log);
}
/**
*
* @param {import(“@cloudflare/workers-types”).WebSocket} webSocketServer
* @param {string} earlyDataHeader for ws 0rtt
* @param {(information: string)=> void} log for ws 0rtt
*/
perform makeReadableWebSocketStream(webSocketServer, earlyDataHeader, log) {
let readableStreamCancel = false;
const stream = new ReadableStream({
begin(controller) {
webSocketServer.addEventListener(‘message’, (occasion) => {
if (readableStreamCancel) {
return;
}
const message = occasion.knowledge;
controller.enqueue(message);
});
// The occasion implies that the consumer closed the consumer -> server stream.
// Nonetheless, the server -> consumer stream continues to be open till you name shut() on the server aspect.
// The WebSocket protocol says {that a} separate shut message have to be despatched in every course to completely shut the socket.
webSocketServer.addEventListener(‘shut’, () => {
// consumer ship shut, want shut server
// if stream is cancel, skip controller.shut
safeCloseWebSocket(webSocketServer);
if (readableStreamCancel) {
return;
}
controller.shut();
}
);
webSocketServer.addEventListener(‘error’, (err) => {
log(‘webSocketServer has error’);
controller.error(err);
}
);
// for ws 0rtt
const { earlyData, error } = base64ToArrayBuffer(earlyDataHeader);
if (error) {
controller.error(error);
} else if (earlyData) {
controller.enqueue(earlyData);
}
},
pull(controller) {
// if ws can cease learn if stream is full, we are able to implement backpressure
// https://streams.spec.whatwg.org/#example-rs-push-backpressure
},
cancel(purpose) {
// 1. pipe WritableStream has error, this cancel will known as, so ws deal with server shut into right here
// 2. if readableStream is cancel, all controller.shut/enqueue want skip,
// 3. however from testing controller.error nonetheless work even when readableStream is cancel
if (readableStreamCancel) {
return;
}
log(`ReadableStream was canceled, as a consequence of ${purpose}`)
readableStreamCancel = true;
safeCloseWebSocket(webSocketServer);
}
});
return stream;
}
// https://xtls.github.io/growth/protocols/vless.html
// https://github.com/zizifn/excalidraw-backup/blob/important/v2ray-protocol.excalidraw
/**
*
* @param { ArrayBuffer} vlessBuffer
* @param {string} userID
* @returns
*/
perform processVlessHeader(
vlessBuffer,
userID
) {
if (vlessBuffer.byteLength return {
hasError: true,
message: ‘invalid knowledge’,
};
}
const model = new Uint8Array(vlessBuffer.slice(0, 1));
let isValidUser = false;
let isUDP = false;
if (stringify(new Uint8Array(vlessBuffer.slice(1, 17))) === userID) {
isValidUser = true;
}
if (!isValidUser) {
return {
hasError: true,
message: ‘invalid consumer’,
};
}
const optLength = new Uint8Array(vlessBuffer.slice(17, 18))(0);
//skip go for now
const command = new Uint8Array(
vlessBuffer.slice(18 + optLength, 18 + optLength + 1)
)(0);
// 0x01 TCP
// 0x02 UDP
// 0x03 MUX
if (command === 1) {
} else if (command === 2) {
isUDP = true;
} else {
return {
hasError: true,
message: `command ${command} is just not assist, command 01-tcp,02-udp,03-mux`,
};
}
const portIndex = 18 + optLength + 1;
const portBuffer = vlessBuffer.slice(portIndex, portIndex + 2);
// port is big-Endian in uncooked knowledge and so on 80 == 0x005d
const portRemote = new DataView(portBuffer).getUint16(0);
let addressIndex = portIndex + 2;
const addressBuffer = new Uint8Array(
vlessBuffer.slice(addressIndex, addressIndex + 1)
);
// 1–> ipv4 addressLength =4
// 2–> area title addressLength=addressBuffer(1)
// 3–> ipv6 addressLength =16
const addressType = addressBuffer(0);
let addressLength = 0;
let addressValueIndex = addressIndex + 1;
let addressValue = ”;
swap (addressType) {
case 1:
addressLength = 4;
addressValue = new Uint8Array(
vlessBuffer.slice(addressValueIndex, addressValueIndex + addressLength)
).be part of(‘.’);
break;
case 2:
addressLength = new Uint8Array(
vlessBuffer.slice(addressValueIndex, addressValueIndex + 1)
)(0);
addressValueIndex += 1;
addressValue = new TextDecoder().decode(
vlessBuffer.slice(addressValueIndex, addressValueIndex + addressLength)
);
break;
case 3:
addressLength = 16;
const dataView = new DataView(
vlessBuffer.slice(addressValueIndex, addressValueIndex + addressLength)
);
// 2001:0db8:85a3:0000:0000:8a2e:0370:7334
const ipv6 = ();
for (let i = 0; i ipv6.push(dataView.getUint16(i * 2).toString(16));
}
addressValue = ipv6.be part of(‘:’);
// appears no want add () for ipv6
break;
default:
return {
hasError: true,
message: `invild addressType is ${addressType}`,
};
}
if (!addressValue) {
return {
hasError: true,
message: `addressValue is empty, addressType is ${addressType}`,
};
}
return {
hasError: false,
addressRemote: addressValue,
addressType,
portRemote,
rawDataIndex: addressValueIndex + addressLength,
vlessVersion: model,
isUDP,
};
}
/**
*
* @param {import(“@cloudflare/workers-types”).Socket} remoteSocket
* @param {import(“@cloudflare/workers-types”).WebSocket} webSocket
* @param {ArrayBuffer} vlessResponseHeader
* @param null retry
* @param {*} log
*/
async perform remoteSocketToWS(remoteSocket, webSocket, vlessResponseHeader, retry, log) {
// distant–> ws
let remoteChunkCount = 0;
let chunks = ();
/** @kind null */
let vlessHeader = vlessResponseHeader;
let hasIncomingData = false; // examine if remoteSocket has incoming knowledge
await remoteSocket.readable
.pipeTo(
new WritableStream({
begin() {
},
/**
*
* @param {Uint8Array} chunk
* @param {*} controller
*/
async write(chunk, controller) {
hasIncomingData = true;
// remoteChunkCount++;
if (webSocket.readyState !== WS_READY_STATE_OPEN) {
controller.error(
‘webSocket.readyState is just not open, possibly shut’
);
}
if (vlessHeader) {
webSocket.ship(await new Blob((vlessHeader, chunk)).arrayBuffer());
vlessHeader = null;
} else {
// appears no want price restrict this, CF appears repair this??..
// if (remoteChunkCount > 20000) {
// // cf one bundle is 4096 byte(4kb), 4096 * 20000 = 80M
// await delay(1);
// }
webSocket.ship(chunk);
}
},
shut() {
log(`remoteConnection!.readable is shut with hasIncomingData is ${hasIncomingData}`);
// safeCloseWebSocket(webSocket); // no want server shut websocket frist for some case will casue HTTP ERR_CONTENT_LENGTH_MISMATCH problem, consumer will ship shut occasion anyway.
},
abort(purpose) {
console.error(`remoteConnection!.readable abort`, purpose);
},
})
)
.catch((error) => );
// appears is cf join socket have error,
// 1. Socket.closed may have error
// 2. Socket.readable will probably be shut with none knowledge coming
if (hasIncomingData === false && retry) {
log(`retry`)
retry();
}
}
/**
*
* @param {string} base64Str
* @returns
*/
perform base64ToArrayBuffer(base64Str) {
if (!base64Str) {
return { error: null };
}
attempt {
// go use modified Base64 for URL rfc4648 which js atob not assist
base64Str = base64Str.change(/-/g, ‘+’).change(/_/g, ‘/’);
const decode = atob(base64Str);
const arryBuffer = Uint8Array.from(decode, (c) => c.charCodeAt(0));
return { earlyData: arryBuffer.buffer, error: null };
} catch (error) {
return { error };
}
}
/**
* This isn’t actual UUID validation
* @param {string} uuid
*/
perform isValidUUID(uuid) {
const uuidRegex = /^(0-9a-f){8}-(0-9a-f){4}-(4)(0-9a-f){3}-(89ab)(0-9a-f){3}-(0-9a-f){12}$/i;
return uuidRegex.take a look at(uuid);
}
const WS_READY_STATE_OPEN = 1;
const WS_READY_STATE_CLOSING = 2;
/**
* Usually, WebSocket is not going to has exceptions when shut.
* @param {import(“@cloudflare/workers-types”).WebSocket} socket
*/
perform safeCloseWebSocket(socket) {
attempt {
if (socket.readyState === WS_READY_STATE_OPEN || socket.readyState === WS_READY_STATE_CLOSING) {
socket.shut();
}
} catch (error) {
console.error(‘safeCloseWebSocket error’, error);
}
}
const byteToHex = ();
for (let i = 0; i byteToHex.push((i + 256).toString(16).slice(1));
}
perform unsafeStringify(arr, offset = 0) {
return (byteToHex(arr(offset + 0)) + byteToHex(arr(offset + 1)) + byteToHex(arr(offset + 2)) + byteToHex(arr(offset + 3)) + “-” + byteToHex(arr(offset + 4)) + byteToHex(arr(offset + 5)) + “-” + byteToHex(arr(offset + 6)) + byteToHex(arr(offset + 7)) + “-” + byteToHex(arr(offset + 8)) + byteToHex(arr(offset + 9)) + “-” + byteToHex(arr(offset + 10)) + byteToHex(arr(offset + 11)) + byteToHex(arr(offset + 12)) + byteToHex(arr(offset + 13)) + byteToHex(arr(offset + 14)) + byteToHex(arr(offset + 15))).toLowerCase();
}
perform stringify(arr, offset = 0) {
const uuid = unsafeStringify(arr, offset);
if (!isValidUUID(uuid)) {
throw TypeError(“Stringified UUID is invalid”);
}
return uuid;
}
/**
*
* @param {import(“@cloudflare/workers-types”).WebSocket} webSocket
* @param {ArrayBuffer} vlessResponseHeader
* @param {(string)=> void} log
*/
async perform handleUDPOutBound(webSocket, vlessResponseHeader, log) {
let isVlessHeaderSent = false;
const transformStream = new TransformStream({
begin(controller) {
},
remodel(chunk, controller) {
// udp message 2 byte is the the size of udp knowledge
// TODO: this could have bug, beacsue possibly udp chunk will be in two websocket message
for (let index = 0; index const lengthBuffer = chunk.slice(index, index + 2);
const udpPakcetLength = new DataView(lengthBuffer).getUint16(0);
const udpData = new Uint8Array(
chunk.slice(index + 2, index + 2 + udpPakcetLength)
);
index = index + 2 + udpPakcetLength;
controller.enqueue(udpData);
}
},
flush(controller) {
}
});
// solely deal with dns udp for now
transformStream.readable.pipeTo(new WritableStream({
async write(chunk) {
const resp = await fetch(‘https://1.1.1.1/dns-query’,
{
technique: ‘POST’,
headers: {
‘content-type’: ‘utility/dns-message’,
},
physique: chunk,
})
const dnsQueryResult = await resp.arrayBuffer();
const udpSize = dnsQueryResult.byteLength;
// console.log((…new Uint8Array(dnsQueryResult)).map((x) => x.toString(16)));
const udpSizeBuffer = new Uint8Array(((udpSize >> 8) & 0xff, udpSize & 0xff));
if (webSocket.readyState === WS_READY_STATE_OPEN) {
log(`doh success and dns message size is ${udpSize}`);
if (isVlessHeaderSent) {
webSocket.ship(await new Blob((udpSizeBuffer, dnsQueryResult)).arrayBuffer());
} else {
webSocket.ship(await new Blob((vlessResponseHeader, udpSizeBuffer, dnsQueryResult)).arrayBuffer());
isVlessHeaderSent = true;
}
}
}
})).catch((error) => {
log(‘dns udp has error’ + error)
});
const author = transformStream.writable.getWriter();
return {
/**
*
* @param {Uint8Array} chunk
*/
write(chunk) {
author.write(chunk);
}
};
}
/**
*
* @param {string} userID
* @param null hostName
* @returns {string}
*/
perform getVLESSConfig(userID, hostName) {
const vlessMain = `vless://${userID}u0040${hostName}:443?encryption=none&safety=tls&sni=${hostName}&fp=randomized&kind=ws&host=${hostName}&path=%2Fpercent3Fedpercent3D2048#${hostName}`
return `
################################################################
v2ray
—————————————————————
${vlessMain}
—————————————————————
################################################################
clash-meta
—————————————————————
– kind: vless
title: ${hostName}
server: ${hostName}
port: 443
uuid: ${userID}
community: ws
tls: true
udp: false
sni: ${hostName}
client-fingerprint: chrome
ws-opts:
path: “/?ed=2048”
headers:
host: ${hostName}
—————————————————————
################################################################
`;
}
