Tunneling over QUIC: Modern Network Protocol Implementation in Go#

1
// generateTLSConfig creates a self-signed certificate for QUIC server
2
func generateTLSConfig() (*tls.Config, error) {
3
    // Generate RSA private key
4
    key, err := rsa.GenerateKey(rand.Reader, 2048)
5
    if err != nil {
6
        return nil, fmt.Errorf("GenerateKey error: %w", err)
7
    }
8

9
    // Create certificate template
10
    template := x509.Certificate{
11
        SerialNumber: big.NewInt(1),
12
        Subject: pkix.Name{
13
            Organization:  []string{"QUIC Tunnel"},
14
            Country:       []string{"US"},
15
            Province:      []string{""},
16
            Locality:      []string{"San Francisco"},
17
            StreetAddress: []string{""},
18
            PostalCode:    []string{""},
19
        },
20
        NotBefore:    time.Now(),
21
        NotAfter:     time.Now().Add(365 * 24 * time.Hour),
22
        KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
23
        ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
24
        IPAddresses:  []net.IP{net.IPv4(127, 0, 0, 1)},
25
    }
26

27
    // Create certificate
28
    certDER, err := x509.CreateCertificate(rand.Reader, &template, &template, &key.PublicKey, key)
29
    if err != nil {
30
        return nil, fmt.Errorf("CreateCertificate error: %w", err)
31
    }
32

33
    // Encode to PEM format
34
    keyPEM := pem.EncodeToMemory(&pem.Block{
35
        Type:  "RSA PRIVATE KEY",
36
        Bytes: x509.MarshalPKCS1PrivateKey(key),
37
    })
38
    certPEM := pem.EncodeToMemory(&pem.Block{
39
        Type:  "CERTIFICATE",
40
        Bytes: certDER,
41
    })
42

43
    // Create TLS certificate
44
    tlsCert, err := tls.X509KeyPair(certPEM, keyPEM)
45
    if err != nil {
46
        return nil, fmt.Errorf("X509KeyPair error: %w", err)
47
    }
48

49
    return &tls.Config{
50
        Certificates: []tls.Certificate{tlsCert},
51
        NextProtos:   []string{"quic-tunnel"},
52
    }, nil
53
}

1
// startProxy initializes both QUIC and HTTP servers
2
func startProxy(httpAddr, quicAddr string) {
3
    log.Printf("Starting QUIC server on %s", quicAddr)
4

5
    // Start QUIC listener
6
    quicListener, err := startQUICListener(quicAddr)
7
    if err != nil {
8
        log.Fatalf("Failed to start QUIC listener: %v", err)
9
    }
10

11
    // Session management variables
12
    var session quic.Connection
13
    var sessionMu sync.Mutex
14

15
    // HTTP request handler
16
    http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
17
        log.Printf("Received HTTP request for %s", r.URL.Path)
18

19
        // Ensure we have a valid QUIC session
20
        sessionMu.Lock()
21
        if session == nil || session.Context().Err() != nil {
22
            session, err = quicListener.Accept(context.Background())
23
            if err != nil {
24
                sessionMu.Unlock()
25
                http.Error(w, "Failed to accept QUIC session", http.StatusInternalServerError)
26
                return
27
            }
28
            log.Printf("New QUIC session established")
29
        }
30
        sessionMu.Unlock()
31

32
        // Open a new stream for this request
33
        stream, err := session.OpenStreamSync(context.Background())
34
        if err != nil {
35
            http.Error(w, "Failed to open QUIC stream", http.StatusInternalServerError)
36
            return
37
        }
38
        defer stream.Close()
39

40
        // Forward the HTTP request over the QUIC stream
41
        err = r.Write(stream)
42
        if err != nil {
43
            http.Error(w, "Failed to forward request over QUIC", http.StatusInternalServerError)
44
            return
45
        }
46

47
        // Read the response from the QUIC stream
48
        resp, err := http.ReadResponse(bufio.NewReader(stream), r)
49
        if err != nil {
50
            http.Error(w, "Failed to read response from QUIC", http.StatusInternalServerError)
51
            return
52
        }
53
        defer resp.Body.Close()
54

55
        // Write the response back to the original HTTP client
56
        for key, values := range resp.Header {
57
            w.Header().Set(key, strings.Join(values, "; "))
58
        }
59
        w.WriteHeader(resp.StatusCode)
60
        io.Copy(w, resp.Body)
61
    })
62

63
    log.Printf("Starting HTTP server on %s", httpAddr)
64
    log.Fatal(http.ListenAndServe(httpAddr, nil))
65
}
66

67
// startQUICListener creates and configures a QUIC listener
68
func startQUICListener(addr string) (*quic.Listener, error) {
69
    tlsConf, err := generateTLSConfig()
70
    if err != nil {
71
        return nil, err
72
    }
73

74
    return quic.ListenAddr(addr, tlsConf, &quic.Config{
75
        MaxIdleTimeout:  20 * time.Second,
76
        KeepAlivePeriod: 10 * time.Second,
77
    })
78
}

1
// startAgent connects to proxy via QUIC and handles request forwarding
2
func startAgent(quicAddr, forwardAddress string) {
3
    log.Printf("Connecting to QUIC server at %s", quicAddr)
4
    log.Printf("Forwarding to %s", forwardAddress)
5

6
    // Configure TLS for client connection
7
    tlsConf := &tls.Config{
8
        InsecureSkipVerify: true, // Accept self-signed certificates
9
        NextProtos:         []string{"quic-tunnel"},
10
    }
11

12
    // Establish QUIC connection to proxy
13
    session, err := quic.DialAddr(context.Background(), quicAddr, tlsConf, &quic.Config{
14
        MaxIdleTimeout:  20 * time.Second,
15
        KeepAlivePeriod: 10 * time.Second,
16
    })
17
    if err != nil {
18
        log.Fatalf("Failed to dial QUIC address %s: %v", quicAddr, err)
19
    }
20
    defer session.CloseWithError(0, "Agent shutting down")
21

22
    log.Printf("QUIC connection established")
23

24
    // Handle incoming streams
25
    for {
26
        stream, err := session.AcceptStream(context.Background())
27
        if err != nil {
28
            log.Printf("Failed to accept QUIC stream: %v", err)
29
            return
30
        }
31

32
        // Handle each stream in a separate goroutine
33
        go handleQUICStream(stream, forwardAddress)
34
    }
35
}
36

37
// handleQUICStream processes individual QUIC streams
38
func handleQUICStream(stream quic.Stream, forwardAddress string) {
39
    defer stream.Close()
40

41
    log.Printf("Handling new QUIC stream, forwarding to %s", forwardAddress)
42

43
    // Establish connection to target service
44
    conn, err := net.Dial("tcp", forwardAddress)
45
    if err != nil {
46
        log.Printf("Failed to connect to forward address %s: %v", forwardAddress, err)
47
        return
48
    }
49
    defer conn.Close()
50

51
    // Start bidirectional data relay
52
    if err := startRelay(conn, stream); err != nil {
53
        log.Printf("Relay error: %v", err)
54
    }
55
}

1
// relay copies data from source to destination
2
func relay(src io.ReadCloser, dst io.Writer, stop chan error) {
3
    defer src.Close()
4
    _, err := io.Copy(dst, src)
5
    stop <- err
6
}
7

8
// startRelay manages bidirectional data flow
9
func startRelay(src io.ReadWriteCloser, dst io.ReadWriteCloser) error {
10
    stop := make(chan error, 2)
11

12
    // Start relaying in both directions
13
    go relay(src, dst, stop)
14
    go relay(dst, src, stop)
15

16
    // Wait for either direction to complete or error
17
    return <-stop
18
}

1
type ConnectionPool struct {
2
    sessions map[string]quic.Connection
3
    mutex    sync.RWMutex
4
}
5

6
func (cp *ConnectionPool) GetSession(addr string) (quic.Connection, error) {
7
    cp.mutex.RLock()
8
    session, exists := cp.sessions[addr]
9
    cp.mutex.RUnlock()
10

11
    if exists && session.Context().Err() == nil {
12
        return session, nil
13
    }
14

15
    // Create new session
16
    cp.mutex.Lock()
17
    defer cp.mutex.Unlock()
18

19
    session, err := quic.DialAddr(context.Background(), addr, tlsConf, quicConfig)
20
    if err != nil {
21
        return nil, err
22
    }
23

24
    cp.sessions[addr] = session
25
    return session, nil
26
}

1
type LoadBalancer struct {
2
    agents   []string
3
    current  int
4
    mutex    sync.Mutex
5
}
6

7
func (lb *LoadBalancer) NextAgent() string {
8
    lb.mutex.Lock()
9
    defer lb.mutex.Unlock()
10

11
    agent := lb.agents[lb.current]
12
    lb.current = (lb.current + 1) % len(lb.agents)
13
    return agent
14
}

1
func (a *Agent) maintainConnection() {
2
    for {
3
        if err := a.connect(); err != nil {
4
            log.Printf("Connection failed: %v, retrying in 5 seconds", err)
5
            time.Sleep(5 * time.Second)
6
            continue
7
        }
8

9
        a.handleStreams()
10
        log.Printf("Connection lost, attempting to reconnect")
11
    }
12
}

1
type Metrics struct {
2
    ConnectionsActive   int64
3
    RequestsTotal       int64
4
    RequestsDuration    time.Duration
5
    BytesTransferred   int64
6
}
7

8
func (m *Metrics) RecordRequest(duration time.Duration, bytes int64) {
9
    atomic.AddInt64(&m.RequestsTotal, 1)
10
    atomic.AddInt64(&m.BytesTransferred, bytes)
11
    // Update duration with proper synchronization
12
}

1
func createProductionTLSConfig() *tls.Config {
2
    return &tls.Config{
3
        InsecureSkipVerify: false,
4
        ServerName:         "your-tunnel-server.com",
5
        NextProtos:         []string{"quic-tunnel"},
6
        MinVersion:         tls.VersionTLS13,
7
    }
8
}

1
func authenticateClient(stream quic.Stream) bool {
2
    // Read authentication token
3
    token := make([]byte, 32)
4
    n, err := stream.Read(token)
5
    if err != nil || n != 32 {
6
        return false
7
    }
8

9
    // Validate token
10
    return validateToken(string(token))
11
}

1
type RateLimiter struct {
2
    requests map[string][]time.Time
3
    mutex    sync.Mutex
4
    limit    int
5
    window   time.Duration
6
}
7

8
func (rl *RateLimiter) Allow(clientIP string) bool {
9
    rl.mutex.Lock()
10
    defer rl.mutex.Unlock()
11

12
    now := time.Now()
13
    requests := rl.requests[clientIP]
14

15
    // Remove old requests
16
    var validRequests []time.Time
17
    for _, req := range requests {
18
        if now.Sub(req) < rl.window {
19
            validRequests = append(validRequests, req)
20
        }
21
    }
22

23
    if len(validRequests) >= rl.limit {
24
        return false
25
    }
26

27
    validRequests = append(validRequests, now)
28
    rl.requests[clientIP] = validRequests
29
    return true
30
}

1
graph TB
2
    subgraph "Performance Metrics"
3
        subgraph "Connection Setup"
4
            TCP_SETUP[TCP: 3 RTT] --> QUIC_SETUP[QUIC: 1 RTT]
5
        end
6

7
        subgraph "Packet Loss Recovery"
8
            TCP_LOSS[TCP: Blocks entire stream] --> QUIC_LOSS[QUIC: Per-stream recovery]
9
        end
10

11
        subgraph "Multiplexing"
12
            TCP_MUX[TCP: Single stream] --> QUIC_MUX[QUIC: Multiple streams]
13
        end
14
    end
15

16
    style QUIC_SETUP fill:#c8e6c9
17
    style QUIC_LOSS fill:#c8e6c9
18
    style QUIC_MUX fill:#c8e6c9
19
    style TCP_SETUP fill:#ffcdd2
20
    style TCP_LOSS fill:#ffcdd2
21
    style TCP_MUX fill:#ffcdd2

1
# Dockerfile
2
FROM golang:1.21-alpine AS builder
3
WORKDIR /app
4
COPY . .
5
RUN go mod tidy && go build -o tunnel .
6

7
FROM alpine:latest
8
RUN apk --no-cache add ca-certificates
9
WORKDIR /root/
10
COPY --from=builder /app/tunnel .
11
EXPOSE 3333 8080
12
CMD ["./tunnel"]

1
type ServiceRegistry struct {
2
    services map[string][]string
3
    mutex    sync.RWMutex
4
}
5

6
func (sr *ServiceRegistry) RegisterService(name, address string) {
7
    sr.mutex.Lock()
8
    defer sr.mutex.Unlock()
9

10
    sr.services[name] = append(sr.services[name], address)
11
}
12

13
func (sr *ServiceRegistry) GetService(name string) string {
14
    sr.mutex.RLock()
15
    defer sr.mutex.RUnlock()
16

17
    services := sr.services[name]
18
    if len(services) == 0 {
19
        return ""
20
    }
21

22
    // Simple round-robin selection
23
    return services[rand.Intn(len(services))]
24
}

1
func startHTTP3Server(addr string, tlsConf *tls.Config) {
2
    server := &http3.Server{
3
        Handler:    http.DefaultServeMux,
4
        Addr:       addr,
5
        TLSConfig:  tlsConf,
6
    }
7

8
    log.Fatal(server.ListenAndServe())
9
}

1
type ProtocolNegotiator struct {
2
    supportedProtocols []string
3
}
4

5
func (pn *ProtocolNegotiator) NegotiateProtocol(clientProtocols []string) string {
6
    for _, clientProto := range clientProtocols {
7
        for _, supportedProto := range pn.supportedProtocols {
8
            if clientProto == supportedProto {
9
                return clientProto
10
            }
11
        }
12
    }
13
    return "quic-tunnel-v1" // fallback
14
}