RoyirinRosmontis/Private-Proxy
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 21 Wiki Activity

feat(lite): merge TUN mode with IPv6 routing

Browse Source
This commit is contained in:
RoyirinRosmontis
2026-09-19 03:41:41 +08:00
parent 3e29012d9c
commit 50364dc17a
23 changed files with 2996 additions and 237 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lite/rrpp_core/dns_observer.py
+152
View File
@@ -0,0 +1,152 @@
"""轻量 DNS 观察器，用于把 TUN 里的目标 IP 关联回解析域名。
TUN 送到 SOCKS5 的请求通常只带目标 IP。这里观察经 UoT 或直连的
UDP DNS 回包，保存短期的 ``IP -> 域名`` 映射供分流和日志使用。
"""
from __future__ import annotations
import ipaddress
import struct
import threading
import time
from typing import Callable
def _read_name(packet: bytes, offset: int) -> tuple[str, int]:
labels: list[str] = []
cursor = offset
next_offset = None
jumps = 0
while True:
if cursor >= len(packet):
raise ValueError("DNS 名称超出数据包")
length = packet[cursor]
if length == 0:
cursor += 1
if next_offset is None:
next_offset = cursor
break
if length & 0xC0 == 0xC0:
if cursor + 1 >= len(packet):
raise ValueError("DNS 压缩指针不完整")
pointer = ((length & 0x3F) << 8) | packet[cursor + 1]
if next_offset is None:
next_offset = cursor + 2
cursor = pointer
jumps += 1
if jumps > 16:
raise ValueError("DNS 名称压缩指针循环")
continue
if length > 63 or cursor + 1 + length > len(packet):
raise ValueError("DNS 标签不完整")
labels.append(packet[cursor + 1:cursor + 1 + length].decode("idna"))
cursor += 1 + length
return ".".join(labels).rstrip(".").lower(), int(next_offset)
def _question(packet: bytes) -> tuple[int, str, int]:
if len(packet) < 12:
raise ValueError("DNS 头不完整")
txid, flags, questions, _answers, _authority, _additional = struct.unpack(
"!HHHHHH", packet[:12]
)
if flags & 0x8000 or questions < 1:
raise ValueError("不是 DNS 查询")
name, offset = _read_name(packet, 12)
if offset + 4 > len(packet):
raise ValueError("DNS 问题段不完整")
return txid, name, offset + 4
class DnsObserver:
def __init__(self, log: Callable[[str], None] | None = None,
max_ttl: int = 300):
self.log = log or (lambda _message: None)
self.max_ttl = max(1, int(max_ttl))
self._lock = threading.RLock()
self._domain_to_ips: dict[str, tuple[float, tuple[str, ...]]] = {}
# 一个 CDN IP 可能同时服务多个域名；不能把最后一次 DNS 回包当成唯一身份。
self._ip_to_domains: dict[str, tuple[float, set[str]]] = {}
def observe_query(self, packet: bytes) -> str | None:
try:
_txid, domain, _ = _question(packet)
return domain or None
except (ValueError, UnicodeError):
return None
def observe_response(self, packet: bytes) -> tuple[str, tuple[str, ...]] | None:
try:
if len(packet) < 12:
raise ValueError("DNS 头不完整")
_txid, flags, questions, answers, _authority, _additional = struct.unpack(
"!HHHHHH", packet[:12]
)
if not (flags & 0x8000) or questions < 1:
raise ValueError("不是 DNS 回包")
domain, offset = _read_name(packet, 12)
if offset + 4 > len(packet):
raise ValueError("DNS 问题段不完整")
offset += 4
ips: list[str] = []
ttl = self.max_ttl
for _ in range(answers):
_owner, offset = _read_name(packet, offset)
if offset + 10 > len(packet):
raise ValueError("DNS 答案头不完整")
rtype, rclass, record_ttl, size = struct.unpack(
"!HHIH", packet[offset:offset + 10]
)
offset += 10
if offset + size > len(packet):
raise ValueError("DNS 答案数据不完整")
raw = packet[offset:offset + size]
offset += size
if rclass != 1 or rtype not in (1, 28):
continue
if (rtype == 1 and size != 4) or (rtype == 28 and size != 16):
continue
ips.append(str(ipaddress.ip_address(raw)))
ttl = min(ttl, max(1, int(record_ttl)))
if not domain or not ips:
return None
expires = time.monotonic() + min(ttl, self.max_ttl)
unique = tuple(dict.fromkeys(ips))
with self._lock:
self._domain_to_ips[domain] = (expires, unique)
for ip in unique:
previous = self._ip_to_domains.get(ip)
domains = set(previous[1]) if previous and previous[0] > time.monotonic() else set()
domains.add(domain)
self._ip_to_domains[ip] = (expires, domains)
return domain, unique
except (ValueError, UnicodeError, OSError):
return None
def lookup_ip(self, ip: str) -> str | None:
try:
normalized = str(ipaddress.ip_address(ip))
except ValueError:
return None
now = time.monotonic()
with self._lock:
item = self._ip_to_domains.get(normalized)
if not item:
return None
if item[0] <= now:
self._ip_to_domains.pop(normalized, None)
return None
return next(iter(item[1])) if len(item[1]) == 1 else None
def lookup_domain(self, domain: str) -> tuple[str, ...]:
key = str(domain).rstrip(".").lower()
now = time.monotonic()
with self._lock:
item = self._domain_to_ips.get(key)
if not item:
return ()
if item[0] <= now:
self._domain_to_ips.pop(key, None)
return ()
return item[1]
lite/rrpp_core/socks_bridge.py
+843
View File
@@ -0,0 +1,843 @@
"""本地 SOCKS5 → HTTP CONNECT/UoT v2 桥接。
tun2socks 只需要一个标准 SOCKS5 出口；TCP 连接转成当前节点的 HTTP
CONNECT，UDP 连接转成 magic address 上的 UoT v2 流。系统代理设置完全不参与。
"""
from __future__ import annotations
import base64
import ipaddress
import select
import socket
import ssl
import struct
import threading
from typing import Any, Callable
from .dns_observer import DnsObserver
from .uot_protocol import (
Address, MAGIC_ADDRESS, encode_datagram_frame, encode_request,
read_datagram_frame,
)
# relay 的内网监听端口与外层 CONNECT 端口是两个概念：nginx 接收
# CONNECT magic-host:443 后，将字节流转发到 127.0.0.1:15201。
DEFAULT_UOT_RELAY_PORT = 15201
DEFAULT_UOT_CONNECT_PORT = 443
def _recv_exact(stream: socket.socket, size: int) -> bytes:
"""按 SOCKS5/TCP 协议长度读取，不能假设一次 recv 就拿全。"""
data = bytearray()
while len(data) < size:
chunk = stream.recv(size - len(data))
if not chunk:
raise ConnectionError("SOCKS5 连接在握手中断开")
data.extend(chunk)
return bytes(data)
def _node_http(node: dict[str, Any]) -> tuple[str, int, str, str]:
methods = (node.get("methods") or {}).get("http") or {}
host = str(node.get("domain") or "").strip()
port = methods.get("port") or node.get("port") or 443
username = methods.get("username") or node.get("username") or ""
password = methods.get("password") or node.get("password") or ""
if not host:
raise ValueError("节点缺少 HTTP CONNECT 地址")
return host, int(port), str(username), str(password)
def _node_uot_connect_port(node: dict[str, Any]) -> int:
"""返回 magic CONNECT 的对外端口，不能使用 0。"""
chain = node.get("_jump_chain") if isinstance(node, dict) else None
if isinstance(chain, list) and chain:
return _node_uot_connect_port(chain[-1])
methods = (node.get("methods") or {}).get("http") or {}
raw = methods.get("uot_connect_port")
if raw is None:
raw = node.get("uot_connect_port")
# 兼容早期把 uot_port 当作 CONNECT 端口的本地配置；服务端 nginx
# 会按 magic host 映射到隐藏的 15201 relay 端口。
if raw is None:
raw = methods.get("uot_port")
if raw is None:
raw = node.get("uot_port")
if raw is None:
raw = DEFAULT_UOT_CONNECT_PORT
port = int(raw)
if not 1 <= port <= 65535:
raise ValueError("UoT CONNECT 端口超出范围")
return port
def _socks_address(stream: socket.socket, kind: int | None = None) -> Address:
# SOCKS5 请求头已经读取过 ATYP 时直接传入；独立解析时才从流中读取。
if kind is None:
kind = _recv_exact(stream, 1)[0]
if kind == 1:
host = socket.inet_ntoa(_recv_exact(stream, 4))
elif kind == 4:
host = socket.inet_ntop(socket.AF_INET6, _recv_exact(stream, 16))
elif kind == 3:
size = _recv_exact(stream, 1)[0]
host = _recv_exact(stream, size).decode("idna")
else:
raise ValueError("SOCKS5 地址类型不支持")
port = struct.unpack("!H", _recv_exact(stream, 2))[0]
return Address(host, port)
def _pack_socks_udp(destination: Address, payload: bytes) -> bytes:
try:
ip = ipaddress.ip_address(destination.host)
except ValueError:
raw = destination.host.encode("idna")
return b"\x00\x00\x00\x03" + bytes([len(raw)]) + raw + struct.pack("!H", destination.port) + payload
atyp = 1 if ip.version == 4 else 4
return b"\x00\x00\x00" + bytes([atyp]) + ip.packed + struct.pack("!H", destination.port) + payload
def _unpack_socks_udp(packet: bytes) -> tuple[Address, bytes]:
if len(packet) < 4 or packet[:2] != b"\x00\x00":
raise ValueError("SOCKS5 UDP 包头无效")
if packet[2] != 0:
# RFC 1928 允许分片，但 tun2socks 当前不会发送分片；静默拼接会把
# 不完整的报文当成 DNS/QUIC 数据，造成更难排查的协议损坏。
raise ValueError("暂不支持 SOCKS5 UDP 分片")
atyp = packet[3]
offset = 4
if atyp == 1:
if len(packet) < offset + 4:
raise ValueError("SOCKS5 UDP IPv4 地址不完整")
host = socket.inet_ntoa(packet[offset:offset + 4]); offset += 4
elif atyp == 4:
if len(packet) < offset + 16:
raise ValueError("SOCKS5 UDP IPv6 地址不完整")
host = socket.inet_ntop(socket.AF_INET6, packet[offset:offset + 16]); offset += 16
elif atyp == 3:
if len(packet) < offset + 1:
raise ValueError("SOCKS5 UDP 域名长度不完整")
size = packet[offset]; offset += 1
if len(packet) < offset + size:
raise ValueError("SOCKS5 UDP 域名地址不完整")
host = packet[offset:offset + size].decode("idna"); offset += size
else:
raise ValueError("SOCKS5 UDP 地址类型不支持")
if len(packet) < offset + 2:
raise ValueError("SOCKS5 UDP 端口不完整")
port = struct.unpack("!H", packet[offset:offset + 2])[0]
return Address(host, port), packet[offset + 2:]
class HttpConnectDialer:
def __init__(self, node: dict[str, Any], timeout: float = 15.0,
source_address: str | None = None,
proxy_addresses: list[tuple] | None = None,
proxy_addresses_by_node: dict[str, list[tuple]] | None = None):
self.node = node
self.timeout = timeout
# TUN 启动后默认路由会指向虚拟网卡。节点本身必须从物理网卡发出，
# 否则上游 CONNECT 会再次进入本地 SOCKS，形成递归回环。
self.source_address = source_address
self.proxy_addresses = proxy_addresses
self.proxy_addresses_by_node = proxy_addresses_by_node or {}
@staticmethod
def _node_key(node: dict[str, Any]) -> str:
methods = (node.get("methods") or {}).get("http") or {}
return "|".join((str(node.get("domain") or ""),
str(methods.get("port") or node.get("port") or 443),
str(methods.get("username") or node.get("username") or "")))
@staticmethod
def _node_credentials(node: dict[str, Any]) -> tuple[str, str]:
methods = (node.get("methods") or {}).get("http") or {}
username = methods.get("username") or node.get("username") or ""
password = methods.get("password") or node.get("password") or ""
return str(username), str(password)
def _open_proxy_socket(self, host: str, port: int,
addresses: list[tuple] | None = None) -> socket.socket:
addresses = addresses or self.proxy_addresses
if not addresses:
addresses = [item[4] for item in socket.getaddrinfo(
host, port, socket.AF_UNSPEC, socket.SOCK_STREAM)]
last_error: OSError | None = None
for sockaddr in addresses:
family = socket.AF_INET6 if len(sockaddr) == 4 else socket.AF_INET
raw = socket.socket(family, socket.SOCK_STREAM)
try:
raw.settimeout(self.timeout)
if self.source_address:
if family == socket.AF_INET and ":" not in self.source_address:
raw.bind((self.source_address, 0))
elif family == socket.AF_INET6 and ":" in self.source_address:
raw.bind((self.source_address, 0, 0, 0))
raw.connect(sockaddr)
return raw
except OSError as exc:
last_error = exc
raw.close()
if last_error:
raise last_error
raise OSError(f"无法解析 HTTP CONNECT 节点: {host}")
def _jump_addresses(self, node: dict[str, Any]) -> list[tuple] | None:
return self.proxy_addresses_by_node.get(self._node_key(node))
def _open_jump(self, target: Address) -> socket.socket:
"""通过 2-3 个 HTTP CONNECT 节点逐层建立 TLS，再连接最终目标。"""
chain = list(self.node.get("_jump_chain") or [])
if not 2 <= len(chain) <= 3:
raise RuntimeError("跳板链路必须包含 2-3 个节点")
ctx = ssl.create_default_context()
first = chain[0]
first_host, first_port, _username, _password = _node_http(first)
stream = self._open_proxy_socket(
first_host, first_port, self._jump_addresses(first))
try:
stream = ctx.wrap_socket(stream, server_hostname=first_host)
for index, next_node in enumerate(chain[1:], 1):
next_host, next_port, _username, _password = _node_http(next_node)
leftover = _http_connect_over(
stream, chain[index - 1], next_host, next_port, resolve_target=True)
stream = _LayeredTlsTransport(stream, ctx, next_host, leftover)
_http_connect_over(
stream, chain[-1], target.host, target.port, resolve_target=False)
return stream
except Exception:
try:
stream.close()
except OSError:
pass
raise
def open(self, target: Address) -> socket.socket:
if self.node.get("_jump_chain"):
return self._open_jump(target)
host, port, username, password = _node_http(self.node)
raw = self._open_proxy_socket(host, port)
ctx = ssl.create_default_context()
stream = ctx.wrap_socket(raw, server_hostname=host)
authority = f"[{target.host}]:{target.port}" if ":" in target.host else f"{target.host}:{target.port}"
auth = ""
if username or password:
token = base64.b64encode(f"{username}:{password}".encode()).decode("ascii")
auth = f"Authorization: Basic {token}\r\n"
request = (
f"CONNECT {authority} HTTP/1.1\r\n"
f"Host: {authority}\r\n"
f"{auth}Connection: Keep-Alive\r\n\r\n"
).encode("ascii")
stream.sendall(request)
response = b""
while b"\r\n\r\n" not in response and len(response) < 65536:
chunk = stream.recv(4096)
if not chunk:
break
response += chunk
first = response.split(b"\r\n", 1)[0].decode("latin1", "replace")
if not first.startswith(("HTTP/1.1 200", "HTTP/1.0 200")):
stream.close()
raise ConnectionError(f"HTTP CONNECT 失败: {first[:160]}")
return stream
def _resolve_jump_address(host: str, port: int) -> tuple:
infos = socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM)
infos.sort(key=lambda item: 0 if item[0] == socket.AF_INET else 1)
if not infos:
raise OSError(f"无法解析跳板地址: {host}")
return infos[0][4]
def _http_connect_over(transport, proxy_node: dict[str, Any], target_host: str,
target_port: int, *, resolve_target: bool) -> bytes:
"""在当前 TLS 层发送 CONNECT；中间跳板使用解析后的 IP，末跳保留目标名。"""
username, password = HttpConnectDialer._node_credentials(proxy_node)
auth_header = ""
if username or password:
token = base64.b64encode(f"{username}:{password}".encode()).decode("ascii")
auth_header = f"Authorization: Basic {token}\r\n"
if resolve_target:
address = _resolve_jump_address(target_host, target_port)
authority = f"[{address[0]}]:{address[1]}" if ":" in address[0] else f"{address[0]}:{address[1]}"
else:
authority = f"[{target_host}]:{target_port}" if ":" in target_host else f"{target_host}:{target_port}"
request = (
f"CONNECT {authority} HTTP/1.1\r\n"
f"Host: {authority}\r\n"
f"{auth_header}Connection: Keep-Alive\r\n\r\n"
).encode("ascii")
transport.sendall(request)
response = b""
while b"\r\n\r\n" not in response and len(response) < 65536:
chunk = transport.recv(4096)
if not chunk:
break
response += chunk
marker = b"\r\n\r\n"
end = response.find(marker)
first = response.split(b"\r\n", 1)[0].decode("latin-1", "replace")
if not (first.startswith("HTTP/1.1 200") or first.startswith("HTTP/1.0 200")):
raise ConnectionError(f"跳板 CONNECT 失败: {first[:160]}")
return response[end + len(marker):] if end >= 0 else b""
class _LayeredTlsTransport:
"""在已有 TLS 字节流上承载下一层 TLS。"""
def __init__(self, transport, ctx, server_hostname: str, initial: bytes = b""):
self._transport = transport
self._incoming = ssl.MemoryBIO()
self._outgoing = ssl.MemoryBIO()
self._pending = initial
self._ssl = ctx.wrap_bio(
self._incoming, self._outgoing, server_side=False,
server_hostname=server_hostname)
self._handshake()
def _flush(self):
data = self._outgoing.read()
if data:
self._transport.sendall(data)
def _feed(self):
if self._pending:
data, self._pending = self._pending, b""
else:
data = self._transport.recv(16384)
if not data:
raise ConnectionError("分层 TLS 下层连接已关闭")
self._incoming.write(data)
def _handshake(self):
while True:
try:
self._ssl.do_handshake()
self._flush()
return
except ssl.SSLWantReadError:
self._flush()
self._feed()
except ssl.SSLWantWriteError:
self._flush()
def sendall(self, data):
view = memoryview(data)
while view:
try:
written = self._ssl.write(view)
view = view[written:]
self._flush()
except ssl.SSLWantReadError:
self._flush()
self._feed()
except ssl.SSLWantWriteError:
self._flush()
def recv(self, size):
while True:
try:
return self._ssl.read(size)
except ssl.SSLWantReadError:
self._flush()
self._feed()
except ssl.SSLWantWriteError:
self._flush()
def settimeout(self, value):
self._transport.settimeout(value)
def gettimeout(self):
return self._transport.gettimeout()
def close(self):
self._transport.close()
class Socks5Bridge:
def __init__(self, node: dict[str, Any], bypass_lan: bool = True,
route_rules: list[dict[str, Any]] | None = None,
log: Callable[[str], None] | None = None,
source_address: str | None = None,
proxy_addresses: list[tuple] | None = None,
direct_target_resolver: Callable[[str, str, int], tuple[str, int] | None] | None = None,
route_rule_resolver: Callable[[str], dict[str, Any] | None] | None = None,
route_node_resolver: Callable[[dict[str, Any]], dict[str, Any] | None] | None = None,
proxy_addresses_by_node: dict[str, list[tuple]] | None = None,
direct_route_ensurer: Callable[[str], None] | None = None):
self.node = node
self.bypass_lan = bypass_lan
self.route_rules = route_rules or []
self.log = log or (lambda _message: None)
self.source_address = source_address
self.proxy_addresses = proxy_addresses
# 由 main.py 注入 Lite 的同一套 PAC/路由判定，TUN 不复制另一份规则语义。
self.direct_target_resolver = direct_target_resolver
self.route_rule_resolver = route_rule_resolver
self.route_node_resolver = route_node_resolver
self.proxy_addresses_by_node = proxy_addresses_by_node or {}
self.direct_route_ensurer = direct_route_ensurer
self.listener: socket.socket | None = None
self._running = threading.Event()
self._threads: list[threading.Thread] = []
self._up = 0
self._down = 0
self._counter_lock = threading.Lock()
self._dns = DnsObserver(log=self.log)
self._udp_resources: list[socket.socket] = []
self._udp_resources_lock = threading.RLock()
def start(self) -> int:
self.listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.listener.bind(("127.0.0.1", 0))
self.listener.listen(32)
self.listener.settimeout(1)
self._running.set()
thread = threading.Thread(target=self._accept_loop, daemon=True)
thread.start(); self._threads.append(thread)
return self.listener.getsockname()[1]
def _accept_loop(self):
while self._running.is_set() and self.listener:
try:
client, _ = self.listener.accept()
except socket.timeout:
continue
except OSError:
break
thread = threading.Thread(target=self._client, args=(client,), daemon=True)
thread.start(); self._threads.append(thread)
def _client(self, client: socket.socket):
try:
client.settimeout(15)
greeting = _recv_exact(client, 2)
if greeting[0] != 5:
return
methods = _recv_exact(client, greeting[1])
if 0 not in methods:
client.sendall(b"\x05\xff")
return
client.sendall(b"\x05\x00")
header = _recv_exact(client, 4)
if header[0] != 5:
return
command = header[1]
destination = _socks_address(client, header[3])
if command == 1:
self.log(f"[桥接] TCP 目标: {self._target_label(destination)}")
self._tcp(client, destination)
elif command == 3:
self._udp(client)
else:
client.sendall(b"\x05\x07\x00\x01\x00\x00\x00\x00\x00\x00")
except Exception as exc:
# 停止 TUN 时主动关闭仍在转发的连接，Windows 可能返回
# WSAECONNRESET (10054)；这是收尾动作，不应作为用户错误记录。
if self._running.is_set():
self.log(f"[桥接] SOCKS5 请求失败: {exc}")
finally:
try: client.close()
except OSError: pass
def _target_label(self, target: Address) -> str:
host = target.host
try:
ipaddress.ip_address(host)
except ValueError:
ips = self._dns.lookup_domain(host)
resolved = ",".join(ips) if ips else "未知"
return f"domain={host} ip={resolved} port={target.port}"
domain = self._dns.lookup_ip(host) or "未知"
return f"domain={domain} ip={host} port={target.port}"
def _policy_host(self, host: str) -> str:
"""对已观察到的唯一 DNS 映射应用域名规则；实际连接仍使用原目标 IP。"""
try:
ipaddress.ip_address(host)
except ValueError:
return host
return self._dns.lookup_ip(host) or host
def _direct_target(self, host: str, port: int) -> tuple[str, int] | None:
explicit = False
normalized = str(host).rstrip(".").lower()
for rule in self.route_rules:
if not isinstance(rule, dict) or not rule.get("enabled", True):
continue
if str(rule.get("action") or "direct").lower() != "direct":
continue
value = str(rule.get("domain") or rule.get("value") or "").strip().lower().rstrip(".")
if value.startswith("*."):
value = value[2:]
try:
if ipaddress.ip_address(normalized) in ipaddress.ip_network(value, strict=False):
explicit = True
except ValueError:
if normalized == value or normalized.endswith("." + value):
explicit = True
if explicit:
break
if not self.bypass_lan and not explicit:
return None
try:
address = ipaddress.ip_address(host)
return (host, port) if explicit or address.is_private else None
except ValueError:
try:
for item in socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM):
address = item[4][0].split("%", 1)[0]
if explicit or ipaddress.ip_address(address).is_private:
return address, port
except OSError:
pass
return None
def _route_rule(self, host: str, original_host: str | None = None) -> dict[str, Any] | None:
if self.route_rule_resolver is not None:
try:
rule = self.route_rule_resolver(host)
if isinstance(rule, dict):
return rule
if original_host and original_host != host:
rule = self.route_rule_resolver(original_host)
if isinstance(rule, dict):
return rule
except Exception as exc:
self.log(f"[路由] 规则判断失败: {exc}")
for rule in self.route_rules:
if not isinstance(rule, dict) or not rule.get("enabled", True):
continue
value = str(rule.get("domain") or rule.get("value") or "").strip().lower().rstrip(".")
normalized = str(host).rstrip(".").lower()
base = value[2:] if value.startswith("*.") else value
if base and (normalized == base or normalized.endswith("." + base)):
return rule
return None
def _direct_target_for(self, host: str, port: int,
policy_host: str | None = None) -> tuple[str, int] | None:
policy_host = policy_host or self._policy_host(host)
rule = self._route_rule(policy_host, host)
action = str((rule or {}).get("action") or "").lower()
if action == "node":
return None
if self.direct_target_resolver is not None:
try:
return self.direct_target_resolver(policy_host, host, port)
except Exception as exc:
self.log(f"[路由] PAC 直连判断失败: {exc}")
return None
if action == "direct":
return (host, port)
return self._direct_target(host, port)
def _route_node(self, rule: dict[str, Any] | None) -> dict[str, Any] | None:
if not rule or str(rule.get("action") or "").lower() != "node":
return None
if self.route_node_resolver is None:
return None
try:
node = self.route_node_resolver(rule)
return node if isinstance(node, dict) else None
except Exception as exc:
self.log(f"[路由] 固定节点解析失败: {exc}")
return None
@staticmethod
def _node_key(node: dict[str, Any]) -> str:
chain = node.get("_jump_chain")
if isinstance(chain, list) and chain:
return "jump|" + ">".join(
Socks5Bridge._node_key(item) for item in chain if isinstance(item, dict)
)
methods = (node.get("methods") or {}).get("http") or {}
return "|".join((str(node.get("domain") or ""), str(methods.get("port") or node.get("port") or 443),
str(methods.get("username") or node.get("username") or "")))
def _dialer(self, node: dict[str, Any]) -> HttpConnectDialer:
proxy_addresses = self.proxy_addresses
chain = node.get("_jump_chain")
if isinstance(chain, list) and chain:
proxy_addresses = self.proxy_addresses_by_node.get(
self._node_key(chain[0]))
return HttpConnectDialer(
node, source_address=self.source_address,
proxy_addresses=(proxy_addresses if node is self.node else
self.proxy_addresses_by_node.get(self._node_key(node), proxy_addresses)),
proxy_addresses_by_node=self.proxy_addresses_by_node,
)
def _ensure_direct_routes(self, host: str, port: int) -> None:
if self.direct_route_ensurer is None:
return
try:
self.direct_route_ensurer(str(ipaddress.ip_address(host)))
return
except ValueError:
pass
try:
for item in socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM):
self.direct_route_ensurer(str(item[4][0]).split("%", 1)[0])
except OSError:
pass
def _open_target(self, target: Address) -> socket.socket:
policy_host = self._policy_host(target.host)
rule = self._route_rule(policy_host, target.host)
route_node = self._route_node(rule)
if rule and str(rule.get("action") or "").lower() == "node":
if route_node is None:
raise ConnectionError("域名路由指定的节点不可用")
return self._dialer(route_node).open(target)
direct = self._direct_target_for(target.host, target.port, policy_host)
if direct is not None:
self._ensure_direct_routes(direct[0], direct[1])
return socket.create_connection(direct, 15)
return self._dialer(self.node).open(target)
def _tcp(self, client: socket.socket, target: Address):
upstream = self._open_target(target)
upstream.settimeout(None); client.settimeout(None)
client.sendall(b"\x05\x00\x00\x01\x00\x00\x00\x00\x00\x00")
self._relay(client, upstream)
def _relay(self, left: socket.socket, right: socket.socket):
sockets = [left, right]
try:
while self._running.is_set():
readable, _, _ = select.select(sockets, [], [], 1)
for source in readable:
data = source.recv(65536)
if not data: return
target = right if source is left else left
target.sendall(data)
with self._counter_lock:
if source is left: self._up += len(data)
else: self._down += len(data)
finally:
for item in sockets:
try: item.close()
except OSError: pass
def _udp(self, control: socket.socket):
# tun2socks v2.7 在 Windows 上通过 ListenPacket("udp", "")
# 创建 IPv6 wildcard socket（日志形如 [::]:port）。SOCKS5 返回的
# UDP relay 地址必须与这个地址族一致，否则 Windows 会在
# wsasendto 阶段以 WSAEINVAL 拒绝向 127.0.0.1:port 发包。
# 优先使用 IPv6 loopback；老系统没有 IPv6 时再回退 IPv4。
try:
udp = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
udp.bind(("::1", 0))
relay_address = b"\x04" + socket.inet_pton(socket.AF_INET6, "::1")
relay_bind = f"[::1]:{udp.getsockname()[1]}"
except OSError:
udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
udp.bind(("127.0.0.1", 0))
relay_address = b"\x01" + socket.inet_aton("127.0.0.1")
relay_bind = f"127.0.0.1:{udp.getsockname()[1]}"
port = udp.getsockname()[1]
udp.settimeout(1)
with self._udp_resources_lock:
self._udp_resources.append(udp)
control.sendall(b"\x05\x00\x00" + relay_address + struct.pack("!H", port))
self.log(f"[桥接] SOCKS5 UDP 关联已建立: {relay_bind}")
control.settimeout(1)
streams: dict[str, socket.socket] = {}
direct_flows: dict[tuple[str, int], tuple[socket.socket, tuple, Address]] = {}
malformed = 0
try:
while self._running.is_set():
try:
packet, peer = udp.recvfrom(65535)
except socket.timeout:
try:
if not control.recv(1): break
except socket.timeout:
continue
continue
try:
destination, payload = _unpack_socks_udp(packet)
except Exception as exc:
malformed += 1
if malformed <= 5:
self.log(
f"[桥接] SOCKS5 UDP 数据包解析失败: {exc} len={len(packet)}"
)
continue
if malformed:
malformed = 0
if not streams and not direct_flows:
self.log(
f"[桥接] SOCKS5 UDP 数据报: target={destination.host}:{destination.port} "
f"bytes={len(payload)}"
)
if destination.port == 53:
domain = self._dns.observe_query(payload)
if domain:
self.log(
f"[DNS] 查询: domain={domain} server={destination.host}:{destination.port}"
)
policy_host = self._policy_host(destination.host)
rule = self._route_rule(policy_host, destination.host)
route_node = self._route_node(rule)
if rule and str(rule.get("action") or "").lower() == "node" and route_node is None:
raise ConnectionError("UDP 域名路由指定的节点不可用")
direct = None if route_node is not None else self._direct_target_for(
destination.host, destination.port, policy_host)
if direct is not None:
key = (str(direct[0]), int(direct[1]))
flow = direct_flows.get(key)
if flow is None:
flow_socket, sockaddr = self._open_direct_udp(direct)
flow = (flow_socket, sockaddr, destination)
direct_flows[key] = flow
threading.Thread(
target=self._direct_udp_reader,
args=(flow_socket, udp, destination, peer),
daemon=True,
).start()
self.log(f"[UDP] 直连通道: target={destination.host}:{destination.port}")
flow_socket, direct_addr, _flow_destination = flow
flow_socket.sendto(payload, direct_addr)
with self._counter_lock:
self._up += len(payload)
continue
selected_node = route_node or self.node
stream_key = self._node_key(selected_node)
stream = streams.get(stream_key)
if stream is None:
self.log(
f"[UoT] 建立 UDP 通道: target={destination.host}:{destination.port}"
+ ("（固定节点）" if route_node is not None else "")
)
stream = self._dialer(selected_node).open(
Address(MAGIC_ADDRESS, _node_uot_connect_port(selected_node))
)
stream.settimeout(None)
stream.sendall(encode_request(False, destination))
streams[stream_key] = stream
with self._udp_resources_lock:
self._udp_resources.append(stream)
threading.Thread(
target=self._uot_reader, args=(stream, udp, peer), daemon=True
).start()
# UoT v2 non-connect 模式每个数据报都带目标地址。
stream.sendall(encode_datagram_frame(destination, payload))
with self._counter_lock:
self._up += len(payload)
finally:
udp.close()
for stream in streams.values():
try:
stream.close()
except OSError:
pass
for flow_socket, _sockaddr, _destination in direct_flows.values():
try:
flow_socket.close()
except OSError:
pass
with self._udp_resources_lock:
self._udp_resources = [
item for item in self._udp_resources
if item is not udp and item not in streams.values()
]
def _open_direct_udp_target(self, target: tuple[str, int]) -> tuple[socket.socket, tuple]:
host, port = target
last_error = None
for item in socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_DGRAM):
family, socktype, proto, _canonname, sockaddr = item
raw = socket.socket(family, socktype, proto)
try:
destination_ip = str(sockaddr[0]).split("%", 1)[0]
if self.direct_route_ensurer is not None:
self.direct_route_ensurer(destination_ip)
is_loopback = False
try:
is_loopback = ipaddress.ip_address(destination_ip).is_loopback
except ValueError:
pass
if (family == socket.AF_INET and self.source_address and ":" not in self.source_address
and not is_loopback):
raw.bind((self.source_address, 0))
elif (family == socket.AF_INET6 and self.source_address and ":" in self.source_address
and not is_loopback):
raw.bind((self.source_address, 0, 0, 0))
if family == socket.AF_INET:
try:
raw.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1)
except OSError:
pass
raw.settimeout(1)
return raw, sockaddr
except OSError as exc:
last_error = exc
raw.close()
raise last_error or OSError(f"无法解析 UDP 目标: {host}")
def _open_direct_udp(self, target: tuple[str, int]) -> tuple[socket.socket, tuple]:
raw, sockaddr = self._open_direct_udp_target(target)
# 解析后的 sockaddr 直接用于 sendto，保留 IPv6 scope id。
return raw, sockaddr
def _direct_udp_reader(self, raw: socket.socket, udp: socket.socket,
destination: Address, peer):
try:
while self._running.is_set():
try:
payload, _source = raw.recvfrom(65535)
except socket.timeout:
continue
if not payload:
continue
if destination.port == 53:
observed = self._dns.observe_response(payload)
if observed:
domain, ips = observed
self.log(f"[DNS] 直连回包: domain={domain} ip={','.join(ips)}")
udp.sendto(_pack_socks_udp(destination, payload), peer)
with self._counter_lock:
self._down += len(payload)
except OSError:
pass
def _uot_reader(self, stream, udp, peer):
try:
while self._running.is_set():
destination, payload = read_datagram_frame(stream)
observed = self._dns.observe_response(payload)
if observed:
domain, ips = observed
self.log(f"[DNS] 回包: domain={domain} ip={','.join(ips)}")
udp.sendto(_pack_socks_udp(destination, payload), peer)
with self._counter_lock: self._down += len(payload)
except Exception as exc:
if self._running.is_set():
self.log(f"[UoT] UDP 回包读取失败: {exc}")
def stop(self):
self._running.clear()
if self.listener:
try: self.listener.close()
except OSError: pass
self.listener = None
with self._udp_resources_lock:
resources = list(self._udp_resources)
self._udp_resources.clear()
for resource in resources:
try:
resource.close()
except OSError:
pass
def traffic(self) -> tuple[int, int, int, int]:
with self._counter_lock:
return self._up, self._down, self._up, self._down
lite/rrpp_core/system_proxy_mode.py
+137
View File
@@ -0,0 +1,137 @@
"""Windows 系统代理模式：注册表切换、原状态保存与异常退出恢复。"""
from __future__ import annotations
import ctypes
import re
from typing import Callable
PROXY_REG = r"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
BACKUP_KEY = "prev_proxy_state"
_VALUE_NAMES = ("ProxyEnable", "ProxyServer", "ProxyOverride", "AutoConfigURL")
def is_our_pac_url(value: str) -> bool:
return bool(re.fullmatch(r"http://127\.0\.0\.1:\d+/proxy\.pac", str(value).strip()))
def notify_proxy_change() -> None:
"""通知 WinINET 和顶层窗口重新读取系统代理。"""
try:
ctypes.windll.Wininet.InternetSetOptionW(None, 39, None, 0)
ctypes.windll.Wininet.InternetSetOptionW(None, 37, None, 0)
result = ctypes.c_ulong()
ctypes.windll.user32.SendMessageTimeoutW(
0xFFFF, 0x001A, 0, ctypes.c_wchar_p("InternetSettings"),
0x0002, 5000, ctypes.byref(result))
except Exception:
pass
class SystemProxyMode:
def __init__(self, *, run: Callable, settings_load: Callable,
settings_save: Callable, log: Callable,
endpoint: Callable[[], tuple[str, int]],
proxy_override: Callable[[bool], str]):
self.run = run
self.settings_load = settings_load
self.settings_save = settings_save
self.log = log
self.endpoint = endpoint
self.proxy_override = proxy_override
self._previous = None
def reg_query(self, name: str):
result = self.run(["reg", "query", PROXY_REG, "/v", name], warn=False)
if result.returncode:
return None
for line in (result.stdout or "").splitlines():
parts = line.strip().split(None, 2)
if len(parts) >= 3 and parts[0].lower() == name.lower():
return parts[1], parts[2]
return None
def _backup(self):
if self._previous is not None:
return
state = {name: list(value) if (value := self.reg_query(name)) else None
for name in _VALUE_NAMES}
self._previous = state
try:
self.settings_save({**self.settings_load(), BACKUP_KEY: state})
except Exception:
pass
def _restore(self):
state = self._previous
if state is None:
state = self.settings_load().get(BACKUP_KEY)
if isinstance(state, dict):
for name in _VALUE_NAMES:
value = state.get(name)
if value:
self.run(["reg", "add", PROXY_REG, "/v", name, "/t", value[0],
"/d", value[1], "/f"], warn=False)
else:
self.run(["reg", "delete", PROXY_REG, "/v", name, "/f"], warn=False)
self.log("已恢复开启代理前的系统代理设置")
else:
for name in ("ProxyServer", "ProxyOverride", "AutoConfigURL"):
self.run(["reg", "delete", PROXY_REG, "/v", name, "/f"], warn=False)
self.run(["reg", "add", PROXY_REG, "/v", "ProxyEnable", "/t",
"REG_DWORD", "/d", "0", "/f"])
self._previous = None
try:
data = self.settings_load()
if BACKUP_KEY in data:
del data[BACKUP_KEY]
self.settings_save(data)
except Exception:
pass
def enable(self, pac_url=None, bypass_lan=False):
self._backup()
if pac_url:
self.run(["reg", "add", PROXY_REG, "/v", "ProxyEnable", "/t",
"REG_DWORD", "/d", "0", "/f"])
for name in ("ProxyServer", "ProxyOverride"):
self.run(["reg", "delete", PROXY_REG, "/v", name, "/f"], warn=False)
self.run(["reg", "add", PROXY_REG, "/v", "AutoConfigURL", "/t",
"REG_SZ", "/d", pac_url, "/f"])
self.log("系统代理已设置 (PAC)")
else:
host, port = self.endpoint()
address = f"{host}:{port}"
self.run(["reg", "add", PROXY_REG, "/v", "ProxyEnable", "/t",
"REG_DWORD", "/d", "1", "/f"])
self.run(["reg", "add", PROXY_REG, "/v", "ProxyServer", "/t",
"REG_SZ", "/d", address, "/f"])
self.run(["reg", "add", PROXY_REG, "/v", "ProxyOverride", "/t",
"REG_SZ", "/d", self.proxy_override(bypass_lan), "/f"])
self.log(f"系统代理已设置: {address}")
notify_proxy_change()
def disable(self):
self._restore()
notify_proxy_change()
def is_on(self):
host, port = self.endpoint()
enabled = self.reg_query("ProxyEnable")
try:
fixed_enabled = bool(enabled and int(str(enabled[1]).strip(), 0) == 1)
except (TypeError, ValueError):
fixed_enabled = False
if fixed_enabled:
server = self.reg_query("ProxyServer")
return bool(server and (server[1] or "").strip() == f"{host}:{port}")
pac = self.reg_query("AutoConfigURL")
return bool(pac) and is_our_pac_url(pac[1] or "")
def is_stale(self):
host, port = self.endpoint()
server = self.reg_query("ProxyServer")
pac = self.reg_query("AutoConfigURL")
return (bool(server) and (server[1] or "").strip() == f"{host}:{port}") or \
(bool(pac) and is_our_pac_url(pac[1] or ""))
lite/rrpp_core/tun_backend.py
+774
View File
@@ -0,0 +1,774 @@
"""路线 B 的 Windows TUN 后端：tun2socks + 自有 SOCKS5/UoT 桥接。
这里不启动 sing-box。tun2socks 只负责 Wintun 和用户态 TCP/IP 栈，
所有上游协议由本项目的 ``socks_bridge`` 处理：TCP 使用 HTTP CONNECT，
UDP 使用裸 UoT v2。
"""
from __future__ import annotations
import ctypes
import ipaddress
import json
import os
import shutil
import socket
import subprocess
import sys
import threading
import time
from pathlib import Path
from typing import Any, Callable
from .socks_bridge import Socks5Bridge
class TunBackendError(RuntimeError):
"""TUN 后端无法启动或停止。"""
class TunBackend:
def __init__(self, user_dir: str | Path, engine_path: str | Path | None = None,
log: Callable[[str], None] | None = None,
detail_log: Callable[[str], None] | None = None):
self.user_dir = Path(user_dir)
self.engine_path = Path(engine_path) if engine_path else None
self.log = log or (lambda _message: None)
self.detail_log = detail_log or self.log
self._process: subprocess.Popen[str] | None = None
self._bridge: Socks5Bridge | None = None
self._lock = threading.RLock()
self._route_added = False
self._ipv6_route_added = False
self._lan_routes: list[str] = []
self._lan_ipv6_routes: list[str] = []
self._node_routes: list[str] = []
self._node_ipv6_routes: list[str] = []
self._physical_gateway = ""
self._physical_ifindex = ""
self._physical_ipv6_gateway = ""
self._physical_ipv6_ifindex = ""
self._device = "RRPP-TUN"
self._address = "10.255.0.1"
self._ipv6_address = "fd42:7272:5050::1"
self._dns_configured = False
self._tun_dns_servers = ("8.8.8.8", "1.1.1.1")
self._bypass_lan = True
self._cleanup_pending = False
self._state_path = self.user_dir / "tun_state.json"
# Wintun 是三层虚拟接口，默认路由的下一跳使用接口自身地址。
self._gateway = self._address
self._ipv6_gateway = self._ipv6_address
self._recover_stale_state()
@staticmethod
def is_admin() -> bool:
if os.name != "nt":
return True
try:
return bool(ctypes.windll.shell32.IsUserAnAdmin())
except Exception:
return False
def resolve_engine(self) -> Path:
candidates: list[Path] = []
if self.engine_path:
candidates.append(self.engine_path)
# 目录式发布：主 EXE 与 tun2socks.exe、wintun.dll 放在同一目录。
# PyInstaller onefile：主程序会把内置文件解压到 _MEIPASS。
executable_dir = Path(sys.executable).resolve().parent
meipass = getattr(sys, "_MEIPASS", None)
package_dir = Path(__file__).resolve().parents[1]
candidates.extend([
self.user_dir / "tun2socks.exe",
self.user_dir.parent / "tun2socks.exe",
executable_dir / "tun2socks.exe",
Path(meipass) / "tun2socks.exe" if meipass else Path("__rrpp_no_meipass__"),
package_dir / "tun2socks.exe",
package_dir / "runtime" / "tun2socks.exe",
])
found = shutil.which("tun2socks")
if found:
candidates.append(Path(found))
for candidate in candidates:
try:
path = candidate.expanduser().resolve()
except OSError:
continue
if path.is_file():
return path
raise TunBackendError(
"未找到 tun2socks.exe。请将 tun2socks.exe 和 wintun.dll 放在 TUN 程序目录，"
"或在 config.json 的 tun_engine_path 中填写完整路径。"
)
@staticmethod
def _physical_interface() -> str:
command = ["powershell", "-NoProfile", "-Command",
"(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | "
"Where-Object InterfaceAlias -ne 'RRPP-TUN' | "
"Sort-Object RouteMetric | Select-Object -First 1 -ExpandProperty InterfaceAlias)"]
try:
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
value = (result.stdout or "").strip().splitlines()
if value and value[0].strip():
return value[0].strip()
except Exception:
pass
return ""
@staticmethod
def _physical_source_address(interface: str) -> str:
if not interface:
return ""
escaped = interface.replace("'", "''")
command = ["powershell", "-NoProfile", "-Command",
f"(Get-NetIPAddress -InterfaceAlias '{escaped}' -AddressFamily IPv4 "
"-AddressState Preferred | Select-Object -First 1 -ExpandProperty IPAddress)"]
try:
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
value = (result.stdout or "").strip().splitlines()
if value and value[0].strip():
return value[0].strip()
except Exception:
pass
return ""
@staticmethod
def _physical_route_info() -> tuple[str, str]:
"""返回当前物理默认路由的网关和接口索引。"""
command = ["powershell", "-NoProfile", "-Command",
"Get-NetRoute -DestinationPrefix '0.0.0.0/0' | "
"Where-Object InterfaceAlias -ne 'RRPP-TUN' | "
"Sort-Object RouteMetric | Select-Object -First 1 "
"NextHop,InterfaceIndex | ConvertTo-Json -Compress"]
try:
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
data = json.loads((result.stdout or "").strip())
if isinstance(data, dict):
return str(data.get("NextHop") or ""), str(data.get("InterfaceIndex") or "")
except Exception:
pass
return "", ""
@staticmethod
def _physical_ipv6_route_info() -> tuple[str, str]:
"""返回当前物理 IPv6 默认路由的下一跳和接口索引。"""
command = ["powershell", "-NoProfile", "-Command",
"Get-NetRoute -AddressFamily IPv6 -DestinationPrefix '::/0' | "
"Where-Object InterfaceAlias -ne 'RRPP-TUN' | "
"Sort-Object RouteMetric | Select-Object -First 1 "
"NextHop,InterfaceIndex | ConvertTo-Json -Compress"]
try:
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
data = json.loads((result.stdout or "").strip())
if isinstance(data, dict):
return str(data.get("NextHop") or ""), str(data.get("InterfaceIndex") or "")
except Exception:
pass
return "", ""
@staticmethod
def _active_global_ipv6() -> bool | None:
"""返回是否存在公网 IPv6；无法查询时返回 None，避免误报已接管。"""
if os.name != "nt":
return False
command = [
"powershell", "-NoProfile", "-Command",
"@(Get-NetIPAddress -AddressFamily IPv6 -AddressState Preferred | "
"Where-Object { $_.IPAddress -notlike 'fe80:*' -and "
"$_.IPAddress -ne '::1' -and $_.IPAddress -notlike 'fc*' -and "
"$_.IPAddress -notlike 'fd*' }).IPAddress | ConvertTo-Json -Compress",
]
try:
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
if result.returncode:
return None
value = json.loads((result.stdout or "").strip() or "[]")
if isinstance(value, str):
return bool(value.strip())
return bool(value)
except Exception:
return None
@staticmethod
def _resolve_proxy_addresses(node: dict[str, Any]) -> list[tuple]:
methods = (node.get("methods") or {}).get("http") or {}
host = str(node.get("domain") or "").strip()
port = int(methods.get("port") or node.get("port") or 443)
if not host:
return []
addresses: list[tuple] = []
for item in socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM):
if item[4] not in addresses:
addresses.append(item[4])
return addresses
@staticmethod
def _node_chain(node: dict[str, Any]) -> list[dict[str, Any]]:
chain = node.get("_jump_chain") if isinstance(node, dict) else None
if isinstance(chain, list) and chain:
return [item for item in chain if isinstance(item, dict)]
return [node] if isinstance(node, dict) else []
@staticmethod
def _node_key(node: dict[str, Any]) -> str:
methods = (node.get("methods") or {}).get("http") or {}
return "|".join((str(node.get("domain") or ""),
str(methods.get("port") or node.get("port") or 443),
str(methods.get("username") or node.get("username") or "")))
def _add_node_routes(self, proxy_addresses: list[tuple]) -> None:
"""把 HTTP CONNECT 节点固定走物理网卡，防止默认 TUN 路由形成回环。"""
candidates_v4: list[str] = []
candidates_v6: list[str] = []
for sockaddr in proxy_addresses:
address = str(sockaddr[0])
try:
parsed = ipaddress.ip_address(address.split("%", 1)[0])
except ValueError:
continue
target = candidates_v4 if parsed.version == 4 else candidates_v6
normalized = parsed.compressed
if normalized not in target:
target.append(normalized)
if candidates_v4 and not self._physical_ifindex:
raise TunBackendError("找不到物理 IPv4 接口，无法固定代理节点路由")
for address in candidates_v4:
if address in self._node_routes:
continue
command = ["route", "ADD", address, "MASK", "255.255.255.255"]
if self._physical_gateway:
command.append(self._physical_gateway)
command.extend(["METRIC", "1", "IF", self._physical_ifindex])
result = subprocess.run(command, capture_output=True, text=True,
encoding="mbcs", errors="replace", timeout=15)
if result.returncode:
detail = (result.stderr or result.stdout or "").strip()
# 已存在的等价路由不影响启动；其它错误继续暴露，避免静默回环。
if "already exists" not in detail.lower() and "已存在" not in detail:
raise TunBackendError(f"节点物理路由添加失败 ({address}): {detail[:200]}")
continue
self._node_routes.append(address)
self._write_state()
if candidates_v6 and not self._physical_ipv6_ifindex:
# 双栈节点仍可使用 IPv4 地址；只有 IPv6-only 节点需要物理 IPv6 出口。
if candidates_v4:
candidates_v6 = []
else:
raise TunBackendError("代理节点仅包含 IPv6 地址，但找不到物理 IPv6 默认路由")
for address in candidates_v6:
if address in self._node_ipv6_routes:
continue
self._add_ipv6_physical_route(address)
def _add_ipv6_physical_route(self, address: str) -> None:
if not self._physical_ipv6_ifindex:
raise TunBackendError("找不到物理 IPv6 接口，无法固定 IPv6 路由")
command = ["interface", "ipv6", "add", "route", f"prefix={address}/128",
f"interface={self._physical_ipv6_ifindex}"]
if self._physical_ipv6_gateway and self._physical_ipv6_gateway != "::":
command.append(f"nexthop={self._physical_ipv6_gateway}")
command.append("metric=1")
result = subprocess.run(["netsh", *command], capture_output=True, text=True,
encoding="mbcs", errors="replace", timeout=15)
if result.returncode:
detail = (result.stderr or result.stdout or "").strip()
if "already exists" not in detail.lower() and "已存在" not in detail:
raise TunBackendError(f"IPv6 节点物理路由添加失败 ({address}): {detail[:200]}")
return
self._node_ipv6_routes.append(address)
self._write_state()
def _ensure_physical_route(self, address: str) -> None:
"""为 TUN 内部的直连目标补一条物理出口 /32 路由。"""
if os.name != "nt":
return
try:
parsed = ipaddress.ip_address(str(address).split("%", 1)[0])
except ValueError:
return
if parsed.version == 6:
normalized = parsed.compressed
if normalized in self._node_ipv6_routes:
return
self._add_ipv6_physical_route(normalized)
return
if not self._physical_ifindex:
raise TunBackendError("找不到物理 IPv4 接口，无法固定直连路由")
normalized = parsed.compressed
if normalized in self._node_routes:
return
command = ["route", "ADD", normalized, "MASK", "255.255.255.255"]
if self._physical_gateway:
command.append(self._physical_gateway)
command.extend(["METRIC", "1", "IF", self._physical_ifindex])
result = subprocess.run(command, capture_output=True, text=True,
encoding="mbcs", errors="replace", timeout=15)
detail = (result.stderr or result.stdout or "").strip()
if result.returncode:
if "already exists" in detail.lower() or "已存在" in detail:
return
raise TunBackendError(f"直连目标物理路由添加失败 ({normalized}): {detail[:200]}")
self._node_routes.append(normalized)
self._write_state()
@staticmethod
def _cleanup_succeeded(result: subprocess.CompletedProcess[str]) -> bool:
if result.returncode == 0:
return True
detail = (result.stderr or result.stdout or "").strip().lower()
# 清理是幂等操作：路由或网卡已经消失时，目标状态已经达到。
return any(marker in detail for marker in (
"not found", "does not exist", "cannot find", "no such",
"找不到", "不存在", "未找到", "没有找到",
))
def _cleanup_netsh(self, args: list[str]) -> bool:
try:
result = subprocess.run(["netsh", *args], capture_output=True, text=True,
encoding="mbcs", errors="replace", timeout=15)
except Exception as exc:
self.detail_log(f"[TUN] 清理 netsh 失败: {exc}")
return False
if self._cleanup_succeeded(result):
return True
detail = (result.stderr or result.stdout or "").strip()
self.detail_log(f"[TUN] 清理 netsh 未完成: {detail[:300]}")
return False
def _remove_node_routes(self) -> bool:
remaining: list[str] = []
for address in self._node_routes:
try:
result = subprocess.run(["route", "DELETE", address], capture_output=True,
text=True, encoding="mbcs", errors="replace", timeout=15)
except Exception as exc:
self.detail_log(f"[TUN] 清理节点路由失败 ({address}): {exc}")
remaining.append(address)
continue
if not self._cleanup_succeeded(result):
detail = (result.stderr or result.stdout or "").strip()
self.detail_log(f"[TUN] 清理节点路由未完成 ({address}): {detail[:200]}")
remaining.append(address)
self._node_routes = remaining
remaining_v6: list[str] = []
for address in self._node_ipv6_routes:
command = ["interface", "ipv6", "delete", "route", f"prefix={address}/128"]
if self._physical_ipv6_ifindex:
command.append(f"interface={self._physical_ipv6_ifindex}")
try:
result = subprocess.run(["netsh", *command], capture_output=True, text=True,
encoding="mbcs", errors="replace", timeout=15)
except Exception as exc:
self.detail_log(f"[TUN] 清理 IPv6 节点路由失败 ({address}): {exc}")
remaining_v6.append(address)
continue
if not self._cleanup_succeeded(result):
detail = (result.stderr or result.stdout or "").strip()
self.detail_log(f"[TUN] 清理 IPv6 节点路由未完成 ({address}): {detail[:200]}")
remaining_v6.append(address)
self._node_ipv6_routes = remaining_v6
return not remaining and not remaining_v6
def _netsh(self, args: list[str], *, ignore_error: bool = False) -> None:
result = subprocess.run(["netsh", *args], capture_output=True, text=True,
encoding="mbcs", errors="replace", timeout=15)
if result.returncode and not ignore_error:
detail = (result.stderr or result.stdout or "").strip()
raise TunBackendError(f"netsh 操作失败: {detail[:300]}")
def _configure_routes(self) -> None:
for _ in range(20):
try:
probe = subprocess.run(
["powershell", "-NoProfile", "-Command",
f"Get-NetAdapter -Name '{self._device}' -ErrorAction SilentlyContinue"],
capture_output=True, text=True, timeout=3,
)
if probe.stdout and self._device.lower() in probe.stdout.lower():
break
except Exception:
pass
time.sleep(0.25)
else:
raise TunBackendError(f"tun2socks 未创建虚拟网卡: {self._device}")
self._netsh(["interface", "ipv4", "set", "address",
f"name={self._device}", "source=static",
f"addr={self._address}", "mask=255.255.255.252"])
self._netsh(["interface", "ipv4", "add", "route", "0.0.0.0/0",
f"{self._device}", self._gateway, "metric=1"])
self._route_added = True
self._write_state()
self._netsh(["interface", "ipv6", "set", "address",
f"interface={self._device}", f"address={self._ipv6_address}",
"store=active"])
self._netsh(["interface", "ipv6", "add", "route", "prefix=::/0",
f"interface={self._device}", f"nexthop={self._ipv6_gateway}",
"metric=1"])
self._ipv6_route_added = True
self._write_state()
if not self._bypass_lan:
# Windows 物理网卡通常已有更具体的私网路由；补同前缀的 TUN
# 路由，确保“内网也代理”不会在进入 tun2socks 前被物理网卡截走。
for network in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
"169.254.0.0/16"):
self._netsh(["interface", "ipv4", "add", "route", network,
f"{self._device}", self._gateway, "metric=1"])
self._lan_routes.append(network)
self._write_state()
for network in ("fc00::/7",):
self._netsh(["interface", "ipv6", "add", "route", f"prefix={network}",
f"interface={self._device}", f"nexthop={self._ipv6_gateway}",
"metric=1"])
self._lan_ipv6_routes.append(network)
self._write_state()
self._configure_dns()
def _configure_dns(self) -> None:
"""让 Windows DNS 请求也进入 TUN，避免沿用物理网卡 DNS。"""
if os.name != "nt":
return
ipv4 = [item for item in self._tun_dns_servers if ":" not in item]
ipv6 = [item for item in self._tun_dns_servers if ":" in item]
if ipv4:
self._netsh([
"interface", "ipv4", "set", "dnsservers",
f"name={self._device}", "source=static",
f"address={ipv4[0]}", "register=none", "validate=no",
])
for index, secondary in enumerate(ipv4[1:], start=2):
self._netsh([
"interface", "ipv4", "add", "dnsservers",
f"name={self._device}", f"address={secondary}",
f"index={index}", "validate=no",
], ignore_error=True)
if ipv6:
self._netsh([
"interface", "ipv6", "set", "dnsservers",
f"name={self._device}", "source=static",
f"address={ipv6[0]}", "register=none", "validate=no",
], ignore_error=True)
for index, secondary in enumerate(ipv6[1:], start=2):
self._netsh([
"interface", "ipv6", "add", "dnsservers",
f"name={self._device}", f"address={secondary}",
f"index={index}", "validate=no",
], ignore_error=True)
self._dns_configured = True
self._write_state()
def _remove_routes(self) -> None:
cleanup_ok = True
if self._dns_configured:
ipv4_ok = self._cleanup_netsh([
"interface", "ipv4", "set", "dnsservers",
f"name={self._device}", "source=dhcp",
])
ipv6_ok = self._cleanup_netsh([
"interface", "ipv6", "set", "dnsservers",
f"name={self._device}", "source=dhcp",
])
cleanup_ok &= ipv4_ok and ipv6_ok
if ipv4_ok and ipv6_ok:
self._dns_configured = False
if self._route_added:
route_ok = self._cleanup_netsh(["interface", "ipv4", "delete", "route",
"0.0.0.0/0", f"{self._device}", self._gateway])
cleanup_ok &= route_ok
if route_ok:
self._route_added = False
if self._ipv6_route_added:
route_ok = self._cleanup_netsh(["interface", "ipv6", "delete", "route",
"prefix=::/0", f"interface={self._device}",
f"nexthop={self._ipv6_gateway}"])
cleanup_ok &= route_ok
if route_ok:
self._ipv6_route_added = False
remaining_lan: list[str] = []
for network in self._lan_routes:
route_ok = self._cleanup_netsh(["interface", "ipv4", "delete", "route",
network, f"{self._device}", self._gateway])
cleanup_ok &= route_ok
if not route_ok:
remaining_lan.append(network)
self._lan_routes = remaining_lan
remaining_lan_v6: list[str] = []
for network in self._lan_ipv6_routes:
route_ok = self._cleanup_netsh(["interface", "ipv6", "delete", "route",
f"prefix={network}", f"interface={self._device}",
f"nexthop={self._ipv6_gateway}"])
cleanup_ok &= route_ok
if not route_ok:
remaining_lan_v6.append(network)
self._lan_ipv6_routes = remaining_lan_v6
cleanup_ok &= self._remove_node_routes()
self._cleanup_pending = not cleanup_ok
if cleanup_ok:
self._clear_state()
else:
self._write_state()
self.detail_log("[TUN] 部分路由/DNS 清理失败，已保留状态并将在下次启动重试")
def _write_state(self) -> None:
"""记录本进程改过的路由/DNS，强杀后下次启动可恢复。"""
try:
self.user_dir.mkdir(parents=True, exist_ok=True)
payload = {
"device": self._device,
"address": self._address,
"gateway": self._gateway,
"ipv6_address": self._ipv6_address,
"ipv6_gateway": self._ipv6_gateway,
"lan_routes": list(self._lan_routes),
"lan_ipv6_routes": list(self._lan_ipv6_routes),
"bypass_lan": bool(self._bypass_lan),
"physical_gateway": self._physical_gateway,
"physical_ifindex": self._physical_ifindex,
"physical_ipv6_gateway": self._physical_ipv6_gateway,
"physical_ipv6_ifindex": self._physical_ipv6_ifindex,
"node_routes": list(self._node_routes),
"node_ipv6_routes": list(self._node_ipv6_routes),
"route_added": bool(self._route_added),
"ipv6_route_added": bool(self._ipv6_route_added),
"dns_configured": bool(self._dns_configured),
"dns_servers": list(self._tun_dns_servers),
"cleanup_pending": bool(self._cleanup_pending),
"pid": os.getpid(),
}
temp = self._state_path.with_suffix(".tmp")
temp.write_text(json.dumps(payload, ensure_ascii=False), encoding="utf-8")
temp.replace(self._state_path)
except Exception as exc:
self.detail_log(f"[TUN] 状态记录失败: {exc}")
def _clear_state(self) -> None:
try:
self._state_path.unlink(missing_ok=True)
except Exception:
pass
@staticmethod
def _pid_alive(pid: Any) -> bool:
"""避免合并版误清理仍在运行的旧 TUN 实例。"""
if os.name != "nt":
return False
try:
number = int(pid)
if number <= 0:
return False
kernel = ctypes.windll.kernel32
kernel.OpenProcess.argtypes = [ctypes.c_ulong, ctypes.c_bool, ctypes.c_ulong]
kernel.OpenProcess.restype = ctypes.c_void_p
kernel.GetExitCodeProcess.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_ulong)]
kernel.CloseHandle.argtypes = [ctypes.c_void_p]
handle = kernel.OpenProcess(0x1000, False, number)
if not handle:
return False
try:
code = ctypes.c_ulong()
return bool(kernel.GetExitCodeProcess(handle, ctypes.byref(code))
and code.value == 259)
finally:
kernel.CloseHandle(handle)
except (TypeError, ValueError, OSError):
return False
def _recover_stale_state(self) -> None:
"""启动前清理上次崩溃/强杀留下的 RRPP-TUN 路由和 DNS。"""
try:
if not self._state_path.is_file():
return
state = json.loads(self._state_path.read_text(encoding="utf-8"))
if not state.get("cleanup_pending") and self._pid_alive(state.get("pid")):
raise TunBackendError("检测到另一个 TUN 实例仍在运行，请先关闭后再启动")
self._device = str(state.get("device") or self._device)
self._address = str(state.get("address") or self._address)
self._gateway = str(state.get("gateway") or self._gateway)
self._ipv6_address = str(state.get("ipv6_address") or self._ipv6_address)
self._ipv6_gateway = str(state.get("ipv6_gateway") or self._ipv6_gateway)
self._physical_ipv6_gateway = str(state.get("physical_ipv6_gateway") or "")
self._physical_ipv6_ifindex = str(state.get("physical_ipv6_ifindex") or "")
self._route_added = bool(state.get("route_added"))
self._ipv6_route_added = bool(state.get("ipv6_route_added"))
self._lan_routes = [str(item).strip() for item in (state.get("lan_routes") or [])
if str(item).strip()]
self._lan_ipv6_routes = [str(item).strip() for item in (state.get("lan_ipv6_routes") or [])
if str(item).strip()]
self._node_routes = [str(item).strip() for item in (state.get("node_routes") or [])
if str(item).strip()]
self._node_ipv6_routes = [str(item).strip() for item in (state.get("node_ipv6_routes") or [])
if str(item).strip()]
self._dns_configured = bool(state.get("dns_configured"))
self._cleanup_pending = True
self._remove_routes()
if self._cleanup_pending:
self.detail_log("[TUN] 上次异常退出的部分路由/DNS 仍未清理，状态已保留")
else:
self.log("已清理上次异常退出遗留的 TUN 路由和 DNS")
except TunBackendError:
raise
except Exception as exc:
self.detail_log(f"[TUN] 异常退出残留清理失败: {exc}")
def _read_output(self, process: subprocess.Popen[str]) -> None:
if process.stdout is None:
return
try:
for line in process.stdout:
line = line.rstrip()
if line:
self.detail_log(f"[TUN] {line}")
except OSError:
pass
def start(self, node: dict[str, Any], *, bypass_lan: bool = True,
route_rules: list[dict[str, Any]] | None = None,
dns_servers: tuple[str, ...] | list[str] | None = None,
direct_target_resolver: Callable[[str, str, int], tuple[str, int] | None] | None = None,
route_rule_resolver: Callable[[str], dict[str, Any] | None] | None = None,
route_node_resolver: Callable[[dict[str, Any]], dict[str, Any] | None] | None = None,
route_nodes: list[dict[str, Any]] | None = None) -> None:
with self._lock:
if self.status()["running"]:
raise TunBackendError("TUN 已经在运行")
if not self.is_admin():
raise TunBackendError("启动虚拟网卡 TUN 需要管理员权限")
self._bypass_lan = bool(bypass_lan)
if dns_servers is not None:
cleaned = tuple(str(item).strip() for item in dns_servers if str(item).strip())
if not cleaned:
raise TunBackendError("自定义 DNS 不能为空")
try:
for item in cleaned:
socket.inet_pton(socket.AF_INET, item)
except OSError as exc:
raise TunBackendError("当前 TUN 仅支持 IPv4 DNS 服务器") from exc
self._tun_dns_servers = cleaned[:3]
engine = self.resolve_engine()
interface = self._physical_interface()
source_address = self._physical_source_address(interface)
self._physical_gateway, self._physical_ifindex = self._physical_route_info()
self._physical_ipv6_gateway, self._physical_ipv6_ifindex = self._physical_ipv6_route_info()
if not self._physical_ifindex:
raise TunBackendError("找不到物理默认路由，无法保证代理节点不进入 TUN 回环")
if not self._physical_ipv6_ifindex:
self.log("警告：未找到物理 IPv6 默认路由，IPv6 目标将仅尝试通过 IPv4 代理节点转发")
try:
proxy_addresses_by_node: dict[str, list[tuple]] = {}
connection_nodes = [node]
connection_nodes.extend(
(item.get("node") if isinstance(item.get("node"), dict) else item)
for item in (route_nodes or ())
if isinstance(item, dict)
)
for connection_node in connection_nodes:
for hop in self._node_chain(connection_node):
try:
addresses = self._resolve_proxy_addresses(hop)
except OSError as exc:
raise TunBackendError(f"无法解析 HTTP CONNECT 节点地址: {exc}") from exc
if not addresses:
raise TunBackendError("无法解析 HTTP CONNECT 节点地址")
self._add_node_routes(addresses)
proxy_addresses_by_node[self._node_key(hop)] = addresses
first_hop = self._node_chain(node)[0]
proxy_addresses = proxy_addresses_by_node.get(self._node_key(first_hop), [])
if not proxy_addresses:
raise TunBackendError("无法解析 HTTP CONNECT 节点地址")
for route_node in route_nodes or ():
if not isinstance(route_node, dict):
continue
route_value = route_node.get("node") if isinstance(route_node.get("node"), dict) else route_node
for hop in self._node_chain(route_value):
addresses = self._resolve_proxy_addresses(hop)
proxy_addresses_by_node[self._node_key(hop)] = addresses
if not source_address:
self.log("警告：未找到物理网卡 IPv4，节点连接可能无法绕过 TUN")
bridge = Socks5Bridge(
node, bypass_lan=bypass_lan, route_rules=route_rules, log=self.detail_log,
source_address=source_address or None,
proxy_addresses=proxy_addresses,
direct_target_resolver=direct_target_resolver,
route_rule_resolver=route_rule_resolver,
route_node_resolver=route_node_resolver,
proxy_addresses_by_node=proxy_addresses_by_node,
direct_route_ensurer=self._ensure_physical_route,
)
socks_port = bridge.start()
except Exception:
self._remove_routes()
raise
self._bridge = bridge
command = [str(engine), "--device", self._device,
"--proxy", f"socks5://127.0.0.1:{socks_port}"]
# tun2socks 的 Windows socket 选项会把 UDP/TCP socket 绑定到
# --interface 指定的网卡；本项目的 SOCKS relay 在本机回环地址，
# 绑定 WLAN 会让 UDP 回环投递失效。Windows 官方用法也不传该参数。
# 节点连接已经通过物理 /32 路由和 source_address 绕过 TUN，
# 因此 Windows 不需要 --interface；Linux/macOS 仍保留原行为。
if interface and os.name != "nt":
command.extend(["--interface", interface])
self.log(f"本地 SOCKS5 桥接: 127.0.0.1:{socks_port}")
try:
self._process = subprocess.Popen(
command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
text=True, encoding="utf-8", errors="replace",
creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
)
threading.Thread(target=self._read_output, args=(self._process,), daemon=True).start()
time.sleep(0.5)
if self._process.poll() is not None:
raise TunBackendError(f"tun2socks 启动失败，退出码 {self._process.returncode}")
self._configure_routes()
self._write_state()
self.log(f"虚拟网卡 TUN 已启动，进程 PID={self._process.pid}")
except Exception:
bridge.stop()
self._remove_routes()
self._bridge = None
process = self._process
self._process = None
if process is not None and process.poll() is None:
process.terminate()
raise
def stop(self) -> None:
with self._lock:
process = self._process
bridge = self._bridge
self._process = None
self._bridge = None
self._remove_routes()
if process is not None and process.poll() is None:
process.terminate()
try:
process.wait(timeout=10)
except subprocess.TimeoutExpired:
process.kill()
process.wait(timeout=5)
if bridge is not None:
bridge.stop()
if process is not None:
self.log("虚拟网卡 TUN 已停止")
def status(self) -> dict[str, Any]:
with self._lock:
process = self._process
if process is None:
return {"running": False, "pid": None, "exit_code": None}
code = process.poll()
if code is not None:
self._process = None
self._remove_routes()
bridge = self._bridge
self._bridge = None
if bridge is not None:
bridge.stop()
return {"running": False, "pid": process.pid, "exit_code": code}
return {"running": True, "pid": process.pid, "exit_code": None}
def traffic(self) -> tuple[int, int, int, int]:
if self._bridge is None:
return 0, 0, 0, 0
return self._bridge.traffic()
lite/rrpp_core/tun_mode.py
+232
View File
@@ -0,0 +1,232 @@
"""按需提权的 TUN 控制通道；GUI 与管理员工作进程共用同一个入口。"""
from __future__ import annotations
import ctypes
import hmac
import json
import os
import secrets
import socket
import subprocess
import threading
import time
from typing import Any, Callable
WORKER_FLAG = "--rrpp-tun-worker"
_MAX_MESSAGE = 1024 * 1024
class TunModeError(RuntimeError):
pass
def _send(sock: socket.socket, value: dict[str, Any], lock: threading.Lock | None = None) -> None:
payload = (json.dumps(value, ensure_ascii=False, separators=(",", ":")) + "\n").encode("utf-8")
if len(payload) > _MAX_MESSAGE:
raise TunModeError("TUN 控制消息过大")
if lock is None:
sock.sendall(payload)
else:
with lock:
sock.sendall(payload)
def _receive(reader) -> dict[str, Any]:
line = reader.readline(_MAX_MESSAGE + 1)
if not line or len(line) > _MAX_MESSAGE or not line.endswith(b"\n"):
raise TunModeError("TUN 工作进程连接已断开或消息无效")
value = json.loads(line.decode("utf-8"))
if not isinstance(value, dict):
raise TunModeError("TUN 控制消息格式错误")
return value
class TunModeController:
"""普通权限 GUI 仅在首次开启 TUN 时启动管理员工作进程。"""
def __init__(self, command: list[str], log: Callable[[str], None]):
self.command = command
self.log = log
self._lock = threading.RLock()
self._socket: socket.socket | None = None
self._reader = None
def _launch(self, port: int, token: str) -> None:
args = [*self.command[1:], WORKER_FLAG, str(port), token]
if os.name == "nt":
# PyInstaller onefile 的提权子进程必须独立解包，以便 GUI 退出后仍可清理网络。
previous = os.environ.get("PYINSTALLER_RESET_ENVIRONMENT")
os.environ["PYINSTALLER_RESET_ENVIRONMENT"] = "1"
try:
result = ctypes.windll.shell32.ShellExecuteW(
None, "runas", self.command[0], subprocess.list2cmdline(args),
os.path.dirname(os.path.abspath(self.command[0])), 0,
)
finally:
if previous is None:
os.environ.pop("PYINSTALLER_RESET_ENVIRONMENT", None)
else:
os.environ["PYINSTALLER_RESET_ENVIRONMENT"] = previous
if result <= 32:
raise TunModeError("管理员授权已取消或无法启动 TUN 工作进程")
else:
# 非 Windows 仅供无网卡的协议测试；真实 TUN 后端仍限定 Windows。
subprocess.Popen([self.command[0], *args], stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL)
def start(self, payload: dict[str, Any], cancel_event=None) -> None:
with self._lock:
if self._socket is not None:
raise TunModeError("TUN 工作进程已经启动")
token = secrets.token_hex(32)
listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
listener.bind(("127.0.0.1", 0))
listener.listen(2)
deadline = time.monotonic() + 90
try:
self._launch(listener.getsockname()[1], token)
while True:
if cancel_event is not None and cancel_event.is_set():
raise TunModeError("用户取消了开启代理")
remaining = deadline - time.monotonic()
if remaining <= 0:
raise TunModeError("等待 TUN 管理员工作进程超时")
listener.settimeout(min(0.5, remaining))
try:
connection, _peer = listener.accept()
except socket.timeout:
continue
connection.settimeout(3)
reader = connection.makefile("rb")
try:
hello = _receive(reader)
valid = (hello.get("type") == "hello" and
hmac.compare_digest(str(hello.get("token") or ""), token))
except Exception:
valid = False
if valid:
connection.settimeout(120)
self._socket, self._reader = connection, reader
break
reader.close()
connection.close()
if cancel_event is not None and cancel_event.is_set():
raise TunModeError("用户取消了开启代理")
self._request("start", payload)
except Exception:
self.close()
raise
finally:
listener.close()
def _request(self, command: str, payload: dict[str, Any] | None = None) -> Any:
if self._socket is None or self._reader is None:
raise TunModeError("TUN 工作进程未连接")
_send(self._socket, {"command": command, "payload": payload or {}})
while True:
message = _receive(self._reader)
if message.get("type") == "log":
self.log(str(message.get("message") or ""))
continue
if message.get("type") != "result":
raise TunModeError("TUN 工作进程响应无效")
if not message.get("ok"):
raise TunModeError(str(message.get("error") or "TUN 操作失败"))
return message.get("value")
def status(self) -> dict[str, Any]:
with self._lock:
if self._socket is None:
return {"running": False, "pid": None, "exit_code": None}
try:
return self._request("status")
except (OSError, TunModeError, ValueError):
self.close()
return {"running": False, "pid": None, "exit_code": None}
def traffic(self) -> tuple[int, int, int, int]:
with self._lock:
if self._socket is None:
return 0, 0, 0, 0
try:
return tuple(self._request("traffic"))
except (OSError, TunModeError, ValueError):
return 0, 0, 0, 0
def stop(self) -> None:
with self._lock:
try:
if self._socket is not None:
self._request("stop")
finally:
self.close()
def close(self) -> None:
with self._lock:
if self._socket is not None:
try:
self._request("quit")
except (OSError, TunModeError, ValueError):
pass
reader, connection = self._reader, self._socket
self._reader = self._socket = None
if reader is not None:
reader.close()
if connection is not None:
connection.close()
def run_tun_worker(port: int, token: str, backend_factory,
start_backend: Callable[[Any, dict[str, Any]], None]) -> None:
"""管理员进程入口。主 GUI 断开后，必定清理本进程建立的网络状态。"""
connection = socket.create_connection(("127.0.0.1", int(port)), timeout=15)
connection.settimeout(None)
reader = connection.makefile("rb")
send_lock = threading.Lock()
_send(connection, {"type": "hello", "token": token}, send_lock)
def emit(message: str) -> None:
try:
_send(connection, {"type": "log", "message": str(message)}, send_lock)
except OSError:
pass
backend = None
try:
backend = backend_factory(emit)
while True:
try:
request = _receive(reader)
except TunModeError:
break
command = request.get("command")
try:
if command == "start":
if not isinstance(request.get("payload"), dict):
raise TunModeError("TUN 启动参数无效")
start_backend(backend, request["payload"])
value = None
elif command == "stop":
backend.stop()
value = None
elif command == "status":
value = backend.status()
elif command == "traffic":
value = backend.traffic()
elif command == "quit":
backend.stop()
value = None
else:
raise TunModeError("未知的 TUN 控制命令")
_send(connection, {"type": "result", "ok": True, "value": value}, send_lock)
except Exception as exc:
_send(connection, {"type": "result", "ok": False, "error": str(exc)}, send_lock)
if command == "quit":
break
finally:
if backend is not None:
backend.stop()
reader.close()
connection.close()
lite/rrpp_core/uot_protocol.py
+120
View File
@@ -0,0 +1,120 @@
"""SagerNet UDP over TCP v2 帧编解码。
UoT 只负责把 UDP 数据报装入已有的可靠 TCP 字节流；外层连接仍由
HTTP CONNECT + TLS 建立。此模块不依赖 sing-box。
"""
from __future__ import annotations
import ipaddress
import socket
import struct
from dataclasses import dataclass
MAGIC_ADDRESS = "sp.v2.udp-over-tcp.arpa"
MAX_DATAGRAM = 65535
@dataclass(frozen=True)
class Address:
host: str
port: int
def encode_address(host: str, port: int) -> bytes:
host = str(host).strip()
if not 0 <= int(port) <= 65535:
raise ValueError("端口超出范围")
try:
addr = ipaddress.ip_address(host)
except ValueError:
raw = host.encode("idna")
if not 1 <= len(raw) <= 255:
raise ValueError("域名长度超出 UoT 限制")
return b"\x02" + bytes([len(raw)]) + raw + struct.pack("!H", int(port))
if addr.version == 4:
return b"\x00" + addr.packed + struct.pack("!H", int(port))
return b"\x01" + addr.packed + struct.pack("!H", int(port))
def decode_address(data: bytes, offset: int = 0) -> tuple[Address, int]:
if offset >= len(data):
raise ValueError("UoT 地址头不完整")
atyp = data[offset]
offset += 1
if atyp == 0:
size = 4
elif atyp == 1:
size = 16
elif atyp == 2:
if offset >= len(data):
raise ValueError("UoT 域名长度缺失")
size = data[offset]
offset += 1
else:
raise ValueError(f"未知 UoT 地址类型: {atyp}")
end = offset + size
if end + 2 > len(data):
raise ValueError("UoT 地址头不完整")
raw = data[offset:end]
port = struct.unpack("!H", data[end:end + 2])[0]
if atyp == 0:
host = str(ipaddress.IPv4Address(raw))
elif atyp == 1:
host = str(ipaddress.IPv6Address(raw))
else:
host = raw.decode("idna")
return Address(host, port), end + 2
def encode_request(is_connect: bool, destination: Address) -> bytes:
return (b"\x01" if is_connect else b"\x00") + encode_address(
destination.host, destination.port
)
def encode_connect_frame(payload: bytes) -> bytes:
if len(payload) > MAX_DATAGRAM:
raise ValueError("UoT 数据报超过 65535 字节")
return struct.pack("!H", len(payload)) + payload
def encode_datagram_frame(destination: Address, payload: bytes) -> bytes:
if len(payload) > MAX_DATAGRAM:
raise ValueError("UoT 数据报超过 65535 字节")
return encode_address(destination.host, destination.port) + struct.pack("!H", len(payload)) + payload
def read_exact(stream, size: int) -> bytes:
chunks = []
remaining = size
while remaining:
chunk = stream.recv(remaining)
if not chunk:
raise ConnectionError("UoT TCP 流已关闭")
chunks.append(chunk)
remaining -= len(chunk)
return b"".join(chunks)
def read_connect_frame(stream) -> bytes:
size = struct.unpack("!H", read_exact(stream, 2))[0]
return read_exact(stream, size)
def read_datagram_frame(stream) -> tuple[Address, bytes]:
# 地址是变长的，只能先读 ATYP，再按类型补齐。
head = read_exact(stream, 1)
atyp = head[0]
if atyp == 0:
rest = read_exact(stream, 6)
elif atyp == 1:
rest = read_exact(stream, 18)
elif atyp == 2:
length = read_exact(stream, 1)
rest = length + read_exact(stream, length[0] + 2)
else:
raise ValueError(f"未知 UoT 地址类型: {atyp}")
address, _ = decode_address(head + rest)
size = struct.unpack("!H", read_exact(stream, 2))[0]
return address, read_exact(stream, size)