777 lines
37 KiB
Python
777 lines
37 KiB
Python
"""路线 B 的 Windows TUN 后端：tun2socks + 自有 SOCKS5/UoT 桥接。
|
||
|
||
这里不启动 sing-box。tun2socks 只负责 Wintun 和用户态 TCP/IP 栈，
|
||
所有上游协议由本项目的 ``socks_bridge`` 处理：TCP 使用 HTTP CONNECT，
|
||
UDP 使用裸 UoT v2。
|
||
"""
|
||
|
||
from __future__ import annotations
|
||
|
||
import ctypes
|
||
import ipaddress
|
||
import json
|
||
import os
|
||
import shutil
|
||
import socket
|
||
import subprocess
|
||
import sys
|
||
import threading
|
||
import time
|
||
from pathlib import Path
|
||
from typing import Any, Callable
|
||
|
||
from .socks_bridge import Socks5Bridge
|
||
|
||
|
||
class TunBackendError(RuntimeError):
|
||
"""TUN 后端无法启动或停止。"""
|
||
|
||
|
||
class TunBackend:
|
||
def __init__(self, user_dir: str | Path, engine_path: str | Path | None = None,
|
||
log: Callable[[str], None] | None = None,
|
||
detail_log: Callable[[str], None] | None = None):
|
||
self.user_dir = Path(user_dir)
|
||
self.engine_path = Path(engine_path) if engine_path else None
|
||
self.log = log or (lambda _message: None)
|
||
self.detail_log = detail_log or self.log
|
||
self._process: subprocess.Popen[str] | None = None
|
||
self._bridge: Socks5Bridge | None = None
|
||
self._lock = threading.RLock()
|
||
self._route_added = False
|
||
self._ipv6_route_added = False
|
||
self._lan_routes: list[str] = []
|
||
self._lan_ipv6_routes: list[str] = []
|
||
self._node_routes: list[str] = []
|
||
self._node_ipv6_routes: list[str] = []
|
||
self._physical_gateway = ""
|
||
self._physical_ifindex = ""
|
||
self._physical_ipv6_gateway = ""
|
||
self._physical_ipv6_ifindex = ""
|
||
self._device = "RRPP-TUN"
|
||
self._address = "10.255.0.1"
|
||
self._ipv6_address = "fd42:7272:5050::1"
|
||
self._dns_configured = False
|
||
self._tun_dns_servers = ("8.8.8.8", "1.1.1.1")
|
||
self._bypass_lan = True
|
||
self._cleanup_pending = False
|
||
self._state_path = self.user_dir / "tun_state.json"
|
||
# Wintun 是三层虚拟接口，默认路由的下一跳使用接口自身地址。
|
||
self._gateway = self._address
|
||
self._ipv6_gateway = self._ipv6_address
|
||
self._recover_stale_state()
|
||
|
||
@staticmethod
|
||
def is_admin() -> bool:
|
||
if os.name != "nt":
|
||
return True
|
||
try:
|
||
return bool(ctypes.windll.shell32.IsUserAnAdmin())
|
||
except Exception:
|
||
return False
|
||
|
||
def resolve_engine(self) -> Path:
|
||
candidates: list[Path] = []
|
||
if self.engine_path:
|
||
candidates.append(self.engine_path)
|
||
# 目录式发布：主 EXE 与 tun2socks.exe、wintun.dll 放在同一目录。
|
||
# PyInstaller onefile：主程序会把内置文件解压到 _MEIPASS。
|
||
executable_dir = Path(sys.executable).resolve().parent
|
||
meipass = getattr(sys, "_MEIPASS", None)
|
||
package_dir = Path(__file__).resolve().parents[1]
|
||
candidates.extend([
|
||
self.user_dir / "tun2socks.exe",
|
||
self.user_dir.parent / "tun2socks.exe",
|
||
executable_dir / "tun2socks.exe",
|
||
Path(meipass) / "tun2socks.exe" if meipass else Path("__rrpp_no_meipass__"),
|
||
package_dir / "tun2socks.exe",
|
||
package_dir / "runtime" / "tun2socks.exe",
|
||
])
|
||
found = shutil.which("tun2socks")
|
||
if found:
|
||
candidates.append(Path(found))
|
||
for candidate in candidates:
|
||
try:
|
||
path = candidate.expanduser().resolve()
|
||
except OSError:
|
||
continue
|
||
if path.is_file():
|
||
return path
|
||
raise TunBackendError(
|
||
"未找到 tun2socks.exe。请将 tun2socks.exe 和 wintun.dll 放在 TUN 程序目录，"
|
||
"或在 config.json 的 tun_engine_path 中填写完整路径。"
|
||
)
|
||
|
||
@staticmethod
|
||
def _physical_interface() -> str:
|
||
command = ["powershell", "-NoProfile", "-Command",
|
||
"(Get-NetRoute -DestinationPrefix '0.0.0.0/0' | "
|
||
"Where-Object InterfaceAlias -ne 'RRPP-TUN' | "
|
||
"Sort-Object RouteMetric | Select-Object -First 1 -ExpandProperty InterfaceAlias)"]
|
||
try:
|
||
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
|
||
value = (result.stdout or "").strip().splitlines()
|
||
if value and value[0].strip():
|
||
return value[0].strip()
|
||
except Exception:
|
||
pass
|
||
return ""
|
||
|
||
@staticmethod
|
||
def _physical_source_address(interface: str) -> str:
|
||
if not interface:
|
||
return ""
|
||
escaped = interface.replace("'", "''")
|
||
command = ["powershell", "-NoProfile", "-Command",
|
||
f"(Get-NetIPAddress -InterfaceAlias '{escaped}' -AddressFamily IPv4 "
|
||
"-AddressState Preferred | Select-Object -First 1 -ExpandProperty IPAddress)"]
|
||
try:
|
||
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
|
||
value = (result.stdout or "").strip().splitlines()
|
||
if value and value[0].strip():
|
||
return value[0].strip()
|
||
except Exception:
|
||
pass
|
||
return ""
|
||
|
||
@staticmethod
|
||
def _physical_route_info() -> tuple[str, str]:
|
||
"""返回当前物理默认路由的网关和接口索引。"""
|
||
command = ["powershell", "-NoProfile", "-Command",
|
||
"Get-NetRoute -DestinationPrefix '0.0.0.0/0' | "
|
||
"Where-Object InterfaceAlias -ne 'RRPP-TUN' | "
|
||
"Sort-Object RouteMetric | Select-Object -First 1 "
|
||
"NextHop,InterfaceIndex | ConvertTo-Json -Compress"]
|
||
try:
|
||
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
|
||
data = json.loads((result.stdout or "").strip())
|
||
if isinstance(data, dict):
|
||
return str(data.get("NextHop") or ""), str(data.get("InterfaceIndex") or "")
|
||
except Exception:
|
||
pass
|
||
return "", ""
|
||
|
||
@staticmethod
|
||
def _physical_ipv6_route_info() -> tuple[str, str]:
|
||
"""返回当前物理 IPv6 默认路由的下一跳和接口索引。"""
|
||
command = ["powershell", "-NoProfile", "-Command",
|
||
"Get-NetRoute -AddressFamily IPv6 -DestinationPrefix '::/0' | "
|
||
"Where-Object InterfaceAlias -ne 'RRPP-TUN' | "
|
||
"Sort-Object RouteMetric | Select-Object -First 1 "
|
||
"NextHop,InterfaceIndex | ConvertTo-Json -Compress"]
|
||
try:
|
||
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
|
||
data = json.loads((result.stdout or "").strip())
|
||
if isinstance(data, dict):
|
||
return str(data.get("NextHop") or ""), str(data.get("InterfaceIndex") or "")
|
||
except Exception:
|
||
pass
|
||
return "", ""
|
||
|
||
@staticmethod
|
||
def _active_global_ipv6() -> bool | None:
|
||
"""返回是否存在公网 IPv6；无法查询时返回 None，避免误报已接管。"""
|
||
if os.name != "nt":
|
||
return False
|
||
command = [
|
||
"powershell", "-NoProfile", "-Command",
|
||
"@(Get-NetIPAddress -AddressFamily IPv6 -AddressState Preferred | "
|
||
"Where-Object { $_.IPAddress -notlike 'fe80:*' -and "
|
||
"$_.IPAddress -ne '::1' -and $_.IPAddress -notlike 'fc*' -and "
|
||
"$_.IPAddress -notlike 'fd*' }).IPAddress | ConvertTo-Json -Compress",
|
||
]
|
||
try:
|
||
result = subprocess.run(command, capture_output=True, text=True, timeout=5)
|
||
if result.returncode:
|
||
return None
|
||
value = json.loads((result.stdout or "").strip() or "[]")
|
||
if isinstance(value, str):
|
||
return bool(value.strip())
|
||
return bool(value)
|
||
except Exception:
|
||
return None
|
||
|
||
@staticmethod
|
||
def _resolve_proxy_addresses(node: dict[str, Any]) -> list[tuple]:
|
||
methods = (node.get("methods") or {}).get("http") or {}
|
||
host = str(node.get("domain") or "").strip()
|
||
port = int(methods.get("port") or node.get("port") or 443)
|
||
if not host:
|
||
return []
|
||
addresses: list[tuple] = []
|
||
for item in socket.getaddrinfo(host, port, socket.AF_UNSPEC, socket.SOCK_STREAM):
|
||
if item[4] not in addresses:
|
||
addresses.append(item[4])
|
||
return addresses
|
||
|
||
@staticmethod
|
||
def _node_chain(node: dict[str, Any]) -> list[dict[str, Any]]:
|
||
chain = node.get("_jump_chain") if isinstance(node, dict) else None
|
||
if isinstance(chain, list) and chain:
|
||
return [item for item in chain if isinstance(item, dict)]
|
||
return [node] if isinstance(node, dict) else []
|
||
|
||
@staticmethod
|
||
def _node_key(node: dict[str, Any]) -> str:
|
||
methods = (node.get("methods") or {}).get("http") or {}
|
||
return "|".join((str(node.get("domain") or ""),
|
||
str(methods.get("port") or node.get("port") or 443),
|
||
str(methods.get("username") or node.get("username") or "")))
|
||
|
||
def _add_node_routes(self, proxy_addresses: list[tuple]) -> None:
|
||
"""把 HTTP CONNECT 节点固定走物理网卡，防止默认 TUN 路由形成回环。"""
|
||
candidates_v4: list[str] = []
|
||
candidates_v6: list[str] = []
|
||
for sockaddr in proxy_addresses:
|
||
address = str(sockaddr[0])
|
||
try:
|
||
parsed = ipaddress.ip_address(address.split("%", 1)[0])
|
||
except ValueError:
|
||
continue
|
||
target = candidates_v4 if parsed.version == 4 else candidates_v6
|
||
normalized = parsed.compressed
|
||
if normalized not in target:
|
||
target.append(normalized)
|
||
if candidates_v4 and not self._physical_ifindex:
|
||
raise TunBackendError("找不到物理 IPv4 接口，无法固定代理节点路由")
|
||
for address in candidates_v4:
|
||
if address in self._node_routes:
|
||
continue
|
||
command = ["route", "ADD", address, "MASK", "255.255.255.255"]
|
||
if self._physical_gateway:
|
||
command.append(self._physical_gateway)
|
||
command.extend(["METRIC", "1", "IF", self._physical_ifindex])
|
||
result = subprocess.run(command, capture_output=True, text=True,
|
||
encoding="mbcs", errors="replace", timeout=15)
|
||
if result.returncode:
|
||
detail = (result.stderr or result.stdout or "").strip()
|
||
# 已存在的等价路由不影响启动；其它错误继续暴露，避免静默回环。
|
||
if "already exists" not in detail.lower() and "已存在" not in detail:
|
||
raise TunBackendError(f"节点物理路由添加失败 ({address}): {detail[:200]}")
|
||
continue
|
||
self._node_routes.append(address)
|
||
self._write_state()
|
||
if candidates_v6 and not self._physical_ipv6_ifindex:
|
||
# 双栈节点仍可使用 IPv4 地址；只有 IPv6-only 节点需要物理 IPv6 出口。
|
||
if candidates_v4:
|
||
candidates_v6 = []
|
||
else:
|
||
raise TunBackendError("代理节点仅包含 IPv6 地址，但找不到物理 IPv6 默认路由")
|
||
for address in candidates_v6:
|
||
if address in self._node_ipv6_routes:
|
||
continue
|
||
self._add_ipv6_physical_route(address)
|
||
|
||
def _add_ipv6_physical_route(self, address: str) -> None:
|
||
if not self._physical_ipv6_ifindex:
|
||
raise TunBackendError("找不到物理 IPv6 接口，无法固定 IPv6 路由")
|
||
command = ["interface", "ipv6", "add", "route", f"prefix={address}/128",
|
||
f"interface={self._physical_ipv6_ifindex}"]
|
||
if self._physical_ipv6_gateway and self._physical_ipv6_gateway != "::":
|
||
command.append(f"nexthop={self._physical_ipv6_gateway}")
|
||
command.append("metric=1")
|
||
result = subprocess.run(["netsh", *command], capture_output=True, text=True,
|
||
encoding="mbcs", errors="replace", timeout=15)
|
||
if result.returncode:
|
||
detail = (result.stderr or result.stdout or "").strip()
|
||
if "already exists" not in detail.lower() and "已存在" not in detail:
|
||
raise TunBackendError(f"IPv6 节点物理路由添加失败 ({address}): {detail[:200]}")
|
||
return
|
||
self._node_ipv6_routes.append(address)
|
||
self._write_state()
|
||
|
||
def _ensure_physical_route(self, address: str) -> None:
|
||
"""为 TUN 内部的直连目标补一条物理出口 /32 路由。"""
|
||
if os.name != "nt":
|
||
return
|
||
try:
|
||
parsed = ipaddress.ip_address(str(address).split("%", 1)[0])
|
||
except ValueError:
|
||
return
|
||
if parsed.version == 6:
|
||
normalized = parsed.compressed
|
||
if normalized in self._node_ipv6_routes:
|
||
return
|
||
self._add_ipv6_physical_route(normalized)
|
||
return
|
||
if not self._physical_ifindex:
|
||
raise TunBackendError("找不到物理 IPv4 接口，无法固定直连路由")
|
||
normalized = parsed.compressed
|
||
if normalized in self._node_routes:
|
||
return
|
||
command = ["route", "ADD", normalized, "MASK", "255.255.255.255"]
|
||
if self._physical_gateway:
|
||
command.append(self._physical_gateway)
|
||
command.extend(["METRIC", "1", "IF", self._physical_ifindex])
|
||
result = subprocess.run(command, capture_output=True, text=True,
|
||
encoding="mbcs", errors="replace", timeout=15)
|
||
detail = (result.stderr or result.stdout or "").strip()
|
||
if result.returncode:
|
||
if "already exists" in detail.lower() or "已存在" in detail:
|
||
return
|
||
raise TunBackendError(f"直连目标物理路由添加失败 ({normalized}): {detail[:200]}")
|
||
self._node_routes.append(normalized)
|
||
self._write_state()
|
||
|
||
@staticmethod
|
||
def _cleanup_succeeded(result: subprocess.CompletedProcess[str]) -> bool:
|
||
if result.returncode == 0:
|
||
return True
|
||
detail = (result.stderr or result.stdout or "").strip().lower()
|
||
# 清理是幂等操作：路由或网卡已经消失时，目标状态已经达到。
|
||
return any(marker in detail for marker in (
|
||
"not found", "does not exist", "cannot find", "no such",
|
||
"找不到", "不存在", "未找到", "没有找到",
|
||
))
|
||
|
||
def _cleanup_netsh(self, args: list[str]) -> bool:
|
||
try:
|
||
result = subprocess.run(["netsh", *args], capture_output=True, text=True,
|
||
encoding="mbcs", errors="replace", timeout=15)
|
||
except Exception as exc:
|
||
self.detail_log(f"[TUN] 清理 netsh 失败: {exc}")
|
||
return False
|
||
if self._cleanup_succeeded(result):
|
||
return True
|
||
detail = (result.stderr or result.stdout or "").strip()
|
||
self.detail_log(f"[TUN] 清理 netsh 未完成: {detail[:300]}")
|
||
return False
|
||
|
||
def _remove_node_routes(self) -> bool:
|
||
remaining: list[str] = []
|
||
for address in self._node_routes:
|
||
try:
|
||
result = subprocess.run(["route", "DELETE", address], capture_output=True,
|
||
text=True, encoding="mbcs", errors="replace", timeout=15)
|
||
except Exception as exc:
|
||
self.detail_log(f"[TUN] 清理节点路由失败 ({address}): {exc}")
|
||
remaining.append(address)
|
||
continue
|
||
if not self._cleanup_succeeded(result):
|
||
detail = (result.stderr or result.stdout or "").strip()
|
||
self.detail_log(f"[TUN] 清理节点路由未完成 ({address}): {detail[:200]}")
|
||
remaining.append(address)
|
||
self._node_routes = remaining
|
||
remaining_v6: list[str] = []
|
||
for address in self._node_ipv6_routes:
|
||
command = ["interface", "ipv6", "delete", "route", f"prefix={address}/128"]
|
||
if self._physical_ipv6_ifindex:
|
||
command.append(f"interface={self._physical_ipv6_ifindex}")
|
||
try:
|
||
result = subprocess.run(["netsh", *command], capture_output=True, text=True,
|
||
encoding="mbcs", errors="replace", timeout=15)
|
||
except Exception as exc:
|
||
self.detail_log(f"[TUN] 清理 IPv6 节点路由失败 ({address}): {exc}")
|
||
remaining_v6.append(address)
|
||
continue
|
||
if not self._cleanup_succeeded(result):
|
||
detail = (result.stderr or result.stdout or "").strip()
|
||
self.detail_log(f"[TUN] 清理 IPv6 节点路由未完成 ({address}): {detail[:200]}")
|
||
remaining_v6.append(address)
|
||
self._node_ipv6_routes = remaining_v6
|
||
return not remaining and not remaining_v6
|
||
|
||
def _netsh(self, args: list[str], *, ignore_error: bool = False) -> None:
|
||
result = subprocess.run(["netsh", *args], capture_output=True, text=True,
|
||
encoding="mbcs", errors="replace", timeout=15)
|
||
if result.returncode and not ignore_error:
|
||
detail = (result.stderr or result.stdout or "").strip()
|
||
raise TunBackendError(f"netsh 操作失败: {detail[:300]}")
|
||
|
||
def _configure_routes(self) -> None:
|
||
for _ in range(20):
|
||
try:
|
||
probe = subprocess.run(
|
||
["powershell", "-NoProfile", "-Command",
|
||
f"Get-NetAdapter -Name '{self._device}' -ErrorAction SilentlyContinue"],
|
||
capture_output=True, text=True, timeout=3,
|
||
)
|
||
if probe.stdout and self._device.lower() in probe.stdout.lower():
|
||
break
|
||
except Exception:
|
||
pass
|
||
time.sleep(0.25)
|
||
else:
|
||
raise TunBackendError(f"tun2socks 未创建虚拟网卡: {self._device}")
|
||
self._netsh(["interface", "ipv4", "set", "address",
|
||
f"name={self._device}", "source=static",
|
||
f"addr={self._address}", "mask=255.255.255.252"])
|
||
self._netsh(["interface", "ipv4", "add", "route", "0.0.0.0/0",
|
||
f"{self._device}", self._gateway, "metric=1"])
|
||
self._route_added = True
|
||
self._write_state()
|
||
self._netsh(["interface", "ipv6", "set", "address",
|
||
f"interface={self._device}", f"address={self._ipv6_address}",
|
||
"store=active"])
|
||
self._netsh(["interface", "ipv6", "add", "route", "prefix=::/0",
|
||
f"interface={self._device}", f"nexthop={self._ipv6_gateway}",
|
||
"metric=1"])
|
||
self._ipv6_route_added = True
|
||
self._write_state()
|
||
if not self._bypass_lan:
|
||
# Windows 物理网卡通常已有更具体的私网路由；补同前缀的 TUN
|
||
# 路由，确保“内网也代理”不会在进入 tun2socks 前被物理网卡截走。
|
||
for network in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16",
|
||
"169.254.0.0/16"):
|
||
self._netsh(["interface", "ipv4", "add", "route", network,
|
||
f"{self._device}", self._gateway, "metric=1"])
|
||
self._lan_routes.append(network)
|
||
self._write_state()
|
||
for network in ("fc00::/7",):
|
||
self._netsh(["interface", "ipv6", "add", "route", f"prefix={network}",
|
||
f"interface={self._device}", f"nexthop={self._ipv6_gateway}",
|
||
"metric=1"])
|
||
self._lan_ipv6_routes.append(network)
|
||
self._write_state()
|
||
self._configure_dns()
|
||
|
||
def _configure_dns(self) -> None:
|
||
"""让 Windows DNS 请求也进入 TUN，避免沿用物理网卡 DNS。"""
|
||
if os.name != "nt":
|
||
return
|
||
ipv4 = [item for item in self._tun_dns_servers if ":" not in item]
|
||
ipv6 = [item for item in self._tun_dns_servers if ":" in item]
|
||
if ipv4:
|
||
self._netsh([
|
||
"interface", "ipv4", "set", "dnsservers",
|
||
f"name={self._device}", "source=static",
|
||
f"address={ipv4[0]}", "register=none", "validate=no",
|
||
])
|
||
for index, secondary in enumerate(ipv4[1:], start=2):
|
||
self._netsh([
|
||
"interface", "ipv4", "add", "dnsservers",
|
||
f"name={self._device}", f"address={secondary}",
|
||
f"index={index}", "validate=no",
|
||
], ignore_error=True)
|
||
if ipv6:
|
||
self._netsh([
|
||
"interface", "ipv6", "set", "dnsservers",
|
||
f"name={self._device}", "source=static",
|
||
f"address={ipv6[0]}", "register=none", "validate=no",
|
||
], ignore_error=True)
|
||
for index, secondary in enumerate(ipv6[1:], start=2):
|
||
self._netsh([
|
||
"interface", "ipv6", "add", "dnsservers",
|
||
f"name={self._device}", f"address={secondary}",
|
||
f"index={index}", "validate=no",
|
||
], ignore_error=True)
|
||
self._dns_configured = True
|
||
self._write_state()
|
||
|
||
def _remove_routes(self) -> None:
|
||
cleanup_ok = True
|
||
if self._dns_configured:
|
||
ipv4_ok = self._cleanup_netsh([
|
||
"interface", "ipv4", "set", "dnsservers",
|
||
f"name={self._device}", "source=dhcp",
|
||
])
|
||
ipv6_ok = self._cleanup_netsh([
|
||
"interface", "ipv6", "set", "dnsservers",
|
||
f"name={self._device}", "source=dhcp",
|
||
])
|
||
cleanup_ok &= ipv4_ok and ipv6_ok
|
||
if ipv4_ok and ipv6_ok:
|
||
self._dns_configured = False
|
||
if self._route_added:
|
||
route_ok = self._cleanup_netsh(["interface", "ipv4", "delete", "route",
|
||
"0.0.0.0/0", f"{self._device}", self._gateway])
|
||
cleanup_ok &= route_ok
|
||
if route_ok:
|
||
self._route_added = False
|
||
if self._ipv6_route_added:
|
||
route_ok = self._cleanup_netsh(["interface", "ipv6", "delete", "route",
|
||
"prefix=::/0", f"interface={self._device}",
|
||
f"nexthop={self._ipv6_gateway}"])
|
||
cleanup_ok &= route_ok
|
||
if route_ok:
|
||
self._ipv6_route_added = False
|
||
remaining_lan: list[str] = []
|
||
for network in self._lan_routes:
|
||
route_ok = self._cleanup_netsh(["interface", "ipv4", "delete", "route",
|
||
network, f"{self._device}", self._gateway])
|
||
cleanup_ok &= route_ok
|
||
if not route_ok:
|
||
remaining_lan.append(network)
|
||
self._lan_routes = remaining_lan
|
||
remaining_lan_v6: list[str] = []
|
||
for network in self._lan_ipv6_routes:
|
||
route_ok = self._cleanup_netsh(["interface", "ipv6", "delete", "route",
|
||
f"prefix={network}", f"interface={self._device}",
|
||
f"nexthop={self._ipv6_gateway}"])
|
||
cleanup_ok &= route_ok
|
||
if not route_ok:
|
||
remaining_lan_v6.append(network)
|
||
self._lan_ipv6_routes = remaining_lan_v6
|
||
cleanup_ok &= self._remove_node_routes()
|
||
self._cleanup_pending = not cleanup_ok
|
||
if cleanup_ok:
|
||
self._clear_state()
|
||
else:
|
||
self._write_state()
|
||
self.detail_log("[TUN] 部分路由/DNS 清理失败，已保留状态并将在下次启动重试")
|
||
|
||
def _write_state(self) -> None:
|
||
"""记录本进程改过的路由/DNS，强杀后下次启动可恢复。"""
|
||
try:
|
||
self.user_dir.mkdir(parents=True, exist_ok=True)
|
||
payload = {
|
||
"device": self._device,
|
||
"address": self._address,
|
||
"gateway": self._gateway,
|
||
"ipv6_address": self._ipv6_address,
|
||
"ipv6_gateway": self._ipv6_gateway,
|
||
"lan_routes": list(self._lan_routes),
|
||
"lan_ipv6_routes": list(self._lan_ipv6_routes),
|
||
"bypass_lan": bool(self._bypass_lan),
|
||
"physical_gateway": self._physical_gateway,
|
||
"physical_ifindex": self._physical_ifindex,
|
||
"physical_ipv6_gateway": self._physical_ipv6_gateway,
|
||
"physical_ipv6_ifindex": self._physical_ipv6_ifindex,
|
||
"node_routes": list(self._node_routes),
|
||
"node_ipv6_routes": list(self._node_ipv6_routes),
|
||
"route_added": bool(self._route_added),
|
||
"ipv6_route_added": bool(self._ipv6_route_added),
|
||
"dns_configured": bool(self._dns_configured),
|
||
"dns_servers": list(self._tun_dns_servers),
|
||
"cleanup_pending": bool(self._cleanup_pending),
|
||
"pid": os.getpid(),
|
||
}
|
||
temp = self._state_path.with_suffix(".tmp")
|
||
temp.write_text(json.dumps(payload, ensure_ascii=False), encoding="utf-8")
|
||
temp.replace(self._state_path)
|
||
except Exception as exc:
|
||
self.detail_log(f"[TUN] 状态记录失败: {exc}")
|
||
|
||
def _clear_state(self) -> None:
|
||
try:
|
||
self._state_path.unlink(missing_ok=True)
|
||
except Exception:
|
||
pass
|
||
|
||
@staticmethod
|
||
def _pid_alive(pid: Any) -> bool:
|
||
"""避免合并版误清理仍在运行的旧 TUN 实例。"""
|
||
if os.name != "nt":
|
||
return False
|
||
try:
|
||
number = int(pid)
|
||
if number <= 0:
|
||
return False
|
||
kernel = ctypes.windll.kernel32
|
||
kernel.OpenProcess.argtypes = [ctypes.c_ulong, ctypes.c_bool, ctypes.c_ulong]
|
||
kernel.OpenProcess.restype = ctypes.c_void_p
|
||
kernel.GetExitCodeProcess.argtypes = [ctypes.c_void_p, ctypes.POINTER(ctypes.c_ulong)]
|
||
kernel.CloseHandle.argtypes = [ctypes.c_void_p]
|
||
handle = kernel.OpenProcess(0x1000, False, number)
|
||
if not handle:
|
||
return False
|
||
try:
|
||
code = ctypes.c_ulong()
|
||
return bool(kernel.GetExitCodeProcess(handle, ctypes.byref(code))
|
||
and code.value == 259)
|
||
finally:
|
||
kernel.CloseHandle(handle)
|
||
except (TypeError, ValueError, OSError):
|
||
return False
|
||
|
||
def _recover_stale_state(self) -> None:
|
||
"""启动前清理上次崩溃/强杀留下的 RRPP-TUN 路由和 DNS。"""
|
||
try:
|
||
if not self._state_path.is_file():
|
||
return
|
||
state = json.loads(self._state_path.read_text(encoding="utf-8"))
|
||
if not state.get("cleanup_pending") and self._pid_alive(state.get("pid")):
|
||
raise TunBackendError("检测到另一个 TUN 实例仍在运行，请先关闭后再启动")
|
||
self._device = str(state.get("device") or self._device)
|
||
self._address = str(state.get("address") or self._address)
|
||
self._gateway = str(state.get("gateway") or self._gateway)
|
||
self._ipv6_address = str(state.get("ipv6_address") or self._ipv6_address)
|
||
self._ipv6_gateway = str(state.get("ipv6_gateway") or self._ipv6_gateway)
|
||
self._physical_ipv6_gateway = str(state.get("physical_ipv6_gateway") or "")
|
||
self._physical_ipv6_ifindex = str(state.get("physical_ipv6_ifindex") or "")
|
||
self._route_added = bool(state.get("route_added"))
|
||
self._ipv6_route_added = bool(state.get("ipv6_route_added"))
|
||
self._lan_routes = [str(item).strip() for item in (state.get("lan_routes") or [])
|
||
if str(item).strip()]
|
||
self._lan_ipv6_routes = [str(item).strip() for item in (state.get("lan_ipv6_routes") or [])
|
||
if str(item).strip()]
|
||
self._node_routes = [str(item).strip() for item in (state.get("node_routes") or [])
|
||
if str(item).strip()]
|
||
self._node_ipv6_routes = [str(item).strip() for item in (state.get("node_ipv6_routes") or [])
|
||
if str(item).strip()]
|
||
self._dns_configured = bool(state.get("dns_configured"))
|
||
self._cleanup_pending = True
|
||
self._remove_routes()
|
||
if self._cleanup_pending:
|
||
self.detail_log("[TUN] 上次异常退出的部分路由/DNS 仍未清理，状态已保留")
|
||
else:
|
||
self.log("已清理上次异常退出遗留的 TUN 路由和 DNS")
|
||
except TunBackendError:
|
||
raise
|
||
except Exception as exc:
|
||
self.detail_log(f"[TUN] 异常退出残留清理失败: {exc}")
|
||
|
||
def _read_output(self, process: subprocess.Popen[str]) -> None:
|
||
if process.stdout is None:
|
||
return
|
||
try:
|
||
for line in process.stdout:
|
||
line = line.rstrip()
|
||
if line:
|
||
self.detail_log(f"[TUN] {line}")
|
||
except OSError:
|
||
pass
|
||
|
||
def start(self, node: dict[str, Any], *, bypass_lan: bool = True,
|
||
route_rules: list[dict[str, Any]] | None = None,
|
||
dns_servers: tuple[str, ...] | list[str] | None = None,
|
||
direct_target_resolver: Callable[[str, str, int], tuple[str, int] | None] | None = None,
|
||
route_rule_resolver: Callable[[str], dict[str, Any] | None] | None = None,
|
||
route_node_resolver: Callable[[dict[str, Any]], dict[str, Any] | None] | None = None,
|
||
route_nodes: list[dict[str, Any]] | None = None) -> None:
|
||
with self._lock:
|
||
if self.status()["running"]:
|
||
raise TunBackendError("TUN 已经在运行")
|
||
if not self.is_admin():
|
||
raise TunBackendError("启动虚拟网卡 TUN 需要管理员权限")
|
||
self._bypass_lan = bool(bypass_lan)
|
||
if dns_servers is not None:
|
||
cleaned = tuple(str(item).strip() for item in dns_servers if str(item).strip())
|
||
if not cleaned:
|
||
raise TunBackendError("自定义 DNS 不能为空")
|
||
try:
|
||
for item in cleaned:
|
||
address = ipaddress.ip_address(item)
|
||
if address.is_unspecified or address.is_multicast:
|
||
raise ValueError(item)
|
||
except ValueError as exc:
|
||
raise TunBackendError("自定义 DNS 必须是有效的 IPv4/IPv6 地址") from exc
|
||
self._tun_dns_servers = cleaned[:3]
|
||
engine = self.resolve_engine()
|
||
interface = self._physical_interface()
|
||
source_address = self._physical_source_address(interface)
|
||
self._physical_gateway, self._physical_ifindex = self._physical_route_info()
|
||
self._physical_ipv6_gateway, self._physical_ipv6_ifindex = self._physical_ipv6_route_info()
|
||
if not self._physical_ifindex:
|
||
raise TunBackendError("找不到物理默认路由，无法保证代理节点不进入 TUN 回环")
|
||
if not self._physical_ipv6_ifindex:
|
||
self.log("警告：未找到物理 IPv6 默认路由，IPv6 目标将仅尝试通过 IPv4 代理节点转发")
|
||
try:
|
||
proxy_addresses_by_node: dict[str, list[tuple]] = {}
|
||
connection_nodes = [node]
|
||
connection_nodes.extend(
|
||
(item.get("node") if isinstance(item.get("node"), dict) else item)
|
||
for item in (route_nodes or ())
|
||
if isinstance(item, dict)
|
||
)
|
||
for connection_node in connection_nodes:
|
||
for hop in self._node_chain(connection_node):
|
||
try:
|
||
addresses = self._resolve_proxy_addresses(hop)
|
||
except OSError as exc:
|
||
raise TunBackendError(f"无法解析 HTTP CONNECT 节点地址: {exc}") from exc
|
||
if not addresses:
|
||
raise TunBackendError("无法解析 HTTP CONNECT 节点地址")
|
||
self._add_node_routes(addresses)
|
||
proxy_addresses_by_node[self._node_key(hop)] = addresses
|
||
first_hop = self._node_chain(node)[0]
|
||
proxy_addresses = proxy_addresses_by_node.get(self._node_key(first_hop), [])
|
||
if not proxy_addresses:
|
||
raise TunBackendError("无法解析 HTTP CONNECT 节点地址")
|
||
for route_node in route_nodes or ():
|
||
if not isinstance(route_node, dict):
|
||
continue
|
||
route_value = route_node.get("node") if isinstance(route_node.get("node"), dict) else route_node
|
||
for hop in self._node_chain(route_value):
|
||
addresses = self._resolve_proxy_addresses(hop)
|
||
proxy_addresses_by_node[self._node_key(hop)] = addresses
|
||
if not source_address:
|
||
self.log("警告：未找到物理网卡 IPv4，节点连接可能无法绕过 TUN")
|
||
bridge = Socks5Bridge(
|
||
node, bypass_lan=bypass_lan, route_rules=route_rules, log=self.detail_log,
|
||
source_address=source_address or None,
|
||
proxy_addresses=proxy_addresses,
|
||
direct_target_resolver=direct_target_resolver,
|
||
route_rule_resolver=route_rule_resolver,
|
||
route_node_resolver=route_node_resolver,
|
||
proxy_addresses_by_node=proxy_addresses_by_node,
|
||
direct_route_ensurer=self._ensure_physical_route,
|
||
)
|
||
socks_port = bridge.start()
|
||
except Exception:
|
||
self._remove_routes()
|
||
raise
|
||
self._bridge = bridge
|
||
command = [str(engine), "--device", self._device,
|
||
"--proxy", f"socks5://127.0.0.1:{socks_port}"]
|
||
# tun2socks 的 Windows socket 选项会把 UDP/TCP socket 绑定到
|
||
# --interface 指定的网卡；本项目的 SOCKS relay 在本机回环地址，
|
||
# 绑定 WLAN 会让 UDP 回环投递失效。Windows 官方用法也不传该参数。
|
||
# 节点连接已经通过物理 /32 路由和 source_address 绕过 TUN，
|
||
# 因此 Windows 不需要 --interface；Linux/macOS 仍保留原行为。
|
||
if interface and os.name != "nt":
|
||
command.extend(["--interface", interface])
|
||
self.log(f"本地 SOCKS5 桥接: 127.0.0.1:{socks_port}")
|
||
try:
|
||
self._process = subprocess.Popen(
|
||
command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
|
||
text=True, encoding="utf-8", errors="replace",
|
||
creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
|
||
)
|
||
threading.Thread(target=self._read_output, args=(self._process,), daemon=True).start()
|
||
time.sleep(0.5)
|
||
if self._process.poll() is not None:
|
||
raise TunBackendError(f"tun2socks 启动失败，退出码 {self._process.returncode}")
|
||
self._configure_routes()
|
||
self._write_state()
|
||
self.log(f"虚拟网卡 TUN 已启动，进程 PID={self._process.pid}")
|
||
except Exception:
|
||
bridge.stop()
|
||
self._remove_routes()
|
||
self._bridge = None
|
||
process = self._process
|
||
self._process = None
|
||
if process is not None and process.poll() is None:
|
||
process.terminate()
|
||
raise
|
||
|
||
def stop(self) -> None:
|
||
with self._lock:
|
||
process = self._process
|
||
bridge = self._bridge
|
||
self._process = None
|
||
self._bridge = None
|
||
self._remove_routes()
|
||
if process is not None and process.poll() is None:
|
||
process.terminate()
|
||
try:
|
||
process.wait(timeout=10)
|
||
except subprocess.TimeoutExpired:
|
||
process.kill()
|
||
process.wait(timeout=5)
|
||
if bridge is not None:
|
||
bridge.stop()
|
||
if process is not None:
|
||
self.log("虚拟网卡 TUN 已停止")
|
||
|
||
def status(self) -> dict[str, Any]:
|
||
with self._lock:
|
||
process = self._process
|
||
if process is None:
|
||
return {"running": False, "pid": None, "exit_code": None}
|
||
code = process.poll()
|
||
if code is not None:
|
||
self._process = None
|
||
self._remove_routes()
|
||
bridge = self._bridge
|
||
self._bridge = None
|
||
if bridge is not None:
|
||
bridge.stop()
|
||
return {"running": False, "pid": process.pid, "exit_code": code}
|
||
return {"running": True, "pid": process.pid, "exit_code": None}
|
||
|
||
def traffic(self) -> tuple[int, int, int, int]:
|
||
if self._bridge is None:
|
||
return 0, 0, 0, 0
|
||
return self._bridge.traffic()
|