tun2brook v20240101: 可以知道是哪个程序在发起 TCP 和 UDP 网络连接

Updated at: 2023-12-16

更新

优化：当退出 tun2brook 时，自动将系统 DNS 恢复如初
新增：Linux, macOS, Windows 可以知道是哪个程序在发起 TCP 和 UDP 网络连接
新增：也意味着可以用脚本来针对具体应用程序来进行网络控制
提示：macOS 上，运行在沙盒里的 Brook 图形客户端和 Shiliew 的 App 模式里的 appid 是应用的 bundle id

用 nami 安装

nami install tun2brook

FUCK Windows Defender

使用

启动 tun2brook

sudo tun2brook -l 'brook://...' --log /tmp/a.log

Windows 上使用管理员权限打开终端，去掉前面的 sudo

追随下日志

tail -f /tmp/a.log

发起 TCP 连接

curl --http2 https://http3.ooo -v
curl --http2 -4 https://http3.ooo -v
curl --http2 -6 https://http3.ooo -v

发起 UDP 连接

curl --http3-only https://http3.ooo -v
curl --http3-only -4 https://http3.ooo -v
curl --http3-only -6 https://http3.ooo -v

如果你的 curl 不支持 HTTP3，可以看这里

Linux, macOS 会输出如下日志

{"action":"PROXY","appid":"/Users/fuck/.nami/bin/curl","brooklink":"default","content":"137.184.237.95:443","iface":"","kind":"TCP","time":"2023-12-15T16:24:31+08:00"}
{"action":"PROXY","appid":"/Users/fuck/.nami/bin/curl","brooklink":"default","content":"[2604:a880:4:1d0::4cf:b000]:443","iface":"","kind":"TCP","time":"2023-12-15T16:25:29+08:00"}

{"action":"PROXY","appid":"/Users/fuck/.nami/bin/curl","brooklink":"default","content":"137.184.237.95:443","iface":"","kind":"UDP","time":"2023-12-15T16:21:41+08:00"}
{"action":"PROXY","appid":"/Users/fuck/.nami/bin/curl","brooklink":"default","content":"[2604:a880:4:1d0::4cf:b000]:443","iface":"","kind":"UDP","time":"2023-12-15T16:22:43+08:00"}

可以看到 /Users/fuck/.nami/bin/curl 路径的程序刚刚发起了 TCP 和 UDP 连接

Windows 会输出如下日志

{"action":"PROXY","appid":"C:\\Users\\cloud\\.nami\\bin\\curl.exe","brooklink":"default","content":"137.184.237.95:443","iface":"","kind":"TCP","time":"2023-12-15T16:24:31+08:00"}
{"action":"PROXY","appid":"C:\\Users\\cloud\\.nami\\bin\\curl.exe","brooklink":"default","content":"[2604:a880:4:1d0::4cf:b000]:443","iface":"","kind":"TCP","time":"2023-12-15T16:25:29+08:00"}

{"action":"PROXY","appid":"C:\\Users\\cloud\\.nami\\bin\\curl.exe","brooklink":"default","content":"137.184.237.95:443","iface":"","kind":"UDP","time":"2023-12-15T16:21:41+08:00"}
{"action":"PROXY","appid":"C:\\Users\\cloud\\.nami\\bin\\curl.exe","brooklink":"default","content":"[2604:a880:4:1d0::4cf:b000]:443","iface":"","kind":"UDP","time":"2023-12-15T16:22:43+08:00"}

可以看到 C:\\Users\\cloud\\.nami\\bin\\curl.exe 路径的程序刚刚发起了 TCP 和 UDP 连接

使用 FakeDNS

启动 tun2brook

sudo tun2brook -l 'brook://...' --log /tmp/a.log --fakeDNS --script ./a.tengo

Windows 上使用管理员权限打开终端，去掉前面的 sudo

a.tengo(点击展开)

text := import("text")

dnsquery_handler := func(m){
    if m.domain == "dns.google" {
        return {block: true}
    }
}

address_handler := func(m) {
    if m.ipaddress {
        if m.ipaddress == "8.8.8.8:853" || m.ipaddress == "8.8.8.8:443" || m.ipaddress == "8.8.4.4:853" || m.ipaddress == "8.8.4.4:443" || m.ipaddress == "[2001:4860:4860::8888]:853" || m.ipaddress == "[2001:4860:4860::8888]:443" || m.ipaddress == "[2001:4860:4860::8844]:853" || m.ipaddress == "[2001:4860:4860::8844]:443" {
            return { block: true }
        }
    }
    if m.domainaddress {
        if text.has_prefix(m.domainaddress, "dns.google:") {
            return { block: true }
        }
    }
}

handler := func(){
    if in_dnsquery {
        return dnsquery_handler(in_dnsquery)
    }
    if in_address {
        return address_handler(in_address)
    }
}

out := handler()

发起 TCP 连接

curl --http2 https://http3.ooo -v

发起 UDP 连接

curl --http3-only https://http3.ooo -v

Linux, macOS 会输出如下日志

{"action":"PROXY","appid":"/Users/fuck/.nami/bin/curl","brooklink":"default","content":"http3.ooo:443","iface":"","kind":"TCP","time":"2023-12-15T16:33:58+08:00"}

{"action":"PROXY","appid":"/Users/fuck/.nami/bin/curl","brooklink":"default","content":"http3.ooo:443","iface":"","kind":"UDP","time":"2023-12-15T16:34:39+08:00"}

与前面相比，可以看到 TCP 和 UDP 域名地址 http3.ooo:443

Windows 会输出如下日志

{"action":"PROXY","appid":"C:\\Users\\cloud\\.nami\\bin\\curl.exe","brooklink":"default","content":"http3.ooo:443","iface":"","kind":"TCP","time":"2023-12-15T16:33:58+08:00"}

{"action":"PROXY","appid":"C:\\Users\\cloud\\.nami\\bin\\curl.exe","brooklink":"default","content":"http3.ooo:443","iface":"","kind":"UDP","time":"2023-12-15T16:34:39+08:00"}

与前面相比，可以看到 TCP 和 UDP 域名地址 http3.ooo:443

讨论