apernet / OpenGFW

OpenGFW is a flexible, easy-to-use, open source implementation of GFW (Great Firewall of China) on Linux
https://gfw.dev/
Mozilla Public License 2.0
9.47k stars 711 forks source link

Add Socks5 Analyzer #34

Closed KujouRinka closed 7 months ago

KujouRinka commented 7 months ago

I try to add a simple analyzer for socks5, which currently support AuthNotRequired and AuthPassword for handshake. The PropMap after feeding data to this analyzer may looks like:

Take google.com as an example:

If AuthNotRequired:

{
  "socks5": {
    "req": {
      "cmd": 1,         // 0x01: connect, 0x02: bind, 0x03: udp
      "addr_type": 3,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
      "addr": "google.com",
      "port": 80,
      "auth": {
        "method": 0     // 0x00: no auth, 0x02: username/password
      }
    },
    "resp": {
      "rep": 0,         // 0x00: success
      "addr_type": 1,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
      "addr": "198.18.1.31",
      "port": 80,
      "auth": {
        "method": 0     // 0x00: no auth, 0x02: username/password
      }
    }
  }
}

If AuthPassword:

{
  "socks5": {
    "req": {
      "cmd": 1,         // 0x01: connect, 0x02: bind, 0x03: udp
      "addr_type": 3,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
      "addr": "google.com",
      "port": 80,
      "auth": {
        "method": 2,    // 0x00: no auth, 0x02: username/password
        "username": "user",
        "password": "pass"
      }
    },
    "resp": {
      "rep": 0,         // 0x00: success
      "addr_type": 1,   // 0x01: ipv4, 0x03: domain, 0x04: ipv6
      "addr": "198.18.1.31",
      "port": 80,
      "auth": {
        "method": 2,    // 0x00: no auth, 0x02: username/password
        "status": 0     // 0x00: success, 0x01: failure
      }
    }
  }
}
tobyxdd commented 7 months ago

Thanks for your contribution ❤️ I'll test and merge it tomorrow. Could you also add the documentation to docs/Analyzers.md?

KujouRinka commented 7 months ago

I will add the documentation tonight, It's my pleasure!

tobyxdd commented 7 months ago

I can confirm this works. Many thanks!