mirror of
https://github.com/EasyTier/EasyTier.git
synced 2026-09-03 09:35:41 +00:00
Adds a Linux-only socket_mark u32 config flag (CLI: --socket-mark, env:
ET_SOCKET_MARK, TOML/proto: flags.socket_mark, 0 = disabled) that is
applied as SO_MARK to every outbound underlay socket EasyTier creates:
TCP, UDP, QUIC, WebSocket, WireGuard connectors and listeners, plus the
FakeTCP decoy socket. Lets the host policy-route or filter EasyTier
underlay traffic with 'ip rule fwmark ...' or iptables -m mark.
Plumbing mirrors the existing bind_device pattern:
- FlagsInConfig.socket_mark (proto) + default 0 in gen_default_flags
- bind() builder gets a socket_mark arg; setup_socket2_ext calls
apply_socket_mark which is a no-op for mark=0 and on non-Linux
- TunnelConnector trait gets set_socket_mark(u32) default-no-op method
- IP-based connectors override; create_listener_by_url and the connector
factory pass mark from global_ctx flags
- QUIC threads mark through QuicEndpointManager::{server,connect}
- WebSocket/FakeTCP/TCP default-bind bypass paths apply mark via
socket2::SockRef::from(&tokio_socket)
- ForeignNetworkEntry propagates parent socket_mark into its derived ctx
Includes a Linux smoke test plus a CAP_NET_ADMIN-gated test that does a
getsockopt(SO_MARK) round-trip to confirm the kernel applied the value.
SO_MARK requires CAP_NET_ADMIN; ignored silently on non-Linux. FakeTCP's
TUN-written segments are not covered (kernel doesn't tag raw TUN
writes); operators relying on fwmark for FakeTCP must apply an iptables
rule on the FakeTCP TUN device separately.
Co-authored-by: Claude <noreply@anthropic.com>
270 lines
5.8 KiB
Protocol Buffer
270 lines
5.8 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
import "error.proto";
|
|
|
|
package common;
|
|
|
|
message FlagsInConfig {
|
|
string default_protocol = 1;
|
|
string dev_name = 2;
|
|
bool enable_encryption = 3;
|
|
bool enable_ipv6 = 4;
|
|
uint32 mtu = 5;
|
|
bool latency_first = 6;
|
|
bool enable_exit_node = 7;
|
|
bool no_tun = 8;
|
|
bool use_smoltcp = 9;
|
|
string relay_network_whitelist = 10;
|
|
bool disable_p2p = 11;
|
|
bool relay_all_peer_rpc = 12;
|
|
bool disable_udp_hole_punching = 13;
|
|
// string ipv6_listener = 14; [deprecated = true]; use -l udp://[::]:12345
|
|
// instead
|
|
bool multi_thread = 15;
|
|
CompressionAlgoPb data_compress_algo = 16;
|
|
bool bind_device = 17;
|
|
|
|
// should we convert all tcp streams into kcp streams
|
|
bool enable_kcp_proxy = 18;
|
|
// does this peer allow kcp input
|
|
bool disable_kcp_input = 19;
|
|
// disable relay local network kcp packets
|
|
bool disable_relay_kcp = 20;
|
|
bool proxy_forward_by_system = 21;
|
|
|
|
// enable magic dns or not
|
|
bool accept_dns = 22;
|
|
// enable private mode
|
|
bool private_mode = 23;
|
|
|
|
// should we convert all tcp streams into quic streams
|
|
bool enable_quic_proxy = 24;
|
|
// does this peer allow quic input
|
|
bool disable_quic_input = 25;
|
|
// disable relay local network quic packets
|
|
bool disable_relay_quic = 35;
|
|
|
|
// quic listen port
|
|
uint32 quic_listen_port = 33 [deprecated = true];
|
|
|
|
// a global relay limit, only work for foreign network
|
|
uint64 foreign_relay_bps_limit = 26;
|
|
|
|
uint32 multi_thread_count = 27;
|
|
|
|
// enable relay foreign network kcp packets
|
|
bool enable_relay_foreign_network_kcp = 28;
|
|
|
|
// enable relay foreign network quic packets
|
|
bool enable_relay_foreign_network_quic = 36;
|
|
|
|
// encryption algorithm to use, empty string means default (aes-gcm)
|
|
string encryption_algorithm = 29;
|
|
|
|
// disable symmetric nat hole punching, treat symmetric as cone when enabled
|
|
bool disable_sym_hole_punching = 30;
|
|
|
|
// tld dns zone for magic dns
|
|
string tld_dns_zone = 31;
|
|
|
|
bool p2p_only = 32;
|
|
|
|
bool disable_tcp_hole_punching = 34;
|
|
|
|
bool lazy_p2p = 37;
|
|
bool need_p2p = 38;
|
|
uint64 instance_recv_bps_limit = 39;
|
|
bool disable_upnp = 40;
|
|
bool disable_relay_data = 41;
|
|
bool enable_udp_broadcast_relay = 42;
|
|
|
|
// Linux-only: SO_MARK (fwmark) value applied to every outbound underlay
|
|
// socket (TCP/UDP/QUIC/WS/WG connectors and listeners). Unset = leave
|
|
// SO_MARK untouched (kernel default 0). Any set value (including 0) is
|
|
// applied via setsockopt. Requires CAP_NET_ADMIN; silently ignored on
|
|
// non-Linux platforms.
|
|
optional uint32 socket_mark = 43;
|
|
}
|
|
|
|
message RpcDescriptor {
|
|
// allow same service registered multiple times in different domain
|
|
string domain_name = 1;
|
|
|
|
string proto_name = 2;
|
|
string service_name = 3;
|
|
uint32 method_index = 4;
|
|
}
|
|
|
|
message RpcRequest {
|
|
RpcDescriptor descriptor = 1 [ deprecated = true ];
|
|
|
|
bytes request = 2;
|
|
int32 timeout_ms = 3;
|
|
}
|
|
|
|
message RpcResponse {
|
|
bytes response = 1;
|
|
error.Error error = 2;
|
|
|
|
uint64 runtime_us = 3;
|
|
}
|
|
|
|
enum CompressionAlgoPb {
|
|
Invalid = 0;
|
|
None = 1;
|
|
Zstd = 2;
|
|
}
|
|
|
|
message RpcCompressionInfo {
|
|
// use this to compress the content
|
|
CompressionAlgoPb algo = 1;
|
|
|
|
// tell the peer which compression algo is used to compress the next
|
|
// response/request
|
|
CompressionAlgoPb accepted_algo = 2;
|
|
}
|
|
|
|
message RpcPacket {
|
|
uint32 from_peer = 1;
|
|
uint32 to_peer = 2;
|
|
int64 transaction_id = 3;
|
|
|
|
RpcDescriptor descriptor = 4;
|
|
bytes body = 5;
|
|
bool is_request = 6;
|
|
|
|
uint32 total_pieces = 7;
|
|
uint32 piece_idx = 8;
|
|
|
|
int32 trace_id = 9;
|
|
|
|
RpcCompressionInfo compression_info = 10;
|
|
}
|
|
|
|
message Void {}
|
|
|
|
message UUID {
|
|
uint32 part1 = 1;
|
|
uint32 part2 = 2;
|
|
uint32 part3 = 3;
|
|
uint32 part4 = 4;
|
|
}
|
|
|
|
enum NatType {
|
|
// has NAT; but own a single public IP, port is not changed
|
|
Unknown = 0;
|
|
OpenInternet = 1;
|
|
NoPAT = 2;
|
|
FullCone = 3;
|
|
Restricted = 4;
|
|
PortRestricted = 5;
|
|
Symmetric = 6;
|
|
SymUdpFirewall = 7;
|
|
SymmetricEasyInc = 8;
|
|
SymmetricEasyDec = 9;
|
|
}
|
|
|
|
message Ipv4Addr { uint32 addr = 1; }
|
|
|
|
message Ipv6Addr {
|
|
uint32 part1 = 1;
|
|
uint32 part2 = 2;
|
|
uint32 part3 = 3;
|
|
uint32 part4 = 4;
|
|
}
|
|
|
|
message IpAddr {
|
|
oneof ip {
|
|
Ipv4Addr ipv4 = 1;
|
|
Ipv6Addr ipv6 = 2;
|
|
};
|
|
}
|
|
|
|
message Ipv4Inet {
|
|
Ipv4Addr address = 1;
|
|
uint32 network_length = 2;
|
|
}
|
|
|
|
message Ipv6Inet {
|
|
Ipv6Addr address = 1;
|
|
uint32 network_length = 2;
|
|
}
|
|
|
|
message IpInet {
|
|
oneof ip {
|
|
Ipv4Inet ipv4 = 1;
|
|
Ipv6Inet ipv6 = 2;
|
|
};
|
|
}
|
|
|
|
message Url { string url = 1; }
|
|
|
|
message SocketAddr {
|
|
oneof ip {
|
|
Ipv4Addr ipv4 = 1;
|
|
Ipv6Addr ipv6 = 2;
|
|
};
|
|
uint32 port = 3;
|
|
}
|
|
|
|
message TunnelInfo {
|
|
string tunnel_type = 1;
|
|
common.Url local_addr = 2;
|
|
common.Url remote_addr = 3;
|
|
common.Url resolved_remote_addr = 4;
|
|
}
|
|
|
|
message StunInfo {
|
|
NatType udp_nat_type = 1;
|
|
NatType tcp_nat_type = 2;
|
|
int64 last_update_time = 3;
|
|
repeated string public_ip = 4;
|
|
uint32 min_port = 5;
|
|
uint32 max_port = 6;
|
|
}
|
|
|
|
message PeerFeatureFlag {
|
|
bool is_public_server = 1;
|
|
bool avoid_relay_data = 2;
|
|
bool kcp_input = 3;
|
|
bool no_relay_kcp = 4;
|
|
bool support_conn_list_sync = 5;
|
|
bool quic_input = 6;
|
|
bool no_relay_quic = 7;
|
|
bool is_credential_peer = 8;
|
|
bool need_p2p = 9;
|
|
bool disable_p2p = 10;
|
|
bool ipv6_public_addr_provider = 11;
|
|
}
|
|
|
|
enum SocketType {
|
|
TCP = 0;
|
|
UDP = 1;
|
|
}
|
|
|
|
message PortForwardConfigPb {
|
|
SocketAddr bind_addr = 1;
|
|
SocketAddr dst_addr = 2;
|
|
SocketType socket_type = 3;
|
|
}
|
|
|
|
message ProxyDstInfo { SocketAddr dst_addr = 1; }
|
|
|
|
message LimiterConfig {
|
|
optional uint64 burst_rate =
|
|
1; // default 1 means no burst (capacity is same with bps)
|
|
optional uint64 bps = 2; // default 0 means no limit (unit is B/s)
|
|
optional uint64 fill_duration_ms =
|
|
3; // default 10ms, the period to fill the bucket
|
|
}
|
|
|
|
message SecureModeConfig {
|
|
bool enabled = 1;
|
|
|
|
// base64(X25519 private key), used by shared node to present a stable identity
|
|
optional string local_private_key = 2;
|
|
|
|
// base64(X25519 public key), required if local_private_key is set
|
|
optional string local_public_key = 3;
|
|
}
|