MigrateRepos/OpenGFW
1
0
Fork 0
mirror of https://github.com/apernet/OpenGFW.git synced 2024-11-13 13:59:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: update socks doc

Browse Source
This commit is contained in:
KujouRinka 2024-01-27 20:59:41 +08:00
parent ff27ee512a
commit bd724f43c0
1 changed files with 23 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
docs/Analyzers.md
View File

@ -269,64 +269,42 @@ Example for blocking Trojan connections:
expr: trojan != nil && trojan.yes
```
## SOCKS4/SOCKS4A
## SOCKS
SOCKS4:
```json5
{
"socks4": {
"socks": {
"version": 4,
"req": {
"cmd": 1, // 0x01: connect, 0x02: bind
"ip": "1.1.1.1",
"cmd": 1,
"addr_type": 1, // same with socks5
"addr": "1.1.1.1",
// for socks4a
// "addr_type": 3,
// "addr": "google.com",
"port": 443,
"user_id": "user_id"
"auth": {
"user_id": "user"
}
},
"resp": {
"rep": 90, // 0x5A(90): granted
"ip": "1.1.1.1",
"rep": 90, // 0x5A(90) granted
"addr_type": 1,
"addr": "1.1.1.1",
"port": 443
}
}
}
```
SOCKS4A:
```json5
{
"socks4": {
"req": {
"cmd": 1, // 0x01: connect, 0x02: bind
"ip": "0.0.0.1",
"port": 443,
"user_id": "user_id",
"hostname": "google.com"
},
"resp": {
"rep": 90, // 0x5A(90): granted
"ip": "0.0.0.1",
"port": 443
}
}
}
```
Example for blocking connections to `google.com:80`:
```yaml
- name: block baidu socks
action: block
expr: string(socks4?.req?.hostname) endsWith "bilibili.com" && socks4?.req?.port == 80
```
## SOCKS5
SOCKS5 without auth:
```json5
{
"socks5": {
"socks": {
"version": 5,
"req": {
"cmd": 1, // 0x01: connect, 0x02: bind, 0x03: udp
"addr_type": 3, // 0x01: ipv4, 0x03: domain, 0x04: ipv6
@ -353,7 +331,8 @@ SOCKS5 with auth:
```json5
{
"socks5": {
"socks": {
"version": 5,
"req": {
"cmd": 1, // 0x01: connect, 0x02: bind, 0x03: udp
"addr_type": 3, // 0x01: ipv4, 0x03: domain, 0x04: ipv6
@ -382,11 +361,11 @@ SOCKS5 with auth:
Example for blocking connections to `google.com:80` and user `foobar`:
```yaml
- name: Block SOCKS5 google.com:80
- name: Block SOCKS google.com:80
action: block
expr: string(socks5?.req?.addr) endsWith "google.com" && socks5?.req?.port == 80
expr: string(socks?.req?.addr) endsWith "google.com" && socks?.req?.port == 80
- name: Block SOCKS5 user foobar
- name: Block SOCKS user foobar
action: block
expr: socks5?.req?.auth?.method == 2 && socks5?.req?.auth?.username == "foobar"
expr: socks?.req?.auth?.method == 2 && socks?.req?.auth?.username == "foobar"
```