procproxy 0.1.0__py3-none-any.whl

proxycore/dns/__init__.py

@@ -0,0 +1,46 @@
+"""DNS 与 UDP 处理。"""
+
+from __future__ import annotations
+
+from .cache import DEFAULT_TTL_S, CacheEntry, DnsCache, on_network_change
+from .modes import (
+    MODE_BYPASS,
+    MODE_LOCAL,
+    MODE_REMOTE,
+    DnsPolicy,
+    ResolutionPlan,
+    build_query,
+    parse_answers,
+    query_a_record,
+    sniff_queries,
+)
+from .udp import (
+    MAX_UDP_DATAGRAM,
+    UdpForwarder,
+    UdpPolicyResolver,
+    UdpRelayTransport,
+    UdpSession,
+    UdpSessionTable,
+)
+
+__all__ = [
+    "DEFAULT_TTL_S",
+    "MAX_UDP_DATAGRAM",
+    "MODE_BYPASS",
+    "MODE_LOCAL",
+    "MODE_REMOTE",
+    "CacheEntry",
+    "DnsCache",
+    "DnsPolicy",
+    "ResolutionPlan",
+    "UdpForwarder",
+    "UdpPolicyResolver",
+    "UdpRelayTransport",
+    "UdpSession",
+    "UdpSessionTable",
+    "build_query",
+    "on_network_change",
+    "parse_answers",
+    "query_a_record",
+    "sniff_queries",
+]

proxycore/dns/cache.py

@@ -0,0 +1,209 @@
+"""DNS 缓存：IP ↔ 域名映射，带 TTL 且必须标记 inferred。
+
+红线：
+* 通过 DNS 嗅探建立的映射只是近似（TTL 内有效，CDN 会误判）；
+* 必须带 TTL、必须标记 `inferred=True`、日志里必须能打出 `reason=name-inferred`;
+* 不得用于 BLOCK 决策（`is_trusted()` 只对"确定的域名"返回 True）。
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+from dataclasses import dataclass
+from typing import Any
+
+DEFAULT_TTL_S = 300.0
+MAX_ENTRIES = 20000
+
+
+@dataclass(slots=True)
+class CacheEntry:
+    addr: str
+    name: str
+    expires_at: float
+    inferred: bool = True  # 嗅探推断出来的 → 近似匹配
+    source: str = "dns-sniff"
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "addr": self.addr,
+            "name": self.name,
+            "expires_at": self.expires_at,
+            "inferred": self.inferred,
+            "source": self.source,
+        }
+
+
+class DnsCache:
+    """线程安全的 IP→域名表（`dict` + TTL 惰性清理）。"""
+
+    def __init__(self, *, default_ttl_s: float = DEFAULT_TTL_S, max_entries: int = MAX_ENTRIES,
+                 clock: Any = time.time) -> None:
+        self.default_ttl_s = float(default_ttl_s)
+        self.max_entries = max_entries
+        self._clock = clock
+        self._lock = threading.RLock()
+        self._by_ip: dict[str, CacheEntry] = {}
+        self._flush_count = 0
+        # 每次内容变化 +1。`GuardSet.inferred_names` 需要跟着缓存走，但
+        # `snapshot()` 是 O(条目数)（上限 20000），不能在决策热路径上每秒重算一遍；
+        # 调用方比对这个数就知道"要不要刷新"。
+        self._revision = 0
+
+    # ------------------------------------------------------------ 写入 -----
+    def put(
+        self,
+        addr: str,
+        name: str,
+        *,
+        ttl_s: float | None = None,
+        inferred: bool = True,
+        source: str = "dns-sniff",
+    ) -> CacheEntry:
+        ttl = self.default_ttl_s if ttl_s is None else max(1.0, float(ttl_s))
+        entry = CacheEntry(
+            addr=addr,
+            name=name,
+            expires_at=self._clock() + ttl,
+            inferred=inferred,
+            source=source,
+        )
+        with self._lock:
+            self._by_ip[addr] = entry
+            self._revision += 1
+            if len(self._by_ip) > self.max_entries:
+                self._evict_locked()
+        return entry
+
+    # ------------------------------------------------------------ 读取 -----
+    def get(self, addr: str) -> str | None:
+        """取域名（过期即删）。"""
+        with self._lock:
+            entry = self._by_ip.get(addr)
+            if entry is None:
+                return None
+            if entry.expires_at <= self._clock():
+                del self._by_ip[addr]
+                self._revision += 1  # 让 inferred_names 的持有者知道内容变了
+                return None
+            return entry.name
+
+    def entry(self, addr: str) -> CacheEntry | None:
+        with self._lock:
+            entry = self._by_ip.get(addr)
+            if entry is None or entry.expires_at <= self._clock():
+                if self._by_ip.pop(addr, None) is not None:
+                    self._revision += 1
+                return None
+            return entry
+
+    def is_inferred(self, addr: str) -> bool:
+        entry = self.entry(addr)
+        return bool(entry and entry.inferred)
+
+    def is_trusted(self, addr: str) -> bool:
+        """只有"确定的域名"才可信；推断出来的映射不可用于 BLOCK 决策。"""
+        entry = self.entry(addr)
+        return bool(entry and not entry.inferred)
+
+    def resolve(self, addr: str) -> str | None:
+        """`GuardSet.name_resolver` 的签名。"""
+        return self.get(addr)
+
+    def __len__(self) -> int:
+        with self._lock:
+            self._purge_locked()
+            return len(self._by_ip)
+
+    def snapshot(self) -> list[dict[str, Any]]:
+        with self._lock:
+            self._purge_locked()
+            return [e.to_dict() for e in self._by_ip.values()]
+
+    def stats(self) -> dict[str, Any]:
+        with self._lock:
+            self._purge_locked()
+            inferred = sum(1 for e in self._by_ip.values() if e.inferred)
+            return {
+                "entries": len(self._by_ip),
+                "inferred": inferred,
+                "flushes": self._flush_count,
+            }
+
+    # ------------------------------------------------------------ 清理 -----
+    def clear_inferred(self) -> int:
+        """网络切换时清掉推断映射。"""
+        with self._lock:
+            victims = [addr for addr, e in self._by_ip.items() if e.inferred]
+            for addr in victims:
+                del self._by_ip[addr]
+            self._flush_count += 1
+            self._revision += 1
+            return len(victims)
+
+    def clear(self) -> int:
+        with self._lock:
+            count = len(self._by_ip)
+            self._by_ip.clear()
+            self._flush_count += 1
+            self._revision += 1
+            return count
+
+    # -------------------------------------------------------- 变更通知 -----
+    @property
+    def revision(self) -> int:
+        """内容版本号；调用方据此判断"要不要重新读一遍缓存"。"""
+        with self._lock:
+            return self._revision
+
+    def inferred_names(self) -> set[str]:
+        """当前未过期的推断域名集合（`GuardSet.inferred_names` 的来源）。"""
+        with self._lock:
+            self._purge_locked()
+            return {e.name for e in self._by_ip.values() if e.inferred}
+
+    def _purge_locked(self) -> int:
+        now = self._clock()
+        victims = [addr for addr, e in self._by_ip.items() if e.expires_at <= now]
+        for addr in victims:
+            del self._by_ip[addr]
+        if victims:
+            self._revision += 1
+        return len(victims)
+
+    def _evict_locked(self) -> None:
+        # 先清过期，再按即将到期顺序淘汰
+        self._purge_locked()
+        overflow = len(self._by_ip) - self.max_entries
+        if overflow <= 0:
+            return
+        for addr, _ in sorted(self._by_ip.items(), key=lambda kv: kv[1].expires_at)[:overflow]:
+            del self._by_ip[addr]
+            self._revision += 1
+
+
+def on_network_change(cache: DnsCache, *, flush_system: bool = False) -> dict[str, Any]:
+    """网络接口变化时的处理（等效于 `ipconfig /flushdns`）。"""
+    import subprocess
+
+    removed = cache.clear_inferred()
+    result: dict[str, Any] = {"cleared_inferred": removed, "system_flush": False}
+    if flush_system:
+        from ..proc import IS_WINDOWS
+
+        cmd = ["ipconfig", "/flushdns"] if IS_WINDOWS else ["resolvectl", "flush-caches"]
+        try:
+            subprocess.run(cmd, capture_output=True, check=False, timeout=5)
+            result["system_flush"] = True
+        except (OSError, subprocess.SubprocessError) as exc:
+            result["system_flush_error"] = str(exc)
+    return result
+
+
+__all__ = [
+    "DEFAULT_TTL_S",
+    "CacheEntry",
+    "DnsCache",
+    "on_network_change",
+]