feat(udp): add EasyTier analyzer for tcp:// and udp:// transports

Port of NoBrand-Cloud/OpenGFW-RS commit 1177ff7 to Go.

EasyTier's ciphers cover only the payload: the 16-byte PeerManagerHeader
stays in the clear, so peer ids, packet type and two redundant length
fields are readable even on an encrypted mesh. The plaintext handshake
also carries the network name, which lets a rule block one mesh and
leave the rest alone (easytier.network_name). A Syn answered by a Sack
echoing the same connection id and magic, or a handshake carrying the
0xd1e1a5e1 magic, settles a flow on its own; otherwise two consistent
frames are required. Hole-punch probes are reported but never set yes.

The wg://, quic:// and wss:// transports are left to the wireguard, quic
and tls analyzers. fet does not cover the tcp:// transport because it
classifies the plaintext handshake segment and is then done.

Rules must be written as `easytier != nil && ...`: the rule engine only
exposes analyzers that have published properties.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RjQ1CTBn8j65cUZ2JKsY7L

This commit is contained in:

Mxmilu666

2026-09-12 17:05:39 +08:00

co-authored by

Claude Fable 5.1

parent f6342c4bcf

commit cc6ad72706

7 changed files with 1577 additions and 3 deletions

									
										cmd/root.go
									
		+1
		
												View File
												
				@@ -96,6 +96,7 @@ var analyzers = []analyzer.Analyzer{

					&tcp.TLSAnalyzer{},

					&tcp.TrojanAnalyzer{},

					&udp.DNSAnalyzer{},

					&udp.EasyTierAnalyzer{},

					&udp.OpenVPNAnalyzer{},

					&udp.QUICAnalyzer{},

					&udp.WireGuardAnalyzer{},