Resources
SYNOPSIS
GLOBAL OPTIONS
-
+
--blockCIDR4List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr4.txt. Works with server/wsserver/wssserver/quicserver
+
+--blockCIDR6List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr6.txt. Works with server/wsserver/wssserver/quicserver
+
+--blockDomainList="": One domain per line, suffix match mode. https://, http:// or local file absolute path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt. Works with server/wsserver/wssserver/quicserver
+
+--blockGeoIP="": Block IP by Geo country code, such as US. Works with server/wsserver/wssserver/quicserver
+
+--blockListUpdateInterval="": Update list --blockDomainList,--blockCIDR4List,--blockCIDR6List interval, second. default 0, only read one time on start (default: 0)
+--clientHKDFInfo="": client HKDF info, most time you don't need to change this, if changed, all and each brook links in client side must be same, I mean each (default: "brook")
--dialWithDNS="": When a domain name needs to be resolved, use the specified DNS. Such as 8.8.8.8:53 or https://dns.google/dns-query?address=8.8.8.8%3A443, the address is required. Note that for client-side commands, this does not affect the client passing the domain address to the server
@@ -2037,7 +2066,9 @@GLOBAL OPTIONS
--ipLimitWait="": How long (s) to wait for recovery after exceeding ipLimitMax (default: 0)
---log="": Enable log. A valid value is file path or 'console'. If you want to debug SOCKS5 lib, set env SOCKS5_DEBUG=true
+--log="": Enable log. A valid value is file path or 'console'. Send SIGUSR1 to me to reset the log file on unix system. If you want to debug SOCKS5 lib, set env SOCKS5_DEBUG=true
+
+--pid="": A file path used to store pid. Send SIGUSR1 to me to reset the --serverLog file on unix system
--pprof="": go http pprof listen addr, such as :6060
@@ -2047,26 +2078,34 @@ --serverHKDFInfo="": server HKDF info, most time you don't need to change this, if changed, all and each brook links in client side must be same, I mean each (default: "brook")
---serverLog="": Enable server log, traffic and more. A valid value is file path or 'console'. Mutually exclusive with the --log parameter. Works with server/wsserver/wssserver/quicserver
+--serverLog="": Enable server log, traffic and more. A valid value is file path or 'console'. Send SIGUSR1 to me to reset the log file on unix system. Mutually exclusive with the --log parameter. Works with server/wsserver/wssserver/quicserver with brook protocol
+
+--speedLimit="": Limit speed (b), 500kb/s such as: 500000, works with server/wsserver/wssserver/quicserver (default: 0)
+
+--tag="": Tag can be used to the process, will be append into log or serverLog, such as: 'key1:value1'. All tags will also be appended as query parameters one by one to the userAPI
---speedLimit="": Limit speed (b), such as 500kb/s: 500000, works with server/wsserver/wssserver/quicserver (default: 0)
+--userAPI="": When you build your own user system, Brook Server will send GET request to your userAPI to check if token is valid, for example: https://your-api-server.com/a_unpredictable_path. Yes, it is recommended to add an unpredictable path to your https API, of course, you can also use the http api for internal network communication. The request format is https://your-api-server.com/a_unpredictable_path?token=xxx. When the response is 200, the body should be the user's unique identifier, such as user ID; all other status codes are considered to represent an illegitimate user, and in these cases, the body should be a string describing the error. It should be used with --serverLog and server/wsserver/wssserver/quicserver with brook protocol. For more information, please read https://github.com/txthinking/brook/blob/master/protocol/user.md
---tag="": Tag can be used to the process, will be append into log or serverLog, such as: 'key1:value1'
+--userAPIInvalidCacheTime="": Once a token is checked and invalid, the userAPI will not be requested to validate again for a certain period (s). A reasonable value must be set, otherwise it will affect the performance of each incoming connection. Note that this may affect the user experience, when you change the user status from invalid to valid in your user system (default: 1800)
+
+--userAPIValidCacheTime="": Once a token is checked and valid, the userAPI will not be requested to validate again for a certain period (s). A reasonable value must be set, otherwise it will affect the performance of each incoming connection (default: 3600)
--version, -v: print the version
GLOBAL OPTIONS
COMMANDS
server
-Run as brook server, both TCP and UDP
+Start a brook server that supports tcp and udp
-
-
--blockCIDR4List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr4.txt
+--blockCIDR4List="": This option will be removed in a future version, please use the global option instead
+
+--blockCIDR6List="": This option will be removed in a future version, please use the global option instead
---blockCIDR6List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr6.txt
+--blockDomainList="": This option will be removed in a future version, please use the global option instead
---blockDomainList="": One domain per line, suffix match mode. https://, http:// or local file absolute path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
+--blockGeoIP="": This option will be removed in a future version, please use the global option instead
---blockGeoIP="": Block IP by Geo country code, such as US
+--example: Show a minimal example of usage
--listen, -l="": Listen address, like: ':9999'
@@ -2076,14 +2115,18 @@ --udpTimeout="": time (s) (default: 0)
---updateListInterval="": Update list interval, second. default 0, only read one time on start (default: 0)
+--updateListInterval="": This option will be removed in a future version, please use the global option instead (default: 0)
server
client
-Run as brook client, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook client <-> $ brook server <-> dst]
+Start a brook client that supports tcp and udp. It can open a socks5 proxy, [src <-> socks5 <-> $ brook client <-> $ brook server <-> dst]
-
+
--example: Show a minimal example of usage
+--http="": Where to listen for HTTP proxy connections
+--link="": brook link, you can get it via $ brook link. The wssserver and password parameters will be ignored
+--password, -p="": Brook server password
--server, -s="": Brook server address, like: 1.2.3.4:9999
@@ -2096,19 +2139,19 @@client
--udpTimeout="": time (s) (default: 0)
---udpovertcp: UDP over TCP
-
wsserver
-Run as brook wsserver, both TCP and UDP, it will start a standard http server and websocket server
+Start a brook wsserver that supports tcp and udp. It opens a standard http server and a websocket server
-
-
--blockCIDR4List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr4.txt
+--blockCIDR4List="": This option will be removed in a future version, please use the global option instead
+
+--blockCIDR6List="": This option will be removed in a future version, please use the global option instead
---blockCIDR6List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr6.txt
+--blockDomainList="": This option will be removed in a future version, please use the global option instead
---blockDomainList="": One domain per line, suffix match mode. https://, http:// or local file absolute path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
+--blockGeoIP="": This option will be removed in a future version, please use the global option instead
---blockGeoIP="": Block IP by Geo country code, such as US
+--example: Show a minimal example of usage
--listen, -l="": Listen address, like: ':80'
@@ -2120,7 +2163,7 @@ --udpTimeout="": time (s) (default: 0)
---updateListInterval="": Update list interval, second. default 0, only read one time on start (default: 0)
+--updateListInterval="": This option will be removed in a future version, please use the global option instead (default: 0)
--withoutBrookProtocol: The data will not be encrypted with brook protocol
@@ -2128,12 +2171,14 @@
wsserver
wsserver
wsclient
-Run as brook wsclient, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook wsclient <-> $ brook wsserver <-> dst]
+Start a brook wsclient that supports tcp and udp. It can open a socks5 proxy, [src <-> socks5 <-> $ brook wsclient <-> $ brook wsserver <-> dst]
-
-
--address="": Specify address instead of resolving addresses from host, such as 1.2.3.4:443
+--example: Show a minimal example of usage
--http="": Where to listen for HTTP proxy connections
+--link="": brook link, you can get it via $ brook link. The wssserver and password parameters will be ignored
+--password, -p="": Brook wsserver password
--socks5="": Where to listen for SOCKS5 connections (default: 127.0.0.1:1080)
@@ -2144,21 +2189,19 @@wsclient
--udpTimeout="": time (s) (default: 0)
---withoutBrookProtocol: The data will not be encrypted with brook protocol
---wsserver, -s="": Brook wsserver address, like: ws://1.2.3.4:80, if no path then /ws will be used. Do not omit the port under any circumstances
wssserver
-Run as brook wssserver, both TCP and UDP, it will start a standard https server and websocket server
+Start a brook wssserver that supports tcp and udp. It opens a standard https server and a websocket server
-
-
--blockCIDR4List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr4.txt
+--blockCIDR4List="": This option will be removed in a future version, please use the global option instead
---blockCIDR6List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr6.txt
+--blockCIDR6List="": This option will be removed in a future version, please use the global option instead
---blockDomainList="": One domain per line, suffix match mode. https://, http:// or local file absolute path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
+--blockDomainList="": This option will be removed in a future version, please use the global option instead
---blockGeoIP="": Block IP by Geo country code, such as US
+--blockGeoIP="": This option will be removed in a future version, please use the global option instead
--cert="": The cert file absolute path for the domain, such as /path/to/cert.pem. If cert or certkey is empty, a certificate will be issued automatically
@@ -2166,6 +2209,8 @@ --domainaddress="": Such as: domain.com:443. If you choose to automatically issue certificates, the domain must have been resolved to the server IP and 80 port also will be used
+--example: Show a minimal example of usage
+--password, -p="": Server password
--path="": URL path (default: /ws)
@@ -2174,14 +2219,16 @@wssserver
--udpTimeout="": time (s) (default: 0)
---updateListInterval="": Update list interval, second. default 0, only read one time on start (default: 0)
+--updateListInterval="": This option will be removed in a future version, please use the global option instead (default: 0)
--withoutBrookProtocol: The data will not be encrypted with brook protocol
wssserver
wssclient
-Run as brook wssclient, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook wssclient <-> $ brook wssserver <-> dst]
+Start a brook wssclient that supports tcp and udp. It can open a socks5 proxy, [src <-> socks5 <-> $ brook wssclient <-> $ brook wssserver <-> dst]
-
+
--example: Show a minimal example of usage
+--http="": Where to listen for HTTP proxy connections
--link="": brook link, you can get it via $ brook link. The wssserver and password parameters will be ignored
@@ -2200,15 +2247,15 @@wssclient
quicserver
-Run as brook quicserver, both TCP and UDP
+Start a brook quicserver that supports tcp and udp.
-
-
--blockCIDR4List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr4.txt
+--blockCIDR4List="": This option will be removed in a future version, please use the global option instead
---blockCIDR6List="": One CIDR per line, https://, http:// or local file absolute path, like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_cidr6.txt
+--blockCIDR6List="": This option will be removed in a future version, please use the global option instead
---blockDomainList="": One domain per line, suffix match mode. https://, http:// or local file absolute path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
+--blockDomainList="": This option will be removed in a future version, please use the global option instead
---blockGeoIP="": Block IP by Geo country code, such as US
+--blockGeoIP="": This option will be removed in a future version, please use the global option instead
--cert="": The cert file absolute path for the domain, such as /path/to/cert.pem. If cert or certkey is empty, a certificate will be issued automatically
@@ -2216,31 +2263,27 @@ --domainaddress="": Such as: domain.com:443. If you choose to automatically issue certificates, the domain must have been resolved to the server IP and 80 port also will be used
+--example: Show a minimal example of usage
+--password, -p="": Server password
--tcpTimeout="": time (s) (default: 0)
--udpTimeout="": time (s) (default: 0)
---updateListInterval="": Update list interval, second. default 0, only read one time on start (default: 0)
+--updateListInterval="": This option will be removed in a future version, please use the global option instead (default: 0)
--withoutBrookProtocol: The data will not be encrypted with brook protocol
quicserver
quicclient
-Run as brook quicclient, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook quicclient <-> $ brook quicserver <-> dst]. (Note that the global dial parameter is ignored now)
+Start a brook quicclient that supports tcp and udp. It can open a socks5 proxy, [src <-> socks5 <-> $ brook quicclient <-> $ brook quicserver <-> dst]. (The global-dial-parameter is ignored)
-
-
--address="": Specify address instead of resolving addresses from host, such as 1.2.3.4:443
-
---ca="": Specify ca instead of insecure, such as /path/to/ca.pem
+--example: Show a minimal example of usage
--http="": Where to listen for HTTP proxy connections
---insecure: Client do not verify the server's certificate chain and host name
-
---password, -p="": Brook quicserver password
-
---quicserver, -s="": Brook quicserver address, like: quic://google.com:443. Do not omit the port under any circumstances
+--link="": brook link, you can get it via $ brook link. The wssserver and password parameters will be ignored
--socks5="": Where to listen for SOCKS5 connections (default: 127.0.0.1:1080)
@@ -2250,12 +2293,12 @@ --udpTimeout="": time (s) (default: 0)
---withoutBrookProtocol: The data will not be encrypted with brook protocol
-
quicclient
relayoverbrook
-Run as relay over brook, both TCP and UDP, this means access [from address] is equal to [to address], [src <-> from address <-> $ brook server/wsserver/wssserver/quicserver <-> to address]
+Relay network traffic over brook, which supports TCP and UDP. Accessing [from address] is equal to accessing [to address], [src <-> from address <-> $ brook server/wsserver/wssserver/quicserver <-> to address]
-
+
--example: Show a minimal example of usage
+--from, -f, -l="": Listen address: like ':9999'
--link="": brook link, you can get it via $ brook link. The server and password parameters will be ignored
@@ -2272,7 +2315,7 @@relayoverbrook
dnsserveroverbrook
-Run as dns server over brook, both TCP and UDP, [src <-> $ brook dnserversoverbrook <-> $ brook server/wsserver/wssserver/quicserver <-> dns] or [src <-> $ brook dnsserveroverbrook <-> dnsForBypass]
+Run a dns server over brook, which supports TCP and UDP, [src <-> $ brook dnserversoverbrook <-> $ brook server/wsserver/wssserver/quicserver <-> dns] or [src <-> $ brook dnsserveroverbrook <-> dnsForBypass]
--blockDomainList="": One domain per line, suffix match mode. https://, http:// or local absolute file path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
@@ -2286,6 +2329,8 @@ --dnsForBypass="": DNS server for resolving domains in bypass list. Such as 223.5.5.5:53 or https://dns.alidns.com/dns-query?address=223.5.5.5:443, the address is required (default: 223.5.5.5:53)
+--example: Show a minimal example of usage
+--link="": brook link, you can get it via $ brook link. The server and password parameters will be ignored
--listen, -l="": Listen address, like: 127.0.0.1:53
@@ -2300,7 +2345,7 @@dnsserveroverbrook
dnsserveroverbrook
link
-Generate brook link
+Generate a brook link
--address="": When server is brook wsserver or brook wssserver or brook quicserver, specify address instead of resolving addresses from host, such as 1.2.3.4:443
@@ -2308,7 +2353,9 @@ --clientHKDFInfo="": client HKDF info, most time you don't need to change this, read brook protocol if you don't know what this is
---fragment="": When server is brook wssserver, split the ClientHello into multiple fragments and then send them one by one with delays (millisecond). The format is min_length:max_length:min_delay:max_delay, cannot be zero, such as 50:100:10:50, Note that: This is an experimental feature, currently only supported by the brook CLI and tun2brook.
+--example: Show a minimal example of usage
+
+--fragment="": When server is brook wssserver, split the ClientHello into multiple fragments and then send them one by one with delays (millisecond). The format is min_length:max_length:min_delay:max_delay, cannot be zero, such as 50:100:10:50
--insecure: When server is brook wssserver or brook quicserver, client do not verify the server's certificate chain and host name
@@ -2322,6 +2369,10 @@ --tlsfingerprint="": When server is brook wssserver, select tls fingerprint, value can be: chrome
+--token="": A token represents a user's identity. A string encoded in hexadecimal. Server needs to have --userAPI enabled. Note that: Only supported by the brook GUI(except for OpenWrt) and tun2brook
+
+--udpoverstream: When server is brook quicserver, UDP over Stream. Under normal circumstances, you need this parameter because the max datagram size for QUIC is very small. Note: only brook CLI and tun2brook suppport for now
+--udpovertcp: When server is brook server, UDP over TCP
--username, -u="": Username, when server is socks5 server
@@ -2330,8 +2381,10 @@link
link
link
connect
-Run as client and connect to brook link, both TCP and UDP, to start a socks5 proxy, [src <-> socks5 <-> $ brook connect <-> $ brook server/wsserver/wssserver/quicserver <-> dst]
+Run a client and connect with a brook link, which supports TCP and UDP. It can start a socks5 proxy, [src <-> socks5 <-> $ brook connect <-> $ brook server/wsserver/wssserver/quicserver <-> dst]
-
+
--example: Show a minimal example of usage
+--http="": Where to listen for HTTP proxy connections
--link, -l="": brook link, you can get it via $ brook link
@@ -2346,8 +2399,10 @@connect
relay
-Run as standalone relay, both TCP and UDP, this means access [from address] is equal to access [to address], [src <-> from address <-> to address]
+Run a standalone relay, which supports TCP and UDP. Accessing [from address] is equal to accessing [to address], [src <-> from address <-> to address]
-
+
--example: Show a minimal example of usage
+--from, -f, -l="": Listen address: like ':9999'
--tcpTimeout="": time (s) (default: 0)
@@ -2358,7 +2413,7 @@relay
dnsserver
-Run as standalone dns server
+Run a standalone dns server
--blockDomainList="": One domain per line, suffix match mode. https://, http:// or local absolute file path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
@@ -2368,6 +2423,8 @@ --dns="": DNS server which forward to. Such as 8.8.8.8:53 or https://dns.google/dns-query?address=8.8.8.8%3A443, the address is required (default: 8.8.8.8:53)
+--example: Show a minimal example of usage
+--listen, -l="": Listen address, like: 127.0.0.1:53
--tcpTimeout="": time (s) (default: 0)
@@ -2382,13 +2439,15 @@dnsclient
--domain, -d="": Domain
+--example: Show a minimal example of usage
+--short: Short for A/AAAA
--type, -t="": Type, such as A (default: A)
dnsserver
dohserver
-Run as standalone doh server
+Run a standalone doh server
--blockDomainList="": One domain per line, suffix match mode. https://, http:// or local absolute file path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
@@ -2404,6 +2463,8 @@ --domainaddress="": Such as: domain.com:443, if you want to create a https server. If you choose to automatically issue certificates, the domain must have been resolved to the server IP and 80 port also will be used
+--example: Show a minimal example of usage
+--listen="": listen address, if you want to create a http server behind nico
--path="": URL path (default: /dns-query)
@@ -2420,13 +2481,15 @@dohclient
--domain, -d="": Domain
+--example: Show a minimal example of usage
+--short: Short for A/AAAA
--type, -t="": Type, such as A (default: A)
dohserver
dhcpserver
-Run as standalone dhcp server. Note that you need to stop other dhcp servers, if there are.
+Run a standalone dhcp server. Other running dhcp servers need to be stopped.
--cache="": Cache file, local absolute file path, default is $HOME/.brook.dhcpserver
@@ -2434,6 +2497,8 @@ --dnsserver="": The dns server which you want to assign to clients, such as: 192.168.1.1 or 8.8.8.8
+--example: Show a minimal example of usage
+--gateway="": The router gateway which you want to assign to clients, such as: 192.168.1.1
--interface="": Select interface on multi interface device. Linux only
@@ -2446,8 +2511,10 @@dhcpserver
dhcpserver
socks5
-Run as standalone standard socks5 server, both TCP and UDP
+Run a standalone standard socks5 server, which supports TCP and UDP
-
+
--example: Show a minimal example of usage
+--limitUDP: The server MAY use this information to limit access to the UDP association. This usually causes connection failures in a NAT environment, where most clients are.
--listen, -l="": Socks5 server listen address, like: :1080 or 1.2.3.4:1080
@@ -2464,8 +2531,10 @@socks5
socks5tohttp
-Convert socks5 to http proxy, [src <-> listen address(http proxy) <-> socks5 address <-> dst]
+Convert a socks5 proxy to a http proxy, [src <-> listen address(http proxy) <-> socks5 address <-> dst]
-
+
--example: Show a minimal example of usage
+--listen, -l="": HTTP proxy which will be create: like: 127.0.0.1:8010
--socks5, -s="": Socks5 server address, like: 127.0.0.1:1080
@@ -2478,10 +2547,12 @@socks5tohttp
pac
-Run as PAC server or save PAC to file
+Run a PAC server or save PAC to a file
--bypassDomainList, -b="": One domain per line, suffix match mode. http(s):// or local absolute file path. Like: https://raw.githubusercontent.com/txthinking/brook/master/programmable/list/example_domain.txt
+--example: Show a minimal example of usage
+--file, -f="": Save PAC to file, this will ignore listen address
--listen, -l="": Listen address, like: 127.0.0.1:1980
@@ -2490,12 +2561,14 @@pac
testsocks5
-Test UDP and TCP of socks5 server
+Test a socks5 server to see if it works properly
--dns="": DNS server for connecting (default: 8.8.8.8:53)
--domain="": Domain for query (default: http3.ooo)
+--example: Show a minimal example of usage
+--password, -p="": Socks5 password
--socks5, -s="": Like: 127.0.0.1:1080
@@ -2506,12 +2579,14 @@testsocks5
testbrook
-Test UDP and TCP of brook server/wsserver/wssserver/quicserver. (Note that the global dial parameter is ignored now)
+Test UDP and TCP of a brook server/wsserver/wssserver/quicserver connection. (The global-dial-parameter is ignored)
--dns="": DNS server for connecting (default: 8.8.8.8:53)
--domain="": Domain for query (default: http3.ooo)
+--example: Show a minimal example of usage
+--link, -l="": brook link. Get it via $ brook link
--socks5="": Temporarily listening socks5 (default: 127.0.0.1:11080)
@@ -2522,11 +2597,16 @@testbrook
echoserver
Echo server, echo UDP and TCP address of routes
-
-
- --listen, -l="": Listen address, like: ':7777' +
--example: Show a minimal example of usage
+
+--listen, -l="": Listen address, like: ':7777'
+
echoclient
Connect to echoserver, echo UDP and TCP address of routes
-
+
--example: Show a minimal example of usage
+--server, -s="": Echo server address, such as 1.2.3.4:7777
--times="": Times of interactions (default: 0)
@@ -2535,16 +2615,24 @@echoclient
ipcountry
Get country of IP
-
-
- --ip="": 1.1.1.1 +
--example: Show a minimal example of usage
+
+--ip="": 1.1.1.1
+
completion
Generate shell completions
-
-
- --file, -f="": Write to file (default: brook_autocomplete) +
--example: Show a minimal example of usage
+
+--file, -f="": Write to file (default: brook_autocomplete)
+
mdpage
Generate markdown page
-
+
--example: Show a minimal example of usage
+--file, -f="": Write to file, default print to stdout
--help, -h: show help
@@ -2555,7 +2643,10 @@help, h
manpage
Generate man.1 page
-
-
- --file, -f="": Write to file, default print to stdout. You should put to /path/to/man/man1/brook.1 on linux or /usr/local/share/man/man1/brook.1 on macos +
--example: Show a minimal example of usage
+
+--file, -f="": Write to file, default print to stdout. You should put to /path/to/man/man1/brook.1 on linux or /usr/local/share/man/man1/brook.1 on macos
+
help, h
Shows a list of commands or help for one command
@@ -2721,28 +2812,6 @@brook pac creates pac file
brook pac --file proxy.pac --proxy 'SOCKS5 127.0.0.1:1080; SOCKS 127.0.0.1:1080; DIRECT' --bypassDomainList ...There are countless examples; for more feature suggestions, it's best to look at the commands and parameters in the CLI documentation one by one, and blog, YouTube...
-Diagram
--
-Maybe outdated
-overview
-
-
withoutBrookProtocol
-
-
relayoverbrook
-
-
dnsserveroverbrook
-
-
relay
-
-
dnsserver
-
-
tproxy
-
-
gui
-
-
script
-
diff --git a/docs/resources.md b/docs/resources.md index 5eff98e2..a10282e6 100644 --- a/docs/resources.md +++ b/docs/resources.md @@ -27,6 +27,6 @@ | [Socks5 Configurator](https://chromewebstore.google.com/detail/socks5-configurator/hnpgnjkeaobghpjjhaiemlahikgmnghb) | If you prefer CLI brook client | | [IPvBar](https://chromewebstore.google.com/detail/ipvbar/nepjlegfiihpkcdhlmaebfdfppckonlj) | See domain, IP and country in browser | | [TxThinking SSH](https://www.txthinking.com/ssh.html) | A SSH Terminal | -| [brook-dashboard](https://github.com/txthinkinginc/brook-dashboard) | A Brook User System | +| [brook-user-system](https://github.com/txthinkinginc/brook-user-system) | A Brook User System | | [TxThinking](https://www.txthinking.com) | Everything | diff --git a/ping/ping.json b/ping/ping.json index 745babb0..10124dcf 100644 --- a/ping/ping.json +++ b/ping/ping.json @@ -1,5 +1,5 @@ { - "version": "20240404", + "version": "20240606", "text": "Clean the web with Brook", "link": "https://www.txthinking.com/talks/articles/brook-clean-the-web-en.article", "text_zh": "使用 Brook 净化互联网", diff --git a/programmable/example_script.tengo b/programmable/example_script.tengo deleted file mode 100644 index ec5d4195..00000000 --- a/programmable/example_script.tengo +++ /dev/null @@ -1,199 +0,0 @@ -text := import("text") -brook := import("brook") -json := import("json") - -dnsquery_handler := func(m){ - // local dev example - if m.domain == "myapi.local" { - if m.type == "A" { - return {ip: "10.211.1.76"} - } - if m.type == "AAAA" { - return {"block": true} - } - } - // block secure dns - if m.domain == "dns.google" { - return {"block": true} - } - // block ipv6 - if m.type == "AAAA" { - return {"block": true} - } - // do not use fake dns, instagram 90% ? - l := [ - "facebook.com", - "fbcdn.net", - "facebook.net", - "akamaihd.net", - "thefacebook.com", - "tfbnw.net", - "messenger.com", - "fb.me", - "fbsbx.com", - "fb.com", - "whatsapp.net", - "whatsapp.com", - "instagram.com", - "akamai.net", - "aaplimg.com", - "alibabadns.com", - "akamaiedge.net", - "apple-dns.net", - "akadns.net", - "cdninstagram.com" - ] - for v in l { - if text.has_suffix(m.domain, v) { - return {"system": true} - } - } - // use bypass dns to resolve ip, apple push - l = [ - "apple.com", - "icloud.com", - "cdn-apple.com", - "mzstatic.com", - "entrust.net", - "digicert.com", - "verisign.net", - "apple", - "itunes-apple.com.akadns.net", - "cdn-apple.com.akadns.net", - "ks-cdn.com", - "ksyuncdn.com", - "cdn-apple.com.edgekey.net", - "e2885.e9.akamaiedge.net", - "apple.com.edgekey.net", - "e2490.dscb.akamaiedge.net", - "idms-apple.com.akadns.net", - "apple.com.edgekey.net.globalredir.akadns.net", - "e6858.dscx.akamaiedge.net", - "ioshost.qtlcdn.com" - ] - for v in l { - if text.has_suffix(m.domain, v) { - return {"bypass": true} - } - } -} - -address_handler := func(m) { - if m.ipaddress { - // block secure dns - if m.ipaddress == "8.8.8.8:853" || m.ipaddress == "8.8.8.8:443" || m.ipaddress == "8.8.4.4:853" || m.ipaddress == "8.8.4.4:443" || m.ipaddress == "[2001:4860:4860::8888]:853" || m.ipaddress == "[2001:4860:4860::8888]:443" || m.ipaddress == "[2001:4860:4860::8844]:853" || m.ipaddress == "[2001:4860:4860::8844]:443" { - return { "block": true } - } - // extract ip - r := brook.splithostport(m.ipaddress) - if is_error(r) { - return r - } - // block an ip - if r.host == "1.2.4.8" { - return { "block": true } - } - // bypass zz and cn ip - s := brook.country(r.host) - if s == "ZZ" || s == "CN" { - return { "bypass": true } - } - // bypass apple push - l := [ - "17.0.0.0/8", - "103.81.148.0/22", - "103.81.148.0/24", - "103.81.149.0/24", - "2620:149:a44::/48", - "2403:300:a42::/48", - "2403:300:a51::/48", - "2a01:b740:a42::/48" - ] - for v in l { - if brook.cidrcontainsip(v, r.host) { - return {"bypass": true} - } - } - } - if m.domainaddress { - // block secure dns - if text.has_prefix(m.domainaddress, "dns.google:") { - return { "block": true } - } - if m.network == "tcp" { - // Packet Capture and Modify - if m.domainaddress == "httpbin.org:80" { - return {"mitm": true, "mitmprotocol": "http"} - } - if m.domainaddress == "httpbin.org:443" { - return {"mitm": true, "mitmprotocol": "https", "mitmwithbody": true, "mitmautohandlecompress": true} - } - // connect this ip and bypass it - if m.domainaddress == "myapi2.local:80" { - return {"ipaddress": "10.211.1.76:8080", "bypass": true, "mitm": true, "mitmprotocol": "http", "mitmwithbody": true, "mitmautohandlecompress": true} - } - // get A via bypass dns, then connect it and bypass it - if m.domainaddress == "myip.ipip.net:443" { - return {"ipaddressfrombypassdns": "A", "bypass": true, "mitm": true, "mitmprotocol": "https", "mitmwithbody": true, "mitmautohandlecompress": true} - } - } - if m.network == "udp" { - // block http3 - if m.domainaddress == "httpbin.org:443" { - return { "block": true } - } - } - } -} - -httprequest_handler := func(request){ - // redirect - if text.has_prefix(request["URL"], "http://httpbin.org") { - response := { - "StatusCode": 301, - "Location": text.replace(request["URL"], "http://", "https://", 1) - } - return response - } - // Packet Modify request header and body - if request["URL"] == "https://httpbin.org/post" && request["Method"] == "POST" && request["Content-Type"] == "application/x-www-form-urlencoded" { - request["User-Agent"] = "curl/7.79.1" - request["Body"] = bytes("hello=world") - return request - } - return request -} - -httpresponse_handler := func(request, response){ - delete(response, "Alt-Svc") // Avoid upgrading to http3 from http1 or http2 - // Packet Modify response body - if text.has_prefix(request["URL"], "https://httpbin.org") && !text.has_prefix(request["URL"], "https://httpbin.org/stream/") && response["Content-Type"] == "application/json" { - j := json.decode(response["Body"]) - j.origin = "M.A.R.S" - response["Body"] = json.encode(j) - return response - } - // Packet Modify response body - if text.has_prefix(request["URL"], "https://myip.ipip.net") { - response["Body"] = bytes(text.split(string(response["Body"]), "IP")[0] + "来自: 火星") - return response - } - return response -} - -handler := func(){ - if in_dnsquery { - return dnsquery_handler(in_dnsquery) - } - if in_address { - return address_handler(in_address) - } - if in_httprequest && !in_httpresponse { - return httprequest_handler(in_httprequest) - } - if in_httprequest && in_httpresponse { - return httpresponse_handler(in_httprequest, in_httpresponse) - } -} - -out := handler() diff --git a/programmable/modules/bypass_geo.tengo b/programmable/modules/bypass_geo.tengo index 932d43be..4bf24823 100644 --- a/programmable/modules/bypass_geo.tengo +++ b/programmable/modules/bypass_geo.tengo @@ -8,7 +8,7 @@ modules = append(modules, { return r } s := brook.country(r.host) - if s == "ZZ" || s == "CN" { + if s == "ZZ" || s == "CN" { // All private IPs are ZZ return { bypass: true } } } diff --git a/programmable/modules/readme.md b/programmable/modules/readme.md index 749688de..a8e7f95d 100644 --- a/programmable/modules/readme.md +++ b/programmable/modules/readme.md @@ -1,3 +1,36 @@ +## Brook GUI + +In Brook GUI, scripts are abstracted into modules, and it will automatically combine `_header.tengo` and `_footer.tengo`, so you only need to write the module itself. + +``` +modules = append(modules, { + // If you want to predefine multiple brook links, and then programmatically specify which one to connect to, then define `brooklinks` key a function + brooklinks: func(m) { + // Please refer to the example in `brooklinks.tengo` + }, + // If you want to intercept and handle a DNS query, then define `dnsquery` key a function, `m` is the `in_dnsquery` + dnsquery: func(m) { + // Please refer to the example in `block_aaaa.tengo` + }, + // If you want to intercept and handle an address, then define `address` key a function, `m` is the `in_address` + address: func(m) { + // Please refer to the example in `block_google_secure_dns.tengo` + }, + // If you want to intercept and handle a http request, then define `httprequest` key a function, `request` is the `in_httprequest` + httprequest: func(request) { + // Please refer to the example in `ios_app_downgrade.tengo` or `redirect_google_cn.tengo` + }, + // If you want to intercept and handle a http response, then define `httpresponse` key a function, `request` is the `in_httprequest`, `response` is the `in_httpresponse` + httpresponse: func(request, response) { + // Please refer to the example in `response_sample.tengo` + } +}) +``` + +## tun2brook + +If you are using tun2brook, you can combine multiple modules into a complete script in the following way. For example: + ``` cat _header.tengo > my.tengo diff --git a/programmable/modules/xbox.tengo b/programmable/modules/xbox.tengo new file mode 100644 index 00000000..5fede34b --- /dev/null +++ b/programmable/modules/xbox.tengo @@ -0,0 +1,25 @@ +// Unlock Xbox country limit +// [CA] + +modules = append(modules, { + address: func(m) { + if m.domainaddress { + if m.domainaddress == "www.xbox.com:443" || m.domainaddress == "xgpuweb.gssv-play-prod.xboxlive.com:443" { + if m.network == "tcp" { + return {"mitm": true, "mitmprotocol": "https"} + } + if m.network == "udp" { + return { "block": true } + } + } + } + }, + httprequest: func(request) { + text := import("text") + if text.has_prefix(request["URL"], "https://www.xbox.com") || text.has_prefix(request["URL"], "https://xgpuweb.gssv-play-prod.xboxlive.com") { + request["X-Forwarded-For"] = "4.2.2.2" // Any country IP you want + return request + } + } +}) +