[Feature Request] Add a hook to check connection owner UID (gate access)

[cchkx]

On Android, a VPN’s private network can sometimes be reached by apps that shouldn’t be allowed to use it. For example, even if your routing rules don’t include those apps, they may still get VPN access by binding directly to the TUN interface.

Android provides an API called getConnectionOwnerUid(), which lets you figure out which UID (i.e., which app) owns a given network connection. With that, a VPN app can identify unwanted apps and block them from using the VPN.

So I’d like to request a hook in tun2socks that lets it pass the connection’s 4‑tuple (src IP/port + dst IP/port) up to the VPN app. The VPN app would then reply with “allow” or “deny”, and tun2socks would enforce that decision.

It’d be best if this hook/API is asynchronous, so it doesn’t hurt performance or become a bottleneck under high concurrency.

Thanks!

[heiher]

A typical tun2socks setup runs the SOCKS5 proxy locally, which makes it practical to extend the protocol for extra metadata. One useful extension would be to carry the original TUN-side source address directly inside the SOCKS5 protocol. Because the source address would travel together with the connection request, the SOCKS5 server could naturally correlate them without maintaining extra state or relying on out-of-band mechanisms.

To make this work, SOCKS5 request packets and UDP relay packets would need additional address type definitions, for example as below.

SOCKS5 Requests

    +----+-----+-------+------+----------+----------+----------+----------+
    |VER | CMD |  RSV  | ATYP | SRC.ADDR | SRC.PORT | DST.ADDR | DST.PORT |
    +----+-----+-------+------+----------+----------+----------+----------+
    | 1  |  1  | X'00' |  1   | Variable |    2     | Variable |    2     |
    +----+-----+-------+------+----------+----------+----------+----------+

UDP Relays

    +----+------+------+----------+----------+----------+----------+----------+
    |RSV | FRAG | ATYP | SRC.ADDR | SRC.PORT | DST.ADDR | DST.PORT |   DATA   |
    +----+------+------+----------+----------+----------+----------+----------+
    | 2  |  1   |  1   | Variable |    2     | Variable |    2     | Variable |
    +----+------+------+----------+----------+----------+----------+----------+

• ATYP
  • IPv4/IPv4 addresses: X'11'
  • IPv6/IPv6 addresses: X'44'

This would allow the SOCKS5 server to obtain both endpoints of the connection and pass them to getConnectionOwnerUid().

[cchkx]

That’s actually a pretty neat idea. The SOCKS5 server could then block connections from apps that aren’t allowed, and it could also do per-app routing based on which application owns the connection. We'd probably also want a config option to enable or disable this feature. Thanks!