add CAP_NET_RAW in systemd configuration to support transparent proxying

ChangeLog

@@ -4,6 +4,10 @@ vNEXT:
 	Mixed IPv4/IPv6 proxyprotocol setups will move both
 	addresses to IPv6 format on the server side.
 
+	Add CAP_NET_RAW to systemd config so transparent
+	proxying can work. Removed sslh-select systemd file:
+	don't repeat the same configuration file!
+
 v2.3.0:
 	Added `max_connections` setting to `listen` and
 	`protocol` configuration; see the

scripts/systemd.sslh-select@.service

@@ -1,27 +0,0 @@
-[Unit]
-Description=SSL/SSH multiplexer (select mode) for %I
-After=network.target
-
-[Service]
-EnvironmentFile=/etc/default/sslh
-ExecStart=/usr/sbin/sslh-select -F/etc/sslh/%I.cfg -f $DAEMON_OPTS
-KillMode=process
-#Hardening
-PrivateTmp=true
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-SecureBits=noroot-locked
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-MountFlags=private
-NoNewPrivileges=true
-PrivateDevices=true
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-MemoryDenyWriteExecute=true
-DynamicUser=true
-
-[Install]
-WantedBy=multi-user.target

scripts/systemd.sslh@.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=SSL/SSH multiplexer (fork mode) for %I
+Description=SSL/SSH multiplexer for %I
 After=network.target
 
 [Service]
@@ -8,8 +8,8 @@ ExecStart=/usr/sbin/sslh -F/etc/sslh/%I.cfg -f $DAEMON_OPTS
 KillMode=process
 #Hardening
 PrivateTmp=true
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_SETGIT CAP_SETUID CAP_NET_BIND_SERVICE CAP_NET_RAW
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
 SecureBits=noroot-locked
 ProtectSystem=strict
 ProtectHome=true