mirror of
https://github.com/yrutschle/sslh.git
synced 2025-04-04 19:30:04 +03:00
98 lines
3.1 KiB
Bash
Executable File
98 lines
3.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# SPDX-License-Identifier: GPL2-or-later
|
|
#
|
|
# Copyright (C) 2023 Olliver Schinagl <oliver@schinagl.nl>
|
|
#
|
|
# A beginning user should be able to docker run image bash (or sh) without
|
|
# needing to learn about --entrypoint
|
|
# https://github.com/docker-library/official-images#consistency
|
|
|
|
set -eu
|
|
|
|
bin='sslh'
|
|
|
|
# run command if it is not starting with a "-" and is an executable in PATH
|
|
if [ "${#}" -le 0 ] || \
|
|
[ "${1#-}" != "${1}" ] || \
|
|
[ -d "${1}" ] || \
|
|
! command -v "${1}" > '/dev/null' 2>&1; then
|
|
entrypoint='true'
|
|
fi
|
|
|
|
unconfigure_iptables() {
|
|
echo "Received SIG TERM/INT/KILL. Removing iptables / routing changes"
|
|
|
|
set +e # Don't exit if got error
|
|
set -x
|
|
|
|
iptables -t raw -D PREROUTING ! -i lo -d 127.0.0.0/8 -j DROP
|
|
iptables -t mangle -D POSTROUTING ! -o lo -s 127.0.0.0/8 -j DROP
|
|
|
|
iptables -t nat -D OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
|
|
iptables -t mangle -D OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
|
|
|
|
ip rule del fwmark 0x1 lookup 100
|
|
ip route del local 0.0.0.0/0 dev lo table 100
|
|
|
|
|
|
if [ $(cat /proc/sys/net/ipv6/conf/all/disable_ipv6) -eq 0 ]; then
|
|
ip6tables -t raw -D PREROUTING ! -i lo -d ::1/128 -j DROP
|
|
ip6tables -t mangle -D POSTROUTING ! -o lo -s ::1/128 -j DROP
|
|
ip6tables -t nat -D OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
|
|
ip6tables -t mangle -D OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
|
|
|
|
ip -6 rule del fwmark 0x1 lookup 100
|
|
ip -6 route del local ::/0 dev lo table 100
|
|
fi
|
|
|
|
set -e
|
|
set +x
|
|
}
|
|
|
|
configure_iptables() {
|
|
echo "Configuring iptables and routing..."
|
|
|
|
set +e # Don't exit if got error
|
|
set -x
|
|
|
|
iptables -t raw -A PREROUTING ! -i lo -d 127.0.0.0/8 -j DROP
|
|
iptables -t mangle -A POSTROUTING ! -o lo -s 127.0.0.0/8 -j DROP
|
|
|
|
iptables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
|
|
iptables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
|
|
|
|
ip rule add fwmark 0x1 lookup 100
|
|
ip route add local 0.0.0.0/0 dev lo table 100
|
|
|
|
if [ $(cat /proc/sys/net/ipv6/conf/all/disable_ipv6) -eq 0 ]; then
|
|
ip6tables -t raw -A PREROUTING ! -i lo -d ::1/128 -j DROP
|
|
ip6tables -t mangle -A POSTROUTING ! -o lo -s ::1/128 -j DROP
|
|
ip6tables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
|
|
ip6tables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
|
|
|
|
ip -6 rule add fwmark 0x1 lookup 100
|
|
ip -6 route add local ::/0 dev lo table 100
|
|
fi
|
|
|
|
set -e
|
|
set +x
|
|
}
|
|
|
|
for _args in "${@}" ; do
|
|
if [ "${_args:-}" = '--transparent' ] ; then
|
|
echo '--transparent flag is set'
|
|
configure_iptables
|
|
trap unconfigure_iptables TERM INT KILL
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Drop privileges and run as sslh user
|
|
sslh_cmd="${entrypoint:+${bin}} ${@}"
|
|
echo "Executing with user 'sslh': ${sslh_cmd}"
|
|
|
|
exec su - sslh -c "${sslh_cmd}" &
|
|
wait "${!}"
|
|
|
|
exit 0
|