mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/docker-easyconnect/docker-easyconnect.git
synced 2026-09-20 08:03:33 +08:00
Merge branch 'master' into develop
This commit is contained in:
Hagb
@@ -13,7 +13,7 @@ RUN . /tmp/build-scripts/config-apt.sh && \
|
||||
libgtk2.0-0 libx11-xcb1 libxtst6 libnss3 libasound2 libdbus-glib-1-2 iptables xclip\
|
||||
dante-server tigervnc-standalone-server tigervnc-tools psmisc flwm x11-utils \
|
||||
busybox libssl-dev iproute2 tinyproxy-bin libxss1 libgconf-2-4 ca-certificates \
|
||||
$qemu_pkgs && \
|
||||
fonts-wqy-microhei $qemu_pkgs && \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN groupadd -r socks && useradd -r -g socks socks
|
||||
|
||||
@@ -10,9 +10,9 @@ RUN . /tmp/build-scripts/config-apt.sh && \
|
||||
. /tmp/build-scripts/add-qemu.sh && \
|
||||
apt-get update && \
|
||||
apt-get install -y --no-install-recommends --no-install-suggests $qemu_pkgs ca-certificates \
|
||||
libgtk2.0-0 libx11-xcb1 libxtst6 libnss3 libasound2 libdbus-glib-1-2 iptables \
|
||||
libgtk2.0-0 libx11-xcb1 libxtst6 libnss3 libasound2 libdbus-glib-1-2 iptables fonts-wqy-microhei \
|
||||
dante-server psmisc libxaw7 xclip busybox libssl-dev iproute2 tinyproxy-bin libxss1 libgconf-2-4 && \
|
||||
cd /tmp && apt download x11-utils && dpkg -x x11-utils_*.deb x11-utils && \
|
||||
cd /tmp && apt-get download x11-utils && dpkg -x x11-utils_*.deb x11-utils && \
|
||||
mkdir -p /usr/local/bin && cp x11-utils/usr/bin/xmessage /usr/local/bin && rm -r x11-utils* && \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
|
||||
@@ -6,7 +6,9 @@
|
||||
|
||||
- `CHECK_SYSTEM_ONLY`: 默认为空。设为非空值时检查系统是否满足使用条件后退出。（`docker run --cap-add NET_ADMIN --device /dev/net/tun -e CHECK_SYSTEM_ONLY=1 hagb/docker-easyconnect:TAG`）
|
||||
|
||||
- `EXIT`: 默认为空，此时前端退出后会自动重连。不为空时，前端退出后不自动重启。
|
||||
- `EXIT`: 默认为空，此时前端退出后会自动重连。不为空时，前端退出后不自动重启，并停止容器。
|
||||
|
||||
- `EXIT_LOCK`: 默认为空，此时前端退出后会自动重连。不为空时， 前端退出后不自动重启，循环等待锁释放，当锁文件被删除后才会执行到下一步。
|
||||
|
||||
- `FAKE_HWADDR`: 默认为空，向 EasyConnect 提供的固定网卡 MAC 地址。Podman 在非 root 权限下无法固定虚拟网卡的 MAC 地址，为了防止每次启动容器都要重新提交硬件 ID，可设置该环境变量为某一 MAC 地址（建议使用 podman 先前启动时随机生成的地址或已提交的 MAC 地址），劫持 EasyConnect 使其获取到该固定地址。Docker 默认的情况下 MAC 地址即固定，root 环境下的 podman 可以直接使用 `--mac-address` 参数设置，无需使用 `FAKE_HWADDR`。
|
||||
|
||||
|
||||
@@ -1,12 +1,17 @@
|
||||
#!/bin/bash
|
||||
# 不支持 nftables 时使用 iptables-legacy
|
||||
## 感谢 @BoringCat https://github.com/Hagb/docker-easyconnect/issues/5
|
||||
if { [ -z "$IPTABLES_LEGACY" -a -z "$(iptables-legacy-save)" ] && iptables-nft-save ; } 1>/dev/null 2>/dev/null
|
||||
if { [ -z "$IPTABLES_LEGACY" -a -z "$(xtables-legacy-multi iptables-save)" ] && xtables-nft-multi iptables-save ; } 1>/dev/null 2>/dev/null
|
||||
then
|
||||
update-alternatives --set iptables /usr/sbin/iptables-nft
|
||||
update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
|
||||
iptables_type=nft
|
||||
else
|
||||
update-alternatives --set iptables /usr/sbin/iptables-legacy
|
||||
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
|
||||
iptables_type=legacy
|
||||
fi
|
||||
echo "$iptables_type" > /usr/share/sangfor/iptables-type
|
||||
|
||||
for exec in /usr/sbin/iptables{-nft,-legacy,}{-save,-restore,}; do
|
||||
ln -fs /usr/sbin/xtables-echook-multi "$exec"
|
||||
done
|
||||
|
||||
echo "export ECHACK_NOWARN=1"
|
||||
|
||||
|
||||
@@ -7,48 +7,23 @@ IFS="
|
||||
"
|
||||
for i in $(ip route show); do IFS=' '; ip route add $i table 2 ; done
|
||||
)
|
||||
## 回包路由
|
||||
ip rule add iif tun0 table 2
|
||||
## 确定策略路由方式
|
||||
ip rule add iif lo table 2 sport 1080
|
||||
if ip rule show iif lo table 2 | grep sport >/dev/null ; then
|
||||
open_port() { ip rule add iif lo table 2 sport $1; }
|
||||
close_port() { ip rule del iif lo table 2 sport $1; }
|
||||
echo 'open_port() { ip rule add iif lo table 2 sport $1; }'
|
||||
echo 'close_port() { ip rule del iif lo table 2 sport $1; }'
|
||||
elif iptables -t mangle -A OUTPUT -j MARK --set-mark 1 -p tcp --sport 1080 2>/dev/null ; then
|
||||
iptables -t mangle -D OUTPUT -j MARK --set-mark 1 -p tcp --sport 1080
|
||||
ip rule add fwmark 1 table 2
|
||||
open_port() { iptables -t mangle -I OUTPUT -j MARK --set-mark 1 -p tcp --sport $1; }
|
||||
close_port() { iptables -t mangle -D OUTPUT -j MARK --set-mark 1 -p tcp --sport $1; }
|
||||
echo 'open_port() { iptables -t mangle -I OUTPUT -j MARK --set-mark 1 -p tcp --sport $1; }'
|
||||
echo 'close_port() { iptables -t mangle -D OUTPUT -j MARK --set-mark 1 -p tcp --sport $1; }'
|
||||
else
|
||||
open_port() { true; }
|
||||
close_port() { true; }
|
||||
echo 'open_port() { true; }'
|
||||
echo 'close_port() { true; }'
|
||||
echo "Can't find available method to automatically set route for opening ports"\
|
||||
"(refer to https://github.com/Hagb/docker-easyconnect/tree/master/doc/route.md)" >&2
|
||||
|
||||
fi
|
||||
ip rule del iif lo sport 1080 table 2
|
||||
|
||||
if [ -n "$FORWARD" ]; then
|
||||
if iptables -t mangle -A PREROUTING -m addrtype --dst-type LOCAL -j MARK --set-mark 2; then
|
||||
iptables -t mangle -D PREROUTING -m addrtype --dst-type LOCAL -j MARK --set-mark 2
|
||||
iptables -t nat -A POSTROUTING -p tcp -m mark --mark 2 -j MASQUERADE
|
||||
ip rule add fwmark 2 table 2
|
||||
format_error() { echo Format error in \""$rule"\": "$@" >&2 ; }
|
||||
for rule in $FORWARD; do
|
||||
array=(${rule//:/ })
|
||||
case ${#array[@]} in
|
||||
3) src_args="" ;;
|
||||
4) src_args="-s ${array[0]}" ;;
|
||||
*) format_error; continue ;;
|
||||
esac
|
||||
dst=${array[-2]}:${array[-1]}
|
||||
dport=${array[-3]}
|
||||
match_args="$src_args --dport $dport -m addrtype --dst-type LOCAL -i tun0"
|
||||
iptables -t mangle -A PREROUTING -p tcp $match_args -j MARK --set-mark 2
|
||||
iptables -t mangle -A PREROUTING -p udp $match_args -j MARK --set-mark 2
|
||||
iptables -t nat -A PREROUTING -p tcp $match_args -j DNAT --to-destination $dst
|
||||
iptables -t nat -A PREROUTING -p udp $match_args -j DNAT --to-destination $dst
|
||||
|
||||
done
|
||||
else
|
||||
echo "Can't append iptables used to forward ports from EasyConnect to host network!" >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
@@ -69,6 +69,23 @@ do
|
||||
fi
|
||||
[ -n "$MAX_RETRY" ] && ((MAX_RETRY--))
|
||||
|
||||
LOCK_FILE="/tmp/EXIT_LOCK"
|
||||
# 等待后端服务结束
|
||||
[ -n "$EXIT_LOCK" ] && touch "$LOCK_FILE" && {
|
||||
printf "\n\n\n当前前端服务已退出, 由于EXIT_LOCK设置, 暂不执行重启. 执行重启请执行:\n\ndocker exec -it %s rm -f %s\n\n" "$HOSTNAME" "$LOCK_FILE"
|
||||
echo "等待中"
|
||||
while :
|
||||
do
|
||||
sleep 1
|
||||
echo -e '\e[1A\e[K等待中.'
|
||||
sleep 1
|
||||
echo -e '\e[1A\e[K等待中..'
|
||||
sleep 1
|
||||
echo -e '\e[1A\e[K等待中...'
|
||||
[ ! -e "$LOCK_FILE" ] && break
|
||||
done
|
||||
}
|
||||
|
||||
# 自动重连
|
||||
((MAX_RETRY<0)) && exit
|
||||
|
||||
|
||||
@@ -1,10 +1,37 @@
|
||||
#!/bin/bash
|
||||
|
||||
[ -n "$CHECK_SYSTEM_ONLY" ] && detect-tun.sh
|
||||
detect-iptables.sh
|
||||
. "$(which detect-route.sh)"
|
||||
eval "$(detect-iptables.sh)"
|
||||
eval "$(detect-route.sh)"
|
||||
[ -n "$CHECK_SYSTEM_ONLY" ] && exit
|
||||
|
||||
if [ -n "$FORWARD" ]; then
|
||||
if iptables -t mangle -A PREROUTING -m addrtype --dst-type LOCAL -j MARK --set-mark 2; then
|
||||
iptables -t mangle -D PREROUTING -m addrtype --dst-type LOCAL -j MARK --set-mark 2
|
||||
iptables -t nat -A POSTROUTING -p tcp -m mark --mark 2 -j MASQUERADE
|
||||
ip rule add fwmark 2 table 2
|
||||
format_error() { echo Format error in \""$rule"\": "$@" >&2 ; }
|
||||
for rule in $FORWARD; do
|
||||
array=(${rule//:/ })
|
||||
case ${#array[@]} in
|
||||
3) src_args="" ;;
|
||||
4) src_args="-s ${array[0]}" ;;
|
||||
*) format_error; continue ;;
|
||||
esac
|
||||
dst=${array[-2]}:${array[-1]}
|
||||
dport=${array[-3]}
|
||||
match_args="$src_args --dport $dport -m addrtype --dst-type LOCAL -i tun0"
|
||||
iptables -t mangle -A PREROUTING -p tcp $match_args -j MARK --set-mark 2
|
||||
iptables -t mangle -A PREROUTING -p udp $match_args -j MARK --set-mark 2
|
||||
iptables -t nat -A PREROUTING -p tcp $match_args -j DNAT --to-destination $dst
|
||||
iptables -t nat -A PREROUTING -p udp $match_args -j DNAT --to-destination $dst
|
||||
|
||||
done
|
||||
else
|
||||
echo "Can't append iptables used to forward ports from EasyConnect to host network!" >&2
|
||||
fi
|
||||
fi
|
||||
|
||||
cp /etc/danted.conf.sample /run/danted.conf
|
||||
|
||||
if [[ -n "$SOCKS_PASSWD" && -n "$SOCKS_USER" ]];then
|
||||
@@ -31,11 +58,10 @@ sed /^external:/a"$externals" -i /run/danted.conf
|
||||
[ -n "$NODANTED" ] || (while true
|
||||
do
|
||||
sleep 5
|
||||
open_port 1080
|
||||
[ -d /sys/class/net/tun0 ] && {
|
||||
chmod a+w /tmp
|
||||
open_port 1080
|
||||
/usr/sbin/danted -f /run/danted.conf
|
||||
close_port 1080
|
||||
}
|
||||
done
|
||||
)&
|
||||
@@ -43,6 +69,9 @@ open_port 8888
|
||||
tinyproxy -c /etc/tinyproxy.conf
|
||||
|
||||
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
|
||||
open_port 4440
|
||||
iptables -t nat -N SANGFOR_OUTPUT
|
||||
iptables -t nat -A PREROUTING -j SANGFOR_OUTPUT
|
||||
|
||||
# 拒绝 tun0 侧主动请求的连接.
|
||||
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
||||
@@ -52,13 +81,14 @@ iptables -A INPUT -i tun0 -p tcp -j DROP
|
||||
# 感谢 @stingshen https://github.com/Hagb/docker-easyconnect/issues/6
|
||||
# ( while true; do sleep 5 ; iptables -D SANGFOR_VIRTUAL -j DROP 2>/dev/null ; done )&
|
||||
|
||||
|
||||
[ -n "$EXIT" ] && export MAX_RETRY=0
|
||||
|
||||
if [ -n "$_EC_CLI" ]; then
|
||||
ln -fs /usr/share/sangfor/EasyConnect/resources/{conf_${EC_VER},conf}
|
||||
exec start-sangfor.sh
|
||||
fi
|
||||
|
||||
[ -n "$EXIT" ] && MAX_RETRY=0
|
||||
|
||||
# 登录信息持久化处理
|
||||
## 持久化配置文件夹 感谢 @hexid26 https://github.com/Hagb/docker-easyconnect/issues/21
|
||||
[ -d ~/conf ] || cp -a /usr/share/sangfor/EasyConnect/resources/conf_backup ~/conf
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
#!/bin/sh
|
||||
[ "$*" = "-t filter -A SANGFOR_VIRTUAL -j DROP" ] && exit 0
|
||||
exec /usr/sbin/xtables-legacy-multi iptables-legacy "$@"
|
||||
@@ -1,3 +0,0 @@
|
||||
#!/bin/sh
|
||||
[ "$*" = "-t filter -A SANGFOR_VIRTUAL -j DROP" ] && exit 0
|
||||
exec /usr/sbin/xtables-nft-multi iptables-nft "$@"
|
||||
27
docker-root/usr/sbin/xtables-echook-multi
Executable file
27
docker-root/usr/sbin/xtables-echook-multi
Executable file
@@ -0,0 +1,27 @@
|
||||
#!/bin/sh
|
||||
name="$(basename "$0")"
|
||||
iptables_type="$(cat /usr/share/sangfor/iptables-type)"
|
||||
xtables_multi="xtables-$iptables_type-multi"
|
||||
|
||||
[ -z "$ECHACK_NOWARN" ] &&
|
||||
echo "# WARNING: You are calling iptables hook that uses $iptables_type by force and applies some hacks." >&2
|
||||
|
||||
case "$name" in
|
||||
iptables | iptables-legacy | iptables-nft )
|
||||
[ "$*" = "-t filter -A SANGFOR_VIRTUAL -j DROP" ] && exit 0
|
||||
subcommand=iptables
|
||||
;;
|
||||
iptables-save | iptables-nft-save | iptables-legacy-save )
|
||||
subcommand=iptables-save
|
||||
;;
|
||||
iptables-restore | iptables-nft-restore | iptables-legacy-restore )
|
||||
sed -E 's/ -j DNAT --to-destination 127.0.0.1:4440$/ -j REDIRECT --to-ports 4440/' | "$xtables_multi" iptables-restore "$@"
|
||||
exit $?
|
||||
;;
|
||||
* )
|
||||
echo Unknown subcommand "$name"! >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
exec "$xtables_multi" "$subcommand" "$@"
|
||||
1
docker-root/usr/share/sangfor/iptables-type
Normal file
1
docker-root/usr/share/sangfor/iptables-type
Normal file
@@ -0,0 +1 @@
|
||||
nft
|
||||
Reference in New Issue
Block a user