commit b8ce44a74b475eb24b79dde35abe93e04bb8341c Author: Hagb Green Date: Sun May 10 21:25:18 2020 +0800 Init commit diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..ccdfc3e --- /dev/null +++ b/Dockerfile @@ -0,0 +1,21 @@ +FROM debian:buster + +COPY docker-files/EasyConnect.deb /tmp/ + +RUN sed -i s/deb.debian.org/mirrors.cqu.edu.cn/ /etc/apt/sources.list &&\ +apt-get update && \ +apt-get install --yes libgtk2.0-0 libx11-xcb1 libxtst6 libnss3 libasound2 libdbus-glib-1-2 iptables \ +dante-server tigervnc-standalone-server dante-server psmisc &&\ +dpkg -i /tmp/EasyConnect.deb + +COPY docker-files/start.sh docker-files/start-sangfor.sh /usr/local/bin/ +COPY docker-files/sockd.conf /etc/danted.conf +RUN chmod +x /usr/local/bin/start.sh /usr/local/bin/start-sangfor.sh + +ENV TYPE vnc +ENV PASSWORD "" + + +VOLUME /root/ + +ENTRYPOINT start.sh diff --git a/LICENSE.txt b/LICENSE.txt new file mode 100644 index 0000000..cc4ab27 --- /dev/null +++ b/LICENSE.txt @@ -0,0 +1,13 @@ + DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE + Version 2, December 2004 + + Copyright (C) 2004 Sam Hocevar + + Everyone is permitted to copy and distribute verbatim or modified + copies of this license document, and changing it is allowed as long + as the name is changed. + + DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. You just DO WHAT THE FUCK YOU WANT TO. diff --git a/README.md b/README.md new file mode 100644 index 0000000..0e0a53c --- /dev/null +++ b/README.md @@ -0,0 +1,95 @@ +# docker-easyconnect + +让深信服开发的**非自由**的 EasyConnect 代理软件运行在 docker 中，并开放 Socks5 供宿主机连接以使用代理。 + +## Status + +### 已经过测试的版本 + +`7.6.3.0.86415`版. + +其它 TODO... + +## Build + +``` +wget http://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_01/EasyConnect_x64.deb -O docker-files/EasyConnect.deb +docker image build . +``` + +## Usage + +**参数里的`--device /dev/net/tun --cap-add NET_ADMIN`是不可少的。**因为 EasyConnect 要创建虚拟网络设备`tun0`。 + +### 环境变量 + +- `TYPE`: `vnc` 或 `x11` + +`vnc`（默认值）: 将在`5901`端口开放 vnc 服务以操作 EasyConnect 前端。 + +`x11`: 将直接通过`DISPLAY`环境变量的值显示 EasyConnect 前端，请同时设置`DISPLAY`环境变量。这个可能更适合于桌面用户。 + +- `DISPLAY`: `$TYPE`为`x11`时通过该变量来现实 EasyConnect 界面。 + +- `PASSWORD`: 用于 vnc 服务的密码，该变量的值默认为空字符串，表示密码不作改变。 + +给变量赋值（空字符串除外），密码（应小于或等于 8 位）就会被更新到所赋的值。 + +默认密码是`password`. + +### Socks5 + +EasyConnect 创建`tun0`后，Socks5 代理会在容器的`1080`端口开启。这可用`-p`参数转发到`127.0.0.1`上。 + +### VNC 服务器 + +默认情况下，环境变量`TYPE` + +### 配置、登陆信息持久化 + +只需要用`-v`参数将宿主机的目录挂载到容器的 /root 。 + +如`-v $HOME/.ecdata:/root`。 + +由此还能实现全自动登陆。 + +## 例子 + +### X11 socket + +``` +docker run --device /dev/net/tun --cap-add NET_ADMIN -ti -v /tmp/.X11-unix:/tmp/.X11-unix -v $HOME/.Xauthority:/root/.Xauthority -e DISPLAY=$DISPLAY -e TYPE=x11 -v $HOME/.ecdata:/root -p 127.0.0.1:1080:1080 easyconnect +``` + +### vnc + +``` +docker run --device /dev/net/tun --cap-add NET_ADMIN -ti -e PASSWORD=xxxx -v $HOME/.ecdata:/root -p 127.0.0.1:5901:5901 -p 127.0.0.1:1080:1080 easyconnect +``` + +## 已知问题 + +vnc 下代理软件的图表上右键菜单会在第一次调出以后失灵，直到软件被关闭。 + +## 版权及许可证 + +> Copyright © 2020 Hagb (Guo Junyu) +> This work is free. You can redistribute it and/or modify it under the +> terms of the Do What The Fuck You Want To Public License, Version 2, +> as published by Sam Hocevar. See the COPYING file for more details. + +可以对这份东西做任何事情。 + +> DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE +> Version 2, December 2004 +> +> Copyright (C) 2004 Sam Hocevar +> +> Everyone is permitted to copy and distribute verbatim or modified +> copies of this license document, and changing it is allowed as long +> as the name is changed. +> +> DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE +> TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION +> +> 0. You just DO WHAT THE FUCK YOU WANT TO. diff --git a/docker-files/sockd.conf b/docker-files/sockd.conf new file mode 100644 index 0000000..d931b22 --- /dev/null +++ b/docker-files/sockd.conf @@ -0,0 +1,10 @@ +internal: eth0 port = 1080 +external: tun0 +socksmethod: none +clientmethod: none +client pass { + from: 0.0.0.0/0 to: 0.0.0.0/0 +} +socks pass { + from: 0.0.0.0/0 to: 0.0.0.0/0 +} diff --git a/docker-files/start-sangfor.sh b/docker-files/start-sangfor.sh new file mode 100644 index 0000000..0090bde --- /dev/null +++ b/docker-files/start-sangfor.sh @@ -0,0 +1,21 @@ +#!/bin/bash +/usr/share/sangfor/EasyConnect/resources/bin/EasyMonitor +sleep 1 +while true +do + # 在 EasyConnect 前端启动过程中，会出现 cms client connect failed 的报错，此时应该启动 sslservice.sh。但这个脚本启动得太早也会没有作用…… + [ $(jobs |wc -l) -eq 0 ] && + (tail -n 0 -f /usr/share/sangfor/EasyConnect/resources/logs/ECAgent.log | grep "\\[Register\\]cms client connect failed" -m 1 + /usr/share/sangfor/EasyConnect/resources/shell/sslservice.sh + )& + + sleep 1 + # 下面这行就是 EasyConnect 的前端了。 + /usr/share/sangfor/EasyConnect/EasyConnect --enable-transparent-visuals --disable-gpu + # 清除的残余进程，它们可能会妨碍下次的启动。 + killall CSClient svpnservice + sleep 4 + # 只要杀不死，就往死里杀（逃……） + killall CSClient svpnservice -9 + sleep 1 +done diff --git a/docker-files/start.sh b/docker-files/start.sh new file mode 100644 index 0000000..9b0b81e --- /dev/null +++ b/docker-files/start.sh @@ -0,0 +1,32 @@ +#!/bin/bash + +# 在虚拟网络设备 tun0 打开时运行 proxy 代理服务器 +(while true +do +sleep 5 +[ -d /sys/class/net/tun0 ] && danted +done +)& + +[ -e ~/.vnc/passwd ] || mkdir -p ~/.vnc && (echo password | tigervncpasswd -f > ~/.vnc/passwd) + +# 登陆信息持久化处理 +rm /usr/share/sangfor/EasyConnect/resources/conf/easy_connect.json +touch easy_connect.json +ln -s ~/easy_connect.json /usr/share/sangfor/EasyConnect/resources/conf/easy_connect.json + +if [ "$TYPE" = "X11" -o "$TYPE" = "x11" ] +then + exec start-sangfor.sh +else + # 安全起见 vnc 不能从 tun0 处访问 + iptables -I INPUT -p tcp --dport 5901 -j REJECT + iptables -I INPUT -i eth0 -p tcp --dport 5901 -j ACCEPT + iptables -I INPUT -i lo -p tcp --dport 5901 -j ACCEPT + + # $PASSWORD 不为空时，更新 vnc 密码 + [ -n "$PASSWORD" ] && printf %s "$PASSWORD" | tigervncpasswd -f > ~/.vnc/passwd + + # 启动深信服的前端 + exec tigervncserver :1 -geometry 800x600 -localhost no -fg -passwd ~/.vnc/passwd -xstartup start-sangfor.sh +fi