Init commit

Dockerfile

@@ -0,0 +1,21 @@
+FROM debian:buster
+
+COPY docker-files/EasyConnect.deb /tmp/
+
+RUN sed -i s/deb.debian.org/mirrors.cqu.edu.cn/ /etc/apt/sources.list &&\
+apt-get update && \
+apt-get install --yes libgtk2.0-0 libx11-xcb1 libxtst6 libnss3 libasound2 libdbus-glib-1-2 iptables \
+dante-server tigervnc-standalone-server dante-server psmisc &&\
+dpkg -i /tmp/EasyConnect.deb 
+
+COPY docker-files/start.sh docker-files/start-sangfor.sh /usr/local/bin/
+COPY docker-files/sockd.conf /etc/danted.conf
+RUN chmod +x /usr/local/bin/start.sh /usr/local/bin/start-sangfor.sh 
+
+ENV TYPE vnc
+ENV PASSWORD ""
+
+
+VOLUME /root/
+
+ENTRYPOINT start.sh

LICENSE.txt

@@ -0,0 +1,13 @@
+        DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
+                    Version 2, December 2004 
+
+ Copyright (C) 2004 Sam Hocevar <sam@hocevar.net> 
+
+ Everyone is permitted to copy and distribute verbatim or modified 
+ copies of this license document, and changing it is allowed as long 
+ as the name is changed. 
+
+            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 
+
+  0. You just DO WHAT THE FUCK YOU WANT TO. 

README.md

@@ -0,0 +1,95 @@
+# docker-easyconnect
+
+让深信服开发的**非自由**的 EasyConnect 代理软件运行在 docker 中，并开放 Socks5 供宿主机连接以使用代理。
+
+## Status
+
+### 已经过测试的版本
+
+`7.6.3.0.86415`版.
+
+其它 TODO...
+
+## Build
+
+```
+wget http://download.sangfor.com.cn/download/product/sslvpn/pkg/linux_01/EasyConnect_x64.deb -O docker-files/EasyConnect.deb
+docker image build .
+```
+
+## Usage
+
+**参数里的`--device /dev/net/tun --cap-add NET_ADMIN`是不可少的。**因为 EasyConnect 要创建虚拟网络设备`tun0`。
+
+### 环境变量
+
+- `TYPE`: `vnc` 或 `x11`
+
+`vnc`（默认值）: 将在`5901`端口开放 vnc 服务以操作 EasyConnect 前端。
+
+`x11`: 将直接通过`DISPLAY`环境变量的值显示 EasyConnect 前端，请同时设置`DISPLAY`环境变量。这个可能更适合于桌面用户。
+
+- `DISPLAY`: `$TYPE`为`x11`时通过该变量来现实 EasyConnect 界面。
+
+- `PASSWORD`: 用于 vnc 服务的密码，该变量的值默认为空字符串，表示密码不作改变。
+
+给变量赋值（空字符串除外），密码（应小于或等于 8 位）就会被更新到所赋的值。
+
+默认密码是`password`.
+
+### Socks5
+
+EasyConnect 创建`tun0`后，Socks5 代理会在容器的`1080`端口开启。这可用`-p`参数转发到`127.0.0.1`上。
+
+### VNC 服务器
+
+默认情况下，环境变量`TYPE`
+
+### 配置、登陆信息持久化
+
+只需要用`-v`参数将宿主机的目录挂载到容器的 /root 。
+
+如`-v $HOME/.ecdata:/root`。
+
+由此还能实现全自动登陆。
+
+## 例子
+
+### X11 socket
+
+```
+docker run --device /dev/net/tun --cap-add NET_ADMIN -ti -v /tmp/.X11-unix:/tmp/.X11-unix -v $HOME/.Xauthority:/root/.Xauthority -e DISPLAY=$DISPLAY -e TYPE=x11 -v $HOME/.ecdata:/root -p 127.0.0.1:1080:1080 easyconnect
+```
+
+### vnc 
+
+```
+docker run --device /dev/net/tun --cap-add NET_ADMIN -ti -e PASSWORD=xxxx -v $HOME/.ecdata:/root -p 127.0.0.1:5901:5901 -p 127.0.0.1:1080:1080 easyconnect
+```
+
+## 已知问题
+
+vnc 下代理软件的图表上右键菜单会在第一次调出以后失灵，直到软件被关闭。
+
+## 版权及许可证
+
+> Copyright © 2020 Hagb (Guo Junyu) <hagb_green@qq.com>
+> This work is free. You can redistribute it and/or modify it under the
+> terms of the Do What The Fuck You Want To Public License, Version 2,
+> as published by Sam Hocevar. See the COPYING file for more details.
+
+可以对这份东西做任何事情。
+
+>        DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
+>                    Version 2, December 2004 
+>
+> Copyright (C) 2004 Sam Hocevar <sam@hocevar.net> 
+>
+> Everyone is permitted to copy and distribute verbatim or modified 
+> copies of this license document, and changing it is allowed as long 
+> as the name is changed. 
+>
+>            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE 
+>   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 
+>
+>  0. You just DO WHAT THE FUCK YOU WANT TO. 

docker-files/sockd.conf

@@ -0,0 +1,10 @@
+internal: eth0 port = 1080
+external: tun0
+socksmethod: none
+clientmethod: none
+client pass {
+        from: 0.0.0.0/0 to: 0.0.0.0/0
+}
+socks pass {
+        from: 0.0.0.0/0 to: 0.0.0.0/0
+}

docker-files/start-sangfor.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+/usr/share/sangfor/EasyConnect/resources/bin/EasyMonitor
+sleep 1
+while true
+do
+	# 在 EasyConnect 前端启动过程中，会出现 cms client connect failed 的报错，此时应该启动 sslservice.sh。但这个脚本启动得太早也会没有作用……
+	[ $(jobs |wc -l) -eq 0 ] &&
+	       	(tail -n 0 -f /usr/share/sangfor/EasyConnect/resources/logs/ECAgent.log | grep "\\[Register\\]cms client connect failed" -m 1
+		/usr/share/sangfor/EasyConnect/resources/shell/sslservice.sh
+		)&
+	
+	sleep 1
+	# 下面这行就是 EasyConnect 的前端了。
+	/usr/share/sangfor/EasyConnect/EasyConnect --enable-transparent-visuals --disable-gpu
+	# 清除的残余进程，它们可能会妨碍下次的启动。
+	killall CSClient svpnservice
+	sleep 4
+	# 只要杀不死，就往死里杀（逃……）
+	killall CSClient svpnservice -9
+	sleep 1
+done

docker-files/start.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# 在虚拟网络设备 tun0 打开时运行 proxy 代理服务器
+(while true
+do
+sleep 5
+[ -d /sys/class/net/tun0 ] && danted
+done
+)&
+
+[ -e ~/.vnc/passwd ] || mkdir -p ~/.vnc && (echo password | tigervncpasswd -f > ~/.vnc/passwd) 
+
+# 登陆信息持久化处理
+rm /usr/share/sangfor/EasyConnect/resources/conf/easy_connect.json
+touch easy_connect.json
+ln -s ~/easy_connect.json /usr/share/sangfor/EasyConnect/resources/conf/easy_connect.json
+
+if [ "$TYPE" = "X11" -o "$TYPE" = "x11" ]
+then
+	exec start-sangfor.sh
+else
+	# 安全起见 vnc 不能从 tun0 处访问
+	iptables -I INPUT  -p tcp --dport 5901 -j REJECT
+	iptables -I INPUT  -i eth0 -p tcp --dport 5901 -j ACCEPT
+	iptables -I INPUT  -i lo -p tcp --dport 5901 -j ACCEPT
+	
+	# $PASSWORD 不为空时，更新 vnc 密码
+	[ -n "$PASSWORD" ] && printf %s "$PASSWORD" | tigervncpasswd -f > ~/.vnc/passwd
+
+	# 启动深信服的前端
+	exec tigervncserver :1 -geometry 800x600 -localhost no -fg -passwd ~/.vnc/passwd -xstartup start-sangfor.sh
+fi