Mathieu Virbel
9cb65151ee
Remove the built-in HTTP/SOCKS5 proxy servers and domain allowlist/denylist system. Instead, use tun2socks with a TUN device inside the network namespace to transparently route all TCP/UDP traffic through an external SOCKS5 proxy. This enables truly transparent proxying where any binary (Go, static, etc.) has its traffic routed through the proxy without needing to respect HTTP_PROXY/ALL_PROXY environment variables. The external proxy handles its own filtering. Key changes: - NetworkConfig: remove AllowedDomains/DeniedDomains/proxy ports, add ProxyURL - Delete internal/proxy/, internal/templates/, internal/importer/ - Embed tun2socks binary (downloaded at build time via Makefile) - Replace LinuxBridge with ProxyBridge (single Unix socket to external proxy) - Inner script sets up TUN device + tun2socks inside network namespace - Falls back to env-var proxying when TUN is unavailable - macOS: best-effort env-var proxying to external SOCKS5 proxy - CLI: remove --template/import, add --proxy flag - Feature detection: add ip/tun/tun2socks status to --linux-features
54 lines
1.2 KiB
Go
54 lines
1.2 KiB
Go
//go:build !linux
|
|
|
|
package sandbox
|
|
|
|
// LinuxFeatures describes available Linux sandboxing features.
|
|
// This is a stub for non-Linux platforms.
|
|
type LinuxFeatures struct {
|
|
HasBwrap bool
|
|
HasSocat bool
|
|
HasSeccomp bool
|
|
SeccompLogLevel int
|
|
HasLandlock bool
|
|
LandlockABI int
|
|
HasEBPF bool
|
|
HasCapBPF bool
|
|
HasCapRoot bool
|
|
CanUnshareNet bool
|
|
HasIpCommand bool
|
|
HasDevNetTun bool
|
|
HasTun2Socks bool
|
|
KernelMajor int
|
|
KernelMinor int
|
|
}
|
|
|
|
// DetectLinuxFeatures returns empty features on non-Linux platforms.
|
|
func DetectLinuxFeatures() *LinuxFeatures {
|
|
return &LinuxFeatures{}
|
|
}
|
|
|
|
// Summary returns an empty string on non-Linux platforms.
|
|
func (f *LinuxFeatures) Summary() string {
|
|
return "not linux"
|
|
}
|
|
|
|
// CanMonitorViolations returns false on non-Linux platforms.
|
|
func (f *LinuxFeatures) CanMonitorViolations() bool {
|
|
return false
|
|
}
|
|
|
|
// CanUseLandlock returns false on non-Linux platforms.
|
|
func (f *LinuxFeatures) CanUseLandlock() bool {
|
|
return false
|
|
}
|
|
|
|
// CanUseTransparentProxy returns false on non-Linux platforms.
|
|
func (f *LinuxFeatures) CanUseTransparentProxy() bool {
|
|
return false
|
|
}
|
|
|
|
// MinimumViable returns false on non-Linux platforms.
|
|
func (f *LinuxFeatures) MinimumViable() bool {
|
|
return false
|
|
}
|