Mathieu Virbel
9cb65151ee
Remove the built-in HTTP/SOCKS5 proxy servers and domain allowlist/denylist system. Instead, use tun2socks with a TUN device inside the network namespace to transparently route all TCP/UDP traffic through an external SOCKS5 proxy. This enables truly transparent proxying where any binary (Go, static, etc.) has its traffic routed through the proxy without needing to respect HTTP_PROXY/ALL_PROXY environment variables. The external proxy handles its own filtering. Key changes: - NetworkConfig: remove AllowedDomains/DeniedDomains/proxy ports, add ProxyURL - Delete internal/proxy/, internal/templates/, internal/importer/ - Embed tun2socks binary (downloaded at build time via Makefile) - Replace LinuxBridge with ProxyBridge (single Unix socket to external proxy) - Inner script sets up TUN device + tun2socks inside network namespace - Falls back to env-var proxying when TUN is unavailable - macOS: best-effort env-var proxying to external SOCKS5 proxy - CLI: remove --template/import, add --proxy flag - Feature detection: add ip/tun/tun2socks status to --linux-features
74 lines
2.2 KiB
Go
74 lines
2.2 KiB
Go
//go:build !linux
|
|
|
|
package sandbox
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/Use-Tusk/fence/internal/config"
|
|
)
|
|
|
|
// ProxyBridge is a stub for non-Linux platforms.
|
|
type ProxyBridge struct {
|
|
SocketPath string
|
|
ProxyHost string
|
|
ProxyPort string
|
|
}
|
|
|
|
// ReverseBridge is a stub for non-Linux platforms.
|
|
type ReverseBridge struct {
|
|
Ports []int
|
|
SocketPaths []string
|
|
}
|
|
|
|
// LinuxSandboxOptions is a stub for non-Linux platforms.
|
|
type LinuxSandboxOptions struct {
|
|
UseLandlock bool
|
|
UseSeccomp bool
|
|
UseEBPF bool
|
|
Monitor bool
|
|
Debug bool
|
|
}
|
|
|
|
// NewProxyBridge returns an error on non-Linux platforms.
|
|
func NewProxyBridge(proxyURL string, debug bool) (*ProxyBridge, error) {
|
|
return nil, fmt.Errorf("proxy bridge not available on this platform")
|
|
}
|
|
|
|
// Cleanup is a no-op on non-Linux platforms.
|
|
func (b *ProxyBridge) Cleanup() {}
|
|
|
|
// NewReverseBridge returns an error on non-Linux platforms.
|
|
func NewReverseBridge(ports []int, debug bool) (*ReverseBridge, error) {
|
|
return nil, fmt.Errorf("reverse bridge not available on this platform")
|
|
}
|
|
|
|
// Cleanup is a no-op on non-Linux platforms.
|
|
func (b *ReverseBridge) Cleanup() {}
|
|
|
|
// WrapCommandLinux returns an error on non-Linux platforms.
|
|
func WrapCommandLinux(cfg *config.Config, command string, proxyBridge *ProxyBridge, reverseBridge *ReverseBridge, tun2socksPath string, debug bool) (string, error) {
|
|
return "", fmt.Errorf("Linux sandbox not available on this platform")
|
|
}
|
|
|
|
// WrapCommandLinuxWithOptions returns an error on non-Linux platforms.
|
|
func WrapCommandLinuxWithOptions(cfg *config.Config, command string, proxyBridge *ProxyBridge, reverseBridge *ReverseBridge, tun2socksPath string, opts LinuxSandboxOptions) (string, error) {
|
|
return "", fmt.Errorf("Linux sandbox not available on this platform")
|
|
}
|
|
|
|
// StartLinuxMonitor returns nil on non-Linux platforms.
|
|
func StartLinuxMonitor(pid int, opts LinuxSandboxOptions) (*LinuxMonitors, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
// LinuxMonitors is a stub for non-Linux platforms.
|
|
type LinuxMonitors struct{}
|
|
|
|
// Stop is a no-op on non-Linux platforms.
|
|
func (m *LinuxMonitors) Stop() {}
|
|
|
|
// PrintLinuxFeatures prints a message on non-Linux platforms.
|
|
func PrintLinuxFeatures() {
|
|
fmt.Println("Linux sandbox features are only available on Linux.")
|
|
}
|