Mathieu Virbel
9cb65151ee
Remove the built-in HTTP/SOCKS5 proxy servers and domain allowlist/denylist system. Instead, use tun2socks with a TUN device inside the network namespace to transparently route all TCP/UDP traffic through an external SOCKS5 proxy. This enables truly transparent proxying where any binary (Go, static, etc.) has its traffic routed through the proxy without needing to respect HTTP_PROXY/ALL_PROXY environment variables. The external proxy handles its own filtering. Key changes: - NetworkConfig: remove AllowedDomains/DeniedDomains/proxy ports, add ProxyURL - Delete internal/proxy/, internal/templates/, internal/importer/ - Embed tun2socks binary (downloaded at build time via Makefile) - Replace LinuxBridge with ProxyBridge (single Unix socket to external proxy) - Inner script sets up TUN device + tun2socks inside network namespace - Falls back to env-var proxying when TUN is unavailable - macOS: best-effort env-var proxying to external SOCKS5 proxy - CLI: remove --template/import, add --proxy flag - Feature detection: add ip/tun/tun2socks status to --linux-features
54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
//go:build linux
|
|
|
|
package sandbox
|
|
|
|
import (
|
|
"embed"
|
|
"fmt"
|
|
"io/fs"
|
|
"os"
|
|
"runtime"
|
|
)
|
|
|
|
//go:embed bin/tun2socks-linux-*
|
|
var tun2socksFS embed.FS
|
|
|
|
// extractTun2Socks writes the embedded tun2socks binary to a temp file and returns its path.
|
|
// The caller is responsible for removing the file when done.
|
|
func extractTun2Socks() (string, error) {
|
|
var arch string
|
|
switch runtime.GOARCH {
|
|
case "amd64":
|
|
arch = "amd64"
|
|
case "arm64":
|
|
arch = "arm64"
|
|
default:
|
|
return "", fmt.Errorf("tun2socks: unsupported architecture %s", runtime.GOARCH)
|
|
}
|
|
|
|
name := fmt.Sprintf("bin/tun2socks-linux-%s", arch)
|
|
data, err := fs.ReadFile(tun2socksFS, name)
|
|
if err != nil {
|
|
return "", fmt.Errorf("tun2socks: embedded binary not found for %s: %w", arch, err)
|
|
}
|
|
|
|
tmpFile, err := os.CreateTemp("", "fence-tun2socks-*")
|
|
if err != nil {
|
|
return "", fmt.Errorf("tun2socks: failed to create temp file: %w", err)
|
|
}
|
|
|
|
if _, err := tmpFile.Write(data); err != nil {
|
|
tmpFile.Close()
|
|
os.Remove(tmpFile.Name())
|
|
return "", fmt.Errorf("tun2socks: failed to write binary: %w", err)
|
|
}
|
|
tmpFile.Close()
|
|
|
|
if err := os.Chmod(tmpFile.Name(), 0o755); err != nil {
|
|
os.Remove(tmpFile.Name())
|
|
return "", fmt.Errorf("tun2socks: failed to make executable: %w", err)
|
|
}
|
|
|
|
return tmpFile.Name(), nil
|
|
}
|