blob: c1224ec7f2f59d27420648a4d8f002f6dbacf624 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
#!/bin/bash
# Needs full bash
for wait in 1 1 2 3 4 6 8 10 end; do
grep -q '^#_RCONFIG_TAG$' /opt/openslx/config && break
[ "$wait" == "end" ] && echo "Giving up!" && exit 1
echo "No config yet..."
sleep $wait
done
. /opt/openslx/config || echo "Error sourcing config for setup_proxy"
[ -z "$SLX_PROXY_MODE" -o "x$SLX_PROXY_MODE" == "xoff" ] && echo "proxy mode disabled." && exit 0
PROXY=off
if [ "$SLX_PROXY_MODE" == "on" ]; then
PROXY=on
elif [ "$SLX_PROXY_MODE" == "auto" -a -n "$SLX_PXE_CLIENT_IP" ]; then
# auto detection: check if it is actually needed
RET=$(curl -L -m 2 -s http://www.google.de/ | grep -o google | wc -l)
if [ $RET -lt 20 ]; then
sleep 4
RET=$(curl -L -m 5 -s http://www.google.de/ | grep -o google | wc -l)
fi
[ $RET -gt 20 ] && echo "Auto detect: Internet is reachable without proxy." && exit 0
PROXY=on
fi
[ "$PROXY" == "off" ] && echo "Proxy mode not required." && exit 0
echo "Setting up transparent proxying via $SLX_PROXY_IP"
sed -i "s/%%PROXY_IP%%/$SLX_PROXY_IP/g;s/%%PROXY_PORT%%/$SLX_PROXY_PORT/g;s/%%PROXY_TYPE%%/$SLX_PROXY_TYPE/g" /etc/redsocks.conf
mkdir -p /run/redsocks
chown redsocks:redsocks /run/redsocks
systemctl start redsocks
tfile="/opt/openslx/iptables/10-redsocks-proxy"
cat > "$tfile" <<HEREDOCBROWN
#!/bin/ash
iptables -t nat -N REDSOCKS 2>/dev/null
iptables -t nat -F REDSOCKS
iptables -t nat -A REDSOCKS -d "$SLX_PROXY_IP" -j RETURN
iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
HEREDOCBROWN
if [ -n "$SLX_PXE_SERVER_IP" ]; then
# Exclude boot server; we wouldn't be here if it weren't reachable directly
echo "iptables -t nat -A REDSOCKS -d '$SLX_PXE_SERVER_IP' -j RETURN" >> "$tfile"
fi
if [ -n "$SLX_PROXY_BLACKLIST" ]; then
for ADDR in $SLX_PROXY_BLACKLIST; do
echo "iptables -t nat -A REDSOCKS -d '$ADDR' -j RETURN"
done >> "$tfile"
fi
# Append alias for satellite server, used for HTTPS
SLX_PROXY_BLACKLIST="$SLX_PROXY_BLACKLIST satellite.bwlehrpool"
mkdir -p "/etc/profile.d"
rm -f -- "/etc/profile.d/99-proxy.sh"
if [ "${SLX_PROXY_TYPE:0:5}" = "http-" ]; then
# transparent proxying for HTTP -- DOES NOT WORK, might give 400 Bad Request
#echo "iptables -t nat -A REDSOCKS -p tcp --dport 80 -j DNAT --to-destination ${SLX_PROXY_IP}:${SLX_PROXY_PORT}" >> "$tfile"
for var in http_proxy HTTP_PROXY all_proxy ALL_PROXY; do
echo "export ${var}='http://${SLX_PROXY_IP}:${SLX_PROXY_PORT}/'"
done >> "/etc/profile.d/99-proxy.sh"
fi
# No proxy - always set
for var in no_proxy NO_PROXY; do
echo -n "export ${var}='${SLX_PXE_SERVER_IP}"
for ADDR in $SLX_PROXY_BLACKLIST; do
echo -n ", $ADDR"
done
echo "'"
done >> "/etc/profile.d/99-proxy.sh"
cat >> "$tfile" <<HEREDOCBROWN
iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-port 12345
iptables -t nat -A PREROUTING -i nat1 -p tcp -j REDSOCKS
iptables -t nat -A OUTPUT -o br0 -p tcp -j REDSOCKS
iptables -A INPUT -i br0 -p tcp --dport 12345 -j DROP
HEREDOCBROWN
chmod +x "$tfile"
mv -f -- "$tfile" "/opt/openslx/iptables/rules.d/10-redsocks-proxy"
|
