sslh: add transparent proxy support #12280
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Gabor Seljan <sgabe@users.noreply.github.com>
|
Needs a PKG_RELEASE bump. Might want to put all your changes in one PR. |
|
I have opened separate PRs because this way the proposed changes can be discussed and accepted or rejected independently and I could increment the |
Signed-off-by: Gabor Seljan <sgabe@users.noreply.github.com>
|
All of the changes look fine. I’d put them in one PR. Easier that way. |
Signed-off-by: Gabor Seljan <sgabe@users.noreply.github.com>
Compile with USELIBCAP=1 to make use of POSIX capabilities. This will save the required capabilities needed for transparent proxying for unprivileged processes. Signed-off-by: Gabor Seljan <sgabe@users.noreply.github.com>
Upstream will drop support for the ssl option in the next future version. Signed-off-by: Gabor Seljan <sgabe@users.noreply.github.com>
|
As per your request, I have pulled all changes into this PR. |
|
Shouldn't it be cherry-picked into 19.07? |
|
Done - 267b490 Fixes warning in OpenWrt 19.07: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Compile with
USELIBCAP=1to make use of POSIX capabilities. This will save the required capabilities needed for transparent proxying for unprivileged processes. Furthermore, upstream will drop support for thessloption in the next future version, hence we should usetlsinstead.Signed-off-by: Gabor Seljan sgabe@users.noreply.github.com
Maintainer: @jmccrohan
Compile tested: MT7621, RB750Gr3, v19.07.3
Run tested: MT7621, RB750Gr3, v19.07.0
Description:
--transparentoption added in v1.15 of sslh. This PR updates the init script and the configuration file to support transparent proxying.USELIBCAPcompiler flag. This PR adds thelibcappackage as a dependency and enables theUSELIBCAPflag. Capabilities support is especially needed for transparent proxying while running sslh as the unprivileged nobody user.ssloption is deprecated and the legacy support will be removed in sslh v1.21. This PR replaces the oldssloption with the newtlsoption that should be used instead.