Skip to content

Commit 18b3c46

Browse files
burggrafburggraf
committed
added websockproxy package
1 parent ca500f9 commit 18b3c46

15 files changed

+493
-0
lines changed

‎packages/websockproxy/.gitignore

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
*.py[cod]
2+
3+
# C extensions
4+
*.so
5+
6+
# Packages
7+
*.egg
8+
*.egg-info
9+
dist
10+
build
11+
eggs
12+
parts
13+
bin
14+
var
15+
sdist
16+
develop-eggs
17+
.installed.cfg
18+
lib
19+
lib64
20+
__pycache__
21+
22+
# Installer logs
23+
pip-log.txt
24+
25+
# Unit test / coverage reports
26+
.coverage
27+
.tox
28+
nosetests.xml
29+
30+
# Translations
31+
*.mo
32+
33+
# Mr Developer
34+
.mr.developer.cfg
35+
.project
36+
.pydevproject

‎packages/websockproxy/Dockerfile

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
FROM ubuntu:focal
2+
3+
LABEL org.opencontainers.image.authors="benjamin.c.burns@gmail.com,mark@supabase.io"
4+
5+
RUN apt-get update && apt-get install -y python2 python2-dev iptables dnsmasq uml-utilities net-tools build-essential curl && apt-get clean
6+
7+
RUN curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py && python2 get-pip.py && rm get-pip.py
8+
9+
COPY --chown=netdev:netdev zzz_net_tun.rules /etc/udev/rules.d/zzz_net_tun.rules
10+
11+
COPY docker-image-config/docker-startup.sh switchedrelay.py limiter.py requirements.txt /opt/websockproxy/
12+
COPY docker-image-config/dnsmasq/interface docker-image-config/dnsmasq/dhcp /etc/dnsmasq.d/
13+
14+
WORKDIR /opt/websockproxy/
15+
16+
RUN pip2 install -r /opt/websockproxy/requirements.txt
17+
18+
# install tzdata to get around geographical questions during install
19+
RUN apt-get update
20+
RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
21+
RUN apt-get install -y nano && apt-get install -y nginx
22+
23+
COPY nginx.conf /etc/nginx
24+
COPY default /etc/nginx/sites-enabled
25+
#EXPOSE 80
26+
27+
CMD /opt/websockproxy/docker-startup.sh
28+
29+

‎packages/websockproxy/LICENSE

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Copyright 2022 Benjamin C. Burns
2+
3+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
4+
5+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
6+
7+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎packages/websockproxy/README.md

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# WebSockets Proxy
2+
3+
A websocket ethernet switch built using Tornado in Python
4+
5+
Implements crude rate limiting on WebSocket connections to prevent abuse.
6+
7+
Could use some cleanup!
8+
9+
## How it works
10+
11+
It's quite simple. The program starts off by creating a TAP device and listening
12+
for websocket connections on port 80. When clients connect, ethernet frames
13+
received via the websocket are switched between connected clients and the TAP
14+
device. All communication is done via raw ethernet frames.
15+
16+
To use this in support of a virtual network you must set up the host system as
17+
a DHCP server and router.
18+
19+
SSL support is not included. To enable SSL, please use a reverse proxy with SSL
20+
and websockets support, such as nginx.
21+
22+
## Getting Started
23+
24+
The easiest way to get up and running is via its public docker image. This
25+
image will set up a fully contained router enviornment using IPTables for
26+
basic NAT functionality and dnsmasq for DHCP support.
27+
28+
To set up the relay via docker simply run
29+
30+
```shell
31+
docker rm -f relay && docker run --privileged --network host --name relay burggraf/pg_browser_websockproxy:1.0.4
32+
```
33+
34+
and point jor1k, your VPN client, or your emulator of choice at
35+
ws://YOUR_HOSTNAME:8080/
36+
37+
Note that the container must be run in priviliged mode so that it can create
38+
its TAP device and set up IPv4 masquerading.
39+
40+
For better security be sure to set up an Nginx reverse proxy with SSL support
41+
along with a more isolated docker bridge and some host-side firewall rules
42+
which prevent clients of your relay from attempting to connect to your host
43+
machine.

‎packages/websockproxy/default

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
map $server_port $upstream {
2+
"~(\d)(\d\d\d)$" 10.5.$1.$2:5432;
3+
}
4+
server {
5+
listen 6001-6254 so_keepalive=on;
6+
7+
#allow <ip_address>;
8+
#deny all;
9+
10+
proxy_connect_timeout 60s;
11+
proxy_socket_keepalive on;
12+
proxy_pass $upstream;
13+
}
14+

‎packages/websockproxy/docker-image-config/dnsmasq/dhcp

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
dhcp-range=10.5.6.1,10.5.6.254,255.255.0.0,15m
2+
dhcp-option=6,0.0.0.0,8.8.8.8,8.8.4.4

‎packages/websockproxy/docker-image-config/dnsmasq/interface

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
listen-address=10.5.0.1
2+
interface=tap0
3+
bind-interfaces

‎packages/websockproxy/docker-image-config/docker-startup.sh

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/usr/bin/env bash
2+
3+
## Create and initialize TAP device ##
4+
tunctl
5+
6+
ifconfig tap0 down
7+
ifconfig tap0 10.5.0.1
8+
ifconfig tap0 netmask 255.255.0.0
9+
ifconfig tap0 mtu 1500
10+
ifconfig tap0 up
11+
######################
12+
13+
## IP Forwarding config for TAP device ##
14+
echo 1 > /proc/sys/net/ipv4/ip_forward
15+
16+
/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
17+
/sbin/iptables -A FORWARD -i eth0 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
18+
19+
#Drop any packages destined for the host machine or any other docker containers
20+
#NOTE: double check that this matches your docker bridge subnet
21+
/sbin/iptables -A FORWARD -i tap0 -o eth0 -d 172.17.0.0/16 -j DROP
22+
23+
/sbin/iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT
24+
/sbin/iptables-save
25+
#########################################
26+
27+
/etc/init.d/dnsmasq start
28+
nginx
29+
python2 switchedrelay.py

‎packages/websockproxy/limiter.py

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
import time
2+
3+
class RateLimitingState(object):
4+
def __init__(self, rate, clientip, name):
5+
self.name = name
6+
self.clientip = clientip
7+
self.rate = rate
8+
self.allowance = rate
9+
self.last_check = time.time()
10+
11+
def do_throttle(self, message):
12+
current = time.time()
13+
time_passed = current - self.last_check
14+
15+
self.last_check = current
16+
self.allowance += time_passed * self.rate
17+
18+
if self.allowance > self.rate:
19+
self.allowance = self.rate #throttle
20+
21+
if self.allowance > 1.0:
22+
self.allowance -= len(message)
23+
return True;
24+
25+
return False

‎packages/websockproxy/nginx.conf

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
user www-data;
2+
worker_processes auto;
3+
pid /run/nginx.pid;
4+
include /etc/nginx/modules-enabled/*.conf;
5+
6+
events {
7+
worker_connections 768;
8+
# multi_accept on;
9+
}
10+
11+
http {
12+
13+
##
14+
# Basic Settings
15+
##
16+
17+
sendfile on;
18+
tcp_nopush on;
19+
tcp_nodelay on;
20+
keepalive_timeout 65;
21+
types_hash_max_size 2048;
22+
# server_tokens off;
23+
24+
# server_names_hash_bucket_size 64;
25+
# server_name_in_redirect off;
26+
27+
include /etc/nginx/mime.types;
28+
default_type application/octet-stream;
29+
30+
##
31+
# SSL Settings
32+
##
33+
34+
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
35+
ssl_prefer_server_ciphers on;
36+
37+
##
38+
# Logging Settings
39+
##
40+
41+
#access_log /var/log/nginx/access.log;
42+
#error_log /var/log/nginx/error.log;
43+
44+
##
45+
# Gzip Settings
46+
##
47+
48+
gzip on;
49+
50+
# gzip_vary on;
51+
# gzip_proxied any;
52+
# gzip_comp_level 6;
53+
# gzip_buffers 16 8k;
54+
# gzip_http_version 1.1;
55+
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
56+
57+
##
58+
# Virtual Host Configs
59+
##
60+
61+
include /etc/nginx/conf.d/*.conf;
62+
#include /etc/nginx/sites-enabled/*;
63+
}
64+
65+
66+
#mail {
67+
# # See sample authentication script at:
68+
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
69+
#
70+
# # auth_http localhost/auth.php;
71+
# # pop3_capabilities "TOP" "USER";
72+
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
73+
#
74+
# server {
75+
# listen localhost:110;
76+
# protocol pop3;
77+
# proxy on;
78+
# }
79+
#
80+
# server {
81+
# listen localhost:143;
82+
# protocol imap;
83+
# proxy on;
84+
# }
85+
#}
86+
stream {
87+
#access_log /var/log/nginx/db.access.log;
88+
#error_log /var/log/nginx/db.error.log;
89+
include /etc/nginx/sites-enabled/default;
90+
}
91+

‎packages/websockproxy/publish.sh

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
docker build --platform linux/amd64 -t burggraf/pg_browser_websockproxy:1.0.4 .
2+
docker push burggraf/pg_browser_websockproxy:1.0.4

‎packages/websockproxy/relay.service

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[Unit]
2+
Description=jor1k relay service
3+
Requires=docker.service
4+
After=docker.service
5+
6+
[Service]
7+
Restart=always
8+
ExecStart=/usr/bin/docker run --rm --privileged -p 8080:80 --name jor1k-relay benjamincburns/jor1k-relay:latest
9+
10+
RestartSec=2min
11+
12+
[Install]
13+
WantedBy=multi-user.target

‎packages/websockproxy/requirements.txt

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
argparse==1.2.1
2+
python-pytun==2.2.1
3+
tornado==3.1.1
4+
wsgiref==0.1.2

0 commit comments

Comments
 (0)