From 711df03116edc5b678d6ea9732257ad3de7e84b6 Mon Sep 17 00:00:00 2001
From: dnomd343 <i@343.re>
Date: Thu, 20 May 2021 18:50:02 +0800
Subject: [PATCH] feat: tproxy on docker

---
 Dockerfile |  18 +++++++++
 asset.sh   |  17 ++++++++
 load.sh    | 114 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 tproxy.sh  |  27 +++++++++++++
 4 files changed, 176 insertions(+)
 create mode 100644 Dockerfile
 create mode 100644 asset.sh
 create mode 100755 load.sh
 create mode 100755 tproxy.sh

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..123dd49
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,18 @@
+FROM alpine as asset
+COPY ./asset.sh /
+RUN apk --update add --no-cache curl wget && \
+    sh /asset.sh
+
+FROM alpine
+COPY . /tmp/xray
+COPY --from=asset /tmp/asset/ /tmp/xray/asset/
+RUN apk --update add --no-cache iptables ip6tables net-tools curl && \
+    mkdir -p /etc/xray/conf && \
+    mkdir -p /etc/xray/expose/log && \
+    mkdir -p /etc/xray/expose/segment && \
+    mv /tmp/xray/tproxy.sh / && \
+    mv /tmp/xray/load.sh /etc/xray/ && \
+    mv /tmp/xray/asset/xray /usr/bin/ && \
+    mv /tmp/xray/asset /etc/xray/ && \
+    rm -rf /tmp/xray
+CMD ["sh","/tproxy.sh"]
diff --git a/asset.sh b/asset.sh
new file mode 100644
index 0000000..08a6abf
--- /dev/null
+++ b/asset.sh
@@ -0,0 +1,17 @@
+get_github_latest_version() {
+  VERSION=$(curl --silent "https://api.github.com/repos/$1/releases/latest" | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/');
+}
+
+ASSET_DIR="/tmp/asset"
+mkdir -p $ASSET_DIR/pkg
+
+XRAY_PKG_NAME="Xray-linux-arm64-v8a.zip"
+get_github_latest_version "XTLS/Xray-core"
+wget -P $ASSET_DIR/pkg "https://hub.fastgit.org/XTLS/Xray-core/releases/download/$VERSION/$XRAY_PKG_NAME"
+unzip $ASSET_DIR/pkg/$XRAY_PKG_NAME -d /$ASSET_DIR/pkg
+cp $ASSET_DIR/pkg/xray $ASSET_DIR
+rm -rf $ASSET_DIR/pkg
+
+get_github_latest_version "Loyalsoldier/v2ray-rules-dat"
+wget -P $ASSET_DIR "https://hub.fastgit.org/Loyalsoldier/v2ray-rules-dat/releases/download/$VERSION/geoip.dat"
+wget -P $ASSET_DIR "https://hub.fastgit.org/Loyalsoldier/v2ray-rules-dat/releases/download/$VERSION/geosite.dat"
diff --git a/load.sh b/load.sh
new file mode 100755
index 0000000..664172a
--- /dev/null
+++ b/load.sh
@@ -0,0 +1,114 @@
+XRAY_DIR="/etc/xray"
+LOG_DIR="$XRAY_DIR/expose/log"
+load_inbounds(){
+cat>$XRAY_DIR/conf/inbounds.json<<EOF
+{
+  "inbounds": [
+    {
+      "port": 7288,
+      "protocol": "dokodemo-door",
+      "sniffing": {
+        "enabled": true,
+        "destOverride": [
+          "http",
+          "tls"
+        ]
+      },
+      "settings": {
+        "network": "tcp,udp",
+        "followRedirect": true
+      },
+      "streamSettings": {
+        "sockopt": {
+          "tproxy": "tproxy"
+        }
+      }
+    },
+    {
+      "port": 1080,
+      "protocol": "socks",
+      "settings": {
+        "udp": true
+      }
+    },
+    {
+      "port": 1081,
+      "protocol": "http",
+      "settings": {
+        "allowTransparent": false
+      }
+    }
+  ]
+}
+EOF
+}
+
+load_log(){
+cat>$XRAY_DIR/conf/log.json<<EOF
+{
+  "log": {
+    "loglevel": "warning",
+    "access": "$LOG_DIR/access.log",
+    "error": "$LOG_DIR/error.log" 
+  }
+}
+EOF
+}
+
+load_outbounds(){
+cat>$XRAY_DIR/expose/outbounds.json<<EOF
+{
+  "outbounds": [
+    {
+      "tag": "node",
+      "protocol": "freedom"
+    }
+  ]
+}
+EOF
+}
+
+load_routing(){
+cat>$XRAY_DIR/expose/routing.json<<EOF
+{
+  "routing": {
+    "domainStrategy": "AsIs",
+    "rules": [
+      {
+        "type": "field",
+        "ip": [
+          "0.0.0.0/0"
+        ],
+        "outboundTag": "node"
+      }
+    ]
+  }
+}
+EOF
+}
+
+load_ipv4(){
+cat>$XRAY_DIR/expose/segment/ipv4<<EOF
+224.0.0.0/3
+EOF
+}
+
+load_ipv6(){
+cat>$XRAY_DIR/expose/segment/ipv6<<EOF
+FF00::/8
+EOF
+}
+
+mkdir -p $XRAY_DIR/conf
+mkdir -p $XRAY_DIR/expose/segment
+mkdir -p $LOG_DIR
+[ ! -s "$LOG_DIR/access.log" ] && touch $LOG_DIR/access.log
+[ ! -s "$LOG_DIR/error.log" ] && touch $LOG_DIR/error.log
+load_inbounds
+load_log
+[ ! -s "$XRAY_DIR/expose/outbounds.json" ] && load_outbounds
+[ ! -s "$XRAY_DIR/expose/routing.json" ] && load_routing
+cp $XRAY_DIR/expose/outbounds.json $XRAY_DIR/conf/
+cp $XRAY_DIR/expose/routing.json $XRAY_DIR/conf/
+[ ! -s "$XRAY_DIR/expose/segment/ipv4" ] && load_ipv4
+[ ! -s "$XRAY_DIR/expose/segment/ipv6" ] && load_ipv6
diff --git a/tproxy.sh b/tproxy.sh
new file mode 100755
index 0000000..a51159e
--- /dev/null
+++ b/tproxy.sh
@@ -0,0 +1,27 @@
+[ ! -s "/etc/xray/expose/custom.sh" ] && touch /etc/xray/expose/custom.sh
+sh /etc/xray/expose/custom.sh
+sh /etc/xray/load.sh
+
+ip rule add fwmark 1 table 100
+ip route add local 0.0.0.0/0 dev lo table 100
+iptables -t mangle -N XRAY
+while read -r segment
+do
+  eval "iptables -t mangle -A XRAY -d $segment -j RETURN"
+done < /etc/xray/expose/segment/ipv4
+iptables -t mangle -A XRAY -p tcp -j TPROXY --on-port 7288 --tproxy-mark 1
+iptables -t mangle -A XRAY -p udp -j TPROXY --on-port 7288 --tproxy-mark 1
+iptables -t mangle -A PREROUTING -j XRAY
+
+ip -6 rule add fwmark 1 table 106
+ip -6 route add local ::/0 dev lo table 106
+ip6tables -t mangle -N XRAY6
+while read -r segment
+do
+  eval "ip6tables -t mangle -A XRAY6 -d $segment -j RETURN"
+done < /etc/xray/expose/segment/ipv6
+ip6tables -t mangle -A XRAY6 -p tcp -j TPROXY --on-port 7288 --tproxy-mark 1
+ip6tables -t mangle -A XRAY6 -p udp -j TPROXY --on-port 7288 --tproxy-mark 1
+ip6tables -t mangle -A PREROUTING -j XRAY6
+
+xray -confdir /etc/xray/conf/