Index of /srv2/lede/openwrt-20180607/build_dir/target-mips_24kc_musl/redsocks-0.4-20150907

Name	Last modified	Size

Parent Directory		-
Makefile	2015-09-07 15:03	2.3K
README	2015-09-07 15:03	7.2K
README.html	2015-09-07 15:03	10K
base.c	2015-09-07 15:03	11K
base.h	2015-09-07 15:03	365
base64.c	2015-09-07 15:03	3.1K
base64.h	2015-09-07 15:03	1.8K
debian/	2015-09-07 15:03	-
dnstc.c	2015-09-07 15:03	6.4K
dnstc.h	2015-09-07 15:03	375
doc/	2015-09-07 15:03	-
http-auth.c	2015-09-07 15:03	7.1K
http-auth.h	2015-09-07 15:03	727
http-connect.c	2015-09-07 15:03	7.4K
http-relay.c	2015-09-07 15:03	15K
libc-compat.h	2015-09-07 15:03	972
libevent-compat.h	2015-09-07 15:03	428
list.h	2015-09-07 15:03	12K
log.c	2015-09-07 15:03	4.7K
log.h	2015-09-07 15:03	872
main.h	2015-09-07 15:03	625
md5.c	2015-09-07 15:03	12K
md5.h	2015-09-07 15:03	3.3K
parser.c	2015-09-07 15:03	14K
parser.h	2015-09-07 15:03	1.5K
reddns.c	2015-09-07 15:03	2.6K
redsocks.c	2015-09-07 15:03	26K
redsocks.conf.example	2015-09-07 15:03	3.1K
redsocks.h	2015-09-07 15:03	4.1K
redsocks.service	2015-09-07 15:03	438
redudp.c	2015-09-07 15:03	25K
redudp.h	2015-09-07 15:03	1.3K
socks4.c	2015-09-07 15:03	3.9K
socks5.c	2015-09-07 15:03	9.1K
socks5.h	2015-09-07 15:03	2.9K
tools/	2015-09-07 15:03	-
utils.c	2015-09-07 15:03	6.0K
utils.h	2015-09-07 15:03	2.6K
version.h	2015-09-07 15:03	170
main.c	2018-06-07 18:09	4.0K
config.h	2018-06-07 18:09	21
parser.o	2018-06-07 18:09	34K
main.o	2018-06-07 18:09	17K
redsocks.o	2018-06-07 18:09	73K
log.o	2018-06-07 18:09	15K
http-connect.o	2018-06-07 18:09	23K
socks4.o	2018-06-07 18:09	16K
socks5.o	2018-06-07 18:09	28K
http-relay.o	2018-06-07 18:09	40K
base.o	2018-06-07 18:09	20K
base64.o	2018-06-07 18:09	6.6K
md5.o	2018-06-07 18:09	18K
http-auth.o	2018-06-07 18:09	19K
utils.o	2018-06-07 18:09	23K
redudp.o	2018-06-07 18:10	69K
dnstc.o	2018-06-07 18:10	21K
gen/	2018-06-07 18:10	-
redsocks	2018-06-07 18:10	298K
ipkg-mips_24kc/	2018-06-07 18:10	-

redsocks - transparent socks redirector

darkk's homepage download source code

This tool allows you to redirect any TCP connection to SOCKS or HTTPS proxy using your firewall, so redirection is system-wide.

Why is that useful? I can suggest following reasons:

you use tor and don't want any TCP connection to leak
you use DVB ISP and this ISP provides internet connectivity with some special daemon that may be also called "Internet accelerator" and this accelerator acts as proxy. Globax is example of such an accelerator

Linux/iptables, OpenBSD/pf and FreeBSD/ipfw are supported. Linux/iptables is well-tested, other implementations may have bugs, your bugreports are welcome.

Transocks is alike project but it has noticable performance penality.

Transsocks_ev is alike project too, but it has no HTTPS-proxy support and does not support authentication.

Several Andoird apps also use redsocks under-the-hood: ProxyDroid (@AndroidMarket) and sshtunnel (@AndroidMarket). And that's over 100'000 downloads! Wow!

Another related issue is DNS over TCP. Redsocks includes `dnstc' that is fake and really dumb DNS server that returns "truncated answer" to every query via UDP. RFC-compliant resolver should repeat same query via TCP in this case - so the request can be redirected using usual redsocks facilities.

Known compliant resolvers are:

bind9 (server)
dig, nslookup (tools based on bind9 code)

Known non-compliant resolvers are:

eglibc resolver fails without any attempt to send request via TCP
powerdns-recursor can't properly startup without UDP connectivity as it can't load root hints

On the other hand, DNS via TCP using bind9 may be painfully slow. If your bind9 setup is really slow, you have at least two options: pdnsd caching server can run in TCP-only mode, ttdnsd (git repo) has no cache but can be useful for same purpose.

Features

Redirect any TCP connection to SOCKS4, SOCKS5 or HTTPS (HTTP/CONNECT) proxy server.

Login/password authentication is supported for SOCKS5/HTTPS connections. SOCKS4 supports only username, password is ignored. for HTTPS, currently only Basic and Digest scheme is supported.

Redirect UDP packets via SOCKS5 proxy server. NB: UDP still goes via UDP, so you can't relay UDP via OpenSSH.

Sends "truncated reply" as an answer to UDP DNS queries.

Redirect any HTTP connection to proxy that does not support transparent proxying (e.g. old SQUID had broken `acl myport' for such connections).

License

All source code is licensed under Apache 2.0 license.

You can get a copy at http://www.apache.org/licenses/LICENSE-2.0.html

Packages

Compilation

libevent is required.

gcc is only supported compiler right now, other compilers can be used but may require some code changes.

Compilation is as easy as running `make', there is no `./configure' magic.

GNU Make works, other implementations of make were not tested.

Running

Program has following command-line options:
-c sets proper path to config file ("./redsocks.conf" is default one)
-t tests config file syntax
-p set a file to write the getpid() into

Following signals are understood:
SIGUSR1 dumps list of connected clients to log
SIGTERM and SIGINT terminates daemon, all active connections are closed

You can see configuration file example in redsocks.conf.example

iptables example

You have to build iptables with connection tracking and REDIRECT target.

# Create new chain
root# iptables -t nat -N REDSOCKS

# Ignore LANs and some other reserved addresses.
# See Wikipedia and RFC5735 for full list of reserved networks.
root# iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
root# iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
root# iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
root# iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
root# iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
root# iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
root# iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
root# iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN

# Anything else should be redirected to port 12345
root# iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 12345

# Any tcp connection made by `luser' should be redirected.
root# iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner luser -j REDSOCKS

# You can also control that in more precise way using `gid-owner` from
# iptables.
root# groupadd socksified
root# usermod --append --groups socksified luser
root# iptables -t nat -A OUTPUT -p tcp -m owner --gid-owner socksified -j REDSOCKS

# Now you can launch your specific application with GID `socksified` and it
# will be... socksified. See following commands (numbers may vary).
# Note: you may have to relogin to apply `usermod` changes.
luser$ id
uid=1000(luser) gid=1000(luser) groups=1000(luser),1001(socksified)
luser$ sg socksified -c id
uid=1000(luser) gid=1001(socksified) groups=1000(luser),1001(socksified)
luser$ sg socksified -c "firefox"

# If you want to configure socksifying router, you should look at
# doc/iptables-packet-flow.png and doc/iptables-packet-flow-ng.png
# Note, you should have proper `local_ip' value to get external packets with
# redsocks, default 127.0.0.1 will not go. See iptables(8) manpage regarding
# REDIRECT target for details.
# Depending on your network configuration iptables conf. may be as easy as:
root# iptables -t nat -A PREROUTING --in-interface eth_int -p tcp -j REDSOCKS

Note about GID-based redirection

Keep in mind, that changed GID affects filesystem permissions, so if your application creates some files, the files will be created with luser:socksified owner/group. So, if you're not the only user in the group `socksified` and your umask allows to create group-readable files and your directory permissions, and so on, blah-blah, etc. THEN you may expose your files to another user.

Ok, you have been warned.

Homepage

Homepage: http://darkk.net.ru/redsocks/

Mailing list: redsocks@librelist.com

Mailing list also has archives.

TODO

Test OpenBSD (pf) and FreeBSD (ipfw) and write setup examples for those firewall types.

Author

This program was written by Leonid Evdokimov.

 (~~~~~~~~~~\   __
 | jabber:  )  /  \
 | mailto: (  /|oo \
  \_________\(_|  /_)
              _ @/_ \
             |     | \   \\
      leon   | (*) |  \   ))  darkk.net.ru
             |__U__| /  \//
              _//|| _\   /
             (_/(_|(____/
                         Valid CSS!
                         Valid XHTML 1.0 Transitional