Sign inSign up

idein/gatekeeper

By idein

•Updated about 1 year ago

Gatekeeper: A SOCKS5 Server written in Rust

Image
0

10K+

idein/gatekeeper repository overview

original repository(idein/gatekeeper)⁠

⁠Gatekeeper: A SOCKS5⁠ Server written in Rust.

Idein License

⁠Features

⁠Authentication Method

Any authentication method is not supported.

The client connects to the server is required for sending X'00' (NO AUTHENTICATION REQUIRED) as a method selection message.

⁠Command

Only CONNECT command is supported.

⁠Filter

Gatekeeper allow users to restricting connection based on:

  • target address
    • ip address (subnet range)
    • domain name (regex matching, wildcard)
  • port number
  • protocol (currently, tcp is only supported)

⁠Tags

This repository provides some tags.

  • latest-<arch>latest image
  • 2.2.0-<arch> exactly fixed version of 2.2.0 gatekeeper
  • 2.2-<arch> latest version of 2.2.x gatekeeper series
  • 2-<arch> latest version of 2.x.x gatekeeper series

<arch> is one of amd64, arm32v6 or arm32v7.

  • arm32v6 can be executed on RaspberryPi Zero, and
  • arm32v7 can be executed on other RaspberryPi series and Jetson(nano).

⁠Usage

This docker image provides an server executable gatekeeperd.

⁠How to use

Start container without any arguments, gatekeeperd will be executed.


$ docker run -d --rm -p 1080:1080 idein/gatekeeper:2.2.0-x86_64

Expose 1080 because gatekeeperd listen on port 1080 by default.

Other options can be seen by --help option:

# docker run -it --rm idein/gatekeeper:2.2.0-x86_64 --help
[ ok ] Starting system message bus: dbus.
[ ok ] Starting Avahi mDNS/DNS-SD Daemon: avahi-daemon.
gatekeeperd
gatekeeper 2.2.0
takayuki goto <[email protected]>
A SOCKS proxy implementation

USAGE:
    gatekeeperd [OPTIONS]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
    -i, --ip <ipaddr>        Set ipaddress to listen on [default: 0.0.0.0]
    -p, --port <port>        Set port to listen on [default: 1080]
    -r, --rule <rulefile>    Set path to connection rule file (format: yaml)
⁠Debugging

To output logs, execute container in foreground.

# docker run -it --rm -p 1080:1080 idein/gatekeeper:2.2.0-x86_64
[ ok ] Starting system message bus: dbus.
[ ok ] Starting Avahi mDNS/DNS-SD Daemon: avahi-daemon.
gatekeeperd
 2020-09-07T10:35:37.425 INFO  gatekeeper::server > cmd: Connect(_, 1.0.17.172:51357)
 2020-09-07T10:35:37.446 INFO  gatekeeper::session > connected: google.com:80: 172.217.175.14:80
 2020-09-07T10:35:37.446 INFO  gatekeeper::relay   > spawned relay: outbound: 1.0.17.172:51357: 172.217.175.14:80
 2020-09-07T10:35:37.446 INFO  gatekeeper::relay   > spawned relay: incoming: 1.0.17.172:51357: 172.217.175.14:80
 2020-09-07T10:35:37.490 INFO  gatekeeper::relay   > relay thread has been finished: outbound: 1.0.17.172:51357: 172.217.175.14:80
 2020-09-07T10:36:17.644 INFO  gatekeeper::server  > cmd: Terminate
 2020-09-07T10:36:18.613 INFO  gatekeeper::relay   > relay thread is requested termination: 1.0.17.172:51357: 172.217.175.14:80
 2020-09-07T10:36:19.420 INFO  gatekeeper::server  > server shutdown

To get more detailed logs, set RUST_LOG=debug option:

# docker run -it --rm -p 1080:1080 -e RUST_LOG=debug idein/gatekeeper:2.2.0-x86_64
[ ok ] Starting system message bus: dbus.
[ ok ] Starting Avahi mDNS/DNS-SD Daemon: avahi-daemon.
gatekeeperd
 2020-09-07T10:36:44.274 DEBUG gatekeeperd > option: Opt { port: 1080, ipaddr: V4(0.0.0.0), rulefile: None }
 2020-09-07T10:36:57.463 INFO  gatekeeper::server > cmd: Connect(_, 1.0.17.172:52893)
 2020-09-07T10:36:57.463 DEBUG gatekeeper::server > next session id is issued: SessionId(1200096531)
 2020-09-07T10:36:57.463 DEBUG gatekeeper::session > auth method: MethodSelection { version: ProtocolVersion(5), method: NoAuth }
 2020-09-07T10:36:57.464 DEBUG gatekeeper::session > connect request: ConnectRequest { version: ProtocolVersion(5), command: Connect, connect_to: Domain("google.com", 80) }
 2020-09-07T10:36:57.470 INFO  gatekeeper::session > connected: google.com:80: 172.217.175.14:80
 2020-09-07T10:36:57.471 INFO  gatekeeper::relay   > spawned relay: incoming: 1.0.17.172:52893: 172.217.175.14:80
 2020-09-07T10:36:57.471 INFO  gatekeeper::relay   > spawned relay: outbound: 1.0.17.172:52893: 172.217.175.14:80
 2020-09-07T10:36:57.516 INFO  gatekeeper::relay   > relay thread has been finished: outbound: 1.0.17.172:52893: 172.217.175.14:80
 2020-09-07T10:36:59.411 INFO  gatekeeper::server  > cmd: Terminate
 2020-09-07T10:37:02.611 INFO  gatekeeper::relay   > relay thread is requested termination: 1.0.17.172:52893: 172.217.175.14:80
 2020-09-07T10:37:02.611 DEBUG gatekeeper::session > DisconnectGuard: SessionId(1200096531)
 2020-09-07T10:37:02.611 DEBUG gatekeeper::server  > join accept thread
 2020-09-07T10:37:02.611 INFO  gatekeeper::server  > server shutdown
⁠Filter Rule

By default, gatekeeper accepts all connection requests. However, it is possible to filter out some requests along with a filtering rule (described above) given an yaml file. This yaml file follows special format described below.

⁠Format

Any filter rule yaml is constructed from a sequence of RuleEntries. Each RuleEntry is either Allow or Deny.

---
- Allow:
    ..
- Deny:
    ..
- Deny:
    ..
- Allow:
    ..
..

The rule is in the back of this list have higher precedence. Then the head of rules is treated as default rule, and the rule should be either allow all connection or deny all connection.

- Allow:
    address: Any
    port: Any
    protocol: Any
..

Or

- Deny:
    address: Any
    port: Any
    protocol: Any
..

All RuleEntry have 3 fields address, port and protocol. Value of these fields are either Any or Specif. Any matches any values, and Specif matches a specified value(s).

  • address

    # any address
address: Any

    address is either IpAddr or Domain. IpAddr is specified with addr and prefix.

    # 192.168.0.1/24
address:
  Specif:
    IpAddr:
      addr: 192.168.0.1
      prefix: 24

    Domain is specified as either pattern or wildcard.

    # {mail.,}google.{com,co.jp}
address:
  Specif:
    Domain:
      # regexp pattern
      pattern: '\A(mail\.)?google.((com|co)\.jp)\z'

    # allow any Amazon API Gateway's REST API
address:
  Specif:
    Domain:
      # converted to the regex pattern: \A[A-Za-z0-9-]{1,63}\.execute\-api\.[A-Za-z0-9-]{1,63}\.amazonaws\.com\z
      wildcard: '*.execute-api.*.amazonaws.com'

  • port

    # any port number
port: Any

    # match only 8080
port:
  Specif: 8080

  • protocol

    # any protocol
protocol: Any

    # match only tcp
protocol:
  Specif: Tcp
⁠Examples

  • allow all connections

    ---
- Allow:
    address: Any
    port: Any
    protocol: Any

  • allow only local subnet (192.168.0.1/16)

    ---
.. default deny ..
- Allow:
    address:
      Specif:
        IpAddr:
          addr: 192.168.0.1
          prefix: 16
    port: Any
    protocol: Any

  • block access to facebook.com and youtube.com

    ---
.. default allow ..
- Deny:
    address:
      Specif:
        Domain:
          pattern: '\A(www\.)?facebook\.com\z'
    port: Any
    protocol:
      Specif: Tcp
- Deny:
    address:
      Specif:
        Domain:
          pattern: '\A(www\.)?youtube\.com\z'
    port: Any
    protocol:
      Specif: Tcp

Tag summary

Content type

Image

Digest

sha256:2015d1865…

Size

515.6 MB

Last updated

about 1 year ago

docker pull idein/gatekeeper:3.0.0-x86_64