feat: enable `fwmark` (`SO_MARK`) for outgoing sockets by sabify · Pull Request #202 · OutlineFoundation/tunnel-server

sabify · 2024-08-25T17:41:49Z

No description provided.

sbruens · 2024-09-04T19:40:14Z

I have merged some large refactors we've been working on recently; apologies for the merge conflicts, and thank you for this contribution!

We may want to have some more dialer config options in future, so I suggest maybe a dialer wrapper in the config:

dialer:
  fwmark: ...

/cc @fortuna to weigh in on that

fortuna · 2024-09-04T21:37:47Z

@sabify thanks for the changes to inject the dialer. That's solid. As @sbruens pointed out, we need to pull the changes and I like the idea of putting the fwmark in a dialer config. That could be a place for other settings, like interface binding, routing, enable local network, etc)

sabify · 2024-09-09T21:31:14Z

@sbruens @fortuna I just made changes based on the refactored code.

fortuna · 2024-09-11T19:04:35Z

By the way, for your use case, have you considered using a firewall rule based on the PID?

You can probably do things like:

sudo nft add rule filter output meta pid $PID mark set 0x1234

With iptables you can use cgroups and add the pid to it.

It's also possible to use network namespaces.

sabify · 2024-09-12T07:18:29Z

By the way, for your use case, have you considered using a firewall rule based on the PID?

You can probably do things like:
sudo nft add rule filter output meta pid $PID mark set 0x1234
With iptables you can use cgroups and add the pid to it.

It's also possible to use network namespaces.

This already adds too much complexity for even simple routing logic.

I made the changes to be linux-specific but it also opens room for other similar functionality in other platforms like freebsd's SO_USER_COOKIE.

fortuna

Thanks for the changes. Looking good. I just have a few more tweaks.

sabify · 2024-09-12T18:50:11Z

Changes applied.

sabify · 2024-09-28T13:58:11Z

@fortuna @sbruens I just gave you maintainer access to my fork and you are able to apply any of your concerns and code styles that fit best with the codebase. I may not be able to keep up with the rapid changes and requests in the codebase and this PR due to time constraints. Sorry for that and appreciate your work to land this feature. Thank you!

sbruens · 2024-12-16T16:38:59Z

@fortuna @sbruens I just gave you maintainer access to my fork and you are able to apply any of your concerns and code styles that fit best with the codebase. I may not be able to keep up with the rapid changes and requests in the codebase and this PR due to time constraints. Sorry for that and appreciate your work to land this feature. Thank you!

Thanks for all your hard work on this @sabify. I finally found some time to pick this up and merge in the changes.

@fortuna PTAL

fortuna

Thanks for updating this! We should probably release it soon after

sabify · 2024-12-17T07:45:17Z

@sbruens Thanks for taking your time to land this feature.

How is it possible to take control of this feature from outline server (CLI and/or GUI)? https://github.com/Jigsaw-Code/outline-server

sbruens · 2024-12-17T15:58:23Z

You can't right now.

There is some work to be done to get this into outline-server, namely:

Move outline-server to the new service config format introduced in 9992735 to which you added this dial option. We haven't gotten around to this yet.
Add some new API endpoint to actually set/update the dial option(s) so you can call it via the command line.
Expose this in the Manager/GUI.

The first 2 seem feasible, but the latter requires more UX research and we may not want to expose such an advanced feature in the Manager anyway.

sbruens · 2024-12-20T22:04:29Z

Move outline-server to the new service config format introduced in 9992735 to which you added this dial option. We haven't gotten around to this yet.

OutlineFoundation/outline-server#1628

feat: enable `fwmark` (`SO_MARK`) for outgoing sockets (OutlineFoundation#202)

* source_file * Add file source * Supporting adding keys from a source. * Add unit testing for cipher entry CRUD. * Pass sources through to runConfig. * Add a cipher entry from the source to per port cipherList * Make tests pass and add a test for a (deprecated) config example. * Change runConfig to runSource * Add feature to dynamically add configs to outline server. * Changing approach to minimal changes to runConfig * Reverting changes in main.go * Adds loadsource function. * Add cipher updater skeleton. * Add TODO for starting the SS service. * Implement loadSource() -- Create an initial config object from the first key. * server_test.go passes but with the deprecated config example yml file. * Remove shadowsocks.AddKey() and RemoveKey(). * Pass in an empty config to runConfig. We will need synchronization for CipherList though. * Use the new service config objects with listeners rather than the deprecated config. * Create AddCipher in CipherUpdater for a cleaner interface. * Implement key removal. Next: Make key removal faster by not traversing the whole linked list. * Implement key removal. Next: Make key removal faster by not traversing the whole linked list. * Cleanup * Refactor source handling * Added config_example_source.yml and updated source.go to use it. * feat: enable `fwmark` (`SO_MARK`) for outgoing sockets (OutlineFoundation#202) * feat: enable fwmark (SO_MARK) for outgoing sockets * fix: make fwmark linux-specific functionality * fix: minor improvements over handling fwmark * Use `transport.PacketListener` as interface. * Take the `syscall.RawConn` as input to `SetFwdmark()`. * Some cleanup. * Fix copyright dates for new files. * Fix the error types. * Revert changes to integration test. * Optimize removing a cipher entry when a key is removed. (OutlineFoundation#101) * Add fastAuth to tcp service

* source_file * Add file source * Supporting adding keys from a source. * Add unit testing for cipher entry CRUD. * Pass sources through to runConfig. * Add a cipher entry from the source to per port cipherList * Make tests pass and add a test for a (deprecated) config example. * Change runConfig to runSource * Add feature to dynamically add configs to outline server. * Changing approach to minimal changes to runConfig * Reverting changes in main.go * Adds loadsource function. * Add cipher updater skeleton. * Add TODO for starting the SS service. * Implement loadSource() -- Create an initial config object from the first key. * server_test.go passes but with the deprecated config example yml file. * Remove shadowsocks.AddKey() and RemoveKey(). * Pass in an empty config to runConfig. We will need synchronization for CipherList though. * Use the new service config objects with listeners rather than the deprecated config. * Create AddCipher in CipherUpdater for a cleaner interface. * Implement key removal. Next: Make key removal faster by not traversing the whole linked list. * Implement key removal. Next: Make key removal faster by not traversing the whole linked list. * Cleanup * Refactor source handling * Added config_example_source.yml and updated source.go to use it. * feat: enable `fwmark` (`SO_MARK`) for outgoing sockets (Jigsaw-Code#202) * feat: enable fwmark (SO_MARK) for outgoing sockets * fix: make fwmark linux-specific functionality * fix: minor improvements over handling fwmark * Use `transport.PacketListener` as interface. * Take the `syscall.RawConn` as input to `SetFwdmark()`. * Some cleanup. * Fix copyright dates for new files. * Fix the error types. * Revert changes to integration test. * Optimize removing a cipher entry when a key is removed. (Jigsaw-Code#101) * Add fastAuth to tcp service

sabify requested a review from a team as a code owner August 25, 2024 17:41

fortuna reviewed Aug 26, 2024

View reviewed changes

Comment thread service/tcp.go Outdated

Comment thread internal/integration_test/integration_test.go Outdated

sabify force-pushed the master branch from 022d8e8 to aeccec9 Compare August 27, 2024 16:49

fortuna requested changes Aug 27, 2024

View reviewed changes

Comment thread cmd/outline-ss-server/main.go Outdated

Comment thread cmd/outline-ss-server/main.go Outdated

feat: enable fwmark (SO_MARK) for outgoing sockets

d34de28

sabify force-pushed the master branch from 2de5c61 to d34de28 Compare September 9, 2024 21:26

fortuna requested changes Sep 11, 2024

View reviewed changes

Comment thread service/tcp.go Outdated

Comment thread service/udp.go Outdated

Comment thread service/udp.go Outdated

fix: make fwmark linux-specific functionality

91b7a8b

fortuna reviewed Sep 12, 2024

View reviewed changes

Comment thread service/udp_linux.go Outdated

Comment thread service/udp_linux.go Outdated

Comment thread service/tcp_other.go

fix: minor improvements over handling fwmark

33b2a56

fortuna reviewed Sep 24, 2024

View reviewed changes

Comment thread cmd/outline-ss-server/main.go Outdated

fortuna reviewed Sep 24, 2024

View reviewed changes

Comment thread cmd/outline-ss-server/main.go Outdated

Comment thread cmd/outline-ss-server/main.go Outdated

Comment thread service/socketopts_linux.go Outdated

fortuna requested a review from sbruens November 21, 2024 15:54

sbruens added 5 commits December 3, 2024 13:45

Merge branch 'master' into sabify

2ba2094

Use transport.PacketListener as interface.

82d1d71

Take the syscall.RawConn as input to SetFwdmark().

1aed383

Some cleanup.

b48e0a1

Fix copyright dates for new files.

f7b5d75

sbruens requested a review from fortuna December 16, 2024 16:39

fortuna approved these changes Dec 16, 2024

View reviewed changes

sbruens added 2 commits December 16, 2024 16:12

Fix the error types.

85b8d1e

Revert changes to integration test.

9117e7f

sbruens merged commit 98db5b4 into OutlineFoundation:master Dec 16, 2024

62w71st added a commit to JinaVPN/outline-ss-server-v2 that referenced this pull request Dec 29, 2024

Merge pull request #2 from Jigsaw-Code/master

aab253d

feat: enable `fwmark` (`SO_MARK`) for outgoing sockets (OutlineFoundation#202)

Conversation

sabify commented Aug 25, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sbruens commented Sep 4, 2024

Uh oh!

fortuna commented Sep 4, 2024

Uh oh!

sabify commented Sep 9, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

fortuna commented Sep 11, 2024

Uh oh!

sabify commented Sep 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fortuna left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sabify commented Sep 12, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sabify commented Sep 28, 2024

Uh oh!

sbruens commented Dec 16, 2024

Uh oh!

fortuna left a comment

Choose a reason for hiding this comment

Uh oh!

sabify commented Dec 17, 2024

Uh oh!

sbruens commented Dec 17, 2024

Uh oh!

sbruens commented Dec 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sabify commented Sep 12, 2024 •

edited

Loading