init upload

2026-07-25 11:14:52 +03:00
commit f7e67801a5
7 changed files with 360 additions and 0 deletions
@@ -0,0 +1,26 @@
+FROM debian:trixie-slim
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install OpenVPN, OpenSSL, IPTables, GSocket and networking utilities
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    openvpn \
+    openssl \
+    iptables \
+    iproute2 \
+    curl \
+    ca-certificates \
+    procps \
+    gsocket \
+    && rm -rf /var/lib/apt/lists/*
+
+# FIX: Switch default iptables engine to legacy mode to bypass container nf_tables restriction
+RUN update-alternatives --set iptables /usr/sbin/iptables-legacy && \
+    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
+
+WORKDIR /vpn
+
+COPY entrypoint.sh /vpn/entrypoint.sh
+RUN chmod +x /vpn/entrypoint.sh
+
+ENTRYPOINT ["/vpn/entrypoint.sh"]
@@ -0,0 +1,22 @@
+services:
+  gsocket-vpn:
+    build: .
+    container_name: gsocket-vpn
+    restart: unless-stopped
+    environment:
+      - GS_SECRET=${GS_SECRET}
+    dns:
+      - 1.1.1.1
+      - 8.8.8.8
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    devices:
+      - /dev/net/tun:/dev/net/tun
+    sysctls:
+      - net.ipv4.ip_forward=1
+    volumes:
+      - vpn-data:/vpn
+
+volumes:
+  vpn-data:
@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+set -e
+
+if [ -z "$GS_SECRET" ]; then
+  echo "[!] ERROR: GS_SECRET environment variable is missing."
+  echo "    Please start the container with -e GS_SECRET=\"your_secret_key\""
+  exit 1
+fi
+
+# Ensure TUN device node exists in container namespace
+if [ ! -c /dev/net/tun ]; then
+  mkdir -p /dev/net
+  mknod /dev/net/tun c 10 200
+  chmod 600 /dev/net/tun
+fi
+
+# Force public DNS resolvers inside container for GSocket relay lookup
+echo "nameserver 1.1.1.1" > /etc/resolv.conf
+echo "nameserver 8.8.8.8" >> /etc/resolv.conf
+
+# 1. Generate Certificates & OpenVPN Configs (OpenSSL 3.x compliant)
+if [ ! -f /vpn/server.conf ]; then
+  echo "[+] Generating OpenSSL 3.x compliant SSL/TLS Certificates..."
+
+  # A. Generate CA
+  openssl req -x509 -newkey rsa:2048 -nodes \
+    -keyout /vpn/ca.key -out /vpn/ca.crt -days 3650 \
+    -subj "/CN=GSocket-CA" \
+    -addext "basicConstraints=critical,CA:TRUE" \
+    -addext "keyUsage=critical,keyCertSign,cRLSign" >/dev/null 2>&1
+
+  # B. Generate Server Cert
+  cat <<EOF > /vpn/server_ext.cnf
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = DNS:gsocket, IP:127.0.0.1
+EOF
+
+  openssl req -newkey rsa:2048 -nodes -keyout /vpn/server.key -out /vpn/server.csr -subj "/CN=GSocket-Server" >/dev/null 2>&1
+  openssl x509 -req -in /vpn/server.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
+    -out /vpn/server.crt -days 3650 -extfile /vpn/server_ext.cnf >/dev/null 2>&1
+
+  # C. Generate Client Cert
+  cat <<EOF > /vpn/client_ext.cnf
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature
+extendedKeyUsage = clientAuth
+EOF
+
+  openssl req -newkey rsa:2048 -nodes -keyout /vpn/client.key -out /vpn/client.csr -subj "/CN=GSocket-Client" >/dev/null 2>&1
+  openssl x509 -req -in /vpn/client.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
+    -out /vpn/client.crt -days 3650 -extfile /vpn/client_ext.cnf >/dev/null 2>&1
+
+  # D. Generate TLS-Crypt Key
+  openvpn --genkey secret /vpn/tls-crypt.key
+
+  # E. OpenVPN Server Config (uses 'topology subnet' & 'redirect-gateway local')
+  cat <<EOF > /vpn/server.conf
+dev tun
+topology subnet
+ca /vpn/ca.crt
+cert /vpn/server.crt
+key /vpn/server.key
+dh none
+ecdh-curve prime256v1
+tls-crypt /vpn/tls-crypt.key
+server 10.8.0.0 255.255.255.0
+push "redirect-gateway def1 local bypass-dhcp"
+push "dhcp-option DNS 1.1.1.1"
+push "dhcp-option DNS 8.8.8.8"
+keepalive 10 60
+cipher AES-256-GCM
+data-ciphers AES-256-GCM:AES-128-GCM
+persist-key
+persist-tun
+tun-mtu 1300
+mssfix 1200
+EOF
+
+  # F. Unified Client Config (Embedded relay routes via net_gateway)
+  cat <<EOF > /vpn/client.ovpn
+client
+dev tun
+proto tcp-client
+remote 127.0.0.1 1194
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+remote-cert-tls server
+cipher AES-256-GCM
+tun-mtu 1300
+mssfix 1200
+
+# Native OpenVPN routes to bypass GSocket relay nodes via physical default gateway
+route j.gs.thc.org 255.255.255.255 net_gateway
+route a.gs.thc.org 255.255.255.255 net_gateway
+route b.gs.thc.org 255.255.255.255 net_gateway
+route c.gs.thc.org 255.255.255.255 net_gateway
+route g.gs.thc.org 255.255.255.255 net_gateway
+
+<ca>
+$(cat /vpn/ca.crt)
+</ca>
+<cert>
+$(cat /vpn/client.crt)
+</cert>
+<key>
+$(cat /vpn/client.key)
+</key>
+<tls-crypt>
+$(cat /vpn/tls-crypt.key)
+</tls-crypt>
+EOF
+
+  echo "[+] Client config generated at /vpn/client.ovpn"
+fi
+
+# 2. Configure Networking & IPTables inside Container
+WAN_IF=$(ip route show default | awk '/default/ {print $5}' | head -n1)
+echo "[+] Container WAN Interface detected: $WAN_IF"
+
+if [ "$(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null)" = "1" ]; then
+  echo "[+] IPv4 forwarding is active."
+else
+  echo "[!] WARNING: IPv4 forwarding is not active in this container!"
+fi
+
+echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter 2>/dev/null || true
+echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter 2>/dev/null || true
+
+iptables -F
+iptables -t nat -F
+
+iptables -A INPUT -i tun+ -j ACCEPT
+iptables -A OUTPUT -o tun+ -j ACCEPT
+iptables -A FORWARD -i tun+ -j ACCEPT
+iptables -A FORWARD -o tun+ -j ACCEPT
+
+iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
+iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1200
+
+# 3. Start OpenVPN daemon
+echo "[+] Starting local OpenVPN daemon on 127.0.0.1:1194..."
+openvpn --config /vpn/server.conf \
+        --proto tcp4-server \
+        --local 127.0.0.1 \
+        --lport 1194 &
+
+sleep 2
+
+# 4. Forward GSocket stream directly to 127.0.0.1:1194
+echo "[+] Starting gs-netcat port forwarder..."
+exec gs-netcat -s "$GS_SECRET" -l -d 127.0.0.1 -p 1194