luckyimnotanigger/tun2proxy
1
0
Fork 0
mirror of https://github.com/tun2proxy/tun2proxy.git synced 2025-05-14 05:52:48 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

Restrict namespace arguments to Linux

Browse source
This commit is contained in:
B. Blechschmidt 2024-04-07 21:12:20 +02:00
parent af6a8a3cb0
commit e8469f0aee
3 changed files with 39 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/args.rs
View file

@ -1,9 +1,10 @@
use crate::{Error, Result};
use socks5_impl::protocol::UserKey;
use std::{
ffi::OsString,
net::{IpAddr, SocketAddr, ToSocketAddrs},
};
#[cfg(target_os = "linux")]
use std::ffi::OsString;
use std::net::{IpAddr, SocketAddr, ToSocketAddrs};
#[derive(Debug, Clone, clap::Parser)]
#[command(author, version, about = "Tunnel interface to proxy.", long_about = None)]
@ -25,17 +26,21 @@ pub struct Args {
/// Create a tun interface in a newly created unprivileged namespace
/// while maintaining proxy connectivity via the global network namespace.
#[cfg(target_os = "linux")]
#[arg(long)]
pub unshare: bool,
/// File descriptor for UNIX datagram socket meant to transfer
/// network sockets from global namespace to the new one.
/// See `unshare(1)`, `namespaces(7)`, `sendmsg(2)`, `unix(7)`.
#[arg(long, value_name = "fd")]
#[cfg(target_os = "linux")]
#[arg(long, value_name = "fd", hide(true))]
pub socket_transfer_fd: Option<i32>,
/// Specify a command to run with root-like capabilities in the new namespace.
/// Specify a command to run with root-like capabilities in the new namespace
/// when using `--unshare`.
/// This could be useful to start additional daemons, e.g. `openvpn` instance.
#[cfg(target_os = "linux")]
#[arg(requires = "unshare")]
pub admin_command: Vec<OsString>,
@ -91,8 +96,11 @@ impl Default for Args {
proxy: ArgProxy::default(),
tun: None,
tun_fd: None,
#[cfg(target_os = "linux")]
unshare: false,
#[cfg(target_os = "linux")]
socket_transfer_fd: None,
#[cfg(target_os = "linux")]
admin_command: Vec::new(),
ipv6_enabled: false,
setup,