source: trunk/debian/packages/debwrt-net/tags/0.7~debwrtSTRETCH+7/etc/firewall/sslh.inc.sh @ 886

#!/bin/sh

# sslh in transparent mode
#
# sslh listens to connection on the configured listen port and tunnels them,
# based on protocol analisys of the initial request to the configured ip:port
# (can be localhost) for that service. sslh remains the proxy in between.
# 
# When using transparent mode, the Source IP of the outgoing packet is changed
# to the Source IP of the original inbound connection. Allowing the process/
# machine that runs the actual service to see the original inbound client IP.
#
# Effectively causing the handling service to send packets back to that inbound
# client IP and *not* to the sslh deamon which handles the actual inbound
# request. Hence some trickery is involved to get the returned packets, when in
# transparent mode, routed though the sslh deamon.
#
# Any returning packets are marked 0x1 using the mangle table of netfilter. And
# then are routed to localhost.
#
# Note: listen address for sslh should be set to non-localhost address according
#       to the original readme. What works is:
#
#       listen:
#       (
#           { host: "0.0.0.0"; port: "443"; }
#       );
#
# This assumes: connection comming in from wan to SSLH daemon. Which then connects
#               to hosts on br-lan

sslh_start()
{
    ${IPT} -t mangle -N SSLH

    # a line for each host/port managed in /etc/sslh/sslh.conf
    tmpl="${IPT} -t mangle -A FORWARD --protocol tcp --in-interface br-lan -s _IP_ -m multiport --sport _PORT_ --jump SSLH"
    cat /etc/sslh/sslh.cfg \
     | grep "name: \"[a-zA-Z0-9_=+--]\+"\
     | sed 's/[{ },]//g' \
     | tr : = \
     | while read line
       do
           eval "${line}"
           cmd=$(echo ${tmpl} \
                   | sed -e "s/_IP_/${host}/" \
                         -e "s/_PORT_/${port}/")
           ${cmd}
       done

    ${IPT} -t mangle -A SSLH --jump MARK --set-mark 0x1
    ${IPT} -t mangle -A SSLH --jump ACCEPT

    # lookup routing table 100 for packets with mark 0x1
    ip rule add fwmark 0x1 lookup 100

    # routing table 100: route all packets to localhost (=sslh)
    ip route add local 0.0.0.0/0 dev lo table 100
}

sslh_stop()
{
    ip rule del fwmark 0x1 lookup 100
    ip route del local 0.0.0.0/0 dev lo table 100
    ${IPT} -t mangle -F FORWARD
    ${IPT} -t mangle -F SSLH
    ${IPT} -t mangle -X SSLH
}

sslh_flush()
{
    sslh_stop >/dev/null 2>&1
    $IPT -t mangle -F
    $IPT -t mangle -X
}

astart="${astart} sslh_start"
astop="${astop} sslh_stop"
aflush="${aflush} sslh_flush"