Skip to content

Commit 4ce9522

Browse files
rcreaseyrcreasey
committed
almost there.
1 parent 0668aba commit 4ce9522

11 files changed

Lines changed: 122 additions & 96 deletions

File tree

‎client/Dockerfile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
11
FROM phusion/baseimage
2-
MAINTAINER rcreasey@blizzard.com
32

43
ENTRYPOINT ["/bin/bash"]

‎client/run.sh‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,2 @@
1-
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.201.250:3128
2-
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to 192.168.201.250:3129
3-
4-
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 3128 -w
5-
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to 3129 -w
6-
7-
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.99.103:3128 -w
8-
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to 192.168.99.103:3129 -w
1+
iptables -t nat -A PREROUTING -p tcp -s 172.17.0.0/16 --dport 80 -j REDIRECT --to-port 3128
2+
iptables -t nat -A PREROUTING -p tcp -s 172.17.0.0/16 --dport 443 -j REDIRECT --to-port 3129

‎docker-compose.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
proxy:
2+
build: proxy
3+
net: "host"

‎proxy/Dockerfile‎

Lines changed: 12 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,18 @@
1-
FROM phusion/baseimage
2-
MAINTAINER rcreasey@blizzard.com
1+
FROM centos:7
32

4-
ENV SQUID_VERSION=3.3.8 \
5-
SQUID_CACHE_DIR=/var/cache/squid3 \
6-
SQUID_LOG_DIR=/var/log/squid3 \
7-
SQUID_USER=proxy
8-
9-
RUN apt-get update && \
10-
apt-get install -y devscripts build-essential fakeroot libssl-dev && \
11-
DEBIAN_FRONTEND=noninteractive apt-get source squid3 && \
12-
apt-get build-dep -y squid3
3+
ENV SQUID_CACHE_DIR=/var/cache/squid \
4+
SQUID_SSL_DIR=/var/lib/ssl_db \
5+
SQUID_LOG_DIR=/var/log/squid \
6+
SQUID_USER=squid
137

14-
RUN dpkg-source -x squid3_3.3.8-1ubuntu6.4.dsc
15-
16-
ADD rules.patch /squid3-rules.patch
17-
RUN patch squid3-3.3.8/debian/rules < squid3-rules.patch
18-
RUN cd squid3-3.3.8 && dpkg-buildpackage -rfakeroot -b
19-
RUN apt-get install -y ssl-cert squid-langpack
20-
RUN dpkg --install squid3-common_3.3.8-1ubuntu6.4_all.deb && \
21-
dpkg --install squid3_3.3.8-1ubuntu6.4_amd64.deb && \
22-
dpkg --install squidclient_3.3.8-1ubuntu6.4_amd64.deb
23-
24-
RUN /usr/lib/squid3/ssl_crtd -c -s /var/spool/squid3_ssldb && \
25-
chown -R proxy:proxy /var/spool/squid3_ssldb
26-
27-
RUN rm -rf /squid*
8+
RUN yum update -y && yum install -y squid openssl
289

29-
RUN openssl req -new -newkey rsa:2048 -sha256 -days 365 -nodes -x509 \
30-
-out /etc/ssl/certs/squid.pem \
31-
-keyout /etc/ssl/private/squid.pem \
32-
-subj "/C=US/ST=California/L=Irvine/O=Blizzard Entertainment/CN=www.battle.net"
33-
34-
COPY squid.conf /etc/squid3/squid.conf
35-
COPY entrypoint.sh /sbin/entrypoint.sh
36-
RUN chmod 755 /sbin/entrypoint.sh
10+
COPY t1.key /etc/squid/t1.key
11+
COPY t1.pem /etc/squid/t1.pem
12+
COPY squid.conf /etc/squid/squid.conf
13+
COPY entrypoint.sh /entrypoint.sh
14+
RUN chmod 755 /entrypoint.sh
3715

3816
EXPOSE 3128/tcp 3129/tcp
39-
4017
VOLUME ["${SQUID_CACHE_DIR}"]
41-
ENTRYPOINT ["/sbin/entrypoint.sh"]
18+
ENTRYPOINT ["/entrypoint.sh"]

‎proxy/docker-compose.yml‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎proxy/entrypoint.sh‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,20 @@ create_cache_dir() {
1212
chown -R ${SQUID_USER}:${SQUID_USER} ${SQUID_CACHE_DIR}
1313
}
1414

15+
create_ssl_db() {
16+
/usr/lib64/squid/ssl_crtd -c -s ${SQUID_SSL_DIR}
17+
chown -R ${SQUID_USER}:${SQUID_USER} ${SQUID_SSL_DIR}
18+
}
19+
1520
create_log_dir
1621
create_cache_dir
22+
create_ssl_db
1723

18-
# allow arguments to be passed to squid3
24+
# allow arguments to be passed to squid
1925
if [[ ${1:0:1} = '-' ]]; then
2026
EXTRA_ARGS="$@"
2127
set --
22-
elif [[ ${1} == squid3 || ${1} == $(which squid3) ]]; then
28+
elif [[ ${1} == squid ]]; then
2329
EXTRA_ARGS="${@:2}"
2430
set --
2531
fi
@@ -28,10 +34,12 @@ fi
2834
if [[ -z ${1} ]]; then
2935
if [[ ! -d ${SQUID_CACHE_DIR}/00 ]]; then
3036
echo "Initializing cache..."
31-
$(which squid3) -N -f /etc/squid3/squid.conf -z
37+
squid -N -f /etc/squid/squid.conf -z
3238
fi
33-
echo "Starting squid3..."
34-
exec $(which squid3) -f /etc/squid3/squid.conf -NYCd 1 ${EXTRA_ARGS}
39+
echo "Using this Certificate Authority:"
40+
cat /etc/squid/t1.pem
41+
echo "Starting squid..."
42+
exec squid -f /etc/squid/squid.conf -NYCd 1 ${EXTRA_ARGS}
3543
else
3644
exec "$@"
3745
fi

‎proxy/rules.patch‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎proxy/squid.conf‎

Lines changed: 43 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,52 @@
1-
#cache_peer 192.168.99.102 parent 3128 0 no-query default
1+
cache_peer 192.168.99.111 parent 3128 0 no-query no-digest
2+
never_direct allow all
23

3-
http_port 3130
4-
http_port 3128 intercept
5-
https_port 3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/ssl/certs/squid.pem key=/etc/ssl/private/squid.pem
4+
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
5+
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
6+
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
7+
acl localnet src fc00::/7 # RFC 4193 local private network range
8+
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
9+
10+
acl SSL_ports port 443
11+
acl Safe_ports port 80 # http
12+
acl Safe_ports port 21 # ftp
13+
acl Safe_ports port 443 # https
14+
acl Safe_ports port 70 # gopher
15+
acl Safe_ports port 210 # wais
16+
acl Safe_ports port 1025-65535 # unregistered ports
17+
acl Safe_ports port 280 # http-mgmt
18+
acl Safe_ports port 488 # gss-http
19+
acl Safe_ports port 591 # filemaker
20+
acl Safe_ports port 777 # multiling http
21+
acl CONNECT method CONNECT
22+
23+
http_access deny !Safe_ports
24+
25+
http_access deny CONNECT !SSL_ports
26+
27+
http_access allow localhost manager
28+
http_access deny manager
29+
30+
http_access allow localnet
31+
http_access allow localhost
32+
33+
http_access allow all
34+
35+
http_port 0.0.0.0:3127
36+
http_port 0.0.0.0:3128 intercept
37+
https_port 0.0.0.0:3129 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB key=/etc/squid/t1.key cert=/etc/squid/t1.pem
638

739
always_direct allow all
840
ssl_bump server-first all
9-
sslproxy_cert_error allow all
41+
sslproxy_cert_error deny all
1042
sslproxy_flags DONT_VERIFY_PEER
11-
12-
sslcrtd_program /usr/lib/squid3/ssl_crtd -s /var/spool/squid3_ssldb -M 4MB
13-
sslcrtd_children 8 startup=1 idle=1
43+
sslcrtd_program /usr/lib64/squid/ssl_crtd -s /var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1
1444

1545
maximum_object_size 1024 MB
16-
coredump_dir /var/spool/squid3
17-
cache_dir ufs /var/cache/squid3 5000 16 256
18-
shutdown_lifetime 1 second
19-
20-
acl all src all
2146

22-
acl SSL_ports port 443
23-
acl Safe_ports port 80 # http
24-
acl Safe_ports port 21 # ftp
25-
acl Safe_ports port 443 # https
26-
acl Safe_ports port 70 # gopher
27-
acl Safe_ports port 210 # wais
28-
acl Safe_ports port 1025-65535 # unregistered ports
29-
acl Safe_ports port 280 # http-mgmt
30-
acl Safe_ports port 488 # gss-http
31-
acl Safe_ports port 591 # filemaker
32-
acl Safe_ports port 777 # multiling http
33-
acl CONNECT method CONNECT
47+
coredump_dir /var/spool/squid
3448

35-
#http_access deny !Safe_ports
36-
#http_access deny CONNECT !SSL_ports
37-
38-
http_access allow all
49+
refresh_pattern ^ftp: 1440 20% 10080
50+
refresh_pattern ^gopher: 1440 0% 1440
51+
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
52+
refresh_pattern . 0 20% 4320

‎proxy/t1.key‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDanfCeONcJ1ZRq
3+
JrD0G5cxOtbXwj5lSd2zjGf5Xdz9MZVQlhBXYLYONYJT7rJdCnzyqHWl3fqIsnKR
4+
cs839bDT8bYh9pIe0wNoU/slaCMrQ2RhPFShaiiRtVg2jkd9ZRrOqo0c1UeGyHiu
5+
5wVyGmFsiLySGdfRWQiXrZvSUTfDcpK1X3pd0CK2osL5X6AyqCOSHf+IP34Y7hMo
6+
3MTdZJ0NnhD7/xBD+N+v15+1U+P46XR72/sBZqcgMW7KXtSZaeyklmU3X4GYmcib
7+
mvNiQFENwlC7G+EvOducPwwR2CXO7TY2Dta00aavmzHY2/zzLUmaP637QseJ+5cp
8+
bhP9RqZ/AgMBAAECggEBALwidWLESZKGAe4EE/5PDCLqnt8Yo3epRKhyaTv5Yedm
9+
1zd9nNyFNsctl1XBsi9Nik+NV4mBaUxgPSYcZmWjAySx+2po9kCemW0b8KK1Zqah
10+
nW3sbGxonjcel6aDdNRdwN8feMbaaG5+cRUbbN1QBI1Rcu5MXSUk+LcHSXSKPnHr
11+
vVYLyoUnqNKrNq3sTCY08FexJXS/ppJ9599gwQJ06WLd9PX84oTCxQ50evf86K+a
12+
sycZUab/5D5l9yxlnSZZlyiyRoj2rGidOE5GMExpg8scTDKRmNByX+VpyHntn7XO
13+
kyIN/mR8rA1ExkSpSDHfXMrPeHcPLBUAXQA7FF2xjbECgYEA7K62/Q4hh3scp3fI
14+
YiJ6zDRTVzU667Vff7VFMeKoMHS87j1iPT0E3vZuSkA9FY0ALKQkABwZLHy15HOW
15+
NgRekH3u8fa9hPaLQacdb9OgC0gJ3FxwagISUmXTOjawq9yPOjwvkrJgbHLMgr7J
16+
0lh4lZJOXtWpyFr9Oh3SjzjvxXkCgYEA7HXCxdUfD/efnGpqEIeBOcTG2mQSGx6C
17+
va1oe9/g7HkucjzlLyUfhkEOHB89689OcuyONBPjrk9tQyoaE1BnzPt58LUM4p0a
18+
DDhssH70FNHqqPb+UNWiq7lnDLc6FETsOddJyp5Ylj2VlsLi3qoosAI0OkmP/sK5
19+
qzzNQC2GJbcCgYEA2BuveeAtPUdsIn18uh5BgbNFZZt08UPqrvEU/Te32oa8+8uQ
20+
p9nPWMYqbiG5pLPaNOiq9m6xja1RaAciYLAcqFJUmxpwcber74ZnmnPg7mwYlNzS
21+
x/icQiA3fi/xoPsCzGmoBopZAKzRj5AlN6sQb4HnjTAKlqZ+EVKpr5yNUgECgYAc
22+
oiXzztr0FAg/6KLvXXlIhYuO5o9KuWcbkOQWHAYgnIwDSVx3WQd4Omh6/02AQJo/
23+
UGXn6ICpmvSgLXj63cG0EL+zZjkpN9zvneWLedQUsVa5Hy+smjIYmVrhL07ZJX91
24+
gZxt7L7Ncqeqme7fB7vllF6+sCm/r9TL55DzNJAKAQKBgEaJoCr2PbvZSnPqGEY9
25+
Vr6PTr+/fg5bEPgVaM7e+Py66puEfwct9EWySXiDcY50zoa4GzhPPjll7T1HGBRi
26+
gAB02PkP2cvKWBUVkNWDy1kNzkDnWryRVUx2JAxQUMst/GnFh2Ci6W4hCraV/SiV
27+
VndeeWI9dVCRpfBrqePF/UKo
28+
-----END PRIVATE KEY-----

‎proxy/t1.pem‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDezCCAmOgAwIBAgIJAPTYdsNtYldAMA0GCSqGSIb3DQEBCwUAMFQxCzAJBgNV
3+
BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMQ8wDQYDVQQHDAZJcnZpbmUxHzAd
4+
BgNVBAoMFkJsaXp6YXJkIEVudGVydGFpbm1lbnQwHhcNMTYwMTEyMDAxMzM2WhcN
5+
MjYwMTA5MDAxMzM2WjBUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5p
6+
YTEPMA0GA1UEBwwGSXJ2aW5lMR8wHQYDVQQKDBZCbGl6emFyZCBFbnRlcnRhaW5t
7+
ZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2p3wnjjXCdWUaiaw
8+
9BuXMTrW18I+ZUnds4xn+V3c/TGVUJYQV2C2DjWCU+6yXQp88qh1pd36iLJykXLP
9+
N/Ww0/G2IfaSHtMDaFP7JWgjK0NkYTxUoWookbVYNo5HfWUazqqNHNVHhsh4rucF
10+
chphbIi8khnX0VkIl62b0lE3w3KStV96XdAitqLC+V+gMqgjkh3/iD9+GO4TKNzE
11+
3WSdDZ4Q+/8QQ/jfr9eftVPj+Ol0e9v7AWanIDFuyl7UmWnspJZlN1+BmJnIm5rz
12+
YkBRDcJQuxvhLznbnD8MEdglzu02Ng7WtNGmr5sx2Nv88y1Jmj+t+0LHifuXKW4T
13+
/UamfwIDAQABo1AwTjAdBgNVHQ4EFgQUPWceW89zU/7AwaVDfjN2fwqq3REwHwYD
14+
VR0jBBgwFoAUPWceW89zU/7AwaVDfjN2fwqq3REwDAYDVR0TBAUwAwEB/zANBgkq
15+
hkiG9w0BAQsFAAOCAQEALuNAo8tbhedr7Nv9pzVKAS5NQ3xkuVIfCuneYH8gEodj
16+
nD+oXokmaL71osRR/SVLkoNFke+SP5QDZNT8IFjG2LKzgBHyPYqmNbGtWbyX7BJr
17+
uH32cSr4yGprzkkJGB2G/1IRXQIvXyW1KWa5GcRdAbFoqYVBgZsF16KGhLNBEnsW
18+
Lha0truBh7D1/A4EWIavrtivkX0YNg9mPoAJBl/Ma9DGpJhceQfYAwWg5oiUzNnV
19+
QlC1VwP3ARUcSLA6K+fEnYGnRlcMp692aLSK3dtFDXuds38mWpfAn1BwIiL+gZFm
20+
mW5kQLRfGHw8WE6pnp8Lq91bNQfzfxJnnBa1QPZNQQ==
21+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)