Makefile

@@ -1,20 +0,0 @@
-
-PREFIX=/usr
-
-install:
-	install -Dm 644 nnss-ssh@.service -t "$(PREFIX)/lib/systemd/system"
-	install -Dm 644 nnssA@.service    -t "$(PREFIX)/lib/systemd/system"
-	install -Dm 644 nnssB@.service    -t "$(PREFIX)/lib/systemd/system"
-	install -Dm 644 ssh_config        -t "$(PREFIX)/lib/nnss"
-	install -Dm 755 tunsocks.sh       -t "$(PREFIX)/lib/nnss"
-	install -Dm 644 README.md         -t "$(PREFIX)/share/doc/nnss"
-	install -Dm 644 LICENSE           -t "$(PREFIX)/share/doc/nnss"
-	install -Dm 644 tmpfiles.conf     "$(PREFIX)/lib/tmpfiles.d/nnss.conf"
-
-uninstall:
-	rm -rf "$(PREFIX)/lib/nnss" \
-		"$(PREFIX)/share/doc/nnss" \
-		"$(PREFIX)/lib/tmpfiles.d/nnss.conf" \
-		"$(PREFIX)/lib/systemd/system/nnssA@.service" \
-		"$(PREFIX)/lib/systemd/system/nnssB@.service" \
-		"$(PREFIX)/lib/systemd/system/nnss-ssh@.service"

README.md

@@ -1,31 +1,14 @@
 # Network Namespace setup using SSH SOCKS proxy
 
-Create network namespace where all¹ network requests go via socks proxy.
+Create network namespace where all¹ network requests go via ssh connection.
-
-## Dependency
-
-Depends on [tun2socks][4]. Install from [AUR][5] or compile from [source][6].
 
 ## Installing
 
 1. Install from [AUR][2].
-2. Manual installation:
+2. Download and install pre-built archlinux package: [link][3].
+3. For other linux, copy the files to appropriate path as done [here][4].
 
-This will install under `/usr`
+## Creating new namespace
-
-```sh
-sudo make install
-```
-
-Change install directory using `PREFIX`
-
-```sh
-sudo make PREFIX=/usr/local install
-```
-
-For uninstall, run `make uninstall` or `make PREFIX=<prefix> uninstall`
-
-## Type A: Use ssh to create socks proxy
 
 1. Create a simple ssh config at `/etc/nnss/<namespace_name>/config`. This will
    be included with [other settings][0].
@@ -54,7 +37,7 @@ Port 8822 # If the ssh server is not on default port 22
 ```
 
 
-### Testing namespace
+## Testing namespace
 
 ```bash
 ❯ sudo systemd-run \
@@ -83,57 +66,17 @@ xx.xx.xx.xx
        valid_lft forever preferred_lft forever
     inet6 fe80::fd64:c3f3:ce6:650c/64 scope link stable-privacy proto kernel_ll
        valid_lft forever preferred_lft forever
+
+❯
+Finished with result: success
+Main processes terminated with: code=exited, status=0/SUCCESS
+Service runtime: 1min 4.383s
+CPU time consumed: 201ms
+Memory peak: 5.7M (swap: 0B)
+IP traffic received: 3.2K sent: 1.3K
+IO bytes written: 304K
 ```
 
-## Type B: Use existing socks proxy
-
-1. Create an environment file at `/etc/nnss/env_<namespace_name>`. This file
-   should contain one environment variable `SOCKS_PROXY`. See example below
-2. [Edit][1] your application's service file to include below properties
-
-```systemd
-[Unit]
-Requires=nnssB@<namespace_name>.service
-After=nnssB@<namespace_name>.service
-[Service]
-NetworkNamespacePath=/run/netns/<namespace_name>ns
-```
-### Example
-
-Assuming tor daemon is running configured to listen on socks proxy on port 9050.
-
-```bash
-❯ sudo tee /etc/nnss/env_tor > /dev/null
-SOCKS_PROXY=socks5://127.0.0.1:9050
-```
-
-Create a shell inside tor namespace
-
-```bash
-❯ sudo systemd-run \
-    --property=NetworkNamespacePath=/run/netns/torns \
-    --property=User=$USER \
-    --property=Requires=nnssB@tor.service \
-    --property=After=nnssB@tor.service \
-    --shell
-```
-
-Quick check:
-```bash
-❯ curl --silent https://check.torproject.org | grep -E "Sorry|Congratulations"
-      Congratulations. This browser is configured to use Tor.
-```
-
-### Comparison with torsocks
-
-[torsocks][7] can be used to run a program to connect via tor. This works by
-replacing network function calls in libc using `LD_PRELOAD`.
-
-This does not work with programs not using libc functions for networking. E.g.
-go programs. Or when a sub-process is created wihtout passing down
-`LD_PRELOAD`. Network namespaces are more secure and works for any program.
-
-
 ## ¹DNS
 
 DNS by default still goes via host.
@@ -141,7 +84,5 @@ DNS by default still goes via host.
 [0]: ./ssh_config
 [1]: https://wiki.archlinux.org/title/Systemd#Editing_provided_units
 [2]: https://aur.archlinux.org/packages/nnss
-[4]: https://github.com/xjasonlyu/tun2socks
+[3]: https://gitea.balki.me/balki-aur/-/packages/arch/nnss/0.1.0-1
-[5]: https://aur.archlinux.org/packages/tun2socks-git
+[4]: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=nnss#n14
-[6]: https://github.com/xjasonlyu/tun2socks/wiki/Install-from-Source
-[7]: https://gitlab.torproject.org/tpo/core/torsocks

tunsocks.sh

@@ -2,45 +2,26 @@
 
 set -xeuo pipefail
 
-rtdir=${RUNTIME_DIRECTORY:-/tmp}
+pidfile=${RUNTIME_DIRECTORY:-/tmp}/tunsocks.pid
-pidfile="$rtdir/tunsocks.pid"
 
 nsname="$1"
 device="tun${nsname}"
 ns="${nsname}ns"
 
-if [ "$2" = use_env ]; then
+if [ "$2" = use_env ];then
 		proxy="$SOCKS_PROXY"
 		shift
 else
 		proxy="socks5:///run/nnss-${nsname}/sock"
 fi
 
-setup() {
+setup()
+{
 		ip tuntap add mode tun dev "$device"
 
-	chan="$rtdir/chan"
+		/usr/bin/tun2socks -device "$device" -proxy "$proxy" &
-	mkfifo "$chan"
+		echo "$!" > "$pidfile"
-
+		sleep 5
-	{
-		sleep 10
-		echo TIMEOUT >"$chan"
-	} &
-	timeout_pid=$!
-
-	done_cmd="sh -c 'echo DONE > \"$chan\"'"
-
-	tun2socks -device "$device" -proxy "$proxy" -tun-post-up "$done_cmd" &
-	echo "$!" >"$pidfile"
-
-	read -r status <"$chan"
-
-	if [ "$status" = DONE ]; then
-		kill "$timeout_pid"
-	else
-		echo "Failed: $status"
-		return 1
-	fi
 
 		ip netns add "$ns"
 		ip link set "$device" netns "$ns"
@@ -49,19 +30,13 @@ setup() {
 		ip -n "$ns" link set dev "$device" up
 		ip -n "$ns" route add default via 198.19.1.1 dev "$device" metric 100
 		ip -n "$ns" link set lo up
-
 		systemd-notify --ready
 		wait
 }
 
-cleanup() {
+cleanup()
-	# Cleanup as much as possible. Don't stop on first error
+{
-	set +e
+		ip tuntap del mode tun dev "$device" || true
-
-	# If the script failed after creating the device before moving it to namespace
-	ip tuntap del mode tun dev "$device"
-
-	# Regular cleanup when when shutdown normally
 		kill "$(cat "$pidfile")"
 		ip -n "$ns" tuntap del mode tun dev "$device"
 		ip netns del "$ns"