diff --git a/README.md b/README.md
@@ -4,8 +4,8 @@ Your own VLESS + REALITY proxy, with optional Cloudflare WARP egress, in one
container on any Linux box that has Docker.
```
-curl -fsSLO https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.1/install.sh
-sha256sum install.sh # compare against the hash in the v1.0.1 release notes
+curl -fsSLO https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.2/install.sh
+sha256sum install.sh # compare against the hash in the v1.0.2 release notes
less install.sh # please actually read it
sudo sh install.sh
```
@@ -45,7 +45,7 @@ transtation exists because of a narrower set of preferences:
Two-step form above is the recommended one. If you are going to pipe it anyway:
```
-curl -fsSL https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.1/install.sh | sudo sh
+curl -fsSL https://raw.githubusercontent.com/sqzer-x/transtation/v1.0.2/install.sh | sudo sh
```
The installer needs root, refuses anything other than x86_64/aarch64, installs
@@ -59,7 +59,7 @@ If you already run Docker and prefer to do it yourself:
# /opt/transtation/docker-compose.yml
services:
proxy:
- image: ghcr.io/sqzer-x/transtation:v1.0.1
+ image: ghcr.io/sqzer-x/transtation:v1.0.2
container_name: transtation
restart: unless-stopped
ports: ["443:8443"]
@@ -128,7 +128,7 @@ install -Dm600 /dev/stdin /etc/transtation/uri # paste the vless:// link, then
docker run -d --name transtation-client --restart unless-stopped \
-p 127.0.0.1:1080:1080 \
-v /etc/transtation:/etc/transtation:ro \
- ghcr.io/sqzer-x/transtation-client:v1.0.1
+ ghcr.io/sqzer-x/transtation-client:v1.0.2
```
```
@@ -162,7 +162,7 @@ docker run -d --name transtation-client --restart unless-stopped \
-e MODE=tun \
-e DIRECT_SUFFIXES=example.com,example.net \
-v /etc/transtation:/etc/transtation:ro \
- ghcr.io/sqzer-x/transtation-client:v1.0.1
+ ghcr.io/sqzer-x/transtation-client:v1.0.2
```
Exactly three extra flags. `--privileged` is **not** needed and must not be
diff --git a/TROUBLESHOOTING.md b/TROUBLESHOOTING.md
@@ -139,7 +139,8 @@ If `transtation-panic` is not installed, the same thing by hand:
```
sudo nft delete table inet transtation
-for p in $(seq 9000 9010); do sudo ip rule del priority $p 2>/dev/null; done
+# several rules can share one priority, so delete until each one is empty
+for p in $(seq 9000 9010); do while sudo ip rule del priority $p 2>/dev/null; do :; done; done
sudo ip link del tt0
```
diff --git a/client/transtation-client b/client/transtation-client
@@ -285,7 +285,8 @@ panic_banner() {
┌─ IF YOUR NETWORK EVER DIES, RUN THIS ─────────────────────────────┐
│ sudo nft delete table inet transtation 2>/dev/null │
- │ for p in \$(seq 9000 9010); do sudo ip rule del priority \$p; done │
+ │ for p in \$(seq 9000 9010); do while sudo ip rule del priority \$p; │
+ │ do :; done; done │
│ sudo ip link del $TUN_IFACE │
└───────────────────────────────────────────────────────────────────┘
(or: sudo transtation-panic -- or the 'panic' verb of this image)
@@ -300,10 +301,15 @@ cmd_panic() {
nft delete table ip6 transtation 2>/dev/null || true
# sing-box's own ip rules live at priority 9000-9010 and are NOT bound to
# the interface, so they outlive a SIGKILLed container.
+ # Several rules can share one priority and `ip rule del priority N` removes
+ # exactly one, so one pass per priority leaves the rest behind. Verified on
+ # a live host, where two rules sat at 9003.
_p=9000
while [ "$_p" -le 9010 ]; do
- ip -4 rule del priority "$_p" 2>/dev/null || true
- ip -6 rule del priority "$_p" 2>/dev/null || true
+ _n=0
+ while [ "$_n" -lt 20 ] && ip -4 rule del priority "$_p" 2>/dev/null; do _n=$((_n + 1)); done
+ _n=0
+ while [ "$_n" -lt 20 ] && ip -6 rule del priority "$_p" 2>/dev/null; do _n=$((_n + 1)); done
_p=$((_p + 1))
done
ip route flush table 2022 2>/dev/null || true
diff --git a/host/transtation-panic b/host/transtation-panic
@@ -13,8 +13,14 @@ TUN_IFACE=${TUN_IFACE:-tt0}
nft delete table inet transtation 2>/dev/null
nft delete table ip6 transtation 2>/dev/null
for p in $(seq 9000 9010); do
- ip -4 rule del priority "$p" 2>/dev/null
- ip -6 rule del priority "$p" 2>/dev/null
+ # Several rules can share one priority and `ip rule del priority N` removes
+ # exactly one, so a single pass leaves the rest behind -- verified on a live
+ # host, where two rules sat at 9003. Bounded so a misbehaving iproute2
+ # cannot spin here.
+ n=0
+ while [ "$n" -lt 20 ] && ip -4 rule del priority "$p" 2>/dev/null; do n=$((n + 1)); done
+ n=0
+ while [ "$n" -lt 20 ] && ip -6 rule del priority "$p" 2>/dev/null; do n=$((n + 1)); done
done
ip route flush table 2022 2>/dev/null
ip -6 route flush table 2022 2>/dev/null
diff --git a/install.sh b/install.sh
@@ -15,12 +15,12 @@
# last line. If the download is truncated, nothing runs.
set -eu
-VERSION=${TT_VERSION:-v1.0.1}
+VERSION=${TT_VERSION:-v1.0.2}
IMAGE_SERVER=${TT_IMAGE_SERVER:-ghcr.io/sqzer-x/transtation}
IMAGE_CLIENT=${TT_IMAGE_CLIENT:-ghcr.io/sqzer-x/transtation-client}
# Filled in by the release workflow. A tag is mutable -- the same stolen-token
# compromise we already concede for Xray's .dgst would let someone retag
-# v1.0.1, and the hash-verified installer you read would vouch for nothing.
+# v1.0.2, and the hash-verified installer you read would vouch for nothing.
SERVER_DIGEST=${TT_SERVER_DIGEST:-}
CLIENT_DIGEST=${TT_CLIENT_DIGEST:-}
@@ -316,8 +316,8 @@ install_client() {
nft delete table inet transtation 2>/dev/null
nft delete table ip6 transtation 2>/dev/null
for p in $(seq 9000 9010); do
- ip -4 rule del priority "$p" 2>/dev/null
- ip -6 rule del priority "$p" 2>/dev/null
+ n=0; while [ "$n" -lt 20 ] && ip -4 rule del priority "$p" 2>/dev/null; do n=$((n+1)); done
+ n=0; while [ "$n" -lt 20 ] && ip -6 rule del priority "$p" 2>/dev/null; do n=$((n+1)); done
done
ip route flush table 2022 2>/dev/null
ip -6 route flush table 2022 2>/dev/null
|