host/transtation-panic (1391B)
1 #!/bin/sh
2 # transtation-panic -- get this machine back on direct egress, right now.
3 #
4 # Deliberately tiny and dependency-free: it must work when Docker is broken,
5 # when there is no network at all, and when you are reading it off a phone at
6 # 3am. It removes the killswitch, sweeps the ip rules sing-box leaves behind
7 # when it is SIGKILLed (those are not bound to the interface, so they outlive
8 # the tun device), and deletes the tun interface.
9 set -u
10
11 TUN_IFACE=${TUN_IFACE:-tt0}
12
13 nft delete table inet transtation 2>/dev/null
14 nft delete table ip6 transtation 2>/dev/null
15 # Delete exactly the rules that are there. The previous version probed every
16 # priority in the range up to 20 times per address family -- 440 `ip`
17 # invocations in the worst case -- because several rules can share a priority
18 # and one delete removes one rule. Listing first is both bounded by reality and
19 # correct for duplicates: a priority listed twice is deleted twice.
20 for f in -4 -6; do
21 ip $f rule list 2>/dev/null | sed -n 's/^\(90[0-9][0-9]\):.*/\1/p' | while read -r p; do
22 ip $f rule del priority "$p" 2>/dev/null
23 done
24 done
25 ip route flush table 2022 2>/dev/null
26 ip -6 route flush table 2022 2>/dev/null
27 ip link del "$TUN_IFACE" 2>/dev/null
28 docker rm -f transtation-client 2>/dev/null >/dev/null
29
30 echo "killswitch removed, policy routing flushed, $TUN_IFACE deleted."
31 echo "you are back on direct egress."