-
Notifications
You must be signed in to change notification settings - Fork 3.4k
/
https-dns-proxy
executable file
·421 lines (397 loc) · 13.2 KB
/
https-dns-proxy
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
#!/bin/sh /etc/rc.common
# Copyright 2019-2023 Stan Grishin (stangri@melmac.ca)
# shellcheck disable=SC1091,SC3043,SC3060
# shellcheck disable=SC2034
START=90
# shellcheck disable=SC2034
STOP=15
# shellcheck disable=SC2034
USE_PROCD=1
if type extra_command 1>/dev/null 2>&1; then
extra_command 'version' 'Show version information'
else
# shellcheck disable=SC2034
EXTRA_COMMANDS='version'
fi
readonly PKG_VERSION='dev-test'
readonly packageName='https-dns-proxy'
readonly serviceName="$packageName $PKG_VERSION"
readonly _OK_='\033[0;32m\xe2\x9c\x93\033[0m'
readonly _FAIL_='\033[0;31m\xe2\x9c\x97\033[0m'
readonly PROG=/usr/sbin/https-dns-proxy
readonly BOOTSTRAP_CF='1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001'
readonly BOOTSTRAP_GOOGLE='8.8.8.8,8.8.4.4,2001:4860:4860::8888,2001:4860:4860::8844'
readonly DEFAULT_BOOTSTRAP="${BOOTSTRAP_CF},${BOOTSTRAP_GOOGLE}"
readonly canaryDomainsMozilla='use-application-dns.net'
readonly canaryDomainsiCloud='mask.icloud.com mask-h2.icloud.com'
on_boot_trigger=
dnsmasq_restart() { [ -x /etc/init.d/dnsmasq ] || return 1; /etc/init.d/dnsmasq restart >/dev/null 2>&1; }
is_fw4_restart_needed() { [ "$(uci_get "$packageName" 'config' 'force_dns' '1')" = '1' ]; }
is_mac_address() { expr "$1" : '[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]$' >/dev/null; }
is_ipv4() { expr "$1" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev/null; }
is_ipv6() { ! is_mac_address "$1" && str_contains "$1" ":"; }
is_resolver_working() { resolveip -t 3 one.one.one.one >/dev/null 2>&1; }
output() {
local msg memmsg logmsg
local sharedMemoryOutput="/dev/shm/$packageName-output"
[ -t 1 ] && printf "%b" "$@"
msg="${1//$serviceName /service }";
if [ "$(printf "%b" "$msg" | wc -l)" -gt 0 ]; then
[ -s "$sharedMemoryOutput" ] && memmsg="$(cat "$sharedMemoryOutput")"
logmsg="$(printf "%b" "${memmsg}${msg}" | sed 's/\x1b\[[0-9;]*m//g')"
logger -t "$packageName" "$(printf "%b" "$logmsg")"
rm -f "$sharedMemoryOutput"
else
printf "%b" "$msg" >> "$sharedMemoryOutput"
fi
}
output_ok() { output "$_OK_"; }
output_okn() { output "${_OK_}\\n"; }
output_fail() { output "$_FAIL_"; }
output_failn() { output "${_FAIL_}\\n"; }
str_contains() { [ -n "$1" ] &&[ -n "$2" ] && [ "${1//$2}" != "$1" ]; }
uci_add_list_if_new() {
local PACKAGE="$1"
local CONFIG="$2"
local OPTION="$3"
local VALUE="$4"
local i
[ -n "$PACKAGE" ] && [ -n "$CONFIG" ] && [ -n "$OPTION" ] && [ -n "$VALUE" ] || return 1
for i in $(uci_get "$PACKAGE" "$CONFIG" "$OPTION"); do
[ "$i" = "$VALUE" ] && return 0
done
uci_add_list "$PACKAGE" "$CONFIG" "$OPTION" "$VALUE"
}
uci_changes() {
local PACKAGE="$1"
local CONFIG="$2"
local OPTION="$3"
/sbin/uci ${UCI_CONFIG_DIR:+-c $UCI_CONFIG_DIR} changes "$PACKAGE${CONFIG:+.$CONFIG}${OPTION:+.$OPTION}"
}
version() { echo "$PKG_VERSION"; }
xappend() { PROG_param="$PROG_param $1"; }
append_bool() {
local section="$1"
local option="$2"
local value="$3"
local default="${4:-0}"
local _loctmp
config_get_bool _loctmp "$section" "$option" "$default"
[ "$_loctmp" -ne 0 ] && xappend "$value"
}
append_parm() {
local section="$1"
local option="$2"
local switch="$3"
local default="$4"
local _loctmp
config_get _loctmp "$section" "$option" "$default"
[ -n "$_loctmp" ] && xappend "$switch $_loctmp"
}
append_counter() {
local section="$1"
local option="$2"
local switch="$3"
local default="${4:-0}"
local _loctmp i
config_get _loctmp "$section" "$option" "$default"
# shellcheck disable=SC2086,SC2154
for i in $(seq 1 $_loctmp); do
xappend '-v'
done
}
append_bootstrap() {
local section="$1"
local option="$2"
local switch="$3"
local default="$4"
local _old_ifs="$IFS"
local _loctmp _newtmp i
config_get _loctmp "$section" "$option" "$default"
[ -z "$_loctmp" ] && return 0
IFS=" ,"
for i in $_loctmp; do
if { [ "$ipv6_resolvers_only" -eq 0 ] && is_ipv4 "$i"; } || \
{ [ "$ipv6_resolvers_only" -ne 0 ] && is_ipv6 "$i"; }; then
[ -z "$_newtmp" ] && _newtmp="$i" || _newtmp="${_newtmp},${i}"
fi
done
IFS="$_old_ifs"
[ -n "$_newtmp" ] && xappend "$switch $_newtmp"
[ "$ipv6_resolvers_only" -eq 0 ] && xappend '-4'
}
boot() {
ubus -t 30 wait_for network.interface 2>/dev/null
on_boot_trigger=1
rc_procd start_service 'on_boot' && service_started 'on_boot'
is_resolver_working || { rc_procd stop_service 'on_boot' && service_stopped 'on_boot'; }
}
start_instance() {
local cfg="$1" param="$2"
local PROG_param
local listen_addr listen_port ipv6_resolvers_only p url iface
config_get url "$cfg" 'resolver_url'
config_get_bool ipv6_resolvers_only "$cfg" 'use_ipv6_resolvers_only' '0'
append_parm "$cfg" 'resolver_url' '-r'
append_parm "$cfg" 'listen_addr' '-a' '127.0.0.1'
append_parm "$cfg" 'listen_port' '-p' "$port"
append_parm "$cfg" 'dscp_codepoint' '-c'
append_bootstrap "$cfg" 'bootstrap_dns' '-b' "$DEFAULT_BOOTSTRAP"
append_parm "$cfg" 'user' '-u' 'nobody'
append_parm "$cfg" 'group' '-g' 'nogroup'
append_parm "$cfg" 'ca_certs_file' '-C'
append_parm "$cfg" 'polling_interval' '-i'
append_parm "$cfg" 'proxy_server' '-t'
append_parm "$cfg" 'logfile' '-l'
append_bool "$cfg" 'use_http1' '-x'
append_counter "$cfg" 'verbosity' '-v' '0'
procd_open_instance
# shellcheck disable=SC2086
procd_set_param command $PROG $PROG_param
procd_set_param stderr 1
procd_set_param stdout 1
procd_set_param respawn
procd_open_data
json_add_object mdns
procd_add_mdns_service "$packageName" 'udp' "$port" "DNS over HTTPS proxy"
json_close_object
if [ "$force_dns" -ne '0' ]; then
json_add_array firewall
for iface in $procd_fw_src_interfaces; do
for p in $force_dns_port; do
if netstat -tuln | grep 'LISTEN' | grep ":${p}" >/dev/null 2>&1 || [ "$p" = '53' ]; then
json_add_object ''
json_add_string type redirect
json_add_string target DNAT
json_add_string src "$iface"
json_add_string proto 'tcp udp'
json_add_string src_dport "$p"
json_add_string dest_port "$p"
json_add_string family any
json_add_boolean reflection 0
json_close_object
else
json_add_object ''
json_add_string type rule
json_add_string src "$iface"
json_add_string dest '*'
json_add_string proto 'tcp udp'
json_add_string dest_port "$p"
json_add_string target REJECT
json_close_object
fi
done
done
json_close_array
fi
procd_close_data
procd_close_instance
# shellcheck disable=SC2181
if [ "$?" -eq 0 ]; then
config_get listen_addr "$cfg" 'listen_addr' '127.0.0.1'
config_get listen_port "$cfg" 'listen_port' "$port"
if [ "$dnsmasq_config_update" = '*' ]; then
config_load 'dhcp'
config_foreach dnsmasq_doh_server 'dnsmasq' 'add' "${listen_addr}" "${listen_port}"
elif [ -n "$dnsmasq_config_update" ]; then
for i in $dnsmasq_config_update; do
if [ -n "$(uci_get 'dhcp' "@dnsmasq[$i]")" ]; then
dnsmasq_doh_server "@dnsmasq[$i]" 'add' "${listen_addr}" "${listen_port}"
elif [ -n "$(uci_get 'dhcp' "$i")" ]; then
dnsmasq_doh_server "${i}" 'add' "${listen_addr}" "${listen_port}"
fi
done
fi
output_ok
port="$((port+1))"
force_dns='0'
else
output_fail
fi
}
start_service() {
local param="$1"
local canaryDomains canary_domains_icloud canary_domains_mozilla
local dnsmasq_config_update force_dns force_dns_port
local procd_fw_src_interfaces
local port=5053
output "Starting $serviceName instances ${param:+$param }"
config_load "$packageName"
config_get_bool canary_domains_icloud 'config' 'canary_domains_icloud' '1'
config_get_bool canary_domains_mozilla 'config' 'canary_domains_mozilla' '1'
config_get_bool force_dns 'config' 'force_dns' '1'
config_get dnsmasq_config_update 'config' 'dnsmasq_config_update' '*'
config_get force_dns_port 'config' 'force_dns_port' '53 853'
config_get procd_fw_src_interfaces 'config' 'procd_fw_src_interfaces' 'lan'
if [ "$canary_domains_icloud" -ne 0 ]; then
canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsiCloud}"
fi
if [ "$canary_domains_mozilla" -ne 0 ]; then
canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsMozilla}"
fi
dhcp_backup 'create'
config_load "$packageName"
config_foreach start_instance "$packageName" "$param"
output "\\n"
if [ -n "$(uci_changes dhcp)" ]; then
output "Updating dnsmasq config "
if uci_commit 'dhcp'; then
output_okn
param='on_config_update'
else
output_failn
fi
fi
case "$param" in
on_boot|on_config_update|on_hotplug)
output "Restarting dnsmasq ${param:+$param }"
if dnsmasq_restart; then
output_okn
else
output_failn
fi
;;
esac
}
stop_service() {
local param="$1"
local canaryDomains canary_domains_icloud canary_domains_mozilla
local dnsmasq_config_update
local s=0
output "Stopping $serviceName ${param:+$param }"
config_load "$packageName"
config_get dnsmasq_config_update 'config' 'dnsmasq_config_update' '*'
config_get_bool canary_domains_icloud 'config' 'canary_domains_icloud' '1'
config_get_bool canary_domains_mozilla 'config' 'canary_domains_mozilla' '1'
if [ "$canary_domains_icloud" -ne 0 ]; then
canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsiCloud}"
fi
if [ "$canary_domains_mozilla" -ne 0 ]; then
canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsMozilla}"
fi
dhcp_backup 'restore'
if [ -n "$(uci_changes dhcp)" ]; then
uci_commit 'dhcp'
dnsmasq_restart || s=1
fi
# shellcheck disable=SC2015
[ "$s" = '0' ] && output_okn || output_failn
}
service_triggers() {
local wan wan6 i
local procd_trigger_wan6
if [ "$on_boot_trigger" = '1' ]; then
procd_add_raw_trigger "interface.*.up" 3000 "/etc/init.d/${packageName}" restart 'on_interface_up'
else
config_load "$packageName"
config_get_bool procd_trigger_wan6 'config' 'procd_trigger_wan6' '0'
. /lib/functions/network.sh
network_flush_cache
network_find_wan wan
wan="${wan:-wan}"
if [ "$procd_trigger_wan6" -ne 0 ]; then
network_find_wan6 wan6
wan6="${wan6:-wan6}"
fi
for i in $wan $wan6; do
procd_add_interface_trigger "interface.*" "$i" "/etc/init.d/${packageName}" restart 'on_interface_trigger'
done
fi
procd_add_config_trigger "config.change" "$packageName" "/etc/init.d/${packageName}" reload 'on_config_change'
}
service_started() { is_fw4_restart_needed && procd_set_config_changed firewall; }
service_stopped() { is_fw4_restart_needed && procd_set_config_changed firewall; }
restart() { procd_send_signal "$packageName"; rc_procd start_service "$*"; }
dnsmasq_doh_server() {
local cfg="$1" param="$2" address="${3:-127.0.0.1}" port="$4" i
case "$param" in
add)
if [ "$force_dns" -ne 0 ]; then
for i in $canaryDomains; do
uci_add_list_if_new 'dhcp' "$cfg" 'server' "/${i}/"
done
fi
case $address in
0.0.0.0|::ffff:0.0.0.0) address='127.0.0.1';;
::) address='::1';;
esac
uci_add_list_if_new 'dhcp' "$cfg" 'server' "${address}#${port}"
uci_add_list_if_new 'dhcp' "$cfg" 'doh_server' "${address}#${port}"
;;
remove)
for i in $(uci_get 'dhcp' "$cfg" 'doh_server'); do
uci_remove_list 'dhcp' "$cfg" 'server' "$i"
uci_remove_list 'dhcp' "$cfg" 'doh_server' "$i"
done
for i in $canaryDomains; do
uci_remove_list 'dhcp' "$cfg" 'server' "/${i}/"
uci_remove_list 'dhcp' "$cfg" 'doh_server' "/${i}/"
done
;;
esac
}
dnsmasq_create_server_backup() {
local cfg="$1" i
[ -n "$(uci_get 'dhcp' "$cfg")" ] || return 1
if [ -z "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')" ]; then
if [ -z "$(uci_get 'dhcp' "$cfg" 'noresolv')" ]; then
uci_set 'dhcp' "$cfg" 'doh_backup_noresolv' '-1'
else
uci_set 'dhcp' "$cfg" 'doh_backup_noresolv' "$(uci_get 'dhcp' "$cfg" noresolv)"
fi
uci_set 'dhcp' "$cfg" 'noresolv' 1
fi
if [ -z "$(uci_get 'dhcp' "$cfg" 'doh_backup_server')" ]; then
if [ -z "$(uci_get 'dhcp' "$cfg" 'server')" ]; then
uci_add_list 'dhcp' "$cfg" 'doh_backup_server' ""
fi
for i in $(uci_get 'dhcp' "$cfg" 'server'); do
uci_add_list 'dhcp' "$cfg" 'doh_backup_server' "$i"
if [ "$i" = "$(echo "$i" | tr -d /\#)" ]; then
uci_remove_list 'dhcp' "$cfg" 'server' "$i"
fi
done
fi
return 0
}
dnsmasq_restore_server_backup() {
local cfg="$1" i
[ -n "$(uci_get 'dhcp' "$cfg")" ] || return 0
if [ -n "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')" ]; then
if [ "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')" = "-1" ]; then
uci_remove 'dhcp' "$cfg" 'noresolv'
else
uci_set 'dhcp' "$cfg" 'noresolv' "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')"
fi
uci_remove 'dhcp' "$cfg" 'doh_backup_noresolv'
fi
if uci_get 'dhcp' "$cfg" 'doh_backup_server' >/dev/null 2>&1; then
dnsmasq_doh_server "$cfg" 'remove'
for i in $(uci_get 'dhcp' "$cfg" 'doh_backup_server'); do
uci_add_list_if_new 'dhcp' "$cfg" 'server' "$i"
done
uci_remove 'dhcp' "$cfg" 'doh_backup_server'
fi
}
dhcp_backup() {
local i
config_load 'dhcp'
case "$1" in
create)
if [ "$dnsmasq_config_update" = "*" ]; then
config_foreach dnsmasq_create_server_backup 'dnsmasq'
elif [ -n "$dnsmasq_config_update" ]; then
for i in $dnsmasq_config_update; do
if [ -n "$(uci_get 'dhcp' "@dnsmasq[$i]")" ]; then
dnsmasq_create_server_backup "@dnsmasq[$i]"
elif [ -n "$(uci_get 'dhcp' "$i")" ]; then
dnsmasq_create_server_backup "$i"
fi
done
fi
;;
restore)
config_foreach dnsmasq_restore_server_backup 'dnsmasq'
;;
esac
}