You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

262 lines
7.6 KiB

#!/bin/sh /etc/rc.common
# Copyright 2019-2020 Stan Grishin (stangri@melmac.net)
# shellcheck disable=SC2039,SC3043,SC3060
PKG_VERSION='dev-test'
# shellcheck disable=SC2034
START=80
# shellcheck disable=SC2034
USE_PROCD=1
if type extra_command 1>/dev/null 2>&1; then
extra_command 'version' 'Show version information'
else
# shellcheck disable=SC2034
EXTRA_COMMANDS='version'
fi
readonly PROG=/usr/sbin/https-dns-proxy
readonly DEFAULT_BOOTSTRAP='1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001,8.8.8.8,8.8.4.4,2001:4860:4860::8888,2001:4860:4860::8844'
dnsmasqConfig=''; forceDNS=''; forceDNSPorts='';
str_contains() { [ -n "$2" ] && [ "${1//$2}" != "$1" ]; }
is_mac_address() { expr "$1" : '[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]$' >/dev/null; }
is_ipv4() { expr "$1" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev/null; }
is_ipv6() { ! is_mac_address "$1" && str_contains "$1" ":"; }
version() { echo "$PKG_VERSION"; }
xappend() { param="$param $1"; }
append_bool() {
local section="$1"
local option="$2"
local value="$3"
local default="${4:-0}"
local _loctmp
config_get_bool _loctmp "$section" "$option" "$default"
[ "$_loctmp" -ne 0 ] && xappend "$value"
}
append_parm() {
local section="$1"
local option="$2"
local switch="$3"
local default="$4"
local _loctmp
config_get _loctmp "$section" "$option" "$default"
[ -n "$_loctmp" ] && xappend "$switch $_loctmp"
}
append_counter() {
local section="$1"
local option="$2"
local switch="$3"
local default="${4:-0}"
local _loctmp i
config_get _loctmp "$section" "$option" "$default"
# shellcheck disable=SC2086,SC2154
for i in $(seq 1 $_loctmp); do
xappend '-v'
done
}
append_bootstrap() {
local section="$1"
local option="$2"
local switch="$3"
local default="$4"
local _old_ifs="$IFS"
local _loctmp _newtmp i
config_get _loctmp "$section" "$option" "$default"
[ -z "$_loctmp" ] && return 0
IFS=" ,"
for i in $_loctmp; do
if { [ "$ipv6_resolvers_only" -eq 0 ] && is_ipv4 "$i"; } || \
{ [ "$ipv6_resolvers_only" -ne 0 ] && is_ipv6 "$i"; }; then
[ -z "$_newtmp" ] && _newtmp="$i" || _newtmp="${_newtmp},${i}"
fi
done
IFS="$_old_ifs"
[ -n "$_newtmp" ] && xappend "$switch $_newtmp"
[ "$ipv6_resolvers_only" -eq 0 ] && xappend '-4'
}
start_instance() {
local cfg="$1" param listen_addr listen_port i ipv6_resolvers_only
config_get_bool ipv6_resolvers_only "$cfg" 'use_ipv6_resolvers_only' '0'
append_parm "$cfg" 'resolver_url' '-r'
append_parm "$cfg" 'polling_interval' '-i'
append_parm "$cfg" 'listen_addr' '-a' '127.0.0.1'
append_parm "$cfg" 'listen_port' '-p' "$p"
append_parm "$cfg" 'dscp_codepoint' '-c'
append_bootstrap "$cfg" 'bootstrap_dns' '-b' "$DEFAULT_BOOTSTRAP"
append_parm "$cfg" 'user' '-u' 'nobody'
append_parm "$cfg" 'group' '-g' 'nogroup'
append_parm "$cfg" 'proxy_server' '-t'
append_parm "$cfg" 'logfile' '-l'
append_bool "$cfg" 'use_http1' '-x'
append_counter "$cfg" 'verbosity' '-v' '0'
procd_open_instance
# shellcheck disable=SC2086
procd_set_param command $PROG $param
procd_set_param stderr 1
procd_set_param stdout 1
procd_set_param respawn
if [ "$forceDNS" -ne 0 ]; then
procd_open_data
json_add_array firewall
for c in $forceDNSPorts; do
if netstat -tuln | grep 'LISTEN' | grep ":${c}" >/dev/null 2>&1 || [ "$c" = "53" ]; then
json_add_object ""
json_add_string type redirect
json_add_string target DNAT
json_add_string src lan
json_add_string proto "tcp udp"
json_add_string src_dport "$c"
json_add_string dest_port "$c"
json_add_boolean reflection 0
json_close_object
else
json_add_object ""
json_add_string type rule
json_add_string src lan
json_add_string dest "*"
json_add_string proto "tcp udp"
json_add_string dest_port "$c"
json_add_string target REJECT
json_close_object
fi
done
json_close_array
procd_close_data
forceDNS='0'
fi
procd_close_instance
config_get listen_addr "$cfg" 'listen_addr' '127.0.0.1'
config_get listen_port "$cfg" 'listen_port' "$p"
if [ "$dnsmasqConfig" = "*" ]; then
config_load 'dhcp'
config_foreach dnsmasq_add_doh_server 'dnsmasq' "${listen_addr}" "${listen_port}"
elif [ -n "$dnsmasqConfig" ]; then
for i in $dnsmasqConfig; do
dnsmasq_add_doh_server "@dnsmasq[${i}]" "${listen_addr}" "${listen_port}"
done
fi
p="$((p+1))"
}
is_force_dns_active() { iptables-save | grep -q -w -- '--dport 53'; }
start_service() {
local p=5053 c
config_load 'https-dns-proxy'
config_get dnsmasqConfig 'config' 'update_dnsmasq_config' '*'
config_get_bool forceDNS 'config' 'force_dns' '1'
config_get forceDNSPorts 'config' 'force_dns_port' '53 853'
dhcp_backup 'create'
config_load 'https-dns-proxy'
config_foreach start_instance 'https-dns-proxy'
if [ -n "$(uci -q changes dhcp)" ]; then
uci -q commit dhcp
[ -x /etc/init.d/dnsmasq ] && /etc/init.d/dnsmasq restart >/dev/null 2>&1
fi
}
stop_service() {
config_load 'https-dns-proxy'
config_get dnsmasqConfig 'config' 'update_dnsmasq_config' '*'
dhcp_backup 'restore'
if [ -n "$(uci -q changes dhcp)" ]; then
uci -q commit dhcp
[ -x /etc/init.d/dnsmasq ] && /etc/init.d/dnsmasq restart >/dev/null 2>&1
fi
}
service_triggers() {
procd_add_config_trigger "config.change" "https-dns-proxy" /etc/init.d/https-dns-proxy reload
}
service_started() { procd_set_config_changed firewall; }
service_stopped() { procd_set_config_changed firewall; }
dnsmasq_add_doh_server() {
local cfg="$1" address="$2" port="$3"
case $address in
0.0.0.0|::ffff:0.0.0.0) address='127.0.0.1';;
::) address='::1';;
esac
uci -q del_list "dhcp.${cfg}.server=${address}#${port}"
uci -q add_list "dhcp.${cfg}.server=${address}#${port}"
}
dnsmasq_create_server_backup() {
local cfg="$1"
local i
uci -q get "dhcp.${cfg}" >/dev/null || return 1
if ! uci -q get "dhcp.${cfg}.doh_backup_noresolv" >/dev/null; then
if [ -z "$(uci -q get "dhcp.${cfg}.noresolv")" ]; then
uci -q set "dhcp.${cfg}.noresolv=1"
uci -q set "dhcp.${cfg}.doh_backup_noresolv=-1"
elif [ "$(uci -q get "dhcp.${cfg}.noresolv")" != "1" ]; then
uci -q set "dhcp.${cfg}.noresolv=1"
uci -q set "dhcp.${cfg}.doh_backup_noresolv=0"
fi
fi
if ! uci -q get "dhcp.${cfg}.doh_backup_server" >/dev/null; then
if [ -z "$(uci -q get "dhcp.${cfg}.server")" ]; then
uci -q add_list "dhcp.${cfg}.doh_backup_server="
fi
for i in $(uci -q get "dhcp.${cfg}.server"); do
uci -q add_list "dhcp.${cfg}.doh_backup_server=$i"
if [ "$i" = "$(echo "$i" | tr -d /\#)" ]; then
uci -q del_list "dhcp.${cfg}.server=$i"
fi
done
fi
return 0
}
dnsmasq_restore_server_backup() {
local cfg="$1"
local i
uci -q get "dhcp.${cfg}" >/dev/null || return 0
if uci -q get "dhcp.${cfg}.doh_backup_noresolv" >/dev/null; then
if [ "$(uci -q get "dhcp.${cfg}.doh_backup_noresolv")" = "0" ]; then
uci -q set "dhcp.${cfg}.noresolv=0"
else
uci -q del "dhcp.${cfg}.noresolv"
fi
uci -q del "dhcp.${cfg}.doh_backup_noresolv"
fi
if uci -q get "dhcp.${cfg}.doh_backup_server" >/dev/null; then
uci -q del "dhcp.${cfg}.server"
for i in $(uci -q get "dhcp.${cfg}.doh_backup_server"); do
uci -q add_list "dhcp.${cfg}.server=$i"
done
uci -q del "dhcp.${cfg}.doh_backup_server"
fi
}
dhcp_backup() {
local i
config_load 'dhcp'
case "$1" in
create)
if [ "$dnsmasqConfig" = "*" ]; then
config_foreach dnsmasq_create_server_backup 'dnsmasq'
elif [ -n "$dnsmasqConfig" ]; then
for i in $dnsmasqConfig; do
dnsmasq_create_server_backup "@dnsmasq[${i}]" || \
dnsmasq_create_server_backup "$i"
done
fi
;;
restore)
config_foreach dnsmasq_restore_server_backup 'dnsmasq'
;;
esac
}