net/https-dns-proxy/files/etc/init.d/https-dns-proxy

   1 #!/bin/sh /etc/rc.common
   2 # Copyright 2019-2023 Stan Grishin (stangri@melmac.ca)
   3 # shellcheck disable=SC1091,SC3043,SC3060
   4
   5 # shellcheck disable=SC2034
   6 START=90
   7 # shellcheck disable=SC2034
   8 STOP=15
   9 # shellcheck disable=SC2034
  10 USE_PROCD=1
  11
  12 if type extra_command 1>/dev/null 2>&1; then
  13         extra_command 'version' 'Show version information'
  14 else
  15 # shellcheck disable=SC2034
  16         EXTRA_COMMANDS='version'
  17 fi
  18
  19 readonly PKG_VERSION='dev-test'
  20 readonly packageName='https-dns-proxy'
  21 readonly serviceName="$packageName $PKG_VERSION"
  22 readonly _OK_='\033[0;32m\xe2\x9c\x93\033[0m'
  23 readonly _FAIL_='\033[0;31m\xe2\x9c\x97\033[0m'
  24 readonly PROG=/usr/sbin/https-dns-proxy
  25 readonly BOOTSTRAP_CF='1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001'
  26 readonly BOOTSTRAP_GOOGLE='8.8.8.8,8.8.4.4,2001:4860:4860::8888,2001:4860:4860::8844'
  27 readonly DEFAULT_BOOTSTRAP="${BOOTSTRAP_CF},${BOOTSTRAP_GOOGLE}"
  28 readonly canaryDomainsMozilla='use-application-dns.net'
  29 readonly canaryDomainsiCloud='mask.icloud.com mask-h2.icloud.com'
  30
  31 on_boot_trigger=
  32
  33 dnsmasq_restart() { [ -x /etc/init.d/dnsmasq ] || return 1; /etc/init.d/dnsmasq restart >/dev/null 2>&1; }
  34 is_fw4_restart_needed() { [ "$(uci_get "$packageName" 'config' 'force_dns' '1')" = '1' ]; }
  35 is_mac_address() { expr "$1" : '[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]:[0-9A-F][0-9A-F]$' >/dev/null; }
  36 is_ipv4() { expr "$1" : '[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$' >/dev/null; }
  37 is_ipv6() { ! is_mac_address "$1" && str_contains "$1" ":"; }
  38 is_resolver_working() { resolveip -t 3 one.one.one.one >/dev/null 2>&1; }
  39 output() {
  40         local msg memmsg logmsg
  41         local sharedMemoryOutput="/dev/shm/$packageName-output"
  42         [ -t 1 ] && printf "%b" "$@"
  43         msg="${1//$serviceName /service }";
  44         if [ "$(printf "%b" "$msg" | wc -l)" -gt 0 ]; then
  45                 [ -s "$sharedMemoryOutput" ] && memmsg="$(cat "$sharedMemoryOutput")"
  46                 logmsg="$(printf "%b" "${memmsg}${msg}" | sed 's/\x1b\[[0-9;]*m//g')"
  47                 logger -t "$packageName" "$(printf "%b" "$logmsg")"
  48                 rm -f "$sharedMemoryOutput"
  49         else
  50                 printf "%b" "$msg" >> "$sharedMemoryOutput"
  51         fi
  52 }
  53 output_ok() { output "$_OK_"; }
  54 output_okn() { output "${_OK_}\\n"; }
  55 output_fail() { output "$_FAIL_"; }
  56 output_failn() { output "${_FAIL_}\\n"; }
  57 str_contains() { [ -n "$1" ] &&[ -n "$2" ] && [ "${1//$2}" != "$1" ]; }
  58 uci_add_list_if_new() {
  59         local PACKAGE="$1"
  60         local CONFIG="$2"
  61         local OPTION="$3"
  62         local VALUE="$4"
  63         local i
  64         [ -n "$PACKAGE" ] && [ -n "$CONFIG" ] && [ -n "$OPTION" ] && [ -n "$VALUE" ] || return 1
  65         for i in $(uci_get "$PACKAGE" "$CONFIG" "$OPTION"); do
  66                 [ "$i" = "$VALUE" ] && return 0
  67         done
  68         uci_add_list "$PACKAGE" "$CONFIG" "$OPTION" "$VALUE"
  69 }
  70 uci_changes() {
  71         local PACKAGE="$1"
  72         local CONFIG="$2"
  73         local OPTION="$3"
  74         /sbin/uci ${UCI_CONFIG_DIR:+-c $UCI_CONFIG_DIR} changes "$PACKAGE${CONFIG:+.$CONFIG}${OPTION:+.$OPTION}"
  75 }
  76 version() { echo "$PKG_VERSION"; }
  77
  78 xappend() { PROG_param="$PROG_param $1"; }
  79
  80 append_bool() {
  81         local section="$1"
  82         local option="$2"
  83         local value="$3"
  84         local default="${4:-0}"
  85         local _loctmp
  86         config_get_bool _loctmp "$section" "$option" "$default"
  87         [ "$_loctmp" -ne 0 ] && xappend "$value"
  88 }
  89
  90 append_parm() {
  91         local section="$1"
  92         local option="$2"
  93         local switch="$3"
  94         local default="$4"
  95         local _loctmp
  96         config_get _loctmp "$section" "$option" "$default"
  97         [ -n "$_loctmp" ] && xappend "$switch $_loctmp"
  98 }
  99
 100 append_counter() {
 101         local section="$1"
 102         local option="$2"
 103         local switch="$3"
 104         local default="${4:-0}"
 105         local _loctmp i
 106         config_get _loctmp "$section" "$option" "$default"
 107 # shellcheck disable=SC2086,SC2154
 108         for i in $(seq 1 $_loctmp); do
 109                 xappend '-v'
 110         done
 111 }
 112
 113 append_bootstrap() {
 114         local section="$1"
 115         local option="$2"
 116         local switch="$3"
 117         local default="$4"
 118         local _old_ifs="$IFS"
 119         local _loctmp _newtmp i
 120         config_get _loctmp "$section" "$option" "$default"
 121         [ -z "$_loctmp" ] && return 0
 122         IFS=" ,"
 123         for i in $_loctmp; do
 124                 if { [ "$ipv6_resolvers_only" -eq 0 ] && is_ipv4 "$i"; } || \
 125                         { [ "$ipv6_resolvers_only" -ne 0 ] && is_ipv6 "$i"; }; then
 126                         [ -z "$_newtmp" ] && _newtmp="$i" || _newtmp="${_newtmp},${i}"
 127                 fi
 128         done
 129         IFS="$_old_ifs"
 130         [ -n "$_newtmp" ] && xappend "$switch $_newtmp"
 131         [ "$ipv6_resolvers_only" -eq 0 ] && xappend '-4'
 132 }
 133
 134 boot() {
 135         ubus -t 30 wait_for network.interface 2>/dev/null
 136         on_boot_trigger=1
 137         rc_procd start_service 'on_boot' && service_started 'on_boot'
 138         is_resolver_working || { rc_procd stop_service 'on_failed_health_check' && service_stopped 'on_failed_health_check'; }
 139 }
 140
 141 start_instance() {
 142         local cfg="$1" param="$2"
 143         local PROG_param
 144         local listen_addr listen_port ipv6_resolvers_only p url iface
 145
 146         config_get url "$cfg" 'resolver_url'
 147         config_get_bool ipv6_resolvers_only "$cfg" 'use_ipv6_resolvers_only' '0'
 148         append_parm "$cfg" 'resolver_url' '-r'
 149         append_parm "$cfg" 'listen_addr' '-a' '127.0.0.1'
 150         append_parm "$cfg" 'listen_port' '-p' "$port"
 151         append_parm "$cfg" 'dscp_codepoint' '-c'
 152         append_bootstrap "$cfg" 'bootstrap_dns' '-b' "$DEFAULT_BOOTSTRAP"
 153         append_parm "$cfg" 'user' '-u' 'nobody'
 154         append_parm "$cfg" 'group' '-g' 'nogroup'
 155         append_parm "$cfg" 'ca_certs_file' '-C'
 156         append_parm "$cfg" 'polling_interval' '-i'
 157         append_parm "$cfg" 'proxy_server' '-t'
 158         append_parm "$cfg" 'logfile' '-l'
 159         append_bool "$cfg" 'use_http1' '-x'
 160         append_counter "$cfg" 'verbosity' '-v' '0'
 161
 162         procd_open_instance
 163 # shellcheck disable=SC2086
 164         procd_set_param command $PROG $PROG_param
 165         procd_set_param stderr 1
 166         procd_set_param stdout 1
 167         procd_set_param respawn
 168         procd_open_data
 169         json_add_object mdns
 170                 procd_add_mdns_service "$packageName" 'udp' "$port" "DNS over HTTPS proxy"
 171         json_close_object
 172         if [ "$force_dns" -ne '0' ]; then
 173                 json_add_array firewall
 174                 for iface in $procd_fw_src_interfaces; do
 175                         for p in $force_dns_port; do
 176                                 if netstat -tuln | grep 'LISTEN' | grep ":${p}" >/dev/null 2>&1 || [ "$p" = '53' ]; then
 177                                         json_add_object ''
 178                                         json_add_string type redirect
 179                                         json_add_string target DNAT
 180                                         json_add_string src "$iface"
 181                                         json_add_string proto 'tcp udp'
 182                                         json_add_string src_dport "$p"
 183                                         json_add_string dest_port "$p"
 184                                         json_add_string family any
 185                                         json_add_boolean reflection 0
 186                                         json_close_object
 187                                 else
 188                                         json_add_object ''
 189                                         json_add_string type rule
 190                                         json_add_string src "$iface"
 191                                         json_add_string dest '*'
 192                                         json_add_string proto 'tcp udp'
 193                                         json_add_string dest_port "$p"
 194                                         json_add_string target REJECT
 195                                         json_close_object
 196                                 fi
 197                         done
 198                 done
 199                 json_close_array
 200         fi
 201         procd_close_data
 202         procd_close_instance
 203
 204 # shellcheck disable=SC2181
 205         if [ "$?" -eq 0 ]; then
 206                 config_get listen_addr "$cfg" 'listen_addr' '127.0.0.1'
 207                 config_get listen_port "$cfg" 'listen_port' "$port"
 208                 if [ "$dnsmasq_config_update" = '*' ]; then
 209                         config_load 'dhcp'
 210                         config_foreach dnsmasq_doh_server 'dnsmasq' 'add' "${listen_addr}" "${listen_port}"
 211                 elif [ -n "$dnsmasq_config_update" ]; then
 212                         for i in $dnsmasq_config_update; do
 213                                 if [ -n "$(uci_get 'dhcp' "@dnsmasq[$i]")" ]; then
 214                                         dnsmasq_doh_server "@dnsmasq[$i]" 'add' "${listen_addr}" "${listen_port}"
 215                                 elif [ -n "$(uci_get 'dhcp' "$i")" ]; then
 216                                         dnsmasq_doh_server "${i}" 'add' "${listen_addr}" "${listen_port}"
 217                                 fi
 218                         done
 219                 fi
 220                 output_ok
 221                 port="$((port+1))"
 222                 force_dns='0'
 223         else
 224                 output_fail
 225         fi
 226 }
 227
 228 start_service() {
 229         local param="$1"
 230         local canaryDomains canary_domains_icloud canary_domains_mozilla
 231         local dnsmasq_config_update force_dns force_dns_port
 232         local procd_fw_src_interfaces
 233
 234         local port=5053
 235         output "Starting $serviceName instances ${param:+$param }"
 236         config_load "$packageName"
 237         config_get_bool canary_domains_icloud  'config' 'canary_domains_icloud' '1'
 238         config_get_bool canary_domains_mozilla 'config' 'canary_domains_mozilla' '1'
 239         config_get_bool force_dns          'config' 'force_dns' '1'
 240         config_get dnsmasq_config_update   'config' 'dnsmasq_config_update' '*'
 241         config_get force_dns_port          'config' 'force_dns_port' '53 853'
 242         config_get procd_fw_src_interfaces 'config' 'procd_fw_src_interfaces' 'lan'
 243         if [ "$canary_domains_icloud" -ne 0 ]; then
 244                 canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsiCloud}"
 245         fi
 246         if [ "$canary_domains_mozilla" -ne 0 ]; then
 247                 canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsMozilla}"
 248         fi
 249         dhcp_backup 'create'
 250         config_load "$packageName"
 251         config_foreach start_instance "$packageName" "$param"
 252         output "\\n"
 253         if [ -n "$(uci_changes dhcp)" ]; then
 254                 output "Updating dnsmasq config "
 255                 if uci_commit 'dhcp'; then
 256                         output_okn
 257                         param='on_config_update'
 258                 else
 259                         output_failn
 260                 fi
 261         fi
 262         case "$param" in
 263                 on_boot|on_config_update|on_hotplug)
 264                         output "Restarting dnsmasq ${param:+$param }"
 265                         if dnsmasq_restart; then
 266                                 output_okn
 267                         else
 268                                 output_failn
 269                         fi
 270                 ;;
 271         esac
 272 }
 273
 274 stop_service() {
 275         local param="$1"
 276         local canaryDomains canary_domains_icloud canary_domains_mozilla
 277         local dnsmasq_config_update
 278         local s=0
 279         output "Stopping $serviceName ${param:+$param }"
 280         config_load "$packageName"
 281         config_get dnsmasq_config_update        'config' 'dnsmasq_config_update' '*'
 282         config_get_bool canary_domains_icloud   'config' 'canary_domains_icloud' '1'
 283         config_get_bool canary_domains_mozilla  'config' 'canary_domains_mozilla' '1'
 284         if [ "$canary_domains_icloud" -ne 0 ]; then
 285                 canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsiCloud}"
 286         fi
 287         if [ "$canary_domains_mozilla" -ne 0 ]; then
 288                 canaryDomains="${canaryDomains:+$canaryDomains }${canaryDomainsMozilla}"
 289         fi
 290         dhcp_backup 'restore'
 291         if [ -n "$(uci_changes dhcp)" ]; then
 292                 uci_commit 'dhcp'
 293                 dnsmasq_restart || s=1
 294         fi
 295 # shellcheck disable=SC2015
 296         [ "$s" = '0' ] && output_okn || output_failn
 297 }
 298
 299 service_triggers() {
 300         local wan wan6 i
 301         local procd_trigger_wan6
 302         if [ "$on_boot_trigger" = '1' ]; then
 303                 procd_add_raw_trigger "interface.*.up" 3000 "/etc/init.d/${packageName}" restart 'on_interface_up'
 304         else
 305                 config_load "$packageName"
 306                 config_get_bool procd_trigger_wan6 'config' 'procd_trigger_wan6' '0'
 307                 . /lib/functions/network.sh
 308                 network_flush_cache
 309                 network_find_wan wan
 310                 wan="${wan:-wan}"
 311                 if [ "$procd_trigger_wan6" -ne 0 ]; then
 312                         network_find_wan6 wan6
 313                         wan6="${wan6:-wan6}"
 314                 fi
 315                 for i in $wan $wan6; do
 316                         procd_add_interface_trigger "interface.*" "$i" "/etc/init.d/${packageName}" restart 'on_interface_trigger'
 317                 done
 318         fi
 319         procd_add_config_trigger "config.change" "$packageName" "/etc/init.d/${packageName}" reload 'on_config_change'
 320 }
 321
 322 service_started() { is_fw4_restart_needed && procd_set_config_changed firewall; }
 323 service_stopped() { is_fw4_restart_needed && procd_set_config_changed firewall; }
 324 restart() { procd_send_signal "$packageName"; rc_procd start_service "$*"; }
 325
 326 dnsmasq_doh_server() {
 327         local cfg="$1" param="$2" address="${3:-127.0.0.1}" port="$4" i
 328         case "$param" in
 329                 add)
 330                         if [ "$force_dns" -ne 0 ]; then
 331                                 for i in $canaryDomains; do
 332                                         uci_add_list_if_new 'dhcp' "$cfg" 'server' "/${i}/"
 333                                 done
 334                         fi
 335                         case $address in
 336                                 0.0.0.0|::ffff:0.0.0.0) address='127.0.0.1';;
 337                                 ::) address='::1';;
 338                         esac
 339                         uci_add_list_if_new 'dhcp' "$cfg" 'server' "${address}#${port}"
 340                         uci_add_list_if_new 'dhcp' "$cfg" 'doh_server' "${address}#${port}"
 341                 ;;
 342                 remove)
 343                         for i in $(uci_get 'dhcp' "$cfg" 'doh_server'); do
 344                                 uci_remove_list 'dhcp' "$cfg" 'server' "$i"
 345                                 uci_remove_list 'dhcp' "$cfg" 'doh_server' "$i"
 346                         done
 347                         for i in $canaryDomains; do
 348                                 uci_remove_list 'dhcp' "$cfg" 'server' "/${i}/"
 349                                 uci_remove_list 'dhcp' "$cfg" 'doh_server' "/${i}/"
 350                         done
 351                 ;;
 352         esac
 353 }
 354
 355 dnsmasq_create_server_backup() {
 356         local cfg="$1" i
 357         [ -n "$(uci_get 'dhcp' "$cfg")" ] || return 1
 358         if [ -z "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')" ]; then
 359                 if [ -z "$(uci_get 'dhcp' "$cfg" 'noresolv')" ]; then
 360                         uci_set 'dhcp' "$cfg" 'doh_backup_noresolv' '-1'
 361                 else
 362                         uci_set 'dhcp' "$cfg" 'doh_backup_noresolv' "$(uci_get 'dhcp' "$cfg" noresolv)"
 363                 fi
 364                 uci_set 'dhcp' "$cfg" 'noresolv' 1
 365         fi
 366         if [ -z "$(uci_get 'dhcp' "$cfg" 'doh_backup_server')" ]; then
 367                 if [ -z "$(uci_get 'dhcp' "$cfg" 'server')" ]; then
 368                         uci_add_list 'dhcp' "$cfg" 'doh_backup_server' ""
 369                 fi
 370                 for i in $(uci_get 'dhcp' "$cfg" 'server'); do
 371                         uci_add_list 'dhcp' "$cfg" 'doh_backup_server' "$i"
 372                         if [ "$i" = "$(echo "$i" | tr -d /\#)" ]; then
 373                                 uci_remove_list 'dhcp' "$cfg" 'server' "$i"
 374                         fi
 375                 done
 376         fi
 377         return 0
 378 }
 379
 380 dnsmasq_restore_server_backup() {
 381         local cfg="$1" i
 382         [ -n "$(uci_get 'dhcp' "$cfg")" ] || return 0
 383         if [ -n "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')" ]; then
 384                 if [ "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')" = "-1" ]; then
 385                         uci_remove 'dhcp' "$cfg" 'noresolv'
 386                 else
 387                         uci_set 'dhcp' "$cfg" 'noresolv' "$(uci_get 'dhcp' "$cfg" 'doh_backup_noresolv')"
 388                 fi
 389                 uci_remove 'dhcp' "$cfg" 'doh_backup_noresolv'
 390         fi
 391         if uci_get 'dhcp' "$cfg" 'doh_backup_server' >/dev/null 2>&1; then
 392                 dnsmasq_doh_server "$cfg" 'remove'
 393                 for i in $(uci_get 'dhcp' "$cfg" 'doh_backup_server'); do
 394                         uci_add_list_if_new 'dhcp' "$cfg" 'server' "$i"
 395                 done
 396                 uci_remove 'dhcp' "$cfg" 'doh_backup_server'
 397         fi
 398 }
 399
 400 dhcp_backup() {
 401         local i
 402         config_load 'dhcp'
 403         case "$1" in
 404                 create)
 405                         if [ "$dnsmasq_config_update" = "*" ]; then
 406                                 config_foreach dnsmasq_create_server_backup 'dnsmasq'
 407                         elif [ -n "$dnsmasq_config_update" ]; then
 408                                 for i in $dnsmasq_config_update; do
 409                                         if [ -n "$(uci_get 'dhcp' "@dnsmasq[$i]")" ]; then
 410                                                 dnsmasq_create_server_backup "@dnsmasq[$i]"
 411                                         elif [ -n "$(uci_get 'dhcp' "$i")" ]; then
 412                                                 dnsmasq_create_server_backup "$i"
 413                                         fi
 414                                 done
 415                         fi
 416                         ;;
 417                 restore)
 418                         config_foreach dnsmasq_restore_server_backup 'dnsmasq'
 419                         ;;
 420         esac
 421 }