Skip to content

Commit f11ac19

Browse files
uzenuzen
committed
Added rules for ipt v6; flag --no-lists
1 parent 6c7b763 commit f11ac19

File tree

5 files changed

+77
-56
lines changed

5 files changed

+77
-56
lines changed

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,16 @@
22
Custom startup script
33
--------
44
```
5-
. /system/etc/init.d/99dnscrypt.sh start &
5+
. /system/etc/init.d/99dnscrypt.sh start &
66
```
77
Custom shutdown script
88
--------
99
```
1010
. /system/etc/init.d/99dnscrypt.sh stop &
1111
```
1212

13-
-f | --force
13+
-f | --force reboot during startup if something went wrong
14+
-s | --no-lists disables the check for list of public DNS resolvers
1415
-r | --resolv_path path to new public DNS resolvers (public-resolvers.md.minisig)
1516

1617
To forced update the list of public DNS resolvers needed to remove the timestamp from the minisign secret key (*.md.minisig).

‎src/system/etc/dnscrypt-proxy/dnscrypt-proxy.toml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@ server_names = ['scaleway-fr', 'google', 'cloudflare']
3333
## List of local addresses and ports to listen to. Can be IPv4 and/or IPv6.
3434
## Note: When using systemd socket activation, choose an empty set (i.e. [] ).
3535

36-
#listen_addresses = ['127.0.0.1:5353', '[::1]:5353']
37-
listen_addresses = ['127.0.0.1:5353']
36+
listen_addresses = ['127.0.0.1:5353', '[::1]:5353']
3837

3938

4039
## Maximum number of simultaneous client connections to accept

‎src/system/etc/dnscrypt-proxy/init-functions

Lines changed: 1 addition & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -120,47 +120,4 @@ wait_for_daemon () {
120120

121121
sleep 1
122122
done
123-
}
124-
125-
## Iptables rules ##
126-
127-
IPTABLES=/system/bin/iptables
128-
WIFI_INT="wlan0"
129-
PROXY_PORT=5353
130-
131-
iptrules_on () {
132-
iptrules_off
133-
$IPTABLES -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination 127.0.0.1:$PROXY_PORT
134-
$IPTABLES -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination 127.0.0.1:$PROXY_PORT
135-
}
136-
137-
iptrules_off () {
138-
while $IPTABLES -n -t nat -L OUTPUT | grep -q "DNAT.*tcp.*dpt:53.*to:127.0.0.1:$PROXY_PORT" ; do
139-
$IPTABLES -t nat -D OUTPUT -p tcp --dport 53 -j DNAT --to-destination 127.0.0.1:$PROXY_PORT
140-
done
141-
while $IPTABLES -n -t nat -L OUTPUT | grep -q "DNAT.*udp.*dpt:53.*to:127.0.0.1:$PROXY_PORT" ; do
142-
$IPTABLES -t nat -D OUTPUT -p udp --dport 53 -j DNAT --to-destination 127.0.0.1:$PROXY_PORT
143-
done
144-
}
145-
146-
ipv4_addr_lock () {
147-
$IPTABLES -P INPUT DROP
148-
$IPTABLES -P OUTPUT DROP
149-
$IPTABLES -P FORWARD DROP
150-
echo "1" > /proc/sys/net/ipv4/conf/all/disable_policy
151-
echo "1" > /proc/sys/net/ipv4/conf/default/disable_policy
152-
if [ -d /proc/sys/net/ipv4/conf/$WIFI_INT ]; then
153-
echo "1" > /proc/sys/net/ipv4/conf/$WIFI_INT/disable_policy
154-
fi
155-
}
156-
157-
ipv4_addr_unlock () {
158-
$IPTABLES -P INPUT ACCEPT
159-
$IPTABLES -P OUTPUT ACCEPT
160-
$IPTABLES -P FORWARD ACCEPT
161-
echo "0" > /proc/sys/net/ipv4/conf/all/disable_policy
162-
echo "0" > /proc/sys/net/ipv4/conf/default/disable_policy
163-
if [ -d /proc/sys/net/ipv4/conf/$WIFI_INT ]; then
164-
echo "0" > /proc/sys/net/ipv4/conf/$WIFI_INT/disable_policy
165-
fi
166-
}
123+
}

‎src/system/etc/dnscrypt-proxy/iptables-rules

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
## Iptables rules ##
2+
3+
IPTABLES=/system/bin/iptables
4+
IP6TABLES=/system/bin/ip6tables
5+
WIFI_INT="wlan0"
6+
PROXY_PORT=5353
7+
8+
allowed_ipv6 () {
9+
[ ! -f /proc/net/ip6_tables_names ] && return 1
10+
}
11+
12+
iptrules_on () {
13+
iptrules_off
14+
$IPTABLES -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination 127.0.0.1:$PROXY_PORT
15+
$IPTABLES -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination 127.0.0.1:$PROXY_PORT
16+
if allowed_ipv6; then
17+
$IP6TABLES -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination [::1]:$PROXY_PORT
18+
$IP6TABLES -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination [::1]:$PROXY_PORT
19+
fi
20+
}
21+
22+
iptrules_off () {
23+
iptrules_off_helper $IPTABLES "tcp" "127.0.0.1"
24+
iptrules_off_helper $IPTABLES "udp" "127.0.0.1"
25+
if allowed_ipv6; then
26+
iptrules_off_helper $IP6TABLES "tcp" "[::1]"
27+
iptrules_off_helper $IP6TABLES "udp" "[::1]"
28+
fi
29+
}
30+
31+
iptrules_off_helper () {
32+
IPT=$1
33+
IPP=$2
34+
IPA=$3
35+
36+
while $IPT -n -t nat -L OUTPUT | grep -q "DNAT.*$IPP.*dpt:53.*to:$IPA:$PROXY_PORT" ; do
37+
$IPT -t nat -D OUTPUT -p $IPP --dport 53 -j DNAT --to-destination $IPA:$PROXY_PORT
38+
done
39+
}
40+
41+
ipv4_addr_lock () {
42+
$IPTABLES -P INPUT DROP
43+
$IPTABLES -P OUTPUT DROP
44+
$IPTABLES -P FORWARD DROP
45+
echo "1" > /proc/sys/net/ipv4/conf/all/disable_policy
46+
echo "1" > /proc/sys/net/ipv4/conf/default/disable_policy
47+
if [ -d /proc/sys/net/ipv4/conf/$WIFI_INT ]; then
48+
echo "1" > /proc/sys/net/ipv4/conf/$WIFI_INT/disable_policy
49+
fi
50+
}
51+
52+
ipv4_addr_unlock () {
53+
$IPTABLES -P INPUT ACCEPT
54+
$IPTABLES -P OUTPUT ACCEPT
55+
$IPTABLES -P FORWARD ACCEPT
56+
echo "0" > /proc/sys/net/ipv4/conf/all/disable_policy
57+
echo "0" > /proc/sys/net/ipv4/conf/default/disable_policy
58+
if [ -d /proc/sys/net/ipv4/conf/$WIFI_INT ]; then
59+
echo "0" > /proc/sys/net/ipv4/conf/$WIFI_INT/disable_policy
60+
fi
61+
}

‎src/system/etc/init.d/99dnscrypt.sh

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,23 @@ LOCKFILE=$PIDDIR/dnscrypt-proxy.lock
1212
CONFIG_FILE=/etc/dnscrypt-proxy/dnscrypt-proxy.toml
1313
DESC="dns client proxy"
1414

15-
16-
. /system/etc/dnscrypt-proxy/init-functions
15+
. /etc/dnscrypt-proxy/iptables-rules
16+
. /etc/dnscrypt-proxy/init-functions
1717

1818
# Exit if the package is not installed
1919
test -x $DAEMON || exit 0
2020

2121
log_debug_msg () {
2222
if [ -n "${1:-}" ]; then
2323
echo "[D] $NAME: $@" || true
24-
log -p d -t $NAME "$@" || true
24+
log -p d -t $NAME "$@"
2525
fi
2626
}
2727

2828
log_error_msg () {
2929
if [ -n "${1:-}" ]; then
3030
echo "[E] $NAME: $@" || true
31-
log -p e -t $NAME "$@" || true
31+
log -p e -t $NAME "$@"
3232
fi
3333
}
3434

@@ -86,7 +86,9 @@ do_start () {
8686

8787
case "$status" in
8888
0)
89-
if ! wait_for_daemon _wfd_call; then
89+
if [[ "$DNSCRYPT_NOLIST" = 1 ]]; then
90+
sleep $WAITFORDAEMON
91+
elif ! wait_for_daemon _wfd_call; then
9092
log_error_msg "the resolvers file couldn't be uploaded?"
9193
set_prop "dnscrypt-resolvers" ""
9294
return 10
@@ -105,7 +107,6 @@ do_start () {
105107

106108
do_stop () {
107109
if ! killproc "$DAEMON" "$PIDFILE"; then
108-
log_debug_msg "$DAEMON died: process not running or permission denied"
109110
killall $NAME >/dev/null 2>&1
110111
fi
111112

@@ -134,6 +135,8 @@ case "$1" in
134135
continue
135136
elif [[ $arg == -f || $arg == --force ]]; then
136137
DNSCRYPT_FORCE=1
138+
elif [[ $arg == -s || $arg == --no-lists ]]; then
139+
DNSCRYPT_NOLIST=1
137140
elif [[ $arg == -r || $arg == --resolv_path ]]; then
138141
:
139142
elif [[ $prev == -r || $prev == --resolv_path ]]; then
@@ -144,9 +147,9 @@ case "$1" in
144147
prev=$arg
145148
done
146149

147-
status="0"
148-
do_start || status="$?"
150+
do_start
149151

152+
status="$?"
150153
if [[ "$status" -ne 0 || "$DNSCRYPT_FORCE" = 1 ]]; then
151154
log_debug_msg "restore $DESC (#$status)"
152155
do_restart

0 commit comments

Comments
 (0)