From c28a526fe48159e15b61519635c573ec19aeefc8 Mon Sep 17 00:00:00 2001 From: Stan Grishin Date: Wed, 10 Feb 2021 05:59:10 +0000 Subject: https-dns-proxy: support for force DNS/DNS hijacking Signed-off-by: Stan Grishin --- net/https-dns-proxy/files/https-dns-proxy.config | 13 ++++++----- net/https-dns-proxy/files/https-dns-proxy.init | 28 ++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 6 deletions(-) (limited to 'net/https-dns-proxy/files') diff --git a/net/https-dns-proxy/files/https-dns-proxy.config b/net/https-dns-proxy/files/https-dns-proxy.config index 3c5eecf4d..6b0930181 100644 --- a/net/https-dns-proxy/files/https-dns-proxy.config +++ b/net/https-dns-proxy/files/https-dns-proxy.config @@ -1,18 +1,19 @@ config main 'config' option update_dnsmasq_config '*' + option force_dns '1' config https-dns-proxy - option bootstrap_dns '8.8.8.8,8.8.4.4' - option resolver_url 'https://dns.google/dns-query' + option bootstrap_dns '1.1.1.1,1.0.0.1' + option resolver_url 'https://cloudflare-dns.com/dns-query' option listen_addr '127.0.0.1' - option listen_port '5053' + option listen_port '5054' option user 'nobody' option group 'nogroup' config https-dns-proxy - option bootstrap_dns '1.1.1.1,1.0.0.1' - option resolver_url 'https://cloudflare-dns.com/dns-query' + option bootstrap_dns '8.8.8.8,8.8.4.4' + option resolver_url 'https://dns.google/dns-query' option listen_addr '127.0.0.1' - option listen_port '5054' + option listen_port '5053' option user 'nobody' option group 'nogroup' diff --git a/net/https-dns-proxy/files/https-dns-proxy.init b/net/https-dns-proxy/files/https-dns-proxy.init index 98e4403cb..64bf7eccf 100755 --- a/net/https-dns-proxy/files/https-dns-proxy.init +++ b/net/https-dns-proxy/files/https-dns-proxy.init @@ -17,6 +17,7 @@ fi readonly PROG=/usr/sbin/https-dns-proxy dnsmasqConfig='' +forceDNS='1' version() { echo "$PKG_VERSION"; } @@ -91,13 +92,37 @@ start_instance() { p="$((p+1))" } +is_force_dns_active() { iptables-save | grep -q -w -- '--dport 53'; } + start_service() { local p=5053 config_load 'https-dns-proxy' config_get dnsmasqConfig 'config' 'update_dnsmasq_config' '*' + config_get_bool forceDNS 'config' 'force_dns' '1' dhcp_backup 'create' config_load 'https-dns-proxy' config_foreach start_instance 'https-dns-proxy' + if [ "$forceDNS" -ne 0 ]; then + procd_open_instance 'main' + procd_set_param command /bin/true + procd_set_param stdout 1 + procd_set_param stderr 1 + procd_open_data + json_add_array firewall + json_add_object '' + json_add_string type redirect + json_add_string name https_dns_proxy_dns_redirect + json_add_string target DNAT + json_add_string src lan + json_add_string proto tcpudp + json_add_string src_dport 53 + json_add_string dest_port 53 + json_add_string reflection 0 + json_close_object + json_close_array + procd_close_data + procd_close_instance + fi if [ -n "$(uci -q changes dhcp)" ]; then uci -q commit dhcp [ -x /etc/init.d/dnsmasq ] && /etc/init.d/dnsmasq restart >/dev/null 2>&1 @@ -118,6 +143,9 @@ service_triggers() { procd_add_config_trigger "config.change" "https-dns-proxy" /etc/init.d/https-dns-proxy reload } +service_started() { procd_set_config_changed firewall; } +service_stopped() { procd_set_config_changed firewall; } + dnsmasq_add_doh_server() { local cfg="$1" address="$2" port="$3" case $address in -- cgit