Support all resolvers

2014-04-21 21:59:39 -07:00
parent bdb6ba3cfe
commit 417f80be83
205 changed files with 1384 additions and 2255 deletions
@@ -9,8 +9,8 @@ try_resolution() {

 try_http_query() {
  exec alarmer 5 curl -L --max-redirs 5 -4 -m 5 \
-    http://guide.opendns.com/main 2>/dev/null | \
-  fgrep -ic OpenDNS > /dev/null 2>&1
+    http://www.apple.com 2>/dev/null | \
+  fgrep -c Apple > /dev/null 2>&1
 }

 try_everything() {
@@ -10,9 +10,8 @@ DNSCRYPT_PROXY_BASE_DIR="${DNSCRYPT_VAR_BASE_DIR}/dnscrypt-proxy"
 PROXY_PID_FILE="/var/run/dnscrypt-proxy.pid"
 STATES_DIR="${DNSCRYPT_VAR_BASE_DIR}/states"

+DNSCRYPT_RESOLVER_NAME_FILE="${CONTROL_DIR}/dnscrypt-resolver-name"
 DNSCRYPT_FILE="${CONTROL_DIR}/dnscrypt"
-FAMILYSHIELD_FILE="${CONTROL_DIR}/familyshield"
-INSECURE_OPENDNS_FILE="${CONTROL_DIR}/insecure-opendns"
 FALLBACK_FILE="${CONTROL_DIR}/fallback"
 HANDLERS_LOCK_FILE="/var/run/dnscrypt-handlers.lock"
 DNSCRYPT_PROXY_PLUGINS_BASE_FILE="${CONTROL_DIR}/plugin"
@@ -30,6 +29,8 @@ BLACKLIST_DOMAINS_TMP_FILE="${BLACKLIST_DOMAINS_FILE}.tmp"
 EXCEPTIONS_FILE="${CONTROL_DIR}/exceptions"
 EXCEPTIONS_TMP_FILE="${EXCEPTIONS_FILE}.tmp"

+DEFAULT_RESOLVER_NAME='opendns'
+
 INTERFACE_UNBOUND="127.0.0.53"
 INTERFACE_UNBOUND_MASK="24"
 INTERFACE_PROXY="127.0.0.54"
@@ -37,9 +38,6 @@ INTERFACE_PROXY_MASK="24"
 INTERFACE_PROBES="127.0.0.55"
 INTERFACE_PROBES_MASK="24"

-PROVIDER_NAME='2.dnscrypt-cert.opendns.com'
-PROVIDER_KEY='B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79'
-
 DOMAINS_EXCEPTIONS='
 freebox.fr fritz.box intranet lan localdomain nowtv.com private routerlogin.net l
 '
@@ -0,0 +1,8 @@
+#! /bin/sh
+
+. ./common.inc
+
+[ -r "$DNSCRYPT_RESOLVER_NAME_FILE" ] && \
+  sed 's/[^a-zA-Z0-9.-]/_/g' < "$DNSCRYPT_RESOLVER_NAME_FILE" && exit 0
+echo "$DEFAULT_RESOLVER_NAME"
+exit 0
@@ -1,9 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-if [ -e "$FAMILYSHIELD_FILE" ]; then
-  echo 'yes'
-else
-  echo 'no'
-fi
@@ -1,9 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-if [ -e "$INSECURE_OPENDNS_FILE" ]; then
-  echo 'yes'
-else
-  echo 'no'
-fi
@@ -10,24 +10,6 @@ name='None'
 level=0
 while read resolver; do
  case "$resolver" in
-    208.67.222.123|208.67.220.123)
-      if [ $level -le 70 ]; then
-        name='FamilyShield'
-        level=70
-      fi
-    ;;
-    208.67.*)
-      if [ $level -le 40 ]; then
-        name='OpenDNS'
-        level=40
-      fi
-    ;;
-    2620:0:*)
-      if [ $level -le 50 ]; then
-        name='OpenDNS IPv6'
-        level=50
-      fi
-    ;;
    127.0.0.5*)
      if [ $level -le 80 ]; then
        name='DNSCrypt'
@@ -48,7 +30,7 @@ while read resolver; do
    ;;
    *)
      if [ $level -le 10 ]; then
-        name='Insecure'
+        name='Default'
        level=10
      fi
    ;;
@@ -2,12 +2,12 @@

 . ./common.inc

-opendns='no'
+dnscrypt_proxy_used='no'
 upstream_resolvers=''
 while read resolver; do
  case "$resolver" in
    127.0.0.5*)
-      opendns='yes'
+      dnscrypt_proxy_used='yes'
    ;;
  esac
  if [ x"$upstream_resolvers" = 'x' ]; then
@@ -17,7 +17,7 @@ while read resolver; do
  fi
 done

-if [ "$opendns" = 'yes' \
+if [ "$dnscrypt_proxy_used" = 'yes' \
     -a -r "${STATES_DIR}/dnscrypt-proxy-description" ]; then
  cat "${STATES_DIR}/dnscrypt-proxy-description" && exit 0  
 fi
@@ -14,9 +14,6 @@ if [ -r "$STATIC_RESOLVERS_FILE" ]; then
  [ -z "$servers" ] && servers='empty'
 fi

-[ -e "$INSECURE_OPENDNS_FILE" ] && servers='208.67.220.220'
-[ -e "$FAMILYSHIELD_FILE" ] && servers='208.67.220.123'
-
 exec networksetup -listallnetworkservices 2>/dev/null | \
 fgrep -v '*' | while read x ; do
  networksetup -setdnsservers "$x" $servers
@@ -0,0 +1,14 @@
+#! /bin/sh
+
+. ./common.inc
+
+[ $# -lt 1 ] && exit 1
+
+resolver_name="$1"
+
+if [ "$resolver_name" = "" ]; then
+  rm -f "$DNSCRYPT_RESOLVER_NAME_FILE"
+else
+  echo "$resolver_name" | sed 's/^ *//;s/ *$//' \
+  > "$DNSCRYPT_RESOLVER_NAME_FILE"
+fi
@@ -22,6 +22,8 @@ mkdir -p -- "$DESCRIPTIONS_DIR" || exit 1
 PID_DIR="${PROBES_BASE_DIR}/pids" || exit 1
 mkdir -p -- "$PID_DIR" || exit 1

+RESOLVER_NAME=$(./get-dnscrypt-resolver-name.sh) || exit 1
+
 try_resolver() {
  local priority="$1"
  shift
@@ -32,14 +34,14 @@ try_resolver() {

  rm -f "${RES_DIR}/${priority}"
  exec alarmer 3 dnscrypt-proxy --pid="$pid_file" \
-    --provider-name="$PROVIDER_NAME" --provider-key="$PROVIDER_KEY" \
+    --resolver-name="$RESOLVER_NAME" \
    --local-address="${INTERFACE_PROBES}:${priority}" $args 2>&1 | \
  while read line; do
    case "$line" in
      *Proxying\ from\ *)
        answers=$(exec dig +time=1 +short +tries=2 -p $priority \
-          TXT @"$INTERFACE_PROBES" debug.opendns.com. 2> /dev/null | \
-          fgrep -ic 'dnscrypt enabled')
+          @"$INTERFACE_PROBES" www.apple.com. 2> /dev/null | \
+          egrep -ic '^[0-9.:]+$')
        [ -r "$pid_file" ] && kill $(cat -- "$pid_file")
        if [ $answers -gt 0 ]; then
          echo "$args" > "${RES_DIR}/${priority}"
@@ -73,49 +75,14 @@ if [ x"$DISABLE_IPV6" = "xno" ]; then
  [ $? = 0 ] && ipv6_supported="yes"
 fi

-familyshield_wanted="no"
-[ -r "$FAMILYSHIELD_FILE" ] && familyshield_wanted="yes"
-
 wait_pids=""
-if [ x"$familyshield_wanted" = "xyes" ]; then
-  try_resolver 4000 'FamilyShield using DNSCrypt on UDP port 443' \
-    "--resolver-address=208.67.220.123:443" &
-  wait_pids="$wait_pids $!"
-  try_resolver 4001 'FamilyShield using DNSCrypt on UDP port 53' \
-    "--resolver-address=208.67.220.123:53" &
-  wait_pids="$wait_pids $!"
-  try_resolver 4002 'FamilyShield using DNSCrypt on TCP port 443' \
-    "--resolver-address=208.67.220.123:443 --tcp-only" &
-  wait_pids="$wait_pids $!"
-  try_resolver 4003 'FamilyShield using DNSCrypt on TCP port 53' \
-    "--resolver-address=208.67.220.123:53 --tcp-only" &
-  wait_pids="$wait_pids $!"
-fi
-if [ x"$ipv6_supported" = "xyes" ]; then
-  try_resolver 5000 'OpenDNS IPv6 using DNSCrypt on UDP port 443' \
-    "--resolver-address=[2620:0:ccc::2]:443" &
-  wait_pids="$wait_pids $!"
-  try_resolver 5001 'OpenDNS IPv6 using DNSCrypt on UDP port 53' \
-    "--resolver-address=[2620:0:ccc::2]:53" &
-  wait_pids="$wait_pids $!"
-  try_resolver 5002 'OpenDNS IPv6 using DNSCrypt on TCP port 443' \
-    "--resolver-address=[2620:0:ccc::2]:443 --tcp-only" &
-  wait_pids="$wait_pids $!"
-  try_resolver 5003 'OpenDNS IPv6 using DNSCrypt on TCP port 53' \
-    "--resolver-address=[2620:0:ccc::2]:53 --tcp-only" &
-  wait_pids="$wait_pids $!"
-fi
-try_resolver 5004 'OpenDNS using DNSCrypt on UDP port 443' \
-  "--resolver-address=208.67.220.220:443" &
+
+try_resolver 5004 "${RESOLVER_NAME} using DNSCrypt on UDP" \
+  "--resolver-name=$RESOLVER_NAME" &
 wait_pids="$wait_pids $!"
-try_resolver 5005 'OpenDNS using DNSCrypt on UDP port 53' \
-  "--resolver-address=208.67.220.220:53" &
-wait_pids="$wait_pids $!"
-try_resolver 5006 'OpenDNS using DNSCrypt on TCP port 443' \
-  "--resolver-address=208.67.220.220:443 --tcp-only" &
-wait_pids="$wait_pids $!"
-try_resolver 5007 'OpenDNS using DNSCrypt on TCP port 53' \
-  "--resolver-address=208.67.220.220:53 --tcp-only" &
+
+try_resolver 5005 "${RESOLVER_NAME} using DNSCrypt on TCP" \
+  "--resolver-name=$RESOLVER_NAME --tcp-only" &
 wait_pids="$wait_pids $!"

 for pid in $wait_pids; do
@@ -136,7 +103,7 @@ fi
 best_args=$(cat "${RES_DIR}/${best_file}")

 eval dnscrypt-proxy $best_args --local-address="$INTERFACE_PROXY" \
-  --provider-name="$PROVIDER_NAME" --provider-key="$PROVIDER_KEY" \
+  --resolver-name="$RESOLVER_NAME" \
  --pidfile="$PROXY_PID_FILE" --user=daemon --daemonize $plugin_args

 if [ $? != 0 ]; then
@@ -148,7 +115,7 @@ if [ $? != 0 ]; then
  killall -9 dnscrypt-proxy
  sleep 1
  eval dnscrypt-proxy $best_args --local-address="$INTERFACE_PROXY" \
-    --provider-name="$PROVIDER_NAME" --provider-key="$PROVIDER_KEY" \  
+    --resolver-name="$RESOLVER_NAME" \
    --pidfile="$PROXY_PID_FILE" --user=daemon --daemonize $plugin_args || \
    exit 1
 fi
@@ -1,5 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-rm -f "$FAMILYSHIELD_FILE"
@@ -1,5 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-touch "$FAMILYSHIELD_FILE"
@@ -1,5 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-rm -f "$INSECURE_OPENDNS_FILE"
@@ -1,5 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-touch "$INSECURE_OPENDNS_FILE"
@@ -8,7 +8,8 @@ if [ ! -s "$BLACKLIST_DOMAINS_TMP_FILE" ]; then
 fi

 tr -s '[:blank:]' '\n' < "$BLACKLIST_DOMAINS_TMP_FILE" | \
-  egrep -vi 'opendns[.]com$' > "${BLACKLIST_DOMAINS_TMP_FILE}~" &&
+  egrep -vi '^(apple[.]com|resolver1[.]opendns[.]com)$' > \
+  "${BLACKLIST_DOMAINS_TMP_FILE}~" &&
 mv "${BLACKLIST_DOMAINS_TMP_FILE}~" "$BLACKLIST_DOMAINS_FILE"

 exec ./switch-blacklists-on.sh