Goodbye fallback!

2017-02-08 02:38:46 +01:00
parent 217bdfba9a
commit f6aa7c2f8d
19 changed files with 64 additions and 209 deletions
@@ -1,35 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-try_resolution() {
-  exec alarmer 5 dig +tries=2 +time=3 +short google-public-dns-a.google.com \
-    | egrep '^8[.]8[.]8[.]8' > /dev/null 2>&1
-}
-
-try_http_query() {
-  exec alarmer 5 curl -L --max-redirs 5 -4 -m 5 --connect-timeout 5 -s \
-    http://www.apple.com 2>/dev/null | \
-  fgrep -c Apple > /dev/null 2>&1
-}
-
-try_everything() {
-  try_resolution &
-  resolution_pid=$!
-  try_http_query &
-  http_query_pid=$!
-  wait $resolution_pid
-  resolution_ret=$?
-  if [ $resolution_ret != 0 ]; then
-    return 1
-  fi
-  wait $http_query_pid
-  http_query_ret=$?
-  [ $resolution_ret = 0 -a $http_query_ret = 0 ]
-}
-
-try_everything_with_retries() {
-  try_everything || try_everything
-}
-
-try_everything_with_retries
@@ -1,10 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-try_local_resolution() {
-  exec dig +tries=2 +time=3 +short google-public-dns-a.google.com @$INTERFACE_PROXY \
-    | egrep '^8[.]8[.]8[.]8' > /dev/null 2>&1
-}
-
-try_local_resolution
@@ -16,7 +16,6 @@ STATES_DIR="${DNSCRYPT_VAR_BASE_DIR}/states"

 DNSCRYPT_RESOLVER_NAME_FILE="${CONTROL_DIR}/dnscrypt-resolver-name"
 DNSCRYPT_FILE="${CONTROL_DIR}/dnscrypt"
-FALLBACK_FILE="${CONTROL_DIR}/fallback"
 HANDLERS_LOCK_FILE="${DNSCRYPT_VAR_RUN_BASE_DIR}/dnscrypt-handlers.lock"
 DNSCRYPT_PROXY_PLUGINS_BASE_FILE="${CONTROL_DIR}/plugin"
 STATIC_RESOLVERS_FILE="${CONTROL_DIR}/static-resolvers"
@@ -24,6 +23,7 @@ STATIC_RESOLVERS_FILE="${CONTROL_DIR}/static-resolvers"
 DEBUG_ENABLED_FILE="${CONTROL_DIR}/debug.enabled"

 PLUGINS_ENABLED_FILE="${CONTROL_DIR}/plugins.enabled"
+CACHE_FILE="${CONTROL_DIR}/plugin-cache.enabled"
 QUERY_LOGGING_FILE="${CONTROL_DIR}/plugin-query-logging.enabled"
 BLOCKING_FILE="${CONTROL_DIR}/plugin-blocking.enabled"
 AAAA_BLOCKING_FILE="${CONTROL_DIR}/plugin-aaaa-blocking.enabled"
@@ -49,12 +49,8 @@ RESOLVERS_LIST_BASE_DIR="${DNSCRYPT_USR_BASE_DIR}/share/dnscrypt-proxy"
 RESOLVERS_LIST_PUBLIC_KEY="RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"
 RESOLVERS_LIST_STATE="${STATES_DIR}/resolvers-updated"

-INTERFACE_UNBOUND="127.0.0.53"
-INTERFACE_UNBOUND_MASK="24"
 INTERFACE_PROXY="127.0.0.54"
 INTERFACE_PROXY_MASK="24"
-INTERFACE_PROBES="127.0.0.55"
-INTERFACE_PROBES_MASK="24"

 DOMAINS_EXCEPTIONS='
 belkin corp domain example home host invalid lan local localdomain test freebox.fr fritz.box nowtv.com routerlogin.net l onion
@@ -63,9 +59,7 @@ belkin corp domain example home host invalid lan local localdomain test freebox.
 export PATH="${DNSCRYPT_USR_BASE_DIR}/sbin:${DNSCRYPT_USR_BASE_DIR}/bin:${DNSCRYPT_USR_BASE_DIR}/scripts:$PATH"

 init_interfaces() {
-  /sbin/ifconfig lo0 alias ${INTERFACE_UNBOUND}/${INTERFACE_UNBOUND_MASK}
  /sbin/ifconfig lo0 alias ${INTERFACE_PROXY}/${INTERFACE_PROXY_MASK}
-  /sbin/ifconfig lo0 alias ${INTERFACE_PROBES}/${INTERFACE_PROBES_MASK}
 }

 logger_debug() {
@@ -3,7 +3,7 @@
 . ./common.inc

 ifs=$(ifconfig -a | \
-  awk '/^[^ 	:]*:/ { sub(/:.*$/,empty); iface=$0 } /status: active/ { print iface }')
+  awk '/^[^     :]*:/ { sub(/:.*$/,empty); iface=$0 } /status: active/ { print iface }')
 ifs=$(echo $ifs)

 typeset -A found
@@ -1,9 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-if [ -e "$FALLBACK_FILE" ]; then
-  echo 'yes'
-else
-  echo 'no'
-fi
@@ -19,7 +19,7 @@ done

 if [ "$dnscrypt_proxy_used" = 'yes' \
     -a -r "${STATES_DIR}/dnscrypt-proxy-description" ]; then
-  cat "${STATES_DIR}/dnscrypt-proxy-description" && exit 0  
+  cat "${STATES_DIR}/dnscrypt-proxy-description" && exit 0
 fi
 echo "$upstream_resolvers"
 exit 0
@@ -28,3 +28,5 @@ fi

 [ x"$current_uid" != x"$wanted_uid" ] && \
  chown -R "${wanted_uid}:0" "$CONTROL_DIR"
+
+exec sleep 1
@@ -6,13 +6,11 @@ tickets_count=$(./get-tickets-count.sh)
 [ "$tickets_count" != '0' ] && exit 0

 if [ x"$1" != 'x--boot' ]; then
-  [ ! -e "$FALLBACK_FILE" ] && exit 0
  ./check-network-change.sh || exit 0
 fi

 logger_debug "Network configuration changed"

-
 lockfile -1 -r 30 "$HANDLERS_LOCK_FILE" || exit 1
 ./set-dns-to-dhcp.sh
 if [ ! -e "$DNSCRYPT_FILE" ]; then
@@ -2,6 +2,8 @@

 . ./common.inc

+CERTIFICATE_MIN_VALIDITY=60
+
 DNSCRYPT_LIB_BASE_DIR="${DNSCRYPT_USR_BASE_DIR}/lib"
 export DYLD_LIBRARY_PATH="${DNSCRYPT_LIB_BASE_DIR}:${DYLD_LIBRARY_PATH}"

@@ -34,32 +36,15 @@ try_resolver() {

  logger_debug "Running a test dnscrypt proxy for [$description]"
  rm -f "${RES_DIR}/${priority}"
-  exec alarmer 3 dnscrypt-proxy --pid="$pid_file" \
+  alarmer 3 dnscrypt-proxy --pid="$pid_file" \
    --resolver-name="$RESOLVER_NAME" \
-    --local-address="${INTERFACE_PROBES}:${priority}" $args 2>&1 | \
-  while read line; do
-    case "$line" in
-      *Proxying\ from\ *)
-        logger_debug "Proxy for [$description] is up"
-
-# This doesn't send anything to Apple, and any reliable domain name can be used --
-# The following line sends a common query to the chosen DNSCrypt resolver to
-# check that it responds and can be used instead of leaving the mac without
-# a working DNS configuration.
-        answers=$(exec dig +time=1 +short +tries=2 -p $priority \
-          @"$INTERFACE_PROBES" www.apple.com. 2> /dev/null | \
-          egrep -ic '^[0-9.:]+$')
-
-        [ -r "$pid_file" ] && kill $(cat -- "$pid_file")
-        if [ $answers -gt 0 ]; then
-          logger_debug "Proxy for [$description] can be used"
-          echo "$args" > "${RES_DIR}/${priority}"
-          echo "$description" > "${DESCRIPTIONS_DIR}/${priority}"
-        fi
-        ;;
-      *) ;;
-    esac
-  done
+    --test="$CERTIFICATE_MIN_VALIDITY" $args
+  if [ $? = 0 ]; then
+    logger_debug "Certificate for [$description] received"
+    echo "$args" > "${RES_DIR}/${priority}"
+    echo "$description" > "${DESCRIPTIONS_DIR}/${priority}"
+  fi
+  rm -f "$pid_file"
 }

 get_plugin_args() {
@@ -82,11 +67,11 @@ logger_debug "dnscrypt-proxy should be (re)started, stopping previous instance i

 wait_pids=""

-try_resolver 5004 "${RESOLVER_NAME} using DNSCrypt over UDP" \
+try_resolver 1 "${RESOLVER_NAME} using DNSCrypt over UDP" \
  "--resolver-name=$RESOLVER_NAME" &
 wait_pids="$wait_pids $!"

-try_resolver 5005 "${RESOLVER_NAME} using DNSCrypt over TCP" \
+try_resolver 2 "${RESOLVER_NAME} using DNSCrypt over TCP" \
  "--resolver-name=$RESOLVER_NAME --tcp-only" &
 wait_pids="$wait_pids $!"

@@ -105,6 +90,8 @@ if [ x"$best_file" = "x" ]; then
  exit 1
 fi

+./switch-cache-on.sh
+
 plugins_args=''
 if [ -r "${DNSCRYPT_PROXY_PLUGINS_BASE_FILE}s.enabled" ]; then
  plugin_args=$(get_plugin_args)
@@ -133,23 +120,6 @@ if [ $? != 0 ]; then
  logger_debug "dnscrypt-proxy $best_args worked after a retry"
 fi

-sleep 1
-logger_debug "Checking if the current configuration hijacks all DNS queries"
-i=0
-while [ $i -lt 30 ]; do
-  ./check-local-dns.sh && break
-  sleep 0.1
-  i=$((i + 1))
-done
-
-if [ $i -ge 30 ]; then
-  logger_debug "Current configuration hijacks all DNS queries, disabling DNSCrypt"
-  ./switch-to-dhcp.sh
-  exit 1
-fi
-
-logger_debug "Current configuration doesn't seem to hijack all DNS queries"
-
 mv "${DESCRIPTIONS_DIR}/${best_file}" \
   "${STATES_DIR}/dnscrypt-proxy-description" 2>/dev/null || exit 0

@@ -14,4 +14,4 @@ plugin_args=''

 echo "libdcplugin_example_ldns_blocking.la${plugin_args}" > \
  "$BLOCKING_FILE"
-touch "$PLUGINS_ENABLED_FILE"  
+touch "$PLUGINS_ENABLED_FILE"
@@ -2,4 +2,5 @@

 . ./common.inc

-touch "$FALLBACK_FILE"
+rm -f "$CACHE_FILE"
+
@@ -0,0 +1,8 @@
+#! /bin/sh
+
+. ./common.inc
+
+echo "libdcplugin_example_cache.la" > \
+  "$CACHE_FILE"
+
+touch "$PLUGINS_ENABLED_FILE"
@@ -1,5 +0,0 @@
-#! /bin/sh
-
-. ./common.inc
-
-rm -f "$FALLBACK_FILE"
@@ -10,8 +10,6 @@ PAUSE_INCREMENT=1

 logger_debug "DNSCrypt has been requested"

-./set-dns-to-dhcp.sh
-
 pause=0
 while [ -e "$DNSCRYPT_FILE" ]; do
  logger_debug "Switching to dnscrypt if required (pause=$pause)"
@@ -22,41 +20,26 @@ while [ -e "$DNSCRYPT_FILE" ]; do
      ./switch-to-dhcp.sh
    fi
  fi
-  [ $pause -lt $PAUSE_MAX ] &&  pause=$((pause + 1))
  pause_counter=0
  while [ -e "$DNSCRYPT_FILE" -a $pause_counter -lt $pause ]; do
    sleep $PAUSE_UNIT
    pause_counter=$((pause_counter + 1))
  done
+  [ $pause -lt $PAUSE_MAX ] && pause=$((pause + 1))
  [ ! -e "$DNSCRYPT_FILE" ] && break
-  if [ -e "$FALLBACK_FILE" ]; then
-    logger_debug "Checking if the router hijacks HTTP queries"
-    if ./check-hijacking.sh; then
-      logger_debug "The router doesn't hijack HTTP queries"
-    else
-      logger_debug "The router hijacks HTTP queries - DNSCrypt is likely to be blocked"
-      continue
-    fi
-  fi
  ./start-dnscrypt-proxy.sh || continue
-  ./check-local-dns.sh || continue
  ./set-dns.sh "$INTERFACE_PROXY"
  if [ $? != 0 ]; then
    logger_debug "Setting the DNS to [$INTERFACE_PROXY] didn't work"
    ./set-dns-to-dhcp.sh
    continue
  fi
-  ./check-hijacking.sh
-  if [ $? != 0 ]; then
-    logger_debug "Current configuration seems to be hijacking HTTP queries. Reverting to default resolvers."
-    ./set-dns-to-dhcp.sh
-    continue
-  fi
  break
 done

 if [ ! -e "$DNSCRYPT_FILE" ]; then
  touch "$CONTROL_DIR"
+  exit 0
 fi

 exec ./exceptions-add.sh