luci-app-ssr-plus: add filter AAAA & ban BT
This commit is contained in:
CN_SZTL
parent
1219cfe528
commit
5cb839ee2e
@ -60,8 +60,16 @@ o:value("oversea", translate("Oversea Mode"))
|
||||
o.default = gfw
|
||||
|
||||
o = s:option(ListValue, "pdnsd_enable", translate("Resolve Dns Mode"))
|
||||
o:value("1", translate("Use Pdnsd tcp query and cache"))
|
||||
o:value("0", translate("Use Local DNS Service listen port 5335"))
|
||||
o:value("1", translate("Use Pdnsd tcp query and cache"))
|
||||
o:value("2", translate("Use Pdnsd udp query and cache"))
|
||||
if nixio.fs.access("/usr/sbin/dnsforwarder") then
|
||||
o:value("3", translate("Use dnsforwarder tcp query and cache"))
|
||||
o:value("4", translate("Use dnsforwarder udp query and cache"))
|
||||
end
|
||||
if nixio.fs.access("/usr/sbin/dnscrypt-proxy") then
|
||||
o:value("5", translate("Use dnscrypt-proxy query and cache"))
|
||||
end
|
||||
o.default = 1
|
||||
|
||||
o = s:option(ListValue, "tunnel_forward", translate("Anti-pollution DNS Server"))
|
||||
@ -79,5 +87,23 @@ o:value("1.1.1.1:53", translate("Cloudflare DNS (1.1.1.1)"))
|
||||
o:value("114.114.114.114:53", translate("Oversea Mode DNS-1 (114.114.114.114)"))
|
||||
o:value("114.114.115.115:53", translate("Oversea Mode DNS-2 (114.114.115.115)"))
|
||||
o:depends("pdnsd_enable", "1")
|
||||
o:depends("pdnsd_enable", "2")
|
||||
o:depends("pdnsd_enable", "3")
|
||||
o:depends("pdnsd_enable", "4")
|
||||
|
||||
aaaa = s:option(Flag, "filter_aaaa", translate("Filter AAAA"))
|
||||
aaaa.default = 0
|
||||
aaaa.rmempty = false
|
||||
aaaa.description = translate("Dnsmasq rejects IPv6 parsing and optimizes domestic complex dual-stack network")
|
||||
|
||||
o = s:option(Flag, "bt", translate("Kill BT"))
|
||||
o.default = 0
|
||||
o.rmempty = false
|
||||
o.description = translate("Prohibit downloading tool ports through proxy")
|
||||
|
||||
o = s:option(Value, "bt_port", translate("BT Port"))
|
||||
o.default = "51413,8437,12551"
|
||||
o.rmempty = true
|
||||
o:depends("bt", "1")
|
||||
|
||||
return m
|
||||
|
||||
@ -499,3 +499,18 @@ msgstr "4 线程"
|
||||
|
||||
msgid "8 Threads"
|
||||
msgstr "8 线程"
|
||||
|
||||
msgid "Filter AAAA"
|
||||
msgstr "屏蔽AAAA记录"
|
||||
|
||||
msgid "Dnsmasq rejects IPv6 parsing and optimizes domestic complex dual-stack network."
|
||||
msgstr "Dnsmasq不返回ipv6解析结果，优化国内复杂双栈网络。"
|
||||
|
||||
msgid "Kill BT"
|
||||
msgstr "阻止BT流量通过代理"
|
||||
|
||||
msgid "Prohibit downloading tool ports through proxy."
|
||||
msgstr "禁止BT相关端口的流量通过代理进行传输，以避免不必要的麻烦。"
|
||||
|
||||
msgid "BT Port"
|
||||
msgstr "欲封禁的BT端口"
|
||||
|
||||
@ -25,6 +25,7 @@ local_enable=0
|
||||
kcp_enable_flag=0
|
||||
kcp_flag=0
|
||||
pdnsd_enable_flag=0
|
||||
dnsforwarder_enable_flag=0
|
||||
switch_enable=0
|
||||
switch_server=$1
|
||||
MAXFD=32768
|
||||
@ -207,20 +208,31 @@ start_rules() {
|
||||
|
||||
start_pdnsd() {
|
||||
local usr_dns="$1"
|
||||
local usr_port="$2"
|
||||
local usr_port="$2"
|
||||
|
||||
local tcp_dns_list="208.67.222.222, 208.67.220.220"
|
||||
local tcp_dns_list="208.67.222.222,208.67.220.220"
|
||||
[ -z "$usr_dns" ] && usr_dns="8.8.8.8"
|
||||
[ -z "$usr_port" ] && usr_port="53"
|
||||
|
||||
[ -d /var/etc ] || mkdir -p /var/etc
|
||||
|
||||
if [ ! -d /var/pdnsd ];then
|
||||
mkdir -p /var/pdnsd
|
||||
echo -ne "pd13\000\000\000\000" >/var/pdnsd/pdnsd.cache
|
||||
chown -R nobody:nogroup /var/pdnsd
|
||||
fi
|
||||
|
||||
if [ "$(uci_get_by_type global pdnsd_enable)" = "1" ] ;then
|
||||
tcp_only="tcp_only"
|
||||
elif [ "$(uci_get_by_type global pdnsd_enable)" = "2" ] ;then
|
||||
tcp_only="udp_only"
|
||||
fi
|
||||
|
||||
kill $(pidof pdnsd) >/dev/null 2>&1 || killall -9 pdnsd >/dev/null 2>&1
|
||||
kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1
|
||||
/etc/init.d/dnscrypt-proxy stop
|
||||
/etc/init.d/dnscrypt-proxy disable
|
||||
|
||||
[ -d /var/etc ] || mkdir -p /var/etc
|
||||
|
||||
if [ ! -d /var/pdnsd ];then
|
||||
mkdir -p /var/pdnsd
|
||||
echo -ne "pd13\000\000\000\000" >/var/pdnsd/pdnsd.cache
|
||||
chown -R nobody:nogroup /var/pdnsd
|
||||
fi
|
||||
|
||||
cat > /var/etc/pdnsd.conf <<EOF
|
||||
global {
|
||||
perm_cache=1024;
|
||||
@ -230,7 +242,7 @@ global {
|
||||
server_ip = 127.0.0.1;
|
||||
server_port = 5335;
|
||||
status_ctl = on;
|
||||
query_method = tcp_only;
|
||||
query_method = $tcp_only;
|
||||
min_ttl=1h;
|
||||
max_ttl=1w;
|
||||
timeout=10;
|
||||
@ -261,6 +273,138 @@ EOF
|
||||
/usr/sbin/pdnsd -c /var/etc/pdnsd.conf -d
|
||||
}
|
||||
|
||||
start_dnsforwarder()
|
||||
{
|
||||
local usr_dns="$1"
|
||||
local usr_port="$2"
|
||||
|
||||
local tcp_dns_list="1.0.0.1,208.67.220.220"
|
||||
[ -z "$usr_dns" ] && usr_dns="8.8.8.8"
|
||||
[ -z "$usr_port" ] && usr_port="53"
|
||||
|
||||
if [ "$(uci_get_by_type global pdnsd_enable)" = "3" ] ;then
|
||||
dnsgroup="TCPGroup"
|
||||
elif [ "$(uci_get_by_type global pdnsd_enable)" = "4" ] ;then
|
||||
dnsgroup="UDPGroup"
|
||||
fi
|
||||
|
||||
kill $(pidof pdnsd) >/dev/null 2>&1 || killall -9 pdnsd >/dev/null 2>&1
|
||||
kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1
|
||||
/etc/init.d/dnscrypt-proxy stop
|
||||
/etc/init.d/dnscrypt-proxy disable
|
||||
rm -rf /var/run/dnsparsing
|
||||
|
||||
[ ! -f /usr/sbin/dnsparsing ] && ln /usr/bin/dnsforwarder /usr/sbin/dnsparsing
|
||||
DNSCACHE_CONF=/var/run/dnsparsing/dnsparsing.conf
|
||||
PID_PATH=/var/run/dnsparsing
|
||||
PID_FILE=dns.pid
|
||||
mkdir -p $PID_PATH
|
||||
pid=$(pidof dnsparsing)
|
||||
|
||||
cat > /var/run/dnsparsing/dnsparsing.conf <<EOF
|
||||
LogOn false
|
||||
LogFileThresholdLength 102400
|
||||
LogFileFolder /var/run/dnsparsing
|
||||
UDPLocal 127.0.0.1:5335
|
||||
$dnsgroup $usr_dns:$usr_port * no
|
||||
GroupFile
|
||||
BlockIP 243.185.187.39,46.82.174.68,37.61.54.158,93.46.8.89,59.24.3.173,203.98.7.65,8.7.198.45,78.16.49.15,159.106.121.75,69.63.187.12,31.13.76.8,31.13.64.49
|
||||
IPSubstituting
|
||||
BlockNegativeResponse false
|
||||
Hosts
|
||||
HostsUpdateInterval 18000
|
||||
HostsDownloadPath
|
||||
HostsScript
|
||||
HostsRetryInterval 30
|
||||
AppendHosts
|
||||
BlockIpv6WhenIpv4Exists false
|
||||
UseCache true
|
||||
CacheSize 1048576
|
||||
MemoryCache true
|
||||
CacheFile
|
||||
IgnoreTTL false
|
||||
OverrideTTL -1
|
||||
MultipleTTL 1
|
||||
ReloadCache false
|
||||
OverwriteCache false
|
||||
DisabledType
|
||||
DisabledDomain
|
||||
DisabledList
|
||||
DomainStatistic false
|
||||
DomainStatisticTempletFile
|
||||
StatisticUpdateInterval 29
|
||||
EOF
|
||||
|
||||
dnsparsing -f $DNSCACHE_CONF -d
|
||||
echo dnsparsing running pid is $pid
|
||||
logger -t alex the pid of dnsparsing is $PID_PATH/$PID_FILE $pid
|
||||
echo $pid > $PID_PATH/$PID_FILE
|
||||
|
||||
}
|
||||
|
||||
dnscrypt_config_file() {
|
||||
|
||||
kill $(pidof pdnsd) >/dev/null 2>&1 || killall -9 pdnsd >/dev/null 2>&1
|
||||
kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1
|
||||
/etc/init.d/dnscrypt-proxy stop
|
||||
/etc/init.d/dnscrypt-proxy disable
|
||||
|
||||
cat > /etc/dnscrypt-proxy/dnscrypt-proxy.toml <<EOF
|
||||
ipv4_servers = true
|
||||
#ipv6服务开关
|
||||
ipv6_servers = true
|
||||
require_dnssec = true
|
||||
require_nolog = true
|
||||
require_nofilter = true
|
||||
cache = true
|
||||
#是否禁用ipv6
|
||||
block_ipv6 = false
|
||||
force_tcp = true
|
||||
server_names = ["cloudflare", "d0wn-us-ns1"]
|
||||
#ipv6dns
|
||||
#server_names = ["cloudflare-ipv6", "d0wn-tz-ns1-ipv6"]
|
||||
listen_addresses = ['127.0.0.1:5335', '[::1]:5335']
|
||||
max_clients = 300
|
||||
dnscrypt_servers = true
|
||||
doh_servers = true
|
||||
daemonize = false
|
||||
timeout = 5000
|
||||
log_level = 0
|
||||
use_syslog = false
|
||||
cert_refresh_delay = 240
|
||||
ignore_system_dns = false
|
||||
log_files_max_size = 10
|
||||
log_files_max_age = 7
|
||||
log_files_max_backups = 1
|
||||
cache_size = 25600
|
||||
cache_min_ttl = 60000
|
||||
cache_max_ttl = 864000
|
||||
cache_neg_ttl = 60
|
||||
|
||||
fallback_resolver = '9.9.9.9:53'
|
||||
|
||||
[query_log]
|
||||
format = "ltsv"
|
||||
|
||||
[nx_log]
|
||||
format = "ltsv"
|
||||
|
||||
[blacklist]
|
||||
|
||||
[ip_blacklist]
|
||||
|
||||
[sources]
|
||||
|
||||
[sources.public-resolvers]
|
||||
urls = ["https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md", "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md"]
|
||||
minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"
|
||||
cache_file = "public-resolvers.md"
|
||||
refresh_delay = 72
|
||||
prefix = ""
|
||||
|
||||
EOF
|
||||
|
||||
}
|
||||
|
||||
start_redir() {
|
||||
case "$(uci_get_by_name $GLOBAL_SERVER auth_enable)" in
|
||||
@ -349,6 +493,7 @@ start_redir() {
|
||||
|
||||
if [ "$(uci_get_by_type global pdnsd_enable)" = "1" ] ;then
|
||||
local dnsstr="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"
|
||||
local aaaa="$(uci_get_by_type global filter_aaaa 0)"
|
||||
local dnsserver=`echo "$dnsstr"|awk -F ':' '{print $1}'`
|
||||
local dnsport=`echo "$dnsstr"|awk -F ':' '{print $2}'`
|
||||
if [ "$run_mode" = "gfw" ]; then
|
||||
@ -358,10 +503,27 @@ start_redir() {
|
||||
else
|
||||
ipset add ss_spec_wan_ac $dnsserver nomatch 2>/dev/null
|
||||
fi
|
||||
start_pdnsd $dnsserver $dnsport
|
||||
pdnsd_enable_flag=1
|
||||
|
||||
if [ "$(uci_get_by_type global pdnsd_enable)" = "1" ] || [ "$(uci_get_by_type global pdnsd_enable)" = "2" ] ;then
|
||||
start_pdnsd $dnsserver $dnsport
|
||||
pdnsd_enable_flag=1
|
||||
elif [ "$(uci_get_by_type global pdnsd_enable)" = "3" ] || [ "$(uci_get_by_type global pdnsd_enable)" = "4" ] ;then
|
||||
start_dnsforwarder $dnsserver $dnsport
|
||||
dnsforwarder_enable_flag=1
|
||||
elif [ "$(uci_get_by_type global pdnsd_enable)" = "5" ] ;then
|
||||
dnscrypt_config_file
|
||||
/etc/init.d/dnscrypt-proxy enable
|
||||
/etc/init.d/dnscrypt-proxy start
|
||||
fi
|
||||
|
||||
if [ $aaaa -eq 1 ]; then
|
||||
sed -i '/filter-aaaa/d' /etc/dnsmasq.conf
|
||||
echo "filter-aaaa" >> /etc/dnsmasq.conf
|
||||
else
|
||||
sed -i '/filter-aaaa/d' /etc/dnsmasq.conf
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
if [ "$(uci_get_by_type global enable_switch)" = "1" ] ;then
|
||||
if [ "$(uci_get_by_name $GLOBAL_SERVER switch_enable)" = "1" ] ;then
|
||||
if [ -z "$switch_server" ] ;then
|
||||
@ -531,15 +693,25 @@ stop() {
|
||||
killall -q -9 ssr-server
|
||||
killall -q -9 kcptun-client
|
||||
killall -q -9 ssr-local
|
||||
killall -q -9 dnscrypt-proxy
|
||||
|
||||
if [ -f /var/run/pdnsd.pid ] ;then
|
||||
kill $(cat /var/run/pdnsd.pid) >/dev/null 2>&1
|
||||
else
|
||||
kill -9 $(ps | grep pdnsd | grep -v grep | awk '{print $1}') >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
|
||||
kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1
|
||||
rm -rf /var/run/dnsparsing
|
||||
sed -i '/filter-aaaa/d' /etc/dnsmasq.conf
|
||||
|
||||
if [ -f "/tmp/dnsmasq.d/dnsmasq-ssr.conf" ]; then
|
||||
rm -f /tmp/dnsmasq.d/dnsmasq-ssr.conf
|
||||
/etc/init.d/dnsmasq restart >/dev/null 2>&1
|
||||
fi
|
||||
|
||||
/etc/init.d/dnscrypt-proxy stop
|
||||
/etc/init.d/dnscrypt-proxy disable
|
||||
|
||||
del_cron
|
||||
}
|
||||
|
||||
@ -0,0 +1,74 @@
|
||||
From 966471712184cfb3b067f2ae8dad9d8e2a896cae Mon Sep 17 00:00:00 2001
|
||||
From: Bearice Ren <bearice@icybear.net>
|
||||
Date: Tue, 20 Sep 2016 11:52:08 +0800
|
||||
Subject: [PATCH] add filter-aaaa option
|
||||
|
||||
---
|
||||
src/dnsmasq.h | 3 ++-
|
||||
src/option.c | 3 +++
|
||||
src/rfc1035.c | 9 +++++++++
|
||||
3 files changed, 14 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
|
||||
index 1896a64..e10d6c4 100644
|
||||
--- a/src/dnsmasq.h
|
||||
+++ b/src/dnsmasq.h
|
||||
@@ -238,7 +238,8 @@ struct event_desc {
|
||||
#define OPT_SCRIPT_ARP 53
|
||||
#define OPT_MAC_B64 54
|
||||
#define OPT_MAC_HEX 55
|
||||
-#define OPT_LAST 56
|
||||
+#define OPT_FILTER_AAAA 56
|
||||
+#define OPT_LAST 57
|
||||
|
||||
/* extra flags for my_syslog, we use a couple of facilities since they are known
|
||||
not to occupy the same bits as priorities, no matter how syslog.h is set up. */
|
||||
diff --git a/src/option.c b/src/option.c
|
||||
index d8c57d6..1cc65bf 100644
|
||||
--- a/src/option.c
|
||||
+++ b/src/option.c
|
||||
@@ -159,6 +159,7 @@ struct myoption {
|
||||
#define LOPT_SCRIPT_ARP 347
|
||||
#define LOPT_DHCPTTL 348
|
||||
#define LOPT_TFTP_MTU 349
|
||||
+#define LOPT_FILTER_AAAA 350
|
||||
|
||||
#ifdef HAVE_GETOPT_LONG
|
||||
static const struct option opts[] =
|
||||
@@ -323,6 +324,7 @@ static const struct myoption opts[] =
|
||||
{ "dns-loop-detect", 0, 0, LOPT_LOOP_DETECT },
|
||||
{ "script-arp", 0, 0, LOPT_SCRIPT_ARP },
|
||||
{ "dhcp-ttl", 1, 0 , LOPT_DHCPTTL },
|
||||
+ { "filter-aaaa", 0, 0, LOPT_FILTER_AAAA },
|
||||
{ NULL, 0, 0, 0 }
|
||||
};
|
||||
|
||||
@@ -494,6 +496,7 @@ static struct {
|
||||
{ LOPT_LOOP_DETECT, OPT_LOOP_DETECT, NULL, gettext_noop("Detect and remove DNS forwarding loops."), NULL },
|
||||
{ LOPT_IGNORE_ADDR, ARG_DUP, "<ipaddr>", gettext_noop("Ignore DNS responses containing ipaddr."), NULL },
|
||||
{ LOPT_DHCPTTL, ARG_ONE, "<ttl>", gettext_noop("Set TTL in DNS responses with DHCP-derived addresses."), NULL },
|
||||
+ { LOPT_FILTER_AAAA, OPT_FILTER_AAAA, NULL, gettext_noop("Filter all AAAA requests."), NULL },
|
||||
{ 0, 0, NULL, NULL, NULL }
|
||||
};
|
||||
|
||||
diff --git a/src/rfc1035.c b/src/rfc1035.c
|
||||
index 24d08c1..1594962 100644
|
||||
--- a/src/rfc1035.c
|
||||
+++ b/src/rfc1035.c
|
||||
@@ -1783,6 +1783,15 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
|
||||
}
|
||||
}
|
||||
|
||||
+ //patch to filter aaaa forwards
|
||||
+ if (qtype == T_AAAA && option_bool(OPT_FILTER_AAAA) ){
|
||||
+ //return a null reply
|
||||
+ ans = 1;
|
||||
+ if (!dryrun) log_query(F_CONFIG | F_IPV6 | F_NEG, name, &addr, NULL);
|
||||
+ break;
|
||||
+ }
|
||||
+ //end of patch
|
||||
+
|
||||
if (!ans)
|
||||
return 0; /* failed to answer a question */
|
||||
}
|
||||
--
|
||||
Loading…
Reference in New Issue
Block a user