From 5cb839ee2ebae7b33d781c78c27ecd2690e8118c Mon Sep 17 00:00:00 2001 From: CN_SZTL Date: Tue, 2 Jul 2019 02:18:05 +0800 Subject: [PATCH] luci-app-ssr-plus: add filter AAAA & ban BT --- .../luasrc/model/cbi/shadowsocksr/client.lua | 28 ++- .../luci-app-ssr-plus/po/zh-cn/ssr-plus.po | 15 ++ .../root/etc/init.d/shadowsocksr | 202 ++++++++++++++++-- .../patches/099-dnsmasq-filter-aaaa.patch | 74 +++++++ 4 files changed, 303 insertions(+), 16 deletions(-) create mode 100644 package/network/services/dnsmasq/patches/099-dnsmasq-filter-aaaa.patch diff --git a/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client.lua b/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client.lua index f2f1b74d04..2868717b32 100755 --- a/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client.lua +++ b/package/lean/luci-app-ssr-plus/luasrc/model/cbi/shadowsocksr/client.lua @@ -60,8 +60,16 @@ o:value("oversea", translate("Oversea Mode")) o.default = gfw o = s:option(ListValue, "pdnsd_enable", translate("Resolve Dns Mode")) -o:value("1", translate("Use Pdnsd tcp query and cache")) o:value("0", translate("Use Local DNS Service listen port 5335")) +o:value("1", translate("Use Pdnsd tcp query and cache")) +o:value("2", translate("Use Pdnsd udp query and cache")) +if nixio.fs.access("/usr/sbin/dnsforwarder") then + o:value("3", translate("Use dnsforwarder tcp query and cache")) + o:value("4", translate("Use dnsforwarder udp query and cache")) +end +if nixio.fs.access("/usr/sbin/dnscrypt-proxy") then + o:value("5", translate("Use dnscrypt-proxy query and cache")) +end o.default = 1 o = s:option(ListValue, "tunnel_forward", translate("Anti-pollution DNS Server")) @@ -79,5 +87,23 @@ o:value("1.1.1.1:53", translate("Cloudflare DNS (1.1.1.1)")) o:value("114.114.114.114:53", translate("Oversea Mode DNS-1 (114.114.114.114)")) o:value("114.114.115.115:53", translate("Oversea Mode DNS-2 (114.114.115.115)")) o:depends("pdnsd_enable", "1") +o:depends("pdnsd_enable", "2") +o:depends("pdnsd_enable", "3") +o:depends("pdnsd_enable", "4") + +aaaa = s:option(Flag, "filter_aaaa", translate("Filter AAAA")) +aaaa.default = 0 +aaaa.rmempty = false +aaaa.description = translate("Dnsmasq rejects IPv6 parsing and optimizes domestic complex dual-stack network") + +o = s:option(Flag, "bt", translate("Kill BT")) +o.default = 0 +o.rmempty = false +o.description = translate("Prohibit downloading tool ports through proxy") + +o = s:option(Value, "bt_port", translate("BT Port")) +o.default = "51413,8437,12551" +o.rmempty = true +o:depends("bt", "1") return m diff --git a/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po b/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po index 56da600a04..c133534bf1 100755 --- a/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po +++ b/package/lean/luci-app-ssr-plus/po/zh-cn/ssr-plus.po @@ -499,3 +499,18 @@ msgstr "4 线程" msgid "8 Threads" msgstr "8 线程" + +msgid "Filter AAAA" +msgstr "屏蔽AAAA记录" + +msgid "Dnsmasq rejects IPv6 parsing and optimizes domestic complex dual-stack network." +msgstr "Dnsmasq不返回ipv6解析结果，优化国内复杂双栈网络。" + +msgid "Kill BT" +msgstr "阻止BT流量通过代理" + +msgid "Prohibit downloading tool ports through proxy." +msgstr "禁止BT相关端口的流量通过代理进行传输，以避免不必要的麻烦。" + +msgid "BT Port" +msgstr "欲封禁的BT端口" diff --git a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr index 3e3bb8a4e6..f47b9491b9 100755 --- a/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr +++ b/package/lean/luci-app-ssr-plus/root/etc/init.d/shadowsocksr @@ -25,6 +25,7 @@ local_enable=0 kcp_enable_flag=0 kcp_flag=0 pdnsd_enable_flag=0 +dnsforwarder_enable_flag=0 switch_enable=0 switch_server=$1 MAXFD=32768 @@ -207,20 +208,31 @@ start_rules() { start_pdnsd() { local usr_dns="$1" - local usr_port="$2" + local usr_port="$2" - local tcp_dns_list="208.67.222.222, 208.67.220.220" + local tcp_dns_list="208.67.222.222,208.67.220.220" [ -z "$usr_dns" ] && usr_dns="8.8.8.8" [ -z "$usr_port" ] && usr_port="53" - - [ -d /var/etc ] || mkdir -p /var/etc - - if [ ! -d /var/pdnsd ];then - mkdir -p /var/pdnsd - echo -ne "pd13\000\000\000\000" >/var/pdnsd/pdnsd.cache - chown -R nobody:nogroup /var/pdnsd - fi + if [ "$(uci_get_by_type global pdnsd_enable)" = "1" ] ;then + tcp_only="tcp_only" + elif [ "$(uci_get_by_type global pdnsd_enable)" = "2" ] ;then + tcp_only="udp_only" + fi + + kill $(pidof pdnsd) >/dev/null 2>&1 || killall -9 pdnsd >/dev/null 2>&1 + kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1 + /etc/init.d/dnscrypt-proxy stop + /etc/init.d/dnscrypt-proxy disable + + [ -d /var/etc ] || mkdir -p /var/etc + + if [ ! -d /var/pdnsd ];then + mkdir -p /var/pdnsd + echo -ne "pd13\000\000\000\000" >/var/pdnsd/pdnsd.cache + chown -R nobody:nogroup /var/pdnsd + fi + cat > /var/etc/pdnsd.conf </dev/null 2>&1 || killall -9 pdnsd >/dev/null 2>&1 + kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1 + /etc/init.d/dnscrypt-proxy stop + /etc/init.d/dnscrypt-proxy disable + rm -rf /var/run/dnsparsing + + [ ! -f /usr/sbin/dnsparsing ] && ln /usr/bin/dnsforwarder /usr/sbin/dnsparsing + DNSCACHE_CONF=/var/run/dnsparsing/dnsparsing.conf + PID_PATH=/var/run/dnsparsing + PID_FILE=dns.pid + mkdir -p $PID_PATH + pid=$(pidof dnsparsing) + + cat > /var/run/dnsparsing/dnsparsing.conf < $PID_PATH/$PID_FILE + +} + +dnscrypt_config_file() { + + kill $(pidof pdnsd) >/dev/null 2>&1 || killall -9 pdnsd >/dev/null 2>&1 + kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1 + /etc/init.d/dnscrypt-proxy stop + /etc/init.d/dnscrypt-proxy disable + + cat > /etc/dnscrypt-proxy/dnscrypt-proxy.toml </dev/null fi - start_pdnsd $dnsserver $dnsport - pdnsd_enable_flag=1 + + if [ "$(uci_get_by_type global pdnsd_enable)" = "1" ] || [ "$(uci_get_by_type global pdnsd_enable)" = "2" ] ;then + start_pdnsd $dnsserver $dnsport + pdnsd_enable_flag=1 + elif [ "$(uci_get_by_type global pdnsd_enable)" = "3" ] || [ "$(uci_get_by_type global pdnsd_enable)" = "4" ] ;then + start_dnsforwarder $dnsserver $dnsport + dnsforwarder_enable_flag=1 + elif [ "$(uci_get_by_type global pdnsd_enable)" = "5" ] ;then + dnscrypt_config_file + /etc/init.d/dnscrypt-proxy enable + /etc/init.d/dnscrypt-proxy start + fi + + if [ $aaaa -eq 1 ]; then + sed -i '/filter-aaaa/d' /etc/dnsmasq.conf + echo "filter-aaaa" >> /etc/dnsmasq.conf + else + sed -i '/filter-aaaa/d' /etc/dnsmasq.conf + fi fi - + if [ "$(uci_get_by_type global enable_switch)" = "1" ] ;then if [ "$(uci_get_by_name $GLOBAL_SERVER switch_enable)" = "1" ] ;then if [ -z "$switch_server" ] ;then @@ -531,15 +693,25 @@ stop() { killall -q -9 ssr-server killall -q -9 kcptun-client killall -q -9 ssr-local + killall -q -9 dnscrypt-proxy + if [ -f /var/run/pdnsd.pid ] ;then kill $(cat /var/run/pdnsd.pid) >/dev/null 2>&1 else kill -9 $(ps | grep pdnsd | grep -v grep | awk '{print $1}') >/dev/null 2>&1 fi - + + kill $(pidof dnsparsing) >/dev/null 2>&1 || killall -9 dnsparsing >/dev/null 2>&1 + rm -rf /var/run/dnsparsing + sed -i '/filter-aaaa/d' /etc/dnsmasq.conf + if [ -f "/tmp/dnsmasq.d/dnsmasq-ssr.conf" ]; then rm -f /tmp/dnsmasq.d/dnsmasq-ssr.conf /etc/init.d/dnsmasq restart >/dev/null 2>&1 fi + + /etc/init.d/dnscrypt-proxy stop + /etc/init.d/dnscrypt-proxy disable + del_cron } diff --git a/package/network/services/dnsmasq/patches/099-dnsmasq-filter-aaaa.patch b/package/network/services/dnsmasq/patches/099-dnsmasq-filter-aaaa.patch new file mode 100644 index 0000000000..3b447b167c --- /dev/null +++ b/package/network/services/dnsmasq/patches/099-dnsmasq-filter-aaaa.patch @@ -0,0 +1,74 @@ +From 966471712184cfb3b067f2ae8dad9d8e2a896cae Mon Sep 17 00:00:00 2001 +From: Bearice Ren +Date: Tue, 20 Sep 2016 11:52:08 +0800 +Subject: [PATCH] add filter-aaaa option + +--- + src/dnsmasq.h | 3 ++- + src/option.c | 3 +++ + src/rfc1035.c | 9 +++++++++ + 3 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/src/dnsmasq.h b/src/dnsmasq.h +index 1896a64..e10d6c4 100644 +--- a/src/dnsmasq.h ++++ b/src/dnsmasq.h +@@ -238,7 +238,8 @@ struct event_desc { + #define OPT_SCRIPT_ARP 53 + #define OPT_MAC_B64 54 + #define OPT_MAC_HEX 55 +-#define OPT_LAST 56 ++#define OPT_FILTER_AAAA 56 ++#define OPT_LAST 57 + + /* extra flags for my_syslog, we use a couple of facilities since they are known + not to occupy the same bits as priorities, no matter how syslog.h is set up. */ +diff --git a/src/option.c b/src/option.c +index d8c57d6..1cc65bf 100644 +--- a/src/option.c ++++ b/src/option.c +@@ -159,6 +159,7 @@ struct myoption { + #define LOPT_SCRIPT_ARP 347 + #define LOPT_DHCPTTL 348 + #define LOPT_TFTP_MTU 349 ++#define LOPT_FILTER_AAAA 350 + + #ifdef HAVE_GETOPT_LONG + static const struct option opts[] = +@@ -323,6 +324,7 @@ static const struct myoption opts[] = + { "dns-loop-detect", 0, 0, LOPT_LOOP_DETECT }, + { "script-arp", 0, 0, LOPT_SCRIPT_ARP }, + { "dhcp-ttl", 1, 0 , LOPT_DHCPTTL }, ++ { "filter-aaaa", 0, 0, LOPT_FILTER_AAAA }, + { NULL, 0, 0, 0 } + }; + +@@ -494,6 +496,7 @@ static struct { + { LOPT_LOOP_DETECT, OPT_LOOP_DETECT, NULL, gettext_noop("Detect and remove DNS forwarding loops."), NULL }, + { LOPT_IGNORE_ADDR, ARG_DUP, "", gettext_noop("Ignore DNS responses containing ipaddr."), NULL }, + { LOPT_DHCPTTL, ARG_ONE, "", gettext_noop("Set TTL in DNS responses with DHCP-derived addresses."), NULL }, ++ { LOPT_FILTER_AAAA, OPT_FILTER_AAAA, NULL, gettext_noop("Filter all AAAA requests."), NULL }, + { 0, 0, NULL, NULL, NULL } + }; + +diff --git a/src/rfc1035.c b/src/rfc1035.c +index 24d08c1..1594962 100644 +--- a/src/rfc1035.c ++++ b/src/rfc1035.c +@@ -1783,6 +1783,15 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen, + } + } + ++ //patch to filter aaaa forwards ++ if (qtype == T_AAAA && option_bool(OPT_FILTER_AAAA) ){ ++ //return a null reply ++ ans = 1; ++ if (!dryrun) log_query(F_CONFIG | F_IPV6 | F_NEG, name, &addr, NULL); ++ break; ++ } ++ //end of patch ++ + if (!ans) + return 0; /* failed to answer a question */ + } +--