community/dnscrypt-proxy: moved from testing

5 files changed, 462 insertions, 0 deletions

diff --git a/community/dnscrypt-proxy/APKBUILD b/community/dnscrypt-proxy/APKBUILD
new file mode 100644
index 00000000000..ca0bbc5b011
--- /dev/null
+++ b/community/dnscrypt-proxy/APKBUILD
@@ -0,0 +1,69 @@
+# Contributor: Francesco Colista <fcolista@alpinelinux.org>
+# Maintainer: Francesco Colista <fcolista@alpinelinux.org>
+pkgname=dnscrypt-proxy
+pkgver=1.7.0
+pkgrel=0
+pkgdesc="A tool for securing communications between a client and a DNS resolver"
+url="http://dnscrypt.org/"
+arch="all"
+license="custom"
+depends=""
+depends_dev=""
+makedepends="$depends_dev libsodium-dev"
+install="$pkgname.pre-install"
+pkgusers=dnscrypt
+pkggroups=dnscrypt
+subpackages="$pkgname-doc $pkgname-setup"
+source="http://download.dnscrypt.org/$pkgname/$pkgname-$pkgver.tar.bz2
+	$pkgname.initd
+	$pkgname.confd
+	$pkgname.setup
+	"
+
+_builddir="$srcdir"/$pkgname-$pkgver
+
+build() {
+        cd "$_builddir"
+        CFLAGS="$CFLAGS -fPIC" ./configure \
+                --build=$CBUILD \
+                --host=$CHOST \
+                --prefix=/usr \
+                || return 1
+        make || return 1
+}
+
+package() {
+	cd "$_builddir"
+	make DESTDIR=$pkgdir install || return 1
+	mkdir -p "$pkgdir"/var/log/$pkgname
+	mkdir -p "$pkgdir"/var/run/$pkgname
+	mkdir -p "$pkgdir"/var/empty
+	mkdir -p $pkgdir/usr/share/licenses/$pkgname
+        install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/$pkgname
+	install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/$pkgname
+	chown dnscrypt "$pkgdir"/var/log/$pkgname
+	chown dnscrypt "$pkgdir"/var/run/$pkgname
+	chown dnscrypt "$pkgdir"/var/empty
+	install -m 644 COPYING $pkgdir/usr/share/licenses/$pkgname
+}
+
+setup() {
+	arch="noarch"
+	pkgdesc="Script for setting up DNSCrypt Proxy"
+	depends="sed wget $pkgname"
+	mkdir -p "$subpkgdir"/sbin
+	install -m755 -D "$srcdir"/$pkgname.setup "$subpkgdir"/sbin/setup-dnscrypt
+}
+
+md5sums="e8049148b5401c6bc76cfaf11dcde635  dnscrypt-proxy-1.7.0.tar.bz2
+6ca1f01a62ca9e937851986560709a61  dnscrypt-proxy.initd
+77b800da6d8cdf6316afacbff740b09a  dnscrypt-proxy.confd
+5f29e17b4345d8ac9bdba26a69e3ba9a  dnscrypt-proxy.setup"
+sha256sums="1daf77df9092491ea0b5176ec4b170f7b0645f97b62d1a50412a960656b482e3  dnscrypt-proxy-1.7.0.tar.bz2
+aa2b83b1944ba5f47ee5b7f2cf3cf63fbef4735753a2daf83fea3bf0ea51a7a3  dnscrypt-proxy.initd
+36bd49d3fdada3ed8fc6abae7a8dd40a1f7a0aabf0eb1311698030b7ec710699  dnscrypt-proxy.confd
+887c0c2d3b3d1a5326e3229ff8180351bc813f7853997e6772123beafc8bd62a  dnscrypt-proxy.setup"
+sha512sums="45b64001366fcffdd2a9aa2b725ddc11bf26de47b0a6fc603bd9db3f7743e50cc4699abdf60e51b74fde889eb27cdc89cf1bd7213e00440ff45c3d76a0d77e0b  dnscrypt-proxy-1.7.0.tar.bz2
+5ad36161fc44d9c8c86a13e20d4d5fa0be81b317097bf1c092aab1e1e307021a8b6f1a92dbf2bec5fb7c534b59cf926235ea507fa6b4ccd2974ac2e3b7baa257  dnscrypt-proxy.initd
+8cd2d40c1f465a3b26aa934fe2103650beba9504676faca3ccc9ee2b5bad940e561b3dd201d84c380bfdada72cacbe4862fc1315a4bd44fd7c56ef4f19a884f9  dnscrypt-proxy.confd
+904965588e8e1119600413445627dc85a5efc0e32f7f3ad029921f59f214dd5c999bcd98a6622b572e528da4c5265083221fea189ed96407612842033ffcffe1  dnscrypt-proxy.setup"
diff --git a/community/dnscrypt-proxy/dnscrypt-proxy.confd b/community/dnscrypt-proxy/dnscrypt-proxy.confd
new file mode 100644
index 00000000000..9539c66426a
--- /dev/null
+++ b/community/dnscrypt-proxy/dnscrypt-proxy.confd
@@ -0,0 +1,9 @@
+# DNSCRYPT_LOGFILE=/var/log/dnscrypt-proxy/dnscrypt-proxy.log
+
+# override listen address where DNSCRYPT listen
+# DNSCRYPT_LOCALIP=127.0.0.1:53
+
+# override the default OpenDNS Resolver here
+RESOLVER=208.67.220.220:443;
+PROVIDER=2.dnscrypt-cert.opendns.com
+PUBKEY=B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79;
diff --git a/community/dnscrypt-proxy/dnscrypt-proxy.initd b/community/dnscrypt-proxy/dnscrypt-proxy.initd
new file mode 100644
index 00000000000..8c3246b6c66
--- /dev/null
+++ b/community/dnscrypt-proxy/dnscrypt-proxy.initd
@@ -0,0 +1,24 @@
+#!/sbin/openrc-run
+
+pidfile=/var/run/dnscrypt-proxy/dnscrypt-proxy.pid
+command=/usr/sbin/dnscrypt-proxy
+command_args="--pidfile=$pidfile --daemonize
+	--logfile=${DNSCRYPT_LOGFILE:-/var/log/dnscrypt-proxy/dnscrypt-proxy.log}
+	--user=${DNSCRYPT_USER:-dnscrypt}
+	--local-address=${DNSCRYPT_LOCALIP:-127.0.0.1:53}"
+
+
+depend() {
+	use net
+	before dns
+	after logger firewall
+}
+
+start_pre() {
+	checkpath --directory ${pidfile%/*}
+	# by default opendns is used but its possible to override
+	if [ -n "$RESOLVER" ] && [ -n "$PUBKEY" ] && [ -n "$PROVIDER" ]; then
+		command_args="$command_args -r ${RESOLVER} -k ${PUBKEY} -N ${PROVIDER}"
+	fi
+}
+
diff --git a/community/dnscrypt-proxy/dnscrypt-proxy.pre-install b/community/dnscrypt-proxy/dnscrypt-proxy.pre-install
new file mode 100644
index 00000000000..651c01fe265
--- /dev/null
+++ b/community/dnscrypt-proxy/dnscrypt-proxy.pre-install
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+addgroup -S dnscrypt 2>/dev/null
+adduser -S -D -H -h /var/empty -s /sbin/nologin -G dnscrypt -g dnscrypt dnscrypt 2>/dev/null
+
+exit 0
diff --git a/community/dnscrypt-proxy/dnscrypt-proxy.setup b/community/dnscrypt-proxy/dnscrypt-proxy.setup
new file mode 100644
index 00000000000..c1a028c3d32
--- /dev/null
+++ b/community/dnscrypt-proxy/dnscrypt-proxy.setup
@@ -0,0 +1,354 @@
+#!/bin/sh
+# Contributor: Stuart Cardall <developer@it-offshore.co.uk>
+# dnscrypt-proxy setup script to choose DNS Resolver & install / configure / remove DNS Caching
+###############################################################################################
+
+config='/etc/conf.d/dnscrypt-proxy'
+dhcpconfig='/etc/dhcp/dhclient.conf'
+unboundconfig='/etc/unbound/unbound.conf'
+
+SCRIPT=$(echo "`basename $0`")
+
+NORMAL="\033[1;0m"
+STRONG="\033[1;1m"
+RED="\033[1;31m"
+GREEN="\033[1;32m"
+
+print_question() {
+        local prompt="${STRONG}$1 ${RED}$2${NORMAL}"
+        printf "${prompt} %s"
+}
+
+print_strong() {
+        local prompt="${STRONG}$1 ${RED}$2${NORMAL}"
+        printf "${prompt} %s\n"
+}
+
+print_green() {
+        local prompt="${GREEN}${STRONG}$1 ${NORMAL}"
+        printf "${prompt} %s\n"
+}
+
+print_table() {
+        local choice="${RED}${STRONG}$1${NORMAL}"
+	local resolver="${STRONG}$2"
+	local location="${GREEN}$3"
+	printf "${choice} ${resolver} ${location} %s\n"
+}
+
+die() {
+    print_table "ERROR:" "$1" > /dev/null 1>&2
+    exit 1
+}
+
+restart_interface(){
+INTERFACES=$(echo | ifconfig | grep "Link encap" | sed '/lo/d' | cut -d"L" -f1)
+print_question "\nChoose external interface to restart from the following:"
+print_question "\n\n$INTERFACES" "[ default: eth0 ]"
+
+while :
+do
+	read RESTART
+	# Sanitize input
+	export RESTART_CLEAN="`echo "${RESTART}" | tr -cd '[:[alnum]:]'`"
+
+	if [ ! $RESTART ] ;then
+		RESTART_CLEAN=eth0
+	fi
+
+	# tr will strip invalid input to nothing which passes grep
+	if [ "$RESTART_CLEAN" != "" ] && echo "$INTERFACES" | grep -e "$RESTART_CLEAN" 1>/dev/null; then
+		break
+	else
+		#move the cursor & clear the line
+		echo -en "\033[1A\033[28C\022[K"
+	fi
+done
+}
+
+choose_ip(){
+IPADDR=$(ifconfig |grep -B1 "inet addr" |awk '{ if ( $1 == "inet" ) { print $2 } else if ( $2 == "Link" ) { printf "%s:" ,$1 } }' |awk -F" " '{ print $1 ": " $3 }'| sed 's/addr//')
+if echo "$IPADDR" | grep -e "127.0.0.2" 1>/dev/null && which unbound 1> /dev/null; then
+        defaultip='127.0.0.2'
+	IPADDR_CHOICE=$(echo "$IPADDR" | sed '/lo::127.0.0.1:/d')
+else
+        defaultip='127.0.0.1'
+	IPADDR_CHOICE=$(echo "$IPADDR" | sed '/lo:1::127.0.0.2:/d')
+fi
+
+print_question "\nChoose Dnscrypt IP from the following addresses:\n"
+print_question "\n$IPADDR_CHOICE\t" "[ default: $defaultip ]"
+
+while :
+do
+	read IP
+	# Sanitize input
+        export IP_CLEAN="`echo "${IP}" | tr -cd '[:xdigit:] [:\::] [:\.:]'`"
+	if [ ! $IP ]; then
+		IP_CLEAN=$defaultip
+	fi
+	# tr will strip invalid input to nothing which passes grep
+	if [ "$IP_CLEAN" != "" ] && echo "$IPADDR_CHOICE" | grep -e "$IP_CLEAN" 1>/dev/null; then
+		print_green "\nIP: $IP_CLEAN Selected"; break
+	else
+		#move the cursor & clear the line
+		echo -en "\033[1A\033[49C\033[K"
+	fi
+done
+}
+
+choose_port(){
+if grep -e "127.0.0.2" /etc/network/interfaces 1>/dev/null; then
+	defaultport=40
+else
+	defaultport=53
+fi
+
+print_question "\nChoose Dnscrypt Port:" "[ default: $defaultport ]"
+while :
+do
+        read DNSPORT
+	# Sanitize input to an integer and assign to new variable
+	export DNSPORT_CLEAN="`echo "${DNSPORT}" | tr -cd '[:[0-9]:]'`"
+        if [ ! $DNSPORT ]; then
+		DNSPORT_CLEAN=$defaultport
+        fi
+
+	if [ $DNSPORT_CLEAN -gt 0 2>/dev/null ] && [ $DNSPORT_CLEAN -le 65535 2>/dev/null ]; then
+		print_green "\nPort: $DNSPORT_CLEAN Selected"; break
+	else
+		#move the cursor & clear the line
+		echo -en "\033[1A\033[39C\033[K"
+	fi
+done
+}
+
+update_unbound(){
+if [ -f $unboundconfig ]; then
+	if grep "Settings from "$SCRIPT"" $unboundconfig 1>/dev/null; then
+		#update forward zone
+		START=$(sed -n "\%Settings from $SCRIPT%=" $unboundconfig)
+		LINE=$(expr $START + 3 )
+		sed "$LINE c \  forward-addr: $IP_CLEAN@$DNSPORT_CLEAN" $unboundconfig -i
+
+	else
+		# allow querying of localhost
+		START=$(sed -n '/do-not-query-localhost:/=' $unboundconfig)
+		sed "$START c \do-not-query-localhost: no #set by $SCRIPT" $unboundconfig -i
+		# create catch all forward zone
+		echo -e "##### Settings from $SCRIPT #####" >> $unboundconfig
+		echo -e 'forward-zone:' >> $unboundconfig
+		echo -e '  name: "."' >> $unboundconfig
+		echo -e "  forward-addr: $IP_CLEAN@$DNSPORT_CLEAN" >> $unboundconfig
+	fi
+print_strong "\n$unboundconfig settings updated to:"
+print_green "--------------------------------------------------------"
+print_table "do-not-query-localhost: no"
+print_table ""
+print_table 'forward-zone:'
+print_table '  name: "."'
+print_table "  forward-addr: $IP_CLEAN@$DNSPORT_CLEAN"
+print_green "--------------------------------------------------------"
+fi
+}
+
+restart_services(){
+# add / restart services - dnscrypt must be restarted first
+echo ""
+for srv in "dnscrypt-proxy" "unbound"; do
+        if which $srv 1> /dev/null; then
+                rc-status default | grep $srv 1> /dev/null
+                if [ "$?" != "0" ]; then
+                        print_green "Adding $srv to Default Run Level"
+                        rc-update add $srv default
+                fi
+                rc-service $srv restart
+        fi
+done
+}
+
+modify_config(){
+choose_ip; choose_port
+
+# update dnscrypt listening ip & port
+LINE=$(sed -n '/DNSCRYPT_LOCALIP=/=' $config)
+sed "$LINE c DNSCRYPT_LOCALIP=$IP_CLEAN:$DNSPORT_CLEAN" $config -i
+
+# update dhclient.conf
+if [ -f $dhcpconfig ]; then
+	if grep 'supersede domain-name-servers' $dhcpconfig 1>/dev/null; then
+		LINE=$(sed -n '/supersede domain-name-servers/=' $dhcpconfig)
+		sed "$LINE c supersede domain-name-servers $IP" $dhcpconfig -i
+	else
+		echo "supersede domain-name-servers $IP" >> $dhcpconfig
+	fi
+fi
+
+# update resolv.conf & unbound
+LINE=$(sed -n '/nameserver/=' /etc/resolv.conf)
+sed "$LINE c nameserver 127.0.0.1" /etc/resolv.conf -i
+if [ "$removecache" != "Y" ] && [ "$removecache" != "y" ]; then
+	update_unbound
+fi
+
+restart_interface
+
+print_strong "\n/etc/conf.d/dnscrypt-proxy Listening Address updated to:"
+print_green "--------------------------------------------------------"
+print_table "DNSCRYPT_LOCALIP=$IP_CLEAN:$DNSPORT_CLEAN"
+print_green "--------------------------------------------------------\n"
+}
+
+rm_loopback(){
+START=$(sed -n "\%Settings from $SCRIPT%=" /etc/network/interfaces)
+LINE=$(expr $START + 4)
+sed -i ''$START','$LINE'd' /etc/network/interfaces
+print_green "2nd Loopback interface removed"
+}
+
+# END Functions ###################################################################################
+
+# Do some sanity checking.
+if [ $(/usr/bin/id -u) != "0" ]; then
+   die 'DNScrypt Setup must be run by root'
+fi
+
+##### Download DNS Resolver details ################################################################
+
+url='https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv'
+output='/tmp/dnscrypt.list'
+
+echo -e "Retrieving current list of free DNS Resolvers\n"
+wget -q --no-check-certificate $url -O $output
+sed -i 's|\"||g' $output
+
+totalservers=$(cat $output | tail -n +2 | wc -l)
+
+if [ $totalservers = 0 ]; then
+	die "Could not contact $url"
+fi
+
+# colour table ##################################################################################
+
+colourheading=$(awk 'BEGIN { format = "%-8s%-35s%-30s%-10s%-10s%-10s%-25s\n"
+	printf format, "#", "Name", "Location", "DNSSEC", "No Logs", "Namecoin", "Resolver Address" }')
+
+colourline=$(awk 'BEGIN { format = "%-8s%-35s%-30s%-10s%-10s%-10s%-25s\n"
+	printf format, "----", "----------------------------------------", "------------------------------", "----------",\
+			"----------", "----------", "-----------------------------------" }')
+
+print_green "$colourheading"
+print_green "$colourline"
+
+tmpfile=$(mktemp)
+
+cat $output | awk 'BEGIN{FS=""}{gsub(/,\ /,"\ "); print}' | tail -n +2 > $tmpfile
+
+awk -F"\," 'BEGIN {format="%-8s%-35s%-30s%-10s%-10s%-10s%-25s\n"}{ printf format, "\["NR"\]",$1,$4,$8,$9,$10,$11}' $tmpfile
+
+print_green "$colourline"
+print_question "Please choose a DNS Resolver for dnscrypt-proxy to query:" "[1 - $totalservers]"
+
+###### Process Input #############################################################################
+
+while :
+do
+	read DNS
+	# Sanitize input to an integer
+	export DNS_CLEAN="`echo "${DNS}" | tr -cd '[:[0-9]:]'`"
+
+	if [ $DNS_CLEAN -gt 0 2>/dev/null ] && [ $DNS_CLEAN -le $totalservers 2>/dev/null ]; then
+		break
+	else
+		#move the cursor & clear the line
+		echo -en "\033[1A\033[67C\033[K"
+	fi
+done
+
+RESOLVER=$(cat $tmpfile | tr -d "\"" | tr "," ";" | sed -n "$DNS_CLEAN"p |awk -F';' '{print $11}')
+PROVIDER=$(cat $tmpfile | tr -d "\"" | tr "," ";" | sed -n "$DNS_CLEAN"p |awk -F';' '{print $12}')
+PUBKEY=$(cat $tmpfile | tr -d "\"" | tr "," ";" | sed -n "$DNS_CLEAN"p |awk -F';' '{print $13}')
+
+######## END Changes ###########################################################################
+
+if [ ! -f "$config" ]; then
+	touch $config
+	echo "DNSCRYPT_LOGFILE=/var/log/dnscrypt-proxy/dnscrypt-proxy.log" >> $config
+	echo "DNSCRYPT_LOCALIP=127.0.0.1:53" >> $config
+fi
+
+# remove existing Resolver config
+if grep "RESOLVER" $config 1> /dev/null; then
+	sed -e '/RESOLVER/d' -e '/PROVIDER/d' -e '/PUBKEY/d' $config -i
+fi
+
+# update Resolver config
+echo "RESOLVER=$RESOLVER" >> $config
+echo "PROVIDER=$PROVIDER" >> $config
+echo "PUBKEY=$PUBKEY" >> $config
+
+print_strong "\nResolver Settings updated in:" "$config"
+print_green "---------------------------------------------------------------------------------------------"
+print_table "RESOLVER   :" "$RESOLVER"
+print_table "PROVIDER   :" "$PROVIDER"
+print_table "PUBLIC KEY :" "$PUBKEY"
+print_green "---------------------------------------------------------------------------------------------"
+
+# install unbound
+if ! which unbound 1> /dev/null; then
+	print_question "Install Unbound (Caching DNS Server)" "[ Y / N: Default ]"
+	read installsrv
+	if [ "$(echo $installsrv | tr '[A-Z]' '[a-z]')" = "y" ]; then
+	      apk add -q unbound
+	else
+	      echo "nameserver 127.0.0.1" > /etc/resolv.conf
+	fi
+fi
+
+# check for / setup secondary loopback for dns caching
+if which unbound 1> /dev/null && ! grep "address 127.0.0.2" /etc/network/interfaces 1> /dev/null; then
+	IP=127.0.0.2
+	echo "##### Settings from $SCRIPT #####" >> /etc/network/interfaces
+	echo "auto lo:1" >> /etc/network/interfaces
+	echo "iface lo:1 inet static" >> /etc/network/interfaces
+	echo "address $IP" >> /etc/network/interfaces
+	echo "netmask 255.0.0.0" >> /etc/network/interfaces
+	ifconfig lo:1 $IP up
+fi
+
+# modify caching
+if grep "address 127.0.0.2" /etc/network/interfaces 1> /dev/null && [ ! $installsrv ]; then
+	print_question "\nRemove DNS Caching (Unbound) / Secondary loopback device ?" "[ Y / N: Default ]"; read removecache
+	if [ "$(echo $removecache | tr '[A-Z]' '[a-z]')" = "y" ]; then
+		# remove loopback settings
+		rm_loopback
+		echo -e ""; rc-service unbound stop; apk del unbound
+	else
+		print_green "\nSecondary Loopback for DNS Caching configured @ 127.0.0.2"
+		IP=127.0.0.2
+	fi
+fi
+
+# modify ip / ports
+if [ $installsrv ] || [ "$(echo $removecache | tr '[A-Z]' '[a-z]')" = "y" ]; then
+	modify_config
+elif grep -q 127.0.0.2 /etc/network/interfaces && ! which unbound 1> /dev/null; then
+	rm_loopback
+	kill $(cat /var/run/unbound/unbound.pid)
+	modify_config
+else
+	print_question "\nModify dnscrypt-proxy ip / port ?" "[ Y / N: default ]"; read updateip
+	if [ "$(echo $updateip | tr '[A-Z]' '[a-z]')" = "y" ]; then
+		modify_config
+	fi
+fi
+
+if [ "$RESTART_CLEAN" != "" ]; then
+	ifdown $RESTART_CLEAN && ifup $RESTART_CLEAN
+	print_green "Interface $RESTART_CLEAN restarted"
+fi
+
+restart_services
+
+exit 0
+