From 470a4ba99507eff9ffc3c5c6e944494f352701a6 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Mon, 8 May 2023 10:22:43 +0200 Subject: [PATCH] dns/dnscrypt-proxy: fix listening madness, why do DNS services reinvent wheels? Also fix validation against other DNS services using the port already. See: https://github.com/DNSCrypt/dnscrypt-proxy/issues/1217 --- dns/dnscrypt-proxy/Makefile | 1 + dns/dnscrypt-proxy/pkg-descr | 3 +- .../etc/inc/plugins.inc.d/dnscryptproxy.inc | 15 +-- .../models/OPNsense/Dnscryptproxy/General.php | 98 ++++++++++++++----- .../models/OPNsense/Dnscryptproxy/General.xml | 4 +- .../views/OPNsense/Dnscryptproxy/general.volt | 68 ++++++------- 6 files changed, 115 insertions(+), 74 deletions(-) diff --git a/dns/dnscrypt-proxy/Makefile b/dns/dnscrypt-proxy/Makefile index 39d70dd46..fd99efd4d 100644 --- a/dns/dnscrypt-proxy/Makefile +++ b/dns/dnscrypt-proxy/Makefile @@ -1,5 +1,6 @@ PLUGIN_NAME= dnscrypt-proxy PLUGIN_VERSION= 1.13 +PLUGIN_REVISION= 1 PLUGIN_COMMENT= Flexible DNS proxy supporting DNSCrypt and DoH PLUGIN_DEPENDS= dnscrypt-proxy2 PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/dns/dnscrypt-proxy/pkg-descr b/dns/dnscrypt-proxy/pkg-descr index 76d19e885..660be17e3 100644 --- a/dns/dnscrypt-proxy/pkg-descr +++ b/dns/dnscrypt-proxy/pkg-descr @@ -8,7 +8,8 @@ Plugin Changelog 1.13 * Add necessary hooks to allow the plugin to be used as a standalone core DNS server -* Changed default listening addresses to 0.0.0.0/:: for new users +* Changed default listening addresses to 0.0.0.0 for new users +* Prevent using a port being used by another DNS service 1.12 diff --git a/dns/dnscrypt-proxy/src/etc/inc/plugins.inc.d/dnscryptproxy.inc b/dns/dnscrypt-proxy/src/etc/inc/plugins.inc.d/dnscryptproxy.inc index aeb8ef1ff..e236cd683 100644 --- a/dns/dnscrypt-proxy/src/etc/inc/plugins.inc.d/dnscryptproxy.inc +++ b/dns/dnscrypt-proxy/src/etc/inc/plugins.inc.d/dnscryptproxy.inc @@ -51,25 +51,18 @@ function dnscryptproxy_services() $model = new \OPNsense\Dnscryptproxy\General(); $ports = []; - /* - * DNS service is eligable for core use when both 0.0.0.0 and :: are set. - * In order to provide dual stack ports we need to intersect the resulting - * ports for each address family. - */ - $localhost4 = []; - $localhost6 = []; - + /* DNS service is eligable for core use when either 0.0.0.0 or :: are set */ foreach (explode(',', (string)$model->listen_addresses) as $addrport) { if (preg_match('/^0\.0\.0\.0:([\d]+)$/', $addrport, $matches)) { - $localhost4[$matches[1]] = 1; + $ports[$matches[1]] = 1; } elseif (preg_match('/^\[::\]:([\d]+)$/', $addrport, $matches)) { - $localhost6[$matches[1]] = 1; + $ports[$matches[1]] = 1; } } $services[] = [ /* the port may still be something other than 53, but it's safe to register a conflict for it */ - 'dns_ports' => array_keys(array_intersect_key($localhost4, $localhost6)), + 'dns_ports' => array_keys($ports), 'description' => gettext('DNSCrypt-Proxy'), 'configd' => [ 'restart' => ['dnscryptproxy restart'], diff --git a/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.php b/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.php index a10bb4ad9..e8ddbafa3 100644 --- a/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.php +++ b/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.php @@ -1,35 +1,85 @@ - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, - INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY - AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE - AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, - OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF - SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN - CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. -*/ + * Copyright (C) 2018 Michael Muenz + * Copyright (C) 2023 Deciso B.V. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ namespace OPNsense\Dnscryptproxy; use OPNsense\Base\BaseModel; +use OPNsense\Core\Backend; +use Phalcon\Messages\Message; class General extends BaseModel { + public function performValidation($validateFullModel = false) + { + $messages = parent::performValidation($validateFullModel); + + if ( + ($validateFullModel || $this->enabled->isFieldChanged() || $this->listen_addresses->isFieldChanged()) && + !empty((string)$this->enabled) + ) { + $any4 = []; + $any6 = []; + $ports = []; + + /* grab ALL ports to run a validation against, safer for user in the long run */ + foreach (explode(',', (string)$this->listen_addresses) as $addrport) { + if (preg_match('/(.*):([\d]+)$/', $addrport, $matches)) { + $ports[$matches[2]] = 1; + if ($matches[1] == '0.0.0.0') { + $any4[$matches[2]] = 1; + } elseif ($matches[1] == '[::]') { + $any6[$matches[2]] = 1; + } + } + } + + foreach (json_decode((new Backend())->configdpRun('service list'), true) as $service) { + if (empty($service['dns_ports'])) { + continue; + } + if ($service['name'] != 'dnscrypt-proxy' && count(array_intersect(array_keys($ports), $service['dns_ports']))) { + $messages->appendMessage(new Message( + sprintf(gettext('%s is currently using one of these ports.'), $service['description']), + $this->listen_addresses->getInternalXMLTagName() + )); + break; + } + } + + if (count(array_keys(array_intersect_key($any4, $any6)))) { + $messages->appendMessage(new Message( + gettext('Cannot configure on both "0.0.0.0" and "::" as the first occurence will be treated as dual-stack.'), + $this->listen_addresses->getInternalXMLTagName() + )); + } + } + + return $messages; + } } diff --git a/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.xml b/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.xml index 4dd48bdfd..0978e7a5a 100644 --- a/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.xml +++ b/dns/dnscrypt-proxy/src/opnsense/mvc/app/models/OPNsense/Dnscryptproxy/General.xml @@ -8,11 +8,11 @@ Y - 0.0.0.0:5353,[::]:5353 + 0.0.0.0:5353 Y - 0 + 1 Y diff --git a/dns/dnscrypt-proxy/src/opnsense/mvc/app/views/OPNsense/Dnscryptproxy/general.volt b/dns/dnscrypt-proxy/src/opnsense/mvc/app/views/OPNsense/Dnscryptproxy/general.volt index c9106294b..606b63196 100644 --- a/dns/dnscrypt-proxy/src/opnsense/mvc/app/views/OPNsense/Dnscryptproxy/general.volt +++ b/dns/dnscrypt-proxy/src/opnsense/mvc/app/views/OPNsense/Dnscryptproxy/general.volt @@ -1,31 +1,29 @@ {# - -OPNsense® is Copyright © 2014 – 2018 by Deciso B.V. -This file is Copyright © 2018 by Michael Muenz -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, -are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. - -THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, -INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY -AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE -AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, -OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF -SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS -INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN -CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE -POSSIBILITY OF SUCH DAMAGE. - -#} + # Copyright (c) 2014-2018 Deciso B.V. + # Copyright (c) 2018 Michael Muenz + # All rights reserved. + # + # Redistribution and use in source and binary forms, with or without modification, + # are permitted provided that the following conditions are met: + # + # 1. Redistributions of source code must retain the above copyright notice, + # this list of conditions and the following disclaimer. + # + # 2. Redistributions in binary form must reproduce the above copyright notice, + # this list of conditions and the following disclaimer in the documentation + # and/or other materials provided with the distribution. + # + # THIS SOFTWARE IS PROVIDED “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, + # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + # AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + # AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + # POSSIBILITY OF SUCH DAMAGE. + #}