forked from aarond10/https_dns_proxy
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathoptions.c
More file actions
177 lines (170 loc) · 5.96 KB
/
options.c
File metadata and controls
177 lines (170 loc) · 5.96 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
#include <sys/stat.h>
#include <sys/types.h>
#include <ctype.h>
#include <fcntl.h>
#include <grp.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include "logging.h"
#include "options.h"
// Hack for platforms that don't support O_CLOEXEC.
#ifndef O_CLOEXEC
#define O_CLOEXEC 0
#endif
void options_init(struct Options *opt) {
opt->listen_addr = "127.0.0.1";
opt->listen_port = 5053;
opt->logfile = "-";
opt->logfd = -1;
opt->loglevel = LOG_ERROR;
opt->daemonize = 0;
opt->user = NULL;
opt->group = NULL;
opt->uid = -1;
opt->gid = -1;
//new as from https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
opt->bootstrap_dns = "8.8.8.8,1.1.1.1,8.8.4.4,1.0.0.1,145.100.185.15,145.100.185.16,185.49.141.37";
opt->ipv4 = 0;
opt->resolver_url_prefix = "https://dns.google/resolve?";
opt->edns_client_subnet = "";
opt->curl_proxy = NULL;
opt->use_http_1_1 = 0;
}
int options_parse_args(struct Options *opt, int argc, char **argv) {
int c;
while ((c = getopt(argc, argv, "a:p:du:g:b:4r:e:t:l:vx")) != -1) {
switch (c) {
case 'a': // listen_addr
opt->listen_addr = optarg;
break;
case 'p': // listen_port
opt->listen_port = atoi(optarg);
break;
case 'd': // daemonize
opt->daemonize = 1;
break;
case 'u': // user
opt->user = optarg;
break;
case 'g': // group
opt->group = optarg;
break;
case 'b': // bootstrap dns servers
opt->bootstrap_dns = optarg;
break;
case '4': // ipv4 mode - don't use v6 addresses.
opt->ipv4 = 1;
break;
case 'r': // resolver url prefix
opt->resolver_url_prefix = optarg;
break;
case 'e': // edns_client_subnet
opt->edns_client_subnet = optarg;
break;
case 't': // curl http proxy
opt->curl_proxy = optarg;
break;
case 'l': // logfile
opt->logfile = optarg;
break;
case 'v': // verbose
if (opt->loglevel) {
opt->loglevel--;
}
break;
case 'x': // http/1.1
opt->use_http_1_1 = 1;
break;
case '?':
printf("Unknown option '-%c'", c);
return -1;
default:
printf("Unknown state!");
exit(EXIT_FAILURE);
}
}
if (opt->user) {
struct passwd *p;
if (!(p = getpwnam(opt->user)) || !p->pw_uid) {
printf("Username (%s) invalid.\n", opt->user);
return -1;
}
opt->uid = p->pw_uid;
}
if (opt->group) {
struct group *g;
if (!(g = getgrnam(opt->group)) || !g->gr_gid) {
printf("Group (%s) invalid.\n", opt->group);
return -1;
}
opt->gid = g->gr_gid;
}
// Get noisy about bad security practices.
if (getuid() == 0 && (!opt->user || !opt->group)) {
printf("----------------------------\n"
"WARNING: Running as root without dropping privileges "
"is NOT recommended.\n"
"----------------------------\n");
sleep(1);
}
if (opt->logfile == NULL ||
!strcmp(opt->logfile, "-")) {
opt->logfd = STDOUT_FILENO;
} else if ((opt->logfd = open(opt->logfile,
O_CREAT | O_WRONLY | O_APPEND | O_CLOEXEC,
S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP)) <= 0) {
printf("Logfile '%s' is not writable.\n", opt->logfile);
}
if (opt->resolver_url_prefix == NULL ||
strncmp(opt->resolver_url_prefix, "https://", 8) != 0) {
printf("Resolver prefix (%s) must be a https:// address.\n",
opt->resolver_url_prefix);
return -1;
}
return 0;
}
void options_show_usage(int argc, char **argv) {
struct Options defaults;
options_init(&defaults);
printf("Usage: %s [-a <listen_addr>] [-p <listen_port>]\n", argv[0]);
printf(" [-d] [-u <user>] [-g <group>] [-b <dns_servers>]\n");
printf(" [-r <resolver_url_prefix>] [-e <subnet_addr>]\n");
printf(" [-t <proxy_server>] [-l <logfile>] [-x] [-v]+\n\n");
printf(" -a listen_addr Local IPv4/v6 address to bind to. (%s)\n",
defaults.listen_addr);
printf(" -p listen_port Local port to bind to. (%d)\n",
defaults.listen_port);
printf(" -d Daemonize.\n");
printf(" -u user Optional user to drop to if launched as root.\n");
printf(" -g group Optional group to drop to if launched as root.\n");
printf(" -b dns_servers Comma-separated IPv4/v6 addresses and ports (addr:port)\n");
printf(" of DNS servers to resolve resolver host (e.g. dns.google).\n"\
" When specifying a port for IPv6, enclose the address in [].\n"\
" (%s)\n",
defaults.bootstrap_dns);
printf(" -4 Force IPv4 hostnames for DNS resolvers non IPv6 networks.\n");
printf(" -r resolver_url_prefix The HTTPS path to the JSON resolver URL. default: %s\n",
defaults.resolver_url_prefix);
printf(" -e subnet_addr An edns-client-subnet to use such as \"203.31.0.0/16\".\n"\
" (\"%s\")\n",
defaults.edns_client_subnet);
printf(" -t proxy_server Optional HTTP proxy. e.g. socks5://127.0.0.1:1080\n");
printf(" Remote name resolution will be used if the protocol\n");
printf(" supports it (http, https, socks4a, socks5h), otherwise\n");
printf(" initial DNS resolution will still be done via the\n");
printf(" bootstrap DNS servers.\n");
printf(" -l logfile Path to file to log to. (\"%s\")\n",
defaults.logfile);
printf(" -x Use HTTP/1.1 instead of HTTP/2. Useful with broken\n"
" or limited builds of libcurl. (false)\n");
printf(" -v Increase logging verbosity. (INFO)\n");
options_cleanup(&defaults);
}
void options_cleanup(struct Options *opt) {
if (opt->logfd > 0) {
close(opt->logfd);
}
}