1 |
commit: 0ee515fb8a5ff324983ec37c38ec1e2dc8d7aaa6 |
2 |
Author: Georgy Yakovlev <ya <AT> sysdump <DOT> net> |
3 |
AuthorDate: Mon Aug 7 20:52:14 2017 +0000 |
4 |
Commit: Lars Wendler <polynomial-c <AT> gentoo <DOT> org> |
5 |
CommitDate: Tue Nov 7 08:48:03 2017 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0ee515fb |
7 |
|
8 |
net-dns/dnscrypt-proxy: bump to 1.9.5, Sanitize initscripts. |
9 |
|
10 |
Greatly simplify initscript to allow symlinking of unit files |
11 |
for openrc. This approach follows upstream recommendation to |
12 |
use config file instead of command line args. |
13 |
Also proper systemd unit with socket activation from upstream. |
14 |
Fixes 588462 |
15 |
|
16 |
Bug: https://bugs.gentoo.org/show_bug.cgi?id=588462 |
17 |
Closes: https://github.com/gentoo/gentoo/pull/5346 |
18 |
|
19 |
net-dns/dnscrypt-proxy/Manifest | 1 + |
20 |
net-dns/dnscrypt-proxy/dnscrypt-proxy-1.9.5.ebuild | 72 ++++++ |
21 |
net-dns/dnscrypt-proxy/files/dnscrypt-proxy.conf | 242 +++++++++++++++++++++ |
22 |
.../dnscrypt-proxy/files/dnscrypt-proxy.confd-r1 | 1 + |
23 |
.../dnscrypt-proxy/files/dnscrypt-proxy.initd-r1 | 11 + |
24 |
.../dnscrypt-proxy/files/dnscrypt-proxy.service-r1 | 18 ++ |
25 |
.../dnscrypt-proxy/files/dnscrypt-proxy.socket-r1 | 9 + |
26 |
7 files changed, 354 insertions(+) |
27 |
|
28 |
diff --git a/net-dns/dnscrypt-proxy/Manifest b/net-dns/dnscrypt-proxy/Manifest |
29 |
index ffe882a34a7..4c6bf97e058 100644 |
30 |
--- a/net-dns/dnscrypt-proxy/Manifest |
31 |
+++ b/net-dns/dnscrypt-proxy/Manifest |
32 |
@@ -1 +1,2 @@ |
33 |
DIST dnscrypt-proxy-1.9.4.tar.gz 1660333 SHA256 40543efbcd56033ac03a1edf4581305e8c9bed4579ac55e6279644f07c315307 SHA512 b19103dc39655f199c85ec69daab949d07adc12e64411d2323308afb398e6ac6563bbc17f2e317bfe1e6c95c810487d8d62da3f4c7f7257bdcf837cd0390bfb0 WHIRLPOOL 4e9494c2765ecf9d625f7b44c0f58c40e491e1334a58552111730ecd3b95cba10667b2bfa2b29e291ccfa97a5678bbbc398dd14e888914bfddc6f7e61bac4a3a |
34 |
+DIST dnscrypt-proxy-1.9.5.tar.bz2 1290573 SHA256 e89f5b9039979ab392302faf369ef7593155d5ea21580402a75bbc46329d1bb6 SHA512 84c0f7587521b3a198292cf20dd71cb592ccf8a9e003abbc62c5ca112f6c5ed27c49b1642cf91f403d52b4147e25f24af540b65cecfcf93814338329097df836 WHIRLPOOL dec0090456a36fcc2b6883c1510c09d7a17459f022b0957eccf5f48272a305f546a760f9fb5c598b3fe86747ff16fac9b6767e3422f999dfca5fb717cd926ea1 |
35 |
|
36 |
diff --git a/net-dns/dnscrypt-proxy/dnscrypt-proxy-1.9.5.ebuild b/net-dns/dnscrypt-proxy/dnscrypt-proxy-1.9.5.ebuild |
37 |
new file mode 100644 |
38 |
index 00000000000..ee775460c6d |
39 |
--- /dev/null |
40 |
+++ b/net-dns/dnscrypt-proxy/dnscrypt-proxy-1.9.5.ebuild |
41 |
@@ -0,0 +1,72 @@ |
42 |
+# Copyright 1999-2017 Gentoo Foundation |
43 |
+# Distributed under the terms of the GNU General Public License v2 |
44 |
+ |
45 |
+EAPI=6 |
46 |
+ |
47 |
+inherit systemd user |
48 |
+ |
49 |
+DESCRIPTION="A tool for securing communications between a client and a DNS resolver" |
50 |
+HOMEPAGE="https://dnscrypt.org" |
51 |
+SRC_URI="https://download.dnscrypt.org/${PN}/${P}.tar.bz2" |
52 |
+ |
53 |
+LICENSE="ISC" |
54 |
+SLOT="0" |
55 |
+KEYWORDS="~amd64 ~arm ~x86" |
56 |
+IUSE="hardened libressl +plugins ssl systemd" |
57 |
+ |
58 |
+RDEPEND=" |
59 |
+ dev-libs/libsodium |
60 |
+ net-libs/ldns |
61 |
+ ssl? ( |
62 |
+ !libressl? ( dev-libs/openssl:0= ) |
63 |
+ libressl? ( dev-libs/libressl:0= ) |
64 |
+ ) |
65 |
+ systemd? ( sys-apps/systemd )" |
66 |
+DEPEND="${RDEPEND} |
67 |
+ virtual/pkgconfig" |
68 |
+ |
69 |
+pkg_setup() { |
70 |
+ enewgroup dnscrypt |
71 |
+ enewuser dnscrypt -1 -1 /var/empty dnscrypt |
72 |
+} |
73 |
+ |
74 |
+src_configure() { |
75 |
+ econf \ |
76 |
+ $(use_enable hardened pie) \ |
77 |
+ $(use_enable plugins) \ |
78 |
+ $(use_enable ssl openssl) \ |
79 |
+ $(use_with systemd) |
80 |
+} |
81 |
+ |
82 |
+src_install() { |
83 |
+ local DOCS=( AUTHORS ChangeLog NEWS README* THANKS *txt ) |
84 |
+ |
85 |
+ default |
86 |
+ |
87 |
+ newinitd "${FILESDIR}"/${PN}.initd-r1 ${PN} |
88 |
+ newconfd "${FILESDIR}"/${PN}.confd-r1 ${PN} |
89 |
+ systemd_newunit "${FILESDIR}"/${PN}.service-r1 ${PN}.service |
90 |
+ systemd_newunit "${FILESDIR}"/${PN}.socket-r1 ${PN}.socket |
91 |
+ insinto /etc |
92 |
+ doins "${FILESDIR}"/${PN}.conf /etc |
93 |
+} |
94 |
+ |
95 |
+pkg_preinst() { |
96 |
+ # ship working default configuration for systemd users |
97 |
+ if use systemd; then |
98 |
+ sed -i 's/Daemonize yes/Daemonize no/g' "${D}"/etc/${PN}.conf |
99 |
+ fi |
100 |
+} |
101 |
+ |
102 |
+pkg_postinst() { |
103 |
+ elog "After starting the service you will need to update your" |
104 |
+ elog "/etc/resolv.conf and replace your current set of resolvers" |
105 |
+ elog "with:" |
106 |
+ elog |
107 |
+ elog "nameserver 127.0.0.1" |
108 |
+ elog |
109 |
+ use systemd && elog "with systemd dnscrypt-proxy ignores LocalAddress setting in the config file" |
110 |
+ use systemd && elog "edit dnscrypt-proxy.socket if you need to change the defaults" |
111 |
+ elog |
112 |
+ elog "Also see https://github.com/jedisct1/dnscrypt-proxy#usage." |
113 |
+} |
114 |
|
115 |
diff --git a/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.conf b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.conf |
116 |
new file mode 100644 |
117 |
index 00000000000..52487c09c87 |
118 |
--- /dev/null |
119 |
+++ b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.conf |
120 |
@@ -0,0 +1,242 @@ |
121 |
+###################################################### |
122 |
+# # |
123 |
+# Sample configuration file for dnscrypt-proxy # |
124 |
+# # |
125 |
+###################################################### |
126 |
+ |
127 |
+ |
128 |
+############## Resolver settings ############## |
129 |
+ |
130 |
+## [CHANGE THIS] Short name of the resolver to use |
131 |
+## Usually the only thing you need to change in this configuration file. |
132 |
+## This corresponds to the first column in the dnscrypt-resolvers.csv file. |
133 |
+## Alternatively, "random" (without quotes) picks a random random resolver |
134 |
+## accessible over IPv4, that doesn't log and supports DNSSEC. |
135 |
+ |
136 |
+ResolverName random |
137 |
+ |
138 |
+ |
139 |
+## Full path to the list of available DNSCrypt resolvers (dnscrypt-resolvers.csv) |
140 |
+## An up-to-date list is available here: |
141 |
+## https://download.dnscrypt.org/dnscrypt-proxy/dnscrypt-resolvers.csv |
142 |
+## and the dnscrypt-update-resolvers.sh script can be used in order to |
143 |
+## automatically download and verify updates. |
144 |
+ |
145 |
+ResolversList /usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv |
146 |
+ |
147 |
+ |
148 |
+## Manual settings, only for a custom resolver not present in the CSV file |
149 |
+ |
150 |
+#ProviderName 2.dnscrypt.some.provider.name.tld |
151 |
+#ProviderKey 0000:1111:2222:3333:4444:5555:6666:7777:8888:9999:AAAA:BBBB:CCCC:DDDD:EEEE:FFFF |
152 |
+#ResolverAddress 111.222.333.444:56789 |
153 |
+ |
154 |
+ |
155 |
+ |
156 |
+############## Process options ############## |
157 |
+ |
158 |
+## [NOT AVAILABLE ON WINDOWS] Run the proxy as a background process. |
159 |
+## Unless you are using systemd, you probably want to change this to "yes" |
160 |
+## after having verified that the rest of the configuration works as expected. |
161 |
+ |
162 |
+Daemonize yes |
163 |
+ |
164 |
+ |
165 |
+## Write the PID number to a file |
166 |
+ |
167 |
+PidFile /run/dnscrypt-proxy.pid |
168 |
+ |
169 |
+ |
170 |
+## [NOT AVAILABLE ON WINDOWS] Start the process, bind the required ports, and |
171 |
+## run the server as a less-privileged system user. |
172 |
+## The value for this parameter is a user name. |
173 |
+ |
174 |
+User dnscrypt |
175 |
+ |
176 |
+ |
177 |
+############## Network/protocol settings ############## |
178 |
+ |
179 |
+## Local address and port to listen to. |
180 |
+## A 127.0.0.x address is recommended for local use, but 0.0.0.0 or |
181 |
+## a specific interface address can be used on a router, or to |
182 |
+## configure a single machine to act as a DNS proxy for different |
183 |
+## devices. |
184 |
+## If the socket is created by systemd, the proxy cannot change the address |
185 |
+## using this option. You should edit systemd's dnscrypt-proxy.socket file |
186 |
+## instead. |
187 |
+ |
188 |
+LocalAddress 127.0.0.1:53 |
189 |
+ |
190 |
+ |
191 |
+## Cache DNS responses to avoid outgoing traffic when the same queries |
192 |
+## are repeated multiple times in a row. |
193 |
+ |
194 |
+LocalCache on |
195 |
+ |
196 |
+ |
197 |
+## Creates a new key pair for every query. |
198 |
+## This prevents logging servers from correlating client public keys with |
199 |
+## IP addresses. However, this option implies extra CPU load, and is not |
200 |
+## very useful with trusted/non-logging servers. |
201 |
+ |
202 |
+EphemeralKeys off |
203 |
+ |
204 |
+ |
205 |
+## Maximum number of active requests waiting for a response. |
206 |
+## Keep it reasonable relative to the expected number of clients. |
207 |
+ |
208 |
+# MaxActiveRequests 250 |
209 |
+ |
210 |
+ |
211 |
+## This is the maximum payload size allowed when using the UDP protocol. |
212 |
+## The default is safe, and rarely needs to be changed. |
213 |
+ |
214 |
+# EDNSPayloadSize 1252 |
215 |
+ |
216 |
+ |
217 |
+## Ignore the time stamps when checking the certificates |
218 |
+## Do not enable this option ever, unless you know that you need it. |
219 |
+ |
220 |
+# IgnoreTimestamps no |
221 |
+ |
222 |
+ |
223 |
+## Do not send queries using UDP. Only use TCP. |
224 |
+## Even if some resolvers mitigate this, DNS over TCP is almost always slower |
225 |
+## than UDP and doesn't offer additional security. |
226 |
+## Only enable this option if UDP doesn't work on your network. |
227 |
+ |
228 |
+# TCPOnly no |
229 |
+ |
230 |
+ |
231 |
+## Forward queries for specific zones to one or more non-DNSCrypt resolvers. |
232 |
+## For instance, this can be used to redirect queries for local domains to |
233 |
+## the router, or queries for an internal domain to an internal DNS server. |
234 |
+## Multiple whitespace-delimited zones and IP addresses can be specified. |
235 |
+## Do not enable this unless you absolutely know you need it. |
236 |
+## If you see useless queries to these zones, you'd better block them with |
237 |
+## the BlackList feature instead of sending them in clear text to the router. |
238 |
+## This uses a plugin that requires dnscrypt-proxy to be compiled with |
239 |
+## the ldns library. |
240 |
+ |
241 |
+#Forward domains:"localdomain" to:"192.168.0.1" |
242 |
+ |
243 |
+ |
244 |
+############## Logging ############## |
245 |
+ |
246 |
+## Log the received DNS queries to a file, so you can watch in real-time what |
247 |
+## is happening on the network. |
248 |
+## The value for this parameter is a full path to the log file. |
249 |
+## The file name can be prefixed with ltsv: in order to store logs using the |
250 |
+## LTSV format (ex: ltsv:/tmp/dns-queries.log). |
251 |
+ |
252 |
+# QueryLogFile /tmp/dns-queries.log |
253 |
+ |
254 |
+ |
255 |
+## Log file to write server errors and information to. |
256 |
+## If you use this tool for privacy, keeping logs of any kind is usually not |
257 |
+## a good idea. |
258 |
+ |
259 |
+# LogFile /var/log/dnscrypt-proxy.log |
260 |
+ |
261 |
+ |
262 |
+## Don't log events with priority above this log level after the service has |
263 |
+## been started up. Default is 6. |
264 |
+## Valid values are between 0 (critical) to 7 (debug-level messages). |
265 |
+ |
266 |
+# LogLevel 6 |
267 |
+ |
268 |
+ |
269 |
+## [NOT AVAILABLE ON WINDOWS] Send server logs to the syslog daemon |
270 |
+## Log entries can optionally be prefixed with a string. |
271 |
+ |
272 |
+Syslog on |
273 |
+# SyslogPrefix dnscrypt |
274 |
+ |
275 |
+ |
276 |
+ |
277 |
+############## Local filtering ############## |
278 |
+ |
279 |
+## If your network doesn't support IPv6, chances are that your |
280 |
+## applications are still constantly trying to resolve IPv6 addresses, |
281 |
+## causing unnecessary slowdowns. |
282 |
+## This causes the proxy to immediately reply to IPv6 requests, |
283 |
+## without having to send a useless request to upstream resolvers, and |
284 |
+## having to wait for a response. |
285 |
+## This uses a plugin that requires dnscrypt-proxy to be compiled with |
286 |
+## the ldns library. |
287 |
+ |
288 |
+BlockIPv6 no |
289 |
+ |
290 |
+ |
291 |
+## Want to filter ads, malware, sensitive or inappropriate websites and |
292 |
+## domain names? This feature can block lists of IP addresses and names |
293 |
+## matching a list of patterns. The list of rules remains private, and |
294 |
+## the filtering process directly happens on your own network. In order |
295 |
+## to filter IP addresses, the list of IPs has to be put into a text |
296 |
+## file, with one IP address per line. Lists of domain names can also be |
297 |
+## blocked as well. Put the list into a text file, one domain per line. |
298 |
+## Domains can include wildcards (*) in order to match patterns. For |
299 |
+## example *sex* will match any name that contains the sex substring, and |
300 |
+## ads.* will match anything starting with ads. The Internet has plenty |
301 |
+## of free feeds of IP addresses and domain names used for malware, |
302 |
+## phishing and spam that you can use with this feature. |
303 |
+## |
304 |
+## This uses a plugin that requires dnscrypt-proxy to be compiled with |
305 |
+## the ldns library. |
306 |
+## |
307 |
+## To enable, uncomment one of the following definitions: |
308 |
+ |
309 |
+## Block query names matching the rules stored in that file: |
310 |
+# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" |
311 |
+ |
312 |
+## Block responses whose IP addresses match IPs stored in that file: |
313 |
+# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt" |
314 |
+ |
315 |
+## Block both domain names and IP addresses: |
316 |
+# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt" |
317 |
+ |
318 |
+## Same as the above + log the blocked queries in a file. |
319 |
+## The log file can be prefixed with ltsv: (ex: ltsv:/tmp/log.txt) in order to |
320 |
+## store logs using the LTSV format. |
321 |
+# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" logfile:"/var/log/dnscrypt-blocked.log" |
322 |
+# BlackList ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log" |
323 |
+# BlackList domains:"/etc/dnscrypt-blacklist-domains.txt" ips:"/etc/dnscrypt-blacklist-ips.txt" logfile:"/var/log/dnscrypt-blocked.log" |
324 |
+ |
325 |
+ |
326 |
+ |
327 |
+############## User identification ############## |
328 |
+ |
329 |
+## Use a client public key for identification |
330 |
+## By default, the client uses a randomized key pair in order to make tracking |
331 |
+## more difficult. This option does the opposite and uses a static key pair, so |
332 |
+## that DNS providers can offer premium services to queries signed with a known |
333 |
+## set of public keys. A client cannot decrypt the received responses without |
334 |
+## also knowing the secret key. |
335 |
+## The value for this property is the path to a file containing the secret key, |
336 |
+## encoded as a hexadecimal string. The corresponding public key is computed |
337 |
+## automatically. |
338 |
+ |
339 |
+# ClientKey /etc/dnscrypt-client-secret.key |
340 |
+ |
341 |
+ |
342 |
+ |
343 |
+############## Monitoring ############## |
344 |
+ |
345 |
+## Do not actually start the proxy, but check that a valid certificate can be |
346 |
+## retrieved from the server and that it will remain valid for the specified |
347 |
+## time period. The process exit code is 0 if a valid certificate can be used, |
348 |
+## 2 if no valid certificates can be used, 3 if a timeout occurred, and 4 if a |
349 |
+## currently valid certificate is going to expire before the given margin. |
350 |
+## Useful in a cron job to monitor your own dnscrypt-servers. |
351 |
+## The margin is specified in minutes. |
352 |
+ |
353 |
+# Test 2880 |
354 |
+ |
355 |
+ |
356 |
+ |
357 |
+############## Recursive configuration ############## |
358 |
+ |
359 |
+## A configuration file can include other configuration files by inserting |
360 |
+## the `Include` directive anywhere (the full path required, no quotes): |
361 |
+ |
362 |
+# Include /etc/dnscrypt-proxy-common.conf |
363 |
|
364 |
diff --git a/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.confd-r1 b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.confd-r1 |
365 |
new file mode 100644 |
366 |
index 00000000000..9137e1836fe |
367 |
--- /dev/null |
368 |
+++ b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.confd-r1 |
369 |
@@ -0,0 +1 @@ |
370 |
+DNSCRYPT_OPTS="/etc/dnscrypt-proxy.conf" |
371 |
|
372 |
diff --git a/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.initd-r1 b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.initd-r1 |
373 |
new file mode 100644 |
374 |
index 00000000000..08196ff1a7c |
375 |
--- /dev/null |
376 |
+++ b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.initd-r1 |
377 |
@@ -0,0 +1,11 @@ |
378 |
+#!/sbin/openrc-run |
379 |
+# Copyright 1999-2017 Gentoo Foundation |
380 |
+# Distributed under the terms of the GNU General Public License v2 |
381 |
+ |
382 |
+command="/usr/sbin/dnscrypt-proxy" |
383 |
+command_args="${DNSCRYPT_OPTS}" |
384 |
+pidfile="/run/${SVCNAME}.pid" |
385 |
+ |
386 |
+depend() { |
387 |
+ use net dns logger |
388 |
+} |
389 |
|
390 |
diff --git a/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.service-r1 b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.service-r1 |
391 |
new file mode 100644 |
392 |
index 00000000000..8cbf5f1a414 |
393 |
--- /dev/null |
394 |
+++ b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.service-r1 |
395 |
@@ -0,0 +1,18 @@ |
396 |
+[Unit] |
397 |
+Description=DNSCrypt client proxy |
398 |
+Documentation=man:dnscrypt-proxy(8) |
399 |
+Requires=dnscrypt-proxy.socket |
400 |
+After=network.target |
401 |
+Before=nss-lookup.target |
402 |
+ |
403 |
+[Install] |
404 |
+Also=dnscrypt-proxy.socket |
405 |
+WantedBy=multi-user.target |
406 |
+ |
407 |
+[Service] |
408 |
+Type=simple |
409 |
+NonBlocking=true |
410 |
+ |
411 |
+# Edit the configuration file appropriately, or the service will not start. |
412 |
+# See https://dnscrypt.org for more information. |
413 |
+ExecStart=/usr/sbin/dnscrypt-proxy /etc/dnscrypt-proxy.conf |
414 |
|
415 |
diff --git a/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.socket-r1 b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.socket-r1 |
416 |
new file mode 100644 |
417 |
index 00000000000..5ee0e4502cf |
418 |
--- /dev/null |
419 |
+++ b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.socket-r1 |
420 |
@@ -0,0 +1,9 @@ |
421 |
+[Unit] |
422 |
+Description=dnscrypt-proxy listening socket |
423 |
+ |
424 |
+[Socket] |
425 |
+ListenStream=127.0.0.53:53 |
426 |
+ListenDatagram=127.0.0.53:53 |
427 |
+ |
428 |
+[Install] |
429 |
+WantedBy=sockets.target |