Skip to content

fix: 补齐 nat_output DNS 劫持保护 #5223

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eyaeya wants to merge 1 commit into from
Closed

fix: 补齐 nat_output DNS 劫持保护 #5223

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 15 additions & 13 deletions luci-app-openclash/root/etc/init.d/openclash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1351,7 +1351,7 @@ if [ -n "$FW4" ]; then
nft insert rule inet fw4 dstnat position 0 meta l4proto {tcp,udp} th dport 53 ether saddr @lan_ac_white_macs counter redirect to "$DNSPORT" comment \"OpenClash DNS Hijack\"
fi
fi
if [ "$router_self_proxy" = 1 ]; then
if [ "$router_self_proxy" = 1 ] && ! fw4_has_dns_hijack_rule nat_output ipv4; then
nft 'add chain inet fw4 nat_output { type nat hook output priority -1; }'
nft insert rule inet fw4 nat_output position 0 skgid != 65534 meta l4proto {tcp,udp} th dport 53 ip daddr {127.0.0.1} counter redirect to "$DNSPORT" comment \"OpenClash DNS Hijack\"
fi
Expand All @@ -1373,7 +1373,7 @@ if [ -n "$FW4" ]; then
nft add rule inet fw4 openclash_dns_redirect meta l4proto {tcp,udp} th dport 53 ether saddr @lan_ac_white_macs counter redirect to "$dns_port" comment \"OpenClash DNS Hijack\"
fi
nft 'insert rule inet fw4 dstnat position 0 meta l4proto {tcp,udp} th dport 53 counter jump openclash_dns_redirect'
if [ "$router_self_proxy" = 1 ]; then
if [ "$router_self_proxy" = 1 ] && ! fw4_has_dns_hijack_rule nat_output ipv4; then
nft 'add chain inet fw4 nat_output { type nat hook output priority -1; }'
nft insert rule inet fw4 nat_output position 0 meta l4proto {tcp,udp} th dport 53 ip daddr {127.0.0.1} meta skgid != 65534 counter redirect to "$dns_port" comment \"OpenClash DNS Hijack\"
fi
Expand Down Expand Up @@ -1696,8 +1696,8 @@ if [ -n "$FW4" ]; then
fi
fi

if ! fw4_has_dns_hijack_rule dstnat ipv6; then
if [ "$enable_redirect_dns" -eq 1 ]; then
if [ "$enable_redirect_dns" -eq 1 ]; then
if ! fw4_has_dns_hijack_rule dstnat ipv6; then
if [ "$lan_ac_mode" != "1" ]; then
ACBLACKDNSFILTER=""
if [ "$lan_ac_mode" = "0" ]; then
Expand All @@ -1713,11 +1713,13 @@ if [ -n "$FW4" ]; then
nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 ip6 saddr @lan_ac_white_ipv6s counter redirect to "$DNSPORT" comment \"OpenClash DNS Hijack\"
nft insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 ether saddr @lan_ac_white_macs counter redirect to "$DNSPORT" comment \"OpenClash DNS Hijack\"
fi
if [ "$router_self_proxy" = 1 ]; then
nft 'add chain inet fw4 nat_output { type nat hook output priority -1; }'
nft insert rule inet fw4 nat_output position 0 skgid != 65534 meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 ip6 daddr {::/0} counter redirect to "$DNSPORT" comment \"OpenClash DNS Hijack\"
fi
elif [ "$enable_redirect_dns" -eq 2 ]; then
fi
if [ "$router_self_proxy" = 1 ] && ! fw4_has_dns_hijack_rule nat_output ipv6; then
nft 'add chain inet fw4 nat_output { type nat hook output priority -1; }'
nft insert rule inet fw4 nat_output position 0 skgid != 65534 meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 ip6 daddr {::/0} counter redirect to "$DNSPORT" comment \"OpenClash DNS Hijack\"
fi
elif [ "$enable_redirect_dns" -eq 2 ]; then
if ! fw4_has_dns_hijack_rule dstnat ipv6; then
if [ "$lan_ac_mode" != "1" ]; then
ACBLACKDNSFILTER=""
if [ "$lan_ac_mode" = "0" ]; then
Expand All @@ -1734,10 +1736,10 @@ if [ -n "$FW4" ]; then
nft add rule inet fw4 openclash_dns_redirect meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 ether saddr @lan_ac_white_macs counter redirect to "$dns_port" comment \"OpenClash DNS Hijack\"
fi
nft 'insert rule inet fw4 dstnat position 0 meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 counter jump openclash_dns_redirect'
if [ "$router_self_proxy" = 1 ]; then
nft 'add chain inet fw4 nat_output { type nat hook output priority -1; }'
nft insert rule inet fw4 nat_output position 0 meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 ip6 daddr {::/0} meta skgid != 65534 counter redirect to "$dns_port" comment \"OpenClash DNS Hijack\"
fi
fi
if [ "$router_self_proxy" = 1 ] && ! fw4_has_dns_hijack_rule nat_output ipv6; then
nft 'add chain inet fw4 nat_output { type nat hook output priority -1; }'
nft insert rule inet fw4 nat_output position 0 meta nfproto {ipv6} ip6 nexthdr {tcp,udp} th dport 53 ip6 daddr {::/0} meta skgid != 65534 counter redirect to "$dns_port" comment \"OpenClash DNS Hijack\"
fi
fi

Expand Down
35 changes: 35 additions & 0 deletions tests/fw4_dns_hijack_guard_test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,4 +64,39 @@ assert_status 0 fw4_has_dns_hijack_rule dstnat ipv6
assert_status 1 fw4_has_dns_hijack_rule nat_output ipv4
assert_status 0 fw4_has_dns_hijack_rule nat_output ipv6

assert_nat_output_insert_guarded() {
family="$1"
insert_text="$2"

awk -v family="$family" -v insert_text="$insert_text" '
$0 ~ "fw4_has_dns_hijack_rule nat_output " family {
guard_window = 5
}
$0 ~ "nft insert rule inet fw4 nat_output" && index($0, insert_text) && $0 ~ "OpenClash DNS Hijack" {
seen++
if (guard_window <= 0) {
print "nat_output DNS insert is not guarded for " family ": " $0 > "/dev/stderr"
bad = 1
}
}
{
if (guard_window > 0) {
guard_window--
}
}
END {
if (seen != 2) {
print "expected two guarded nat_output DNS inserts for " family ", got " seen > "/dev/stderr"
exit 1
}
if (bad) {
exit 1
}
}
' "$INIT_SCRIPT"
}

assert_nat_output_insert_guarded ipv4 'ip daddr {127.0.0.1}'
assert_nat_output_insert_guarded ipv6 'ip6 daddr {::/0}'

echo "fw4_dns_hijack_guard_test.sh: PASS"