mirror of
https://github.com/openwrt/packages.git
synced 2026-10-22 06:24:25 +04:00
Stan Grishin
f38b17190a
Maintainer: me
Compile tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Run tested: x86_64, Dell EMC Edge620, OpenWrt 25.12.4
Description:
Update to 2026.05.06 and add IP family option
- Update PKG_VERSION to 2026.05.06
- Update PKG_RELEASE to 1
- Add PKG_CPE_ID for CVE tracking
- Update PKG_MIRROR_HASH and PKG_SOURCE_VERSION
files/etc/config/https-dns-proxy:
- Add comments for default options
- Add new 'force_ip_family' option to control IP family for resolvers
- Update default 'bootstrap_dns' to include IPv6 addresses
files/etc/init.d/https-dns-proxy:
- Add DEFAULT_BOOTSTRAP4 and DEFAULT_BOOTSTRAP6 for family fallbacks
- Change 'global_force_ipv6' to 'global_force_ip_family' for new option
- Modify append_boot to filter bootstrap DNS by 'force_ip_family'
- Implement fallback bootstrap DNS for forced IP families with no
compatible configured servers
- Change 'start_instance' to use 'force_ip_family' instead of
'force_ipv6'
- Ensure 'service_started' and 'service_stopped' always return 0 to
prevent incorrect failure reports for `start`/`reload`/`restart`
commands
files/etc/uci-defaults/50-https-dns-proxy-migrate-options.sh:
- Migrate 'force_ipv6_resolvers' option to 'force_ip_family' option
- Remove old 'force_ipv6_resolvers' option after migration
Signed-off-by: Stan Grishin <stangri@melmac.ca>
57 lines
2.4 KiB
Plaintext
57 lines
2.4 KiB
Plaintext
config main 'config'
|
|
# Answer iCloud Private Relay canary domains so DNS-based filtering keeps working
|
|
option canary_domains_icloud '1'
|
|
# Answer Mozilla canary domain so Firefox does not auto-enable its own DoH
|
|
option canary_domains_mozilla '1'
|
|
# dnsmasq instances to point at the proxy ('*' = all, or space-separated indexes/names)
|
|
option dnsmasq_config_update '*'
|
|
# Force LAN clients onto the proxy by redirecting/rejecting their outbound DNS
|
|
option force_dns '1'
|
|
# Add nftables notrack rules for the proxy's loopback DNS traffic
|
|
option notrack_dns '1'
|
|
# Destination ports intercepted by force_dns (53 = DNS, 853 = DoT)
|
|
list force_dns_port '53'
|
|
list force_dns_port '853'
|
|
# ports listed below are used by some
|
|
# of the dnscrypt-proxy v1 resolvers
|
|
# list force_dns_port '553'
|
|
# list force_dns_port '1443'
|
|
# list force_dns_port '4343'
|
|
# list force_dns_port '4434'
|
|
# list force_dns_port '5443'
|
|
# list force_dns_port '8443'
|
|
# Interface(s) whose outbound DNS is forced to the proxy
|
|
list force_dns_src_interface 'lan'
|
|
# Also (re)start instances on wan6 interface events
|
|
option procd_trigger_wan6 '0'
|
|
# Domain resolved to confirm the resolver works after start ('-' disables the check)
|
|
option heartbeat_domain 'heartbeat.mossdef.org'
|
|
# Seconds to wait before running the heartbeat check
|
|
option heartbeat_sleep_timeout '10'
|
|
# Seconds to wait for the heartbeat domain to resolve
|
|
option heartbeat_wait_timeout '10'
|
|
# User the proxy drops privileges to
|
|
option user 'nobody'
|
|
# Group the proxy drops privileges to
|
|
option group 'nogroup'
|
|
# Default local address instances bind to
|
|
option listen_addr '127.0.0.1'
|
|
# IP family for resolvers: 'auto' (dual-stack, default), 'ipv4' (IPv4 only + -4), 'ipv6' (IPv6 only)
|
|
option force_ip_family 'auto'
|
|
|
|
config https-dns-proxy
|
|
# Plain DNS servers used to resolve the DoH resolver hostname at startup
|
|
option bootstrap_dns '1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001'
|
|
# DoH resolver endpoint (RFC 8484)
|
|
option resolver_url 'https://cloudflare-dns.com/dns-query'
|
|
# Local port this instance listens on
|
|
option listen_port '5053'
|
|
|
|
config https-dns-proxy
|
|
# Plain DNS servers used to resolve the DoH resolver hostname at startup
|
|
option bootstrap_dns '8.8.8.8,8.8.4.4,2001:4860:4860::8888,2001:4860:4860::8844'
|
|
# DoH resolver endpoint (RFC 8484)
|
|
option resolver_url 'https://dns.google/dns-query'
|
|
# Local port this instance listens on
|
|
option listen_port '5054'
|