Dec 28

Stubby 是一款支持 DNS-over-TLS 的 DNS 服务器,详情可参考:

https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby

要支持 TLS 1.3,必须先编译 OpenSSL 1.1.1

cd /mnt/data/compile/openssl-1.1.1/
./config
make
mkdir lib
cp libssl.a libcrypto.a lib/
cp include/openssl/* include/

注意,为了不影响原系统,并不安装此 OpenSSL 版本!

还需要编译 libyaml 支持库:

cd /mnt/data/compile/yaml-0.2.1/
./configure --enable-static --disable-shared --prefix=/mmc
make install

然后通过 getdns 静态编译出 Stubby:

cd /mnt/data/compile/getdns-1.5.0/
LDFLAGS="-Wl,-static -static -static-libgcc -s" ./configure --disable-shared --without-libunbound --without-libidn --without-libidn2 --with-ssl=/mnt/data/compile/openssl-1.1.1 --with-stubby --with-piddir=/var/run --prefix=/opt
make

就可以在 src 下得到需要的文件:

file src/stubby
src/stubby: ELF 32-bit LSB executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, stripped, with debug_info


Dec 03

项目地址:
https://github.com/aarond10/https_dns_proxy

特色功能:
自从 Google 发布 DNS-Over-HTTPS 服务以来,其实有很多基于此服务写的程序,但是目前看起来这个项目实现的比较好:
C++ 实现,执行文件很小 (30kiB,静态编译的版本约为 900k),比大多数用 Go 写的小得多
基于 Curl HTTP/2 API , 解析延迟极小
单线程无阻塞式查询,适用于嵌入式系统如路由器等
最好作为 DNSMASQ 这样带缓存的 DNS 服务器上游.
由于 Google 这个服务支持 EDNS SUBNET 的查询,所以理论上通过这个服务器查询的结果不会有 CDN 的问题,当然实际还需时间来证明。

Usage: https_dns_proxy [-a ] [-p ]
[-e ] [-d] [-u ] [-g ] [-b ]
[-l ]
-a listen_addr 监听地址. (127.0.0.1)
-p listen_port 监听端口. (5053)
-e subnet_addr edns-client-subnet edns 子网 “203.31.0.0/16”. 建议通过路由器外网地址来计算()
-d 后台运行.
-u user 用户名. (nobody)
-g group 用户组. (nobody)
-b dns_servers 用来解析 dns.google.com 的域名服务器. (8.8.8.8,8.8.4.4)
-t proxy_server 代理服务器,例如: socks5://127.0.0.1:1080,http://127.0.0.1:8080 (注意上面 dns.google.com 的解析不通过此代理!)
-l logfile 日志文件. (-)
-v 开启调试信息. (INFO)

上面的 subnet_addr 可以通过一些命令行获取,例如:

$(nvram get wan_ipaddr | cut -d "." -f 1-2).0.0/16

如果是内网,则应该用:

curl -sS ifconfig.co | cut -d "." -f 1-2
或者
wget http://ipecho.net/plain -O - -q | cut -d "." -f 1-2

这个在 Tomatoware 上静态编译稍微有点麻烦:

1. 首先要编译 curl (及其库)支持 http2,这样用到 nghttp2:

git clone https://github.com/tatsuhiro-t/nghttp2.git
cd nghttp2
autoreconf -i
automake
autoconf
./configure --prefix=/mmc
make
make install

2. 编译 curl :

#!/bin/sh

[ ! -e ./curl.pem ] && wget -qO curl.pem https://curl.haxx.se/ca/cacert.pem

[ -n "$1" ] && ssVersion=$1 || ssVersion="git"

mkdir -p done/${ssVersion}/OpenSSL-opt

echo "Compiling OpenSSL Version..."
make clean
[ ! -e  /opt/sbin/curl.pem ] && cp ./curl.pem /opt/sbin/
./configure --prefix=/mmc --with-ca-bundle=/opt/sbin/curl.pem --with-nghttp2 
--disable-ldap
make -j2 LDFLAGS="-all-static -s" LIBS="-ldl"
[ $? -eq 0 ] || { echo "Compiling OpenSSL failed."; exit 1; }
make install
mv -f src/curl done/${ssVersion}/OpenSSL-opt/

echo -e "Compile Result:n"

file done/${ssVersion}/OpenSSL-opt/curl

echo ""

done/${ssVersion}/OpenSSL-opt/curl -V

3. 静态编译 https_dns_proxy,修改过的 CMakeList.txt:

project(HttpsDnsProxy)
cmake_minimum_required(VERSION 2.8)

#set(CMAKE_BUILD_TYPE "Debug")
set(CMAKE_BUILD_TYPE "Release")

# set(CMAKE_C_FLAGS "-Wall --pedantic -Wno-strict-aliasing")

set(NXJSON_DIR lib/nxjson/)
set(NXJSON_SRC ${NXJSON_DIR}/nxjson.c)

find_path(LIBCARES_INCLUDE_DIR ares.h)
find_path(LIBCURL_INCLUDE_DIR curl/curl.h)
find_path(LIBEV_INCLUDE_DIR ev.h)
include_directories(
${LIBCARES_INCLUDE_DIR} ${LIBCURL_INCLUDE_DIR}
${LIBEV_INCLUDE_DIR} ${NXJSON_DIR} src)

# The main binary
set(TARGET_NAME "https_dns_proxy")
aux_source_directory(src SRC_LIST)
set(SRC_LIST ${SRC_LIST} ${NXJSON_SRC})
add_executable(${TARGET_NAME} ${SRC_LIST})
#set(LIBS ${LIBS} cares curl ev resolv ssl crypto dl z m)
set(LIBS ${LIBS} cares curl ev resolv ssh2 ssl psl crypto dl z m nghttp2)
target_link_libraries(${TARGET_NAME} ${LIBS})

# Link to static libraries if needed
IF(STATIC_LIB)
SET(CMAKE_FIND_LIBRARY_SUFFIXES ".a")
SET(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -s -static")
ENDIF(STATIC_LIB)

install(CODE "MESSAGE(\"Please install manually for now.\")")

然后:

mkdir b
cd b
cmake -DSTATIC_LIB=ON ..
make

file ./https_dns_proxy
./https_dns_proxy: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, stripped


Mar 27

样本是 China Domain List,平台是 ASUS RT-AC68P ARM + Tomato,DNS 解析程序都是静态编译。支持排除/指定解析列表的,都加载了样本域名。没什么太大实际意义,蛋疼而已。

Unbound
Statistics:

Queries sent: 26919
Queries completed: 26832 (99.68%)
Queries lost: 87 (0.32%)

Response codes: NOERROR 20030 (74.65%), SERVFAIL 6714 (25.02%), NXDOMAIN 88 (0.33%)
Average packet size: request 28, response 50
Run time (s): 69.774275
Queries per second: 384.554336

Average Latency (s): 0.238396 (min 0.000236, max 4.992936)
Latency StdDev (s): 0.389999

Pdnsd:
Statistics:

Queries sent: 26919
Queries completed: 23513 (87.35%)
Queries lost: 3406 (12.65%)

Response codes: NOERROR 23234 (98.81%), SERVFAIL 171 (0.73%), NXDOMAIN 108 (0.46%)
Average packet size: request 28, response 59
Run time (s): 314.555457
Queries per second: 74.749935

Average Latency (s): 0.596292 (min 0.000358, max 4.999555)
Latency StdDev (s): 1.019165

dnsforwarder:
Statistics:

Queries sent: 26919
Queries completed: 25401 (94.36%)
Queries lost: 1518 (5.64%)

Response codes: NOERROR 25401 (100.00%)
Average packet size: request 28, response 61
Run time (s): 183.965017
Queries per second: 138.075165

Average Latency (s): 0.416087 (min 0.000227, max 4.999129)
Latency StdDev (s): 0.644664

ChinaDNS:
Statistics:

Queries sent: 26919
Queries completed: 21331 (79.24%)
Queries lost: 5588 (20.76%)

Response codes: NOERROR 21232 (99.54%), SERVFAIL 13 (0.06%), NXDOMAIN 86 (0.40%)
Average packet size: request 28, response 57
Run time (s): 363.248690
Queries per second: 58.722855

Average Latency (s): 0.375668 (min 0.015623, max 4.569101)
Latency StdDev (s): 0.340221

Pcap_DNSProxy
Statistics:

Queries sent: 26919
Queries completed: 25476 (94.64%)
Queries lost: 1443 (5.36%)

Response codes: NOERROR 25205 (98.94%), SERVFAIL 158 (0.62%), NXDOMAIN 113 (0.44%)
Average packet size: request 28, response 57
Run time (s): 513.577050
Queries per second: 49.605020

Average Latency (s): 1.716650 (min 0.059361, max 4.998602)
Latency StdDev (s): 1.207510


Jan 03

就是记录一下,别期望太高,暂时推荐使用的是 DNSPod,PandaDNS 和 AliDNS。

OpenNIC 151.236.20.236,106.186.17.181;
PandaDNS 182.254.158.191,120.27.30.176
dnspod 119.29.29.29
oneDNS 112.124.47.27,114.215.126.16
HelloDNS 123.56.46.123,121.40.144.82
114 114.114.114.114,114.114.115.115
AliDNS 223.5.5.5,223.6.6.6
BaiduDNS 180.76.76.76
DNSPod DNS+ 119.29.29.29,182.254.116.116
CNNIC DNS 1.2.4.8,210.2.4.8
DNS 派 101.226.4.6,218.30.118.6
DNS 派 联通 123.125.81.6,140.207.198.6
Google DNS 8.8.8.8,8.8.4.4
OpenDNS 208.67.222.222,208.67.220.220
V2EX DNS 199.91.73.222,178.79.131.110

Apple TV DNS
上海电信 180.153.225.136
杭州电信 115.29.189.118
广东电信 203.195.182.150
北方联通 118.244.224.124

Tags: ,

Nov 24

下载编译 libsodium:

git clone https://github.com/jedisct1/libsodium.git
cd libsodium
./autogen.sh
./configure --enable-minimal --enable-static --disable-shared --prefix=/mmc
make && make install

静态编译 dnscrypt-proxy:

git clone https://github.com/jedisct1/dnscrypt-proxy.git
cd dnscrypt-proxy
./autogen.sh
./configure LDFLAGS='-Wl,-static -static -static-libgcc -s -Wl,--gc-sections' --prefix=/opt
#1.7.0+
LDFLAGS='-Wl,-static -static -static-libgcc -s' ./configure --prefix=/opt --with-included-ltdl && make -j2
make

:twisted: :twisted: :twisted:


[1/4]  1 2 3 4 >