Index: head/dns/dnscrypt-proxy2/Makefile =================================================================== --- head/dns/dnscrypt-proxy2/Makefile (revision 468171) +++ head/dns/dnscrypt-proxy2/Makefile (revision 468172) @@ -1,63 +1,64 @@ # $FreeBSD$ PORTNAME= dnscrypt-proxy PORTVERSION= 2.0.10 +PORTREVISION= 1 CATEGORIES= dns security ipv6 PKGNAMESUFFIX= 2 MAINTAINER= egypcio@googlemail.com COMMENT= Flexible DNS proxy with support for encrypted protocols LICENSE= ISCL LICENSE_FILE= ${WRKSRC}/LICENSE BUILD_DEPENDS= go:lang/go RUN_DEPENDS= ca_root_nss>=3.35:security/ca_root_nss USE_RC_SUBR= ${PORTNAME} USE_GITHUB= yes GH_ACCOUNT= jedisct1 USERS= _dnscrypt-proxy GROUPS= _dnscrypt-proxy PLIST_SUB= USER="${USERS}" GROUP="${GROUPS}" SUB_LIST= USER="${USERS}" GROUP="${GROUPS}" SUB_FILES= pkg-message PORTDOCS= README.* PORTEXAMPLES= example* CONFLICTS_INSTALL= dnscrypt-proxy OPTIONS_DEFINE= DOCS EXAMPLES do-build: ${RLN} ${WRKSRC}/vendor ${WRKSRC}/src cd ${WRKSRC}/${PORTNAME} && \ ${SETENV} ${MAKE_ENV} ${BUILD_ENV} GOPATH=${WRKSRC} \ go build -ldflags "-s -w" -o ${WRKDIR}/sbin/${PORTNAME} do-install: ${INSTALL_PROGRAM} ${WRKDIR}/sbin/${PORTNAME} ${STAGEDIR}${PREFIX}/sbin do-install-DOCS-on: ${MKDIR} ${STAGEDIR}${DOCSDIR} cd ${WRKSRC} && ${INSTALL_DATA} ${PORTDOCS} ${STAGEDIR}${DOCSDIR} do-install-EXAMPLES-on: ${MKDIR} ${STAGEDIR}${EXAMPLESDIR} cd ${WRKSRC}/${PORTNAME} && ${INSTALL_DATA} ${PORTEXAMPLES} ${STAGEDIR}${EXAMPLESDIR} post-install: ${MKDIR} ${STAGEDIR}${ETCDIR} # After 'install' examples because of the priv drop issue with Go. # Keeping original example files. @${REINPLACE_CMD} -e \ "s#\['127.0.0.1:53', '\[::1\]:53'\]#\['127.0.0.1:5353'\]#" \ ${WRKSRC}/${PORTNAME}/example-${PORTNAME}.toml ${INSTALL_DATA} ${WRKSRC}/${PORTNAME}/example-${PORTNAME}.toml \ ${STAGEDIR}${ETCDIR}/${PORTNAME}.toml.sample .include Index: head/dns/dnscrypt-proxy2/files/dnscrypt-proxy.in =================================================================== --- head/dns/dnscrypt-proxy2/files/dnscrypt-proxy.in (revision 468171) +++ head/dns/dnscrypt-proxy2/files/dnscrypt-proxy.in (revision 468172) @@ -1,42 +1,105 @@ #!/bin/sh # # $FreeBSD$ # # PROVIDE: dnscrypt_proxy # REQUIRE: cleanvar SERVERS # BEFORE: dnsmasq local_unbound named nsmasq pdns unbound # # Options to configure dnscrypt-proxy via /etc/rc.conf: # # dnscrypt_proxy_enable (bool) Enable service on boot # Default: NO # # dnscrypt_proxy_conf (str) Config file to use # Default: %%ETCDIR%%/dnscrypt-proxy.toml # # dnscrypt_proxy_suexec (bool) Run dnscrypt_proxy as root # Default: NO # # dnscrypt_proxy_uid (str) User to run dnscrypt_proxy as # Default: %%USER%% +# +# dnscrypt_proxy_mac_portacl_enable (bool) +# Load mac_portacl module (network port access control policy) +# Default: NO +# +# dnscrypt_proxy_mac_portacl_port (int) +# Port used in the mac_portacl rule +# Default: 53 . /etc/rc.subr name="dnscrypt_proxy" rcvar="dnscrypt_proxy_enable" pidfile="/var/run/dnscrypt-proxy.pid" procname="%%PREFIX%%/sbin/dnscrypt-proxy" load_rc_config $name : ${dnscrypt_proxy_enable:="NO"} : ${dnscrypt_proxy_conf:="%%ETCDIR%%/dnscrypt-proxy.toml"} : ${dnscrypt_proxy_suexec:="NO"} : ${dnscrypt_proxy_uid:="%%USER%%"} +: ${dnscrypt_proxy_mac_portacl_enable:="NO"} +: ${dnscrypt_proxy_mac_portacl_port:="53"} checkyesno dnscrypt_proxy_suexec && dnscrypt_proxy_uid="root" command="/usr/sbin/daemon" command_args="-p ${pidfile} -u ${dnscrypt_proxy_uid} -f ${procname} -config ${dnscrypt_proxy_conf}" +start_precmd="dnscrypt_proxy_precmd" + +dnscrypt_proxy_precmd() { + local reservedlow reservedhigh rules_current rules_dnscrypt rport ruid + + if checkyesno dnscrypt_proxy_mac_portacl_enable ; then + + # Check and load mac_portacl module + if ! kldstat -m mac_portacl >/dev/null 2>&1 ; then + if ! kldload mac_portacl ; then + warn "Could not load mac_portacl module." + return 1 + fi + fi + + # Check and add mac_portacl rules + ruid=$(id -u $dnscrypt_proxy_uid) + rport=$dnscrypt_proxy_mac_portacl_port #smaller variable + rules_current=$(sysctl -n security.mac.portacl.rules) + rules_dnscrypt="uid:${ruid}:tcp:${rport},uid:${ruid}:udp:${rport}" + if [ ! $rules_current = "" ]; then + if ! echo $rules_current | grep "$rules_dnscrypt" >/dev/null 2>&1 ; then + rules_current="${rules_current},${rules_dnscrypt}" + if ! sysctl security.mac.portacl.rules="$rules_current" >/dev/null 2>&1 ; then + warn "Could not insert mac_portacl rules." + return 1 + fi + fi + elif ! sysctl security.mac.portacl.rules=$rules_dnscrypt >/dev/null 2>&1 ; then + warn "Could not insert mac_portacl rules." + return 1 + fi + + # Check and disable net.inet.ip.portrange.* control + reservedlow=$(sysctl -n net.inet.ip.portrange.reservedlow) + reservedhigh=$(sysctl -n net.inet.ip.portrange.reservedhigh) + if [ ! $reservedlow -eq 0 ]; then + if ! sysctl net.inet.ip.portrange.reservedlow=0 >/dev/null 2>&1 ; then + warn "Could not change net.inet.ip.portrange.reservedlow." + return 1 + fi + fi + if [ ! $reservedhigh -eq 0 ]; then + if ! sysctl net.inet.ip.portrange.reservedhigh=0 >/dev/null 2>&1 ; then + warn "Could not change net.inet.ip.portrange.reservedhigh." + return 1 + fi + fi + + fi # dnscrypt_proxy_mac_portacl_enable + + return 0 +} run_rc_command "$1" Index: head/dns/dnscrypt-proxy2/files/pkg-message.in =================================================================== --- head/dns/dnscrypt-proxy2/files/pkg-message.in (revision 468171) +++ head/dns/dnscrypt-proxy2/files/pkg-message.in (revision 468172) @@ -1,52 +1,59 @@ ====================================================================== Version 2 of dnscrypt-proxy is written in Go and therefore isn't capable of dropping privileges after binding to a low port on FreeBSD. By default, this port's daemon will listen on port 5353 (TCP/UDP) as the -%%USER%% user. It's still possible to bind it and listen on port -53 (TCP/UDP), but it's not recommended. +%%USER%% user. + +It's possible to bind it and listen on port 53 (TCP/UDP) with mac_portacl(4) +kernel module (network port access control policy). For this add +dnscrypt_proxy_mac_portacl_enable=YES in your rc.conf. The dnscrypt-proxy +startup script will load mac_portacl and add a rule where %%USER%% user will +be able to bind on port 53 (TCP/UDP). This port can be changed by +dnscrypt_proxy_mac_portacl_port variable in your rc.conf. You also need to +change dnscrypt-proxy config file to use port 53. Below are a few examples on how to redirect local connections from port 5353 to 53. [ipfw] ipfw nat 1 config if lo0 reset same_ports \ redirect_port tcp 127.0.0.1:5353 53 \ redirect_port udp 127.0.0.1:5353 53 ipfw add nat 1 ip from any to 127.0.0.1 via lo0 /etc/rc.conf: firewall_enable="YES" firewall_nat_enable="YES" /etc/sysctl.conf: net.inet.ip.fw.one_pass=0 [pf] set skip on lo0 rdr pass on lo0 proto { tcp udp } from any to port 53 -> 127.0.0.1 port 5353 /etc/rc.conf: pf_enable="YES" [unbound] /etc/rc.conf: local_unbound_enable="YES" /var/unbound/unbound.conf: server: interface: 127.0.0.1 do-not-query-localhost: no /var/unbound/forward.conf: forward-zone: name: "." forward-addr: 127.0.0.1@5353 If you are using local_unbound, DNSSEC is enabled by default. You should comment the "auto-trust-anchor-file" line or change dnscrypt-proxy to use servers with DNSSEC support only. ======================================================================