net-dns/dnscrypt-proxy: ease of use improvements.

Make it possible to select easily select resolver using the
upstream-provided CSV file, rather than having to manually specify
parameters. Keep the default as the same Cisco OpenDNS provider.

Also use ephemeral keys by default to improve security.

Package-Manager: portage-2.2.24

2 files changed, 73 insertions, 0 deletions

diff --git a/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.confd-1.6.0-r1 b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.confd-1.6.0-r1
new file mode 100644
index 000000000000..5b1b28dd5ab1
--- /dev/null
+++ b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.confd-1.6.0-r1
@@ -0,0 +1,13 @@
+DNSCRYPT_LOCALIP=127.0.0.1
+DNSCRYPT_LOCALPORT=53
+DNSCRYPT_USER=dnscrypt
+DNSCRYPT_OPTIONS="--ephemeral-keys"
+# Pick exactly ONE of the following sets:
+# option 1) selection from CSV file, uses the first column as the key
+DNSCRYPT_RESOLVER_NAME=cisco # Cisco OpenDNS
+DNSCRYPT_RESOLVERS_LIST=/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv
+# option 2) manually specified parameters
+#DNSCRYPT_RESOLVERIP=203.0.133.53
+#DNSCRYPT_RESOLVERPORT=443
+#DNSCRYPT_PROVIDER_NAME=2.dnscrypt-cert.example.com
+#DNSCRYPT_PROVIDER_KEY=1234:5678:90AB:CDEF:DEAD:BEEF:CAFE:BEA7:1234:5678:90AB:CDEF:DEAD:BEEF:CAFE:BEA7
diff --git a/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.initd-1.6.0-r1 b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.initd-1.6.0-r1
new file mode 100644
index 000000000000..e79f8f98d747
--- /dev/null
+++ b/net-dns/dnscrypt-proxy/files/dnscrypt-proxy.initd-1.6.0-r1
@@ -0,0 +1,60 @@
+#!/sbin/runscript
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+DNSCRYPT_LOGFILE=${DNSCRYPT_LOGFILE:-/var/log/dnscrypt-proxy.log}
+DNSCRYPT_RESOLVERS_LIST=${DNSCRYPT_RESOLVERS_LIST:-/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv}
+
+rundir=${rundir:-/var/run/dnscrypt-proxy}
+pidfile=${pidfile:-${rundir}/dnscrypt-proxy.pid}
+rundir=${rundir:-/var/run/dnscrypt-proxy}
+runas_user=${runas_user:-dnscrypt}
+runas_group=${runas_user:-dnscrypt}
+
+depend() {
+	use net
+	before dns
+	after logger
+}
+
+start() {
+	if [ ! -d "${rundir}" ]; then
+		mkdir "${rundir}"
+		if [ -n "${runas_user}" ]; then
+			touch "${DNSCRYPT_LOGFILE}"
+			chown ${runas_user}:${runas_group} "${DNSCRYPT_LOGFILE}"
+			chown -R ${runas_user}:${runas_group} "${rundir}"
+		fi
+	fi
+
+	if [ -n "$DNSCRYPT_RESOLVER_NAME" -a -n "$DNSCRYPT_RESOLVERIP" ]; then
+		eerror "You must set exactly one of DNSCRYPT_RESOLVER_NAME or DNSCRYPT_RESOLVERIP!"
+		return 1
+	elif [ -n "$DNSCRYPT_RESOLVER_NAME" ]; then
+		resolver_opts="--resolvers-list=${DNSCRYPT_RESOLVERS_LIST} --resolver-name=${DNSCRYPT_RESOLVER_NAME}"
+	elif [ -n "$DNSCRYPT_RESOLVERIP" ]; then
+		resolver_opts="--resolver-address=${DNSCRYPT_RESOLVERIP}:${DNSCRYPT_RESOLVERPORT} --provider-name=${DNSCRYPT_PROVIDER_NAME} --provider-key=${DNSCRYPT_PROVIDER_KEY}"
+	else
+		eerror "You must set exactly one of DNSCRYPT_RESOLVER_NAME or DNSCRYPT_RESOLVERIP!"
+		return 1
+	fi
+
+	ebegin "Starting dnscrypt-proxy"
+	start-stop-daemon --start --quiet \
+		--exec /usr/sbin/dnscrypt-proxy \
+		-- \
+		${DNSCRYPT_OPTIONS} \
+		--pidfile="${pidfile}" \
+		--logfile="${DNSCRYPT_LOGFILE}" \
+		--daemonize --user=${runas_user} \
+		--local-address=${DNSCRYPT_LOCALIP}:${DNSCRYPT_LOCALPORT} \
+		$resolver_opts
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping dnscrypt-proxy"
+	start-stop-daemon --stop --quiet --exec /usr/sbin/dnscrypt-proxy
+	eend $?
+}