ddwrt-ultimate-dns-leak-test.sh

#!/bin/sh
#DEBUG=; set -x # comment/uncomment to disable/enable debug mode

#          name: ddwrt-ultimate-dns-leak-test.sh
#       version: 1.0.3, 25-aug-2020, by eibgrad
#       purpose: detect and report dns leaks when using VPNs
#   script type: startup (autostart)
# documentation: https://bit.ly/ddwrt-ultimate-dns-leak-test-doc
#  installation:
#    1. enable jffs2 (administration->jffs2)
#    2. enable syslogd (services->services->system log)
#    3. use shell (telnet/ssh) to execute one of the following commands:
#         curl -kLs bit.ly/ddwrt-installer|tr -d '\r'|sh -s NkKUUjsn startup
#       or
#         wget -qO - bit.ly/ddwrt-installer|tr -d '\r'|sh -s NkKUUjsn startup
#    4. modify options using vi editor (optional):
#         vi /jffs/etc/config/ddwrt-ultimate-dns-leak-test.startup
#    5. reboot
{
# ------------------------------ BEGIN OPTIONS ------------------------------- #

VPN_ENABLED_ONLY='1' # (0 = check 24/7, 1 = check only if VPN enabled)
NOTIFY_BY_EMAIL='0' # (0 = do NOT notify by email, 1 = notify by email)

MAX_PASS=0 # max number of passes through connection tracking (0=infinite)
MIN_EMAIL_TIME=10 # minimum time (in mins) between email notifications
SLEEP_PASS=60 # time (in secs) between passes (60 recommended)

# outgoing email configuration (optional)
SMTP_SERVER=''
SMTP_PORT=''
SMTP_USERNAME=''
SMTP_PASSWORD=''

# ------------------------------- END OPTIONS -------------------------------- #

# ---------------------- DO NOT CHANGE BELOW THIS LINE ----------------------- #

THIS="$(basename $0)"
LOGGER_THIS="$(echo $THIS | grep -Eo '^.{0,23}')"

# modern builds support nf_conntrack, older builds only ip_conntrack
CTRACK_TBL="$([ -e /proc/net/nf_conntrack ] && \
    echo /proc/net/nf_conntrack || echo /proc/net/ip_conntrack)"

# function _echo( message [priority] )
_echo() {
    echo "$(date): $1"
    logger $([ "$2" ] && echo "-p user.$2") -t "$LOGGER_THIS[$$]" "$1"
}

# function notify_by_email( subject message )
notify_by_email() {
    local server="$SMTP_SERVER"
    local port="$SMTP_PORT"
    local user="$SMTP_USERNAME"
    local password="$SMTP_PASSWORD"
    local from="$user"
    local to="$user"
    local subject="$1"
    local body="$2"

    [[ "$SMTP_SERVER" && "$SMTP_PORT" ]] || return 0

    echo -e "Subject:$subject\n$body\n" | \
        sendmail -S"$server:$port" -au"$user" -ap"$password" -f"$from" "$to"
}

# function report_dns_leak()
report_dns_leak() {
    _echo 'dns leak detected' warn

    local curr_time=$(date +%s)

    # limit time between email notifications to avoid flooding inbox
    [ $((curr_time - last_notify_time)) -lt $((MIN_EMAIL_TIME * 60)) ] && return 0

    [ "$NOTIFY_BY_EMAIL" != '0' ] && \
        notify_by_email "$THIS[$$]" "$(date): dns leak detected"

    last_notify_time=$curr_time
}

# function exit_0()
exit_0() { _echo done; exit 0; }

_echo running

# catch premature exit
trap exit_0 SIGHUP SIGINT SIGTERM

# wait until internet is up and running
while ! ping -qc1 -w3 8.8.8.8 >/dev/null 2>&1; do
    _echo 'waiting for internet access'
    sleep 10
done

# initialize this run
pass_count=0
last_notify_time=0

# monitor connection tracking for dns queries
while :; do
    # dns leak test works for both openvpn and pptp clients
    if [[ "$(nvram get openvpncl_enable)"    == "0" && \
          "$(nvram get pptpd_client_enable)" == "0" && \
          "$VPN_ENABLED_ONLY" != "0" ]]; then
        _echo 'nothing to do'
    else
        while :; do
            if [[ "$(nvram get openvpncl_enable)"    == '0' && \
                  "$(nvram get pptpd_client_enable)" == '0' && \
                  "$VPN_ENABLED_ONLY" != "0" ]]; then
               continue 2
            fi

            if [ $MAX_PASS -gt 0 ]; then
                # quit if we've reached any execution limits
                [ $pass_count -ge $MAX_PASS ] && break 2

                let pass_count++
            fi

            # report dns queries over the WAN/ISP
            if cat $CTRACK_TBL | \
                    grep -Eqm1 " dst=$(nvram get wan_ipaddr) sport=53 "; then
                report_dns_leak
            else
                # report use of ISP's dns server(s)
                while read line; do
                    ip="$(echo $line | awk '/nameserver/{print $2}')"
                    [ "$ip" ] && \
                        cat $CTRACK_TBL | grep -Eqm1 " dst=$ip .* dport=53 " && \
                            { report_dns_leak; break; }
                done < /tmp/resolv.dnsmasq

                [ "$line" ] || _echo 'no dns leaks detected'
            fi

            sleep $SLEEP_PASS
        done
    fi

    sleep $SLEEP_PASS
done

exit_0

} 2>&1 | logger $([ ${DEBUG+x} ] && echo '-p user.debug') \
    -t $(echo $(basename $0) | grep -Eo '^.{0,23}')[$$] &