红岩AB区翻墙的一些脚本

domains2unbound.py

from sys import stdin, stdout

domains = set()

for line in stdin:
    line = line.strip()

    if line.startswith('.'):
        line = line[1:]

    if line not in domains:
        stdout.write('local-zone: "*.{0}" redirect\n    local-data: "{0} IN A 2.3.3.3"\n\n'.format(line))
        domains.add(line)

gfwlist2domains.py

from sys import stdin, stdout, stderr
from urllib.parse import urlparse
import re


domain_pattern = re.compile(r'^\.?([a-zA-Z]+\.)+[a-zA-Z]+\.?$')

for line in stdin:
    line = line.strip()
    if not line or line.startswith('!') or line.startswith('@@'):
        stderr.write('ignore line: ' + line + '\n')
        continue

    if line.startswith('||'):
        print(line[2:])
    elif line.startswith('|'):
        print(urlparse(line[1:]).hostname)
    elif line.startswith('.'):
        print(line.split('/')[0])
    elif domain_pattern.match(line):
        print(line)
    else:
        stderr.write('ignore line: ' + line + '\n')

init.sh

#!/bin/sh

NGINX_UID=$(id nginx)

ip route add default dev vpn table $NGINX_UID
ip rule add pref 10000 fwmark $NGINX_UID lookup $NGINX_UID
iptables -t mangle -A OUTPUT -m owner --owner-uid $NGINX_UID -j MARK --set-mark $NGINX_UID

#iptables -t nat -A PREROUTING ! -i lo -p udp --dport 53 -j REDIRECT --to-ports 53

nginx-http.conf

server {
    resolver 8.8.8.8;
    listen 0.0.0.0:80;
    listen [::]:80;
    location / {
        proxy_pass $scheme://$host$request_uri;
        proxy_set_header Host $http_host;
        proxy_buffers 256 4k;
        proxy_max_temp_file_size 0k;
    }
}

nginx-sni.conf

stream {
    server {
        listen 443;
        ssl_preread on;
        resolver 8.8.8.8;
        proxy_pass $ssl_preread_server_name:$server_port;
    }
}

update.sh

#!/bin/bash

function get-gfwlist ()
{
        curl https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt | base64 -d
}

function update ()
{
        get-gfwlist | python3 gfwlist2domains.py | python3 domains2unbound.py > /etc/unbound/unbound.conf.d/gfwlist.conf
        systemctl restart unbound
}

update