#!/bin/bash
DNS_SERVER="127.0.0.1"
LOG_FILE="/tmp/dnsleak-guard.log"

exec 2>>"$LOG_FILE"

if [ "$EUID" -ne 0 ]; then
    echo "[$(date)] ERROR: must run as root" >> "$LOG_FILE"
    exit 1
fi

log() {
    echo "[$(date)] $1" >> "$LOG_FILE"
}

log "dnsleak-guard started"

while true; do
    CHANGED=0

    while IFS= read -r service; do
        [[ "$service" == "An asterisk"* ]] && continue
        [[ -z "$service" ]] && continue
        [[ "$service" == "*"* ]] && continue

        current=$(networksetup -getdnsservers "$service" 2>/dev/null)
        [ -z "$current" ] && continue
        [[ "$current" == *"aren't any"* ]] && continue

        current_flat=$(echo "$current" | tr '\n' ' ' | sed 's/[[:space:]]*$//')

        if [ "$current_flat" != "$DNS_SERVER" ]; then
            if networksetup -setdnsservers "$service" "$DNS_SERVER" 2>/dev/null; then
                CHANGED=1
                log "[$service] DNS reset: '$current_flat' -> $DNS_SERVER"
            fi
        fi
    done < <(networksetup -listallnetworkservices 2>/dev/null)

    if [ "$CHANGED" -eq 1 ]; then
        dscacheutil -flushcache 2>/dev/null
        killall -HUP mDNSResponder 2>/dev/null
        log "DNS cache flushed"
    fi

    sleep 10
done