Skip to content

Commit f5d7efc

Browse files
GedshGedsh
committed
Merge remote-tracking branch 'upstream/master'
2 parents 0624ab7 + e2d09ac commit f5d7efc

436 files changed

Lines changed: 19216 additions & 35157 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.ci/ci-build.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,13 @@ ln dnscrypt-proxy freebsd-arm/
6666
ln ../LICENSE example-dnscrypt-proxy.toml localhost.pem example-*.txt freebsd-arm/
6767
tar czpvf dnscrypt-proxy-freebsd_arm-${PACKAGE_VERSION:-dev}.tar.gz freebsd-arm
6868

69+
go clean
70+
env GOOS=freebsd GOARCH=arm64 go build -mod vendor -ldflags="-s -w"
71+
mkdir freebsd-arm64
72+
ln dnscrypt-proxy freebsd-arm64/
73+
ln ../LICENSE example-dnscrypt-proxy.toml localhost.pem example-*.txt freebsd-arm64/
74+
tar czpvf dnscrypt-proxy-freebsd_arm64-${PACKAGE_VERSION:-dev}.tar.gz freebsd-arm64
75+
6976
go clean
7077
env GOOS=dragonfly GOARCH=amd64 go build -mod vendor -ldflags="-s -w"
7178
mkdir dragonflybsd-amd64
@@ -157,6 +164,13 @@ ln dnscrypt-proxy linux-riscv64/
157164
ln ../LICENSE example-dnscrypt-proxy.toml localhost.pem example-*.txt linux-riscv64/
158165
tar czpvf dnscrypt-proxy-linux_riscv64-${PACKAGE_VERSION:-dev}.tar.gz linux-riscv64
159166

167+
go clean
168+
env CGO_ENABLED=0 GOOS=linux GOARCH=loong64 go build -mod vendor -ldflags="-s -w"
169+
mkdir linux-loong64
170+
ln dnscrypt-proxy linux-loong64/
171+
ln ../LICENSE example-dnscrypt-proxy.toml localhost.pem example-*.txt linux-loong64/
172+
tar czpvf dnscrypt-proxy-linux_loong64-${PACKAGE_VERSION:-dev}.tar.gz linux-loong64
173+
160174
go clean
161175
env GOOS=darwin GOARCH=amd64 go build -mod vendor -ldflags="-s -w"
162176
mkdir macos-x86_64

‎.ci/ci-test.sh‎

Lines changed: 65 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ t() {
1313
}
1414

1515
fail() (
16-
echo "*** Test #${TEST_COUNT} FAILED ***" >&2
16+
echo "*** Test #${TEST_COUNT} FAILED, line: $1 ***" >&2
1717
)
1818

1919
section() {
@@ -26,20 +26,20 @@ t || (
2626
cd ../dnscrypt-proxy
2727
go test -mod vendor
2828
go build -mod vendor -race
29-
) || fail
29+
) || fail $LINENO
3030

3131
section
3232
sed -e "s/127.0.0.1:53/127.0.0.1:${DNS_PORT}/g" -e "s/# server_names =.*/server_names = ['scaleway-fr']/" ../dnscrypt-proxy/example-dnscrypt-proxy.toml >test-dnscrypt-proxy.toml
3333
../dnscrypt-proxy/dnscrypt-proxy -loglevel 3 -config test-dnscrypt-proxy.toml -pidfile /tmp/dnscrypt-proxy.pidfile &
3434
sleep 5
3535

3636
t ||
37-
dig -p${DNS_PORT} . @127.0.0.1 | grep -Fq 'root-servers.net.' || fail
38-
t || dig -p${DNS_PORT} +dnssec . @127.0.0.1 | grep -Fq 'root-servers.net.' || fail
39-
t || dig -p${DNS_PORT} +dnssec . @127.0.0.1 | grep -Fq 'flags: do;' || fail
40-
t || dig -p${DNS_PORT} +short one.one.one.one @127.0.0.1 | grep -Fq '1.1.1.1' || fail
41-
t || dig -p${DNS_PORT} +dnssec dnscrypt.info @127.0.0.1 | grep -Fq 'flags: qr rd ra ad' || fail
42-
t || dig -p${DNS_PORT} +dnssec dnscrypt.info @127.0.0.1 | grep -Fq 'flags: do;' || fail
37+
dig -p${DNS_PORT} . @127.0.0.1 | grep -Fq 'root-servers.net.' || fail $LINENO
38+
t || dig -p${DNS_PORT} +dnssec . @127.0.0.1 | grep -Fq 'root-servers.net.' || fail $LINENO
39+
t || dig -p${DNS_PORT} +dnssec . @127.0.0.1 | grep -Fq 'flags: do;' || fail $LINENO
40+
t || dig -p${DNS_PORT} +short one.one.one.one @127.0.0.1 | grep -Fq '1.1.1.1' || fail $LINENO
41+
t || dig -p${DNS_PORT} +dnssec dnscrypt.info @127.0.0.1 | grep -Fq 'flags: qr rd ra ad' || fail $LINENO
42+
t || dig -p${DNS_PORT} +dnssec dnscrypt.info @127.0.0.1 | grep -Fq 'flags: do;' || fail $LINENO
4343

4444
kill $(cat /tmp/dnscrypt-proxy.pidfile)
4545
sleep 5
@@ -49,102 +49,102 @@ section
4949
sleep 5
5050

5151
section
52-
t || dig -p${DNS_PORT} A microsoft.com @127.0.0.1 | grep -Fq "NOERROR" || fail
53-
t || dig -p${DNS_PORT} A MICROSOFT.COM @127.0.0.1 | grep -Fq "NOERROR" || fail
52+
t || dig -p${DNS_PORT} A microsoft.com @127.0.0.1 | grep -Fq "NOERROR" || fail $LINENO
53+
t || dig -p${DNS_PORT} A MICROSOFT.COM @127.0.0.1 | grep -Fq "NOERROR" || fail $LINENO
5454

5555
section
56-
t || dig -p${DNS_PORT} AAAA ipv6.google.com @127.0.0.1 | grep -Fq 'locally blocked' || fail
56+
t || dig -p${DNS_PORT} AAAA ipv6.google.com @127.0.0.1 | grep -Fq 'locally blocked' || fail $LINENO
5757

5858
section
59-
t || dig -p${DNS_PORT} invalid. @127.0.0.1 | grep -Fq NXDOMAIN || fail
60-
t || dig -p${DNS_PORT} +dnssec invalid. @127.0.0.1 | grep -Fq 'flags: do;' || fail
61-
t || dig -p${DNS_PORT} PTR 168.192.in-addr.arpa @127.0.0.1 | grep -Fq 'NXDOMAIN' || fail
62-
t || dig -p${DNS_PORT} +dnssec PTR 168.192.in-addr.arpa @127.0.0.1 | grep -Fq 'flags: do;' || fail
59+
t || dig -p${DNS_PORT} invalid. @127.0.0.1 | grep -Fq NXDOMAIN || fail $LINENO
60+
t || dig -p${DNS_PORT} +dnssec invalid. @127.0.0.1 | grep -Fq 'flags: do;' || fail $LINENO
61+
t || dig -p${DNS_PORT} PTR 168.192.in-addr.arpa @127.0.0.1 | grep -Fq 'NXDOMAIN' || fail $LINENO
62+
t || dig -p${DNS_PORT} +dnssec PTR 168.192.in-addr.arpa @127.0.0.1 | grep -Fq 'flags: do;' || fail $LINENO
6363

6464
section
65-
t || dig -p${DNS_PORT} +dnssec darpa.mil @127.0.0.1 2>&1 | grep -Fvq 'RRSIG' || fail
66-
t || dig -p${DNS_PORT} +dnssec www.darpa.mil @127.0.0.1 2>&1 | grep -Fvq 'RRSIG' || fail
67-
t || dig -p${DNS_PORT} A download.windowsupdate.com @127.0.0.1 | grep -Fq "NOERROR" || fail
65+
t || dig -p${DNS_PORT} +dnssec darpa.mil @127.0.0.1 2>&1 | grep -Fvq 'RRSIG' || fail $LINENO
66+
t || dig -p${DNS_PORT} +dnssec www.darpa.mil @127.0.0.1 2>&1 | grep -Fvq 'RRSIG' || fail $LINENO
67+
t || dig -p${DNS_PORT} A download.windowsupdate.com @127.0.0.1 | grep -Fq "NOERROR" || fail $LINENO
6868

6969
section
70-
t || dig -p${DNS_PORT} +short cloakedunregistered.com @127.0.0.1 | grep -Eq '1.1.1.1|1.0.0.1' || fail
71-
t || dig -p${DNS_PORT} +short MX cloakedunregistered.com @127.0.0.1 | grep -Fq 'locally blocked' || fail
72-
t || dig -p${DNS_PORT} +short MX example.com @127.0.0.1 | grep -Fvq 'locally blocked' || fail
73-
t || dig -p${DNS_PORT} NS cloakedunregistered.com @127.0.0.1 | grep -Fiq 'gtld-servers.net' || fail
74-
t || dig -p${DNS_PORT} +short www.cloakedunregistered2.com @127.0.0.1 | grep -Eq '1.1.1.1|1.0.0.1' || fail
75-
t || dig -p${DNS_PORT} +short www.dnscrypt-test @127.0.0.1 | grep -Fq '192.168.100.100' || fail
76-
t || dig -p${DNS_PORT} a.www.dnscrypt-test @127.0.0.1 | grep -Fq 'NXDOMAIN' || fail
77-
t || dig -p${DNS_PORT} +short ptr 101.100.168.192.in-addr.arpa. @127.0.0.1 | grep -Eq 'www.dnscrypt-test.com' || fail
78-
t || dig -p${DNS_PORT} +short ptr 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.d.f.ip6.arpa. @127.0.0.1 | grep -Eq 'ipv6.dnscrypt-test.com' || fail
70+
t || dig -p${DNS_PORT} +short cloakedunregistered.com @127.0.0.1 | grep -Eq '1.1.1.1|1.0.0.1' || fail $LINENO
71+
t || dig -p${DNS_PORT} +short MX cloakedunregistered.com @127.0.0.1 | grep -Fq 'locally blocked' || fail $LINENO
72+
t || dig -p${DNS_PORT} +short MX example.com @127.0.0.1 | grep -Fvq 'locally blocked' || fail $LINENO
73+
t || dig -p${DNS_PORT} NS cloakedunregistered.com @127.0.0.1 | grep -Fiq 'gtld-servers.net' || fail $LINENO
74+
t || dig -p${DNS_PORT} +short www.cloakedunregistered2.com @127.0.0.1 | grep -Eq '1.1.1.1|1.0.0.1' || fail $LINENO
75+
t || dig -p${DNS_PORT} +short www.dnscrypt-test @127.0.0.1 | grep -Fq '192.168.100.100' || fail $LINENO
76+
t || dig -p${DNS_PORT} a.www.dnscrypt-test @127.0.0.1 | grep -Fq 'NXDOMAIN' || fail $LINENO
77+
t || dig -p${DNS_PORT} +short ptr 101.100.168.192.in-addr.arpa. @127.0.0.1 | grep -Eq 'www.dnscrypt-test.com' || fail $LINENO
78+
t || dig -p${DNS_PORT} +short ptr 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.d.f.ip6.arpa. @127.0.0.1 | grep -Eq 'ipv6.dnscrypt-test.com' || fail $LINENO
7979

8080
section
81-
t || dig -p${DNS_PORT} telemetry.example @127.0.0.1 | grep -Fq 'locally blocked' || fail
81+
t || dig -p${DNS_PORT} telemetry.example @127.0.0.1 | grep -Fq 'locally blocked' || fail $LINENO
8282

8383
section
84-
t || dig -p${DNS_PORT} dns.google @127.0.0.1 | grep -Fq 'locally blocked' || fail
84+
t || dig -p${DNS_PORT} dns.google @127.0.0.1 | grep -Fq 'locally blocked' || fail $LINENO
8585

8686
section
87-
t || dig -p${DNS_PORT} tracker.xdebian.org @127.0.0.1 | grep -Fq 'locally blocked' || fail
88-
t || dig -p${DNS_PORT} tracker.debian.org @127.0.0.1 | grep -Fqv 'locally blocked' || fail
87+
t || dig -p${DNS_PORT} tracker.xdebian.org @127.0.0.1 | grep -Fq 'locally blocked' || fail $LINENO
88+
t || dig -p${DNS_PORT} tracker.debian.org @127.0.0.1 | grep -Fqv 'locally blocked' || fail $LINENO
8989

9090
section
91-
t || curl --insecure -siL https://127.0.0.1:${HTTP_PORT}/ | grep -Fq 'HTTP/2 404' || fail
92-
t || curl --insecure -sL https://127.0.0.1:${HTTP_PORT}/dns-query | grep -Fq 'dnscrypt-proxy local DoH server' || fail
91+
t || curl --insecure -siL https://127.0.0.1:${HTTP_PORT}/ | grep -Fq 'HTTP/2 404' || fail $LINENO
92+
t || curl --insecure -sL https://127.0.0.1:${HTTP_PORT}/dns-query | grep -Fq 'dnscrypt-proxy local DoH server' || fail $LINENO
9393
t ||
9494
echo yv4BAAABAAAAAAABAAACAAEAACkQAAAAgAAAAA== | base64 -d |
9595
curl -H'Content-Type: application/dns-message' -H'Accept: application/dns-message' --data-binary @- -D - --insecure https://127.0.0.1:${HTTP_PORT}/dns-query 2>/dev/null |
96-
grep -Fq application/dns-message || fail
96+
grep -Fq application/dns-message || fail $LINENO
9797

9898
kill $(cat /tmp/dnscrypt-proxy.pidfile)
9999

100100
sleep 5
101101

102102
section
103-
t || grep -Fq 'telemetry.example' blocked-names.log || fail
104-
t || grep -Fq 'telemetry.*' blocked-names.log || fail
105-
t || grep -Fq 'tracker.xdebian.org' blocked-names.log || fail
106-
t || grep -Fq 'tracker.*' blocked-names.log || fail
103+
t || grep -Fq 'telemetry.example' blocked-names.log || fail $LINENO
104+
t || grep -Fq 'telemetry.*' blocked-names.log || fail $LINENO
105+
t || grep -Fq 'tracker.xdebian.org' blocked-names.log || fail $LINENO
106+
t || grep -Fq 'tracker.*' blocked-names.log || fail $LINENO
107107

108108
section
109-
t || grep -Fq 'dns.google' blocked-ips.log || fail
110-
t || grep -Fq '8.8.8.8' blocked-ips.log || fail
109+
t || grep -Fq 'dns.google' blocked-ips.log || fail $LINENO
110+
t || grep -Fq '8.8.8.8' blocked-ips.log || fail $LINENO
111111

112112
section
113-
t || grep -Fq 'a.www.dnscrypt-test' nx.log || fail
113+
t || grep -Fq 'a.www.dnscrypt-test' nx.log || fail $LINENO
114114

115115
section
116-
t || grep -Fq 'a.www.dnscrypt-test' nx.log || fail
116+
t || grep -Fq 'a.www.dnscrypt-test' nx.log || fail $LINENO
117117

118118
section
119-
t || grep -Eq 'microsoft.com.*PASS.*[^-]$' query.log || fail
120-
t || grep -Eq 'microsoft.com.*PASS.*-$' query.log || fail
121-
t || grep -Eq 'ipv6.google.com.*SYNTH' query.log || fail
122-
t || grep -Eq 'invalid.*SYNTH' query.log || fail
123-
t || grep -Eq '168.192.in-addr.arpa.*SYNTH' query.log || fail
124-
t || grep -Eq 'darpa.mil.*FORWARD' query.log || fail
125-
t || grep -Eq 'www.darpa.mil.*FORWARD' query.log || fail
126-
t || grep -Eq 'download.windowsupdate.com.*FORWARD' query.log || fail
127-
t || grep -Eq 'cloakedunregistered.com.*CLOAK' query.log || fail
128-
t || grep -Eq 'www.cloakedunregistered2.com.*CLOAK' query.log || fail
129-
t || grep -Eq 'www.dnscrypt-test.*CLOAK' query.log || fail
130-
t || grep -Eq 'a.www.dnscrypt-test.*NXDOMAIN' query.log || fail
131-
t || grep -Eq 'telemetry.example.*REJECT' query.log || fail
132-
t || grep -Eq 'dns.google.*REJECT' query.log || fail
133-
t || grep -Eq 'tracker.xdebian.org.*REJECT' query.log || fail
134-
t || grep -Eq 'tracker.debian.org.*PASS' query.log || fail
135-
t || grep -Eq '[.].*NS.*PASS' query.log || fail
119+
t || grep -Eq 'microsoft.com.*PASS.*[^-]$' query.log || fail $LINENO
120+
t || grep -Eq 'microsoft.com.*PASS.*-$' query.log || fail $LINENO
121+
t || grep -Eq 'ipv6.google.com.*SYNTH' query.log || fail $LINENO
122+
t || grep -Eq 'invalid.*SYNTH' query.log || fail $LINENO
123+
t || grep -Eq '168.192.in-addr.arpa.*SYNTH' query.log || fail $LINENO
124+
t || grep -Eq 'darpa.mil.*FORWARD' query.log || fail $LINENO
125+
t || grep -Eq 'www.darpa.mil.*FORWARD' query.log || fail $LINENO
126+
t || grep -Eq 'download.windowsupdate.com.*FORWARD' query.log || fail $LINENO
127+
t || grep -Eq 'cloakedunregistered.com.*CLOAK' query.log || fail $LINENO
128+
t || grep -Eq 'www.cloakedunregistered2.com.*CLOAK' query.log || fail $LINENO
129+
t || grep -Eq 'www.dnscrypt-test.*CLOAK' query.log || fail $LINENO
130+
t || grep -Eq 'a.www.dnscrypt-test.*NXDOMAIN' query.log || fail $LINENO
131+
t || grep -Eq 'telemetry.example.*REJECT' query.log || fail $LINENO
132+
t || grep -Eq 'dns.google.*REJECT' query.log || fail $LINENO
133+
t || grep -Eq 'tracker.xdebian.org.*REJECT' query.log || fail $LINENO
134+
t || grep -Eq 'tracker.debian.org.*PASS' query.log || fail $LINENO
135+
t || grep -Eq '[.].*NS.*PASS' query.log || fail $LINENO
136136

137137
section
138-
t || grep -Fq 'tracker.debian.org' allowed-names.log || fail
139-
t || grep -Fq '*.tracker.debian' allowed-names.log || fail
138+
t || grep -Fq 'tracker.debian.org' allowed-names.log || fail $LINENO
139+
t || grep -Fq '*.tracker.debian' allowed-names.log || fail $LINENO
140140

141141
section
142142
../dnscrypt-proxy/dnscrypt-proxy -loglevel 3 -config test3-dnscrypt-proxy.toml -pidfile /tmp/dnscrypt-proxy.pidfile &
143143
sleep 5
144144

145145
section
146-
t || dig -p${DNS_PORT} A microsoft.com @127.0.0.1 | grep -Fq "NOERROR" || fail
147-
t || dig -p${DNS_PORT} A MICROSOFT.COM @127.0.0.1 | grep -Fq "NOERROR" || fail
146+
t || dig -p${DNS_PORT} A microsoft.com @127.0.0.1 | grep -Fq "NOERROR" || fail $LINENO
147+
t || dig -p${DNS_PORT} A MICROSOFT.COM @127.0.0.1 | grep -Fq "NOERROR" || fail $LINENO
148148

149149
kill $(cat /tmp/dnscrypt-proxy.pidfile)
150150
sleep 5
@@ -154,8 +154,8 @@ section
154154
sleep 5
155155

156156
section
157-
t || dig -p${DNS_PORT} A microsoft.com @127.0.0.1 | grep -Fq "NOERROR" || fail
158-
t || dig -p${DNS_PORT} A cloudflare.com @127.0.0.1 | grep -Fq "NOERROR" || fail
157+
t || dig -p${DNS_PORT} A microsoft.com @127.0.0.1 | grep -Fq "NOERROR" || fail $LINENO
158+
t || dig -p${DNS_PORT} A cloudflare.com @127.0.0.1 | grep -Fq "NOERROR" || fail $LINENO
159159

160160
kill $(cat /tmp/odoh-proxied.pidfile)
161161
sleep 5

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313

1414
steps:
1515
- name: Checkout repository
16-
uses: actions/checkout@v5
16+
uses: actions/checkout@v6
1717
with:
1818
fetch-depth: 2
1919

@@ -23,10 +23,10 @@ jobs:
2323
go-version-file: 'go.mod'
2424

2525
- name: Initialize CodeQL
26-
uses: github/codeql-action/init@v3
26+
uses: github/codeql-action/init@v4
2727

2828
- name: Autobuild
29-
uses: github/codeql-action/autobuild@v3
29+
uses: github/codeql-action/autobuild@v4
3030

3131
- name: Perform CodeQL Analysis
32-
uses: github/codeql-action/analyze@v3
32+
uses: github/codeql-action/analyze@v4

‎.github/workflows/releases.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
echo "Tag version: $VERSION"
3636
3737
- name: Check out code
38-
uses: actions/checkout@v5
38+
uses: actions/checkout@v6
3939

4040
- name: Set up Go
4141
uses: actions/setup-go@v6
@@ -76,7 +76,7 @@ jobs:
7676
ls -l dnscrypt-proxy*
7777
7878
- name: Upload artifacts
79-
uses: actions/upload-artifact@v4
79+
uses: actions/upload-artifact@v5
8080
with:
8181
name: dnscrypt-proxy-${{ steps.get_version.outputs.VERSION }}
8282
path: |

‎ChangeLog‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
1+
# Version 2.1.15
2+
- The proxy now dynamically reduces timeouts as the connection limit is
3+
approached, improving performance and preventing connection exhaustion under
4+
heavy load.
5+
- Fixed crashes in the configuration file watcher when fsnotify creation
6+
fails.
7+
- DHCP resolver errors ($DHCP forwarding) are now properly logged and
8+
visible to system administrators.
9+
- Fixed double-bracketing of IPv6 addresses in DoH stamps that could prevent
10+
proper connection to IPv6 DoH servers.
11+
- Cache statistics are now more accurate by only counting queries that
12+
actually participate in caching.
13+
- The monitoring UI has been enhanced with server health indicators and
14+
improved display of resolver performance metrics.
15+
- Proxy hostnames (when using SOCKS/HTTP proxies) are now pre-resolved using
16+
bootstrap resolvers if they are domain names.
17+
- Multiple IP addresses per hostname are now cached instead of randomly
18+
selecting one, improving connection reliability for multi-homed servers.
19+
120
# Version 2.1.14
221
- Added support for client IP address encryption in logs using IPCrypt
322
(https://ipcrypt-std.github.io/). Three algorithms are supported:

‎dnscrypt-proxy/coldstart.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -59,12 +59,10 @@ func HandleCaptivePortalQuery(msg *dns.Msg, question *dns.Question, ips *Captive
5959
} else if question.Qtype == dns.TypeAAAA {
6060
for _, xip := range *ips {
6161
if xip.To4() == nil {
62-
if ip := xip.To16(); ip != nil {
63-
rr := new(dns.AAAA)
64-
rr.Hdr = dns.RR_Header{Name: question.Name, Rrtype: dns.TypeAAAA, Class: dns.ClassINET, Ttl: ttl}
65-
rr.AAAA = ip
66-
respMsg.Answer = append(respMsg.Answer, rr)
67-
}
62+
rr := new(dns.AAAA)
63+
rr.Hdr = dns.RR_Header{Name: question.Name, Rrtype: dns.TypeAAAA, Class: dns.ClassINET, Ttl: ttl}
64+
rr.AAAA = xip
65+
respMsg.Answer = append(respMsg.Answer, rr)
6866
}
6967
}
7068
}
@@ -78,7 +76,7 @@ func HandleCaptivePortalQuery(msg *dns.Msg, question *dns.Question, ips *Captive
7876
}
7977

8078
func handleColdStartClient(clientPc *net.UDPConn, cancelChannel chan struct{}, ipsMap *CaptivePortalMap) bool {
81-
buffer := make([]byte, MaxDNSPacketSize-1)
79+
buffer := make([]byte, MaxDNSPacketSize)
8280
clientPc.SetDeadline(time.Now().Add(time.Duration(1) * time.Second))
8381
length, clientAddr, err := clientPc.ReadFrom(buffer)
8482
exit := false

‎dnscrypt-proxy/config.go‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ type Config struct {
8282
SourceIPv4 bool `toml:"ipv4_servers"`
8383
SourceIPv6 bool `toml:"ipv6_servers"`
8484
MaxClients uint32 `toml:"max_clients"`
85+
TimeoutLoadReduction float64 `toml:"timeout_load_reduction"`
8586
BootstrapResolversLegacy []string `toml:"fallback_resolvers"`
8687
BootstrapResolvers []string `toml:"bootstrap_resolvers"`
8788
IgnoreSystemDNS bool `toml:"ignore_system_dns"`
@@ -147,6 +148,7 @@ func newConfig() Config {
147148
SourceDoH: true,
148149
SourceODoH: false,
149150
MaxClients: 250,
151+
TimeoutLoadReduction: 0.75,
150152
BootstrapResolvers: []string{DefaultBootstrapResolver},
151153
IgnoreSystemDNS: false,
152154
LogMaxSize: 10,
@@ -694,14 +696,6 @@ func (config *Config) loadSources(proxy *Proxy) error {
694696
if err := proxy.updateRegisteredServers(); err != nil {
695697
return err
696698
}
697-
rs1 := proxy.registeredServers
698-
rs2 := proxy.serversInfo.registeredServers
699-
rand.Shuffle(len(rs1), func(i, j int) {
700-
rs1[i], rs1[j] = rs1[j], rs1[i]
701-
})
702-
rand.Shuffle(len(rs2), func(i, j int) {
703-
rs2[i], rs2[j] = rs2[j], rs2[i]
704-
})
705699
return nil
706700
}
707701

@@ -780,6 +774,11 @@ func isIPAndPort(addrStr string) error {
780774
return fmt.Errorf("Port missing '%s'", addrStr)
781775
} else if _, err := strconv.ParseUint(strconv.Itoa(port), 10, 16); err != nil {
782776
return fmt.Errorf("Port does not parse '%s' [%v]", addrStr, err)
777+
} else if ip.To4() == nil {
778+
// IPv6 address must use bracket notation to avoid ambiguity
779+
if !strings.HasPrefix(host, "[") || !strings.HasSuffix(host, "]") {
780+
return fmt.Errorf("IPv6 addresses must use bracket notation, e.g., [%s]:%d", ip.String(), port)
781+
}
783782
}
784783
return nil
785784
}

0 commit comments

Comments
 (0)