[pull] master from DNSCrypt:master

dnscrypt-proxy/local-doh.go

@@ -72,22 +72,21 @@ func (handler localDoHHandler) ServeHTTP(writer http.ResponseWriter, request *ht
 		writer.WriteHeader(500)
 		return
 	}
-	msg := dns.Msg{Data: packet}
+	msg := dns.Msg{Data: response}
 	if err := msg.Unpack(); err != nil {
 		writer.WriteHeader(400)
 		return
 	}
-	responseLen := len(response)
-	paddedLen := dohPaddedLen(responseLen)
-	padLen := paddedLen - responseLen
 	if hasEDNS0Padding {
-		response, err = addEDNS0PaddingIfNoneFound(&msg, response, padLen)
+		response, err = addLocalDoHResponsePadding(&msg)
 		if err != nil {
 			dlog.Critical(err)
 			writer.WriteHeader(500)
 			return
 		}
 	} else {
+		responseLen := len(response)
+		padLen := dohPaddedLen(responseLen) - responseLen
 		pad := strings.Repeat("X", padLen)
 		writer.Header().Set("X-Pad", pad)
 	}
@@ -97,6 +96,37 @@ func (handler localDoHHandler) ServeHTTP(writer http.ResponseWriter, request *ht
 	writer.Write(response)
 }
 
+func addLocalDoHResponsePadding(msg *dns.Msg) ([]byte, error) {
+	original := append([]byte(nil), msg.Data...)
+	if msg.UDPSize == 0 {
+		msg.UDPSize = uint16(MaxDNSPacketSize)
+	}
+	var paddingRR *dns.PADDING
+	for _, rr := range msg.Pseudo {
+		if padding, ok := rr.(*dns.PADDING); ok {
+			paddingRR = padding
+			paddingRR.Padding = ""
+			break
+		}
+	}
+	if paddingRR == nil {
+		paddingRR = &dns.PADDING{}
+		msg.Pseudo = append(msg.Pseudo, paddingRR)
+	}
+	if err := msg.Pack(); err != nil {
+		return nil, err
+	}
+	if len(msg.Data) > MaxDNSPacketSize {
+		return original, nil
+	}
+	paddingLen := dohPaddedLen(len(msg.Data)) - len(msg.Data)
+	paddingRR.Padding = strings.Repeat("58", paddingLen)
+	if err := msg.Pack(); err != nil {
+		return nil, err
+	}
+	return msg.Data, nil
+}
+
 func (proxy *Proxy) localDoHListener(acceptPc *net.TCPListener) {
 	defer acceptPc.Close()
 	if len(proxy.localDoHCertFile) == 0 || len(proxy.localDoHCertKeyFile) == 0 {

dnscrypt-proxy/pattern_matcher.go

@@ -102,14 +102,10 @@ func (patternMatcher *PatternMatcher) Add(pattern string, val any, position int)
 	switch patternType {
 	case PatternTypeSubstring:
 		patternMatcher.substrings = append(patternMatcher.substrings, pattern)
-		if val != nil {
-			patternMatcher.indirectVals[pattern] = val
-		}
+		patternMatcher.indirectVals[pattern] = val
 	case PatternTypePattern:
 		patternMatcher.patterns = append(patternMatcher.patterns, pattern)
-		if val != nil {
-			patternMatcher.indirectVals[pattern] = val
-		}
+		patternMatcher.indirectVals[pattern] = val
 	case PatternTypePrefix:
 		patternMatcher.prefixes.Insert([]byte(pattern), val)
 	case PatternTypeSuffix:
@@ -127,7 +123,7 @@ func (patternMatcher *PatternMatcher) Eval(qName string) (reject bool, reason st
 		return false, "", nil
 	}
 
-	if xval := patternMatcher.exact[qName]; xval != nil {
+	if xval, found := patternMatcher.exact[qName]; found {
 		return true, qName, xval
 	}
 

dnscrypt-proxy/xtransport.go

@@ -539,6 +539,8 @@ func (xTransport *XTransport) resolveUsingResolver(
 		queryType = append(queryType, dns.TypeAAAA)
 	}
 	var rrTTL uint32
+	rrTTLSet := false
+	var lastErr error
 	ctx, cancel := context.WithTimeout(context.Background(), ResolverReadTimeout)
 	defer cancel()
 	for _, rrType := range queryType {
@@ -559,15 +561,21 @@ func (xTransport *XTransport) resolveUsingResolver(
 					case dns.TypeAAAA:
 						ips = append(ips, answer.(*dns.AAAA).AAAA.Addr.AsSlice())
 					}
-					rrTTL = answer.Header().TTL
+					if answerTTL := answer.Header().TTL; !rrTTLSet || answerTTL < rrTTL {
+						rrTTL = answerTTL
+						rrTTLSet = true
+					}
 				}
 			}
+		} else {
+			lastErr = err
 		}
 	}
 	if len(ips) > 0 {
 		ttl = time.Duration(rrTTL) * time.Second
+		return ips, ttl, nil
 	}
-	return ips, ttl, err
+	return nil, 0, lastErr
 }
 
 func (xTransport *XTransport) resolveUsingServers(