miracle091/dnscrypt-proxy
miracle091
/
dnscrypt-proxy
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Quad9 doesn't seem to block fragments on all networks 

So, remove them from the static list and trust the runtime checks
for detection.
This commit is contained in:
Frank Denis 2020-03-24 14:32:23 +01:00
parent 315f6f45ff
commit c4287c799f
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dnscrypt-proxy/config.go
View File

@ -134,7 +134,7 @@ func newConfig() Config {
LBEstimator: true, LBEstimator: true,
BlockedQueryResponse: "hinfo", BlockedQueryResponse: "hinfo",
BrokenImplementations: BrokenImplementationsConfig{ BrokenImplementations: BrokenImplementationsConfig{
BrokenQueryPadding: []string{"cisco", "cisco-ipv6", "cisco-familyshield", "quad9-dnscrypt-ip4-filter-alt", "quad9-dnscrypt-ip4-filter-pri", "quad9-dnscrypt-ip4-nofilter-alt", "quad9-dnscrypt-ip4-nofilter-pri", "quad9-dnscrypt-ip6-filter-alt", "quad9-dnscrypt-ip6-filter-pri", "quad9-dnscrypt-ip6-nofilter-alt", "quad9-dnscrypt-ip6-nofilter-pri"}, BrokenQueryPadding: []string{"cisco", "cisco-ipv6", "cisco-familyshield"},
}, },
} }
} }

9
dnscrypt-proxy/example-dnscrypt-proxy.toml
View File

@ -626,10 +626,10 @@ cache_neg_max_ttl = 600
# truncate reponses larger than questions as expected by the DNSCrypt protocol. # truncate reponses larger than questions as expected by the DNSCrypt protocol.
# This prevents large responses from being received, and breaks relaying. # This prevents large responses from being received, and breaks relaying.
# A workaround for the first issue will be applied to servers in list below. # A workaround for the first issue will be applied to servers in list below.
# Quad9 appears to currently have a similar issue. # Quad9 appears to be dropping fragmented UDP queries, but only for some networks.
# Do not change that list until the bugs are fixed server-side. # Do not change that list until the bugs are fixed server-side.
broken_query_padding = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri'] broken_query_padding = ['cisco', 'cisco-ipv6', 'cisco-familyshield']
@ -637,10 +637,13 @@ broken_query_padding = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'quad9-dnsc
# TLS Client Authentication # # TLS Client Authentication #
################################ ################################
# This is only useful if you are operating your own, private DoH server(s).
# (for DNSCrypt, see the `query_meta` feature instead)
[tls_client_auth] [tls_client_auth]
# creds = [ # creds = [
# { server_name='myserver', client_cert='client.crt', client_key='client.key' }, # { server_name='myserver', client_cert='client.crt', client_key='client.key' }
# ] # ]