3e264b9da9
Rename tls_client_auth to doh_client_x509_auth
...
Maybe improves clarity? I can never remember what tls_client_auth does.
2020-04-26 21:21:00 +02:00
52f87aee8e
Accept data from systemd sockets at the same time as everything else
2020-04-26 15:00:39 +02:00
4029d3d4f3
proxy.dropPrivilege() doesn't return on success
2020-04-26 14:49:43 +02:00
9519472bbe
Don't print the proxy version in the child
2020-04-20 12:34:59 +02:00
6f2dcb900a
Drop privileges early
...
Fixes #1265
2020-04-20 12:27:53 +02:00
74095d38ed
Remove LargerResponsesDropped
...
dnsdist drops DNSCrypt queries shorter than 256 bytes, interpreting them
as not being encrypted instead. This is surprising when doing ad-hoc
testing, but absolutely fine, and we will never send shorter encrypted
queries on normal circumstances.
So, remove a useless knob.
2020-03-26 17:20:34 +01:00
b3fbc2304d
All dnsdist servers exhibit the same behavior re: sending truncated responses
...
A 128 bytes query will not get a 200 bytes response (randomly tested on
3.tlu.dl.delivery.mp.microsoft.com), not even a truncated one.
It may be related to fragments being blocked on the server socket, or a
different issue. We can expect everything to be back to normal in dnsdist
1.5.0 no matter what.
2020-03-26 15:19:17 +01:00
5049516f53
Add an option to ignore servers incompatible with anonymization
2020-03-26 13:41:57 +01:00
ad36321dc8
Add cleanbrowsing until dnsdist 1.5.0 is out
2020-03-26 12:31:12 +01:00
8896787e66
Add other dnsdist servers until the MTU issue is fixed
...
https://github.com/PowerDNS/pdns/pull/7410
2020-03-26 10:57:09 +01:00
7424f1a8b7
Try harder to work around Cisco and Quad9 bugs
2020-03-25 20:10:11 +01:00
25b89e57ae
Add Quad9 back to the list of servers with broken padding
2020-03-25 18:11:16 +01:00
c4287c799f
Quad9 doesn't seem to block fragments on all networks
...
So, remove them from the static list and trust the runtime checks
for detection.
2020-03-24 14:32:23 +01:00
d876c7b487
Keep the default LB strategy if an invalid p* one is used
2020-03-20 20:53:03 +01:00
34d83f027f
Support power-of-<arbitrary number>
2020-03-20 17:49:32 +01:00
b57cc19d70
Use an interface for load-balancing strategies
2020-03-20 17:37:34 +01:00
49910d2f72
Localize some error values
2020-03-13 18:44:30 +01:00
c040b13d59
Adding the ability to do TLS client authentication for DoH ( #1203 )
...
* Adding the ability to do TLS client authentication for DoH
* whitespace nit
* Check for server specific creds before wildcard
* small comma ok idiom change
2020-03-09 22:11:53 +01:00
a6d946c41f
Shorten the default broken_query_padding list
2020-02-21 20:33:13 +01:00
4608b6d18d
Add auad9 to the broken_query_padding list
...
Fixes #1169
2020-02-21 20:31:45 +01:00
7ada3fcfb8
Support multiple fallback resolvers
2020-01-15 19:58:14 +01:00
66799c4159
Add the ability to block undelegated DNS zones
...
Using the generic pattern matcher as a first iteration, but we can
save some memory and CPU cycles by building and using a critbit tree
directly.
2019-12-16 16:18:47 +01:00
c1202457bf
Json -> JSON
2019-12-11 14:08:48 +01:00
3b4d6c532d
A URL path must start with a /
2019-12-10 16:04:37 +01:00
a635e92606
Add a new plugin to block unqualified host names
2019-12-09 20:25:38 +01:00
8efbf401c8
add error checks
2019-12-09 12:50:30 +01:00
ba8565a59e
Shorten conditions
2019-12-09 10:07:05 +01:00
96d15771e2
add multiple error checks
2019-12-09 09:56:47 +01:00
3b50caf4cd
Add a default local DoH path, print the URLs
2019-11-29 08:53:13 +01:00
f18dbc71ec
Make the local DoH path configurable
2019-11-28 23:49:28 +01:00
6a679cc543
Move local DoH configuration to its own section
2019-11-28 17:04:29 +01:00
be996c486f
Local DoH support, continued
2019-11-28 16:46:25 +01:00
f249813cc5
First bits towards providing access over DoH in addition to DNS
...
Mainly to deal with the Firefox+ESNI situation
2019-11-24 22:46:27 +01:00
b03e7f993f
Add a default list of buggy servers
2019-11-17 21:44:46 +01:00
ca7e5e5bcb
Rename a few things
2019-11-17 15:07:40 +01:00
15b405b552
Support workarounds for ancient/broken implementations
...
Fixes #984
2019-11-16 18:51:16 +01:00
a31e7c0c61
Avoid ridiculously low values for proxy.certRefreshDelay
2019-11-08 22:51:04 +01:00
f6f1a75884
Improve logging by keeping a Source's configured name on the struct
2019-11-08 10:17:12 +01:00
7e73a26a2f
Move most of the prefetching code into sources.go
...
The proxy shouldn't need to know how prefetching works, just that it needs to do it occasionally. Now the prefetching algorithm can be refactored without having to touch the proxy code.
2019-11-08 10:17:12 +01:00
78f2dead79
Move prefetch URLs onto Source struct
...
This is mostly in preparation for further refactoring, but does reduce the number of return values from `NewSource()` too.
2019-11-08 10:17:12 +01:00
b30904f20b
lowercase
2019-11-01 23:06:42 +01:00
8d191cdcf1
Rename CheckResolver to IsIPAndPort for clarity
2019-11-01 23:05:17 +01:00
2f7e057996
move flags parsing into main()
2019-10-31 18:55:44 +01:00
3a68f90c37
Back to 2.0.29 beta 3 ( ceed905196)
2019-10-31 17:50:19 +01:00
9eae8de902
fix the file not found error message when passing -config
2019-10-31 09:53:44 +01:00
b80e4957d1
move flags parsing into main()
2019-10-31 09:53:44 +01:00
778b2cccc1
Revert "move ConfigLoad into Start function when running as a service"
...
This reverts commit 9aeec3478f
2019-10-30 08:02:31 +01:00
9aeec3478f
move ConfigLoad into Start function when running as a service
2019-10-28 15:29:02 +01:00
6680faf665
make sure tcp/udp Conn are closed on stop signal
2019-10-25 12:56:34 +02:00
f60395390e
Typo
2019-10-23 23:30:39 +02:00
e5f3eff760
Add DNS stamps to JSON output
2019-10-23 23:28:46 +02:00
a26b2b42f0
Rename negTTL to rejectTTL to avoid confusion with cacheNegTTL
2019-10-21 18:26:49 +02:00
bb01595320
feature: Add neg_ttl for rejected entries and cloak_ttl for cloaking-rules
...
entries
Previously cache_min_ttl was used. But one can certainly set
cache_min_ttl to 0, but still ensure synthetic values have ttl.
Hence new config file options.
2019-10-21 18:12:49 +02:00
d14d78e648
fix: xtransport: Check 'fallback_resolver'
...
And also DefaultFallbackResolver.
As far a I could see, value needs to have port defined
too. dns.Exchange does seem to use address as such.
2019-10-21 18:12:49 +02:00
6ba2ff4fdc
cleanup: config: rename static config as StaticsConfig
...
Naming similar as SourcesConfig.
2019-10-20 21:30:24 +02:00
5c28950578
Bump the default timeout up
...
Because, yes, some networks have a lot of latency
2019-10-20 19:22:02 +02:00
320197a00e
Accept relay names in routes, improve documentation
2019-10-20 14:19:21 +02:00
94cf37dacf
Do the netprobe even in offline mode
...
This is likely to be required at least on Windows.
2019-10-18 20:34:26 +02:00
0d553a9fa7
cleanup: Drop ExtractPort ExtractHost, use ExtractHostAndPort instead
2019-10-18 20:24:11 +02:00
8c6a968e27
change: config: handle NetProbe fatal error and run only if not offline
...
All errors returned from NetProbe are managed as fatal later.
Decide, connection issues are not fatal but bad configuration is.
Without this configuration errors are silently ignored here.
2019-10-18 20:24:11 +02:00
32c387318a
cleanup: config: drop duplicate code in showCerts setup
2019-10-18 20:24:11 +02:00
5e5d1059d7
change: config: cache_max_expire default value from 8600 to 86400
2019-10-18 20:24:11 +02:00
322447aa91
Support multiple routes per destination
2019-10-14 12:08:47 +02:00
e9ec2aa801
Log anonymized DNS routes
2019-10-14 11:02:13 +02:00
0e8ca9009e
Implement Anonymized DNS
2019-10-14 01:45:38 +02:00
6513818cb3
Continue if some (but not all) server entries are invalid
...
Diff by @alisonatwork -- thanks!
Fixes #949
2019-10-06 09:13:37 +02:00
776e0d7ccc
New feature: query_meta
2019-09-07 16:19:47 +02:00
208c67b53b
Print the version before the netprobe
...
Fixes #901
2019-09-07 11:30:46 +02:00
5812cb2fe4
fold 'refused_code_in_responses' and 'respond_with_ip' options into a new option 'blocked_query_response'
2019-07-17 12:12:28 +02:00
87bbfbfc10
add new option: 'respond_with_ip'
2019-07-17 12:12:28 +02:00
0569c75596
Propagate mainProto to xTransport
...
Fixes #880
2019-07-10 13:13:28 +02:00
ad05fd6f21
Directly dlog.Fatalf() if an invalid static stamp is given
2019-07-06 18:04:02 +02:00
d2aa521369
Add a command-line option to print the server certificate hashes
2019-06-07 01:23:48 +02:00
a060407db1
Use a different address than 255.255.255.0 for netprobes
...
Windows doesn't seem to like this address.
Also default to the fallback resolver IP if there is one and
no netprobe_address option in the configuration file.
Fix netprobe_timeout = -1 by the way
2019-06-04 01:37:59 +02:00
30f2a4fd6b
Misc fixes
...
- Set LBEstimator to true by default
- Shuffle the servers list at startup
- Add the server name to the query log
2019-06-03 16:49:06 +02:00
9e2a945fff
Print the sorted list of latencies
...
Add an option to disable the load-balancing estimator
2019-06-03 13:04:59 +02:00
a417f0d282
Use 255.255.255.0 as the default netprobe address
2019-06-03 12:22:53 +02:00
2e89c8da01
Rename LbStrategyFastest to LbStrategyFirst
2019-06-02 13:24:24 +02:00
b22d6dfc96
Send a byte to the netprobe IP only on Windows
2019-05-31 11:15:59 +02:00
cf261da79a
Fix netProbe write check
...
Write at least 1 byte. This ensures that sockets are ready to use for writing.
Windows specific: during the system startup, sockets can be created but the underlying buffers may not be setup yet. If this is the case Write fails with WSAENOBUFS: "An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full
This fixes: https://github.com/jedisct1/dnscrypt-proxy/issues/841
2019-05-31 11:05:22 +02:00
7c8e20a533
netProbe: Always log Network connectivity detected
...
In the netProb function, always log whether network connectivity is detected or not.
2019-05-30 22:28:57 +02:00
578c090890
Send an empty packet to the probe
...
This seems to be required on Windows.
Also add the ability to wait for up to an hour.
2019-05-28 13:22:11 +02:00
d143ae5279
Set the main protocol to TCP when using a SOCKS proxy
2019-04-14 13:41:43 +02:00
25ac94e7b2
Revert "Add Stretch-Hash-and-Truncate option for extreme DNS privacy"
...
This reverts commit 2d1dd7eaab
2019-04-02 01:57:48 +02:00
2d1dd7eaab
Add Stretch-Hash-and-Truncate option for extreme DNS privacy
...
This works over DNSCrypt and DoH, but requires a specifically configured
server.
Instead of sending the actual DNS queries, the SH-T system works as follows:
Step 1: the client query is evaluated through Argon2id, a military-grade,
memory-hard, CPU-hard stretching function. This makes it very expensive
for an attacker to find the original query, even using GPUs and ASICs.
For post-quantum resistance, we use it to generate a 1024-bit key.
Step 2: in case the Argon2id algorithm has a vulnerability, or, since this
is a popular function used for hashing passwords and for cryptocurrencices,
and people may have built rainbow tables already, we use a hash function over
the result of the previous function. This immediately defeats rainbow tables.
Step 3: the output of the hash function is truncated to 64-bit.
Due to a property of this operation known as collision-misresistance, and even
if the previous steps fail due to a nation-state actor, it is impossible for a
server operator to prove what exact query was originally sent by a client.
This feature is experimental.
2019-04-01 09:36:56 +02:00
c10fbb2aa7
+ disabled_server_names
...
Fixes #735
2019-02-23 14:54:22 +01:00
a726a40dc5
Add refused_code_in_responses
...
Fixes #737
2019-02-23 00:58:25 +01:00
c52b3ef124
Bump the netprobe timeout up to 60 seconds
2018-11-22 17:24:41 +01:00
7174fdc8c8
Do not always override the netprobe_timeout option from config file
...
Fixes #641
2018-11-16 18:13:39 +01:00
2e147364e9
Add support for HTTP/HTTPS proxies
...
Fixes #638
2018-11-15 18:47:33 +01:00
e48779c2eb
Make the network timeout configuration via the command line
...
Fixes #619
2018-11-15 14:24:26 +01:00
844057d9df
Revert "Revert "Remove pledge(2) support""
...
This reverts commit a24cb0d900
2018-08-23 00:44:32 +02:00
a24cb0d900
Revert "Remove pledge(2) support"
...
This reverts commit bc3215a8a6
2018-08-15 17:56:33 +02:00
bc3215a8a6
Remove pledge(2) support
...
Fixes #571
2018-08-15 17:53:36 +02:00
dc602512ff
Don't call PledgeChild() too early
2018-07-07 21:03:08 +02:00
09baa3c40b
Store the userName value again
2018-07-07 17:58:37 +00:00
1019428ca0
username -> user_name
...
in case we want to add user_group and whatnot.
Remove the command-line option as it hides the caveats documented
in the configuration file.
Remove TODO. TODO statements always remain in that state forever.
2018-07-07 17:39:33 +02:00
c73e95256d
Implement an offline mode
...
Fixes #528
2018-07-05 18:05:24 +02:00
09e39c785a
Keep the process running in foreground to avoid a breaking change/allow monitoring
...
This currently doesn't replace the previous process. Maybe there is a way to achieve
this in Go. Need to look closer at os.exec
Also start-child -> child
2018-06-13 17:24:16 +02:00
aab7e6380f
Drop privileges with exec ( #467 )
...
* Drop privileges with exec and SysProcAttr
* Fix windows build
* Fix passing logfile fd
2018-06-13 16:52:41 +02:00
Frank Denis
Kevin O'Sullivan
milgradesec
William Elwood
Alison Winters
Vladimir Bauer
Markus Linnala
James Newell
Mathias Berchtold
Sebastian Schmidt