Commit Graph

1228 Commits

Author SHA1 Message Date
Frank Denis 083fa0ad3c Add an extra retry since ODoH servers are currently unstable 2021-06-07 13:49:37 +02:00
Frank Denis f5a69c3bdc Reduce delay 2021-06-07 13:46:44 +02:00
Frank Denis 9e96bbc20b Continue, don't return 2021-06-07 13:44:08 +02:00
Frank Denis a181a23263 Send a dummy initial query before RTT measurement in ODoH 2021-06-07 13:42:33 +02:00
Frank Denis fad415f05a Update example documentation 2021-06-07 13:37:08 +02:00
Frank Denis 29613096da ODoH servers should not require a static configuration 2021-06-07 13:21:58 +02:00
Frank Denis 7980af6f46 Error propagation 2021-06-07 12:38:36 +02:00
Frank Denis 94151f9f96 Use ODoH relays in probes 2021-06-07 12:23:26 +02:00
Frank Denis a11da2d4fb ODoH: check certificate hashes 2021-06-07 12:09:27 +02:00
Frank Denis e0483bbb27 Pretend not to always use the first ODoH config 2021-06-07 12:06:36 +02:00
Frank Denis b35e27bd51 Shuffle ODoH target configs and use different NX queries 2021-06-07 12:05:42 +02:00
Frank Denis 4a4f69edb7 ODoH: only store working configurations
Actually, we only store the first one right now.

We should at least randomize them.
2021-06-07 12:02:21 +02:00
Frank Denis 96b05e57ca Preliminary propoer ODoH initialization 2021-06-07 11:47:11 +02:00
Frank Denis 56f2e9adcc server_name is ignored for x509 certs 2021-06-07 11:27:33 +02:00
Frank Denis dc99f1bc2c If you need this, implement it 2021-06-07 11:26:37 +02:00
Frank Denis 0d81fa2796 Remove doh_client_x509_auth stuf from fetchServerInfo
It doesn't belong there, and that feature doesn't do what it's
documented to do. It sets client certificates globally instead of
doing it per server.
2021-06-07 11:23:48 +02:00
Frank Denis 402860e2a6 ODoH broke DNSCrypt relays with wildcards - repair 2021-06-07 11:06:41 +02:00
Frank Denis cd45f64c18 ODoH: until relay auto selection is implemented, pick random ones 2021-06-07 11:00:21 +02:00
Frank Denis 27a82c54c8 ODoH: handle relay IP addresses 2021-06-07 10:46:01 +02:00
Frank Denis dce4db4c86 Construct net.URL directly 2021-06-07 10:08:55 +02:00
Frank Denis 525927e797 Don't use net/http 2021-06-07 10:05:20 +02:00
Frank Denis e57d5173e9 Support GET in ODoH targets 2021-06-06 01:22:48 +02:00
Frank Denis f542edacaa ODoH: until detection is in place, without a relay, prefer GET 2021-06-06 01:15:28 +02:00
Frank Denis 92792f0e8b Prevent remotely triggerable crash in ODoH config parser 2021-06-06 01:05:14 +02:00
Frank Denis 1cdb71cd7c Avoid double slashes in ODoH relay URLs 2021-06-06 01:01:39 +02:00
Frank Denis d2947cad75 Unbreak compilation 2021-06-06 00:14:56 +02:00
Frank Denis 3cf5c1ab8e Limit the number of ODoH target configs 2021-06-05 18:35:45 +02:00
Frank Denis 06135b6141 Reduce MaxHTTPBodyLength 2021-06-05 18:29:13 +02:00
Frank Denis 44f3db31ee Just a safeguard 2021-06-05 17:57:48 +02:00
Frank Denis 0a1d3b725c Rename ODoHTarget to ODoHTargetConfig for clarity 2021-06-05 17:49:19 +02:00
Frank Denis e27419f73d x509.SystemCertPool() may fail 2021-06-03 20:59:05 +02:00
Frank Denis ddcc40c954 Hardcode Let's Encrypt ISRG X1 cert
Some operating systems don't include it yet.

Thanks to @rs for the heads up
2021-06-03 12:48:33 +02:00
Frank Denis 14ef11447e Pasto, thanks to @lifenjoiner 2021-05-13 10:30:57 +02:00
Frank Denis 6e8628f796 Print an error if a block/allow rule contains more than a pattern
... and it is not a time range.
2021-05-12 17:43:13 +02:00
Frank Denis 31f4d7aa03 Do not ignore ODoH encryption errors 2021-05-09 16:16:38 +02:00
Frank Denis 367b5062ec Add another IP block list 2021-04-30 20:51:22 +02:00
Frank Denis 58e1410e66 Nits 2021-04-17 16:42:18 +02:00
Frank Denis e2e32406fb Improve ODoH log messages 2021-04-17 16:41:10 +02:00
Christopher Wood 23588733ae
Synchronously update the target configuration upon failure. (#1671)
* Synchronously update the target configuration upon failure.

* Notice a serverInfo failure when key updates fail.

* Add server name to debug logs.
2021-04-17 16:35:55 +02:00
Alison Winters eda8dd5181
replace TrimFunc(s, IsSpace) with TrimSpace for ASCII optimization (#1663) 2021-04-05 11:46:57 +02:00
Frank Denis 3efbacc0d4 Rename 2021-03-30 11:53:59 +02:00
Christopher Wood c748f93752 Add ODoH support. (#1653) 2021-03-30 11:53:51 +02:00
Frank Denis 54d85d7298 Filters don't apply to static entries 2021-03-12 20:05:58 +01:00
Frank Denis b1e96b69fd Save 1.4 MiB of memory 2021-03-08 15:36:42 +01:00
Frank Denis 34909babfb Typo 2021-02-20 19:11:06 +01:00
Frank Denis c500287498 Rename fallback_resolvers to bootstrap_resolvers
Clarify what they are used for.

Remove the legacy `fallback_resolver`.
2021-02-20 18:50:42 +01:00
Frank Denis 96ba551836 Revert "The source tests are completely brok4n :("
This reverts commit a76ffb0143.
2021-01-22 17:50:01 +01:00
lifenjoiner a9cf16b33e
Fix: Randomize source URLs (#1593) 2021-01-22 15:06:49 +01:00
Frank Denis 0ab9e30fa9 Merge branch 'master' of github.com:DNSCrypt/dnscrypt-proxy
* 'master' of github.com:DNSCrypt/dnscrypt-proxy:
  The source tests are completely brok4n :(
  Explain how to listen to all IP addresses
  In the query log, consider everything that's not UDP as TCP
2021-01-22 09:16:56 +01:00
Frank Denis d0f981156b Add the base inherited fd to the application logging fd
Fixes #1585
2021-01-22 09:15:40 +01:00
Frank Denis a76ffb0143 The source tests are completely brok4n :(
Fix at least the fact that URLs are now randomized
2021-01-21 14:59:34 +01:00
Frank Denis 53c8e25352 Explain how to listen to all IP addresses
Fixes #1588
2021-01-21 14:38:36 +01:00
Frank Denis ac0b9cdfe8 In the query log, consider everything that's not UDP as TCP
Fixes #1589
2021-01-21 14:35:06 +01:00
Ian Bashford fcd9225121
Threadsafe update (#1579)
* threadsafe update for relays

* locks around registeredRelays
2021-01-09 22:44:32 +01:00
Frank Denis 85d268f2b9 Randomize source URLs
Fixes #1577
2021-01-04 16:41:39 +01:00
Frank Denis 19dbd13c1b Explain the example allowlist 2021-01-03 18:18:46 +01:00
Frank Denis daa1f3d3b1 Add a NOT_READY return code 2021-01-03 18:09:03 +01:00
Frank Denis f9ec0a9c09 Deep copy cached responses 2021-01-03 17:37:19 +01:00
Frank Denis 3a5585f8a1 Remove test leftover 2021-01-03 17:16:04 +01:00
Frank Denis 1f7b247138 Lower severity 2021-01-03 17:00:39 +01:00
Frank Denis bc42eda1c8 Shorten 2021-01-03 16:58:21 +01:00
Frank Denis 5c3db0dcf5 Try to rely on proxy.serversInfo rather than proxy.registeredServers
With the introduction of background updates, I'm a little bit worried
about race conditions that can happen when a new server or relay is
registered (or even when a stamp changes).
2021-01-03 16:40:38 +01:00
Frank Denis fbd598f027 Nits 2021-01-03 16:22:23 +01:00
Frank Denis 197f13ea0f Fix typo and update message 2021-01-03 16:00:02 +01:00
Frank Denis 5861a58089 Nits 2021-01-03 14:44:02 +01:00
Frank Denis 7c6f0823ea Doc update 2021-01-03 14:41:23 +01:00
Frank Denis 7b962dff98 Nits 2021-01-03 13:58:08 +01:00
Frank Denis 5a079a3eb9 Resolve: print host info 2021-01-03 13:49:43 +01:00
Frank Denis 1e10251407 Only find the farthest route on wildcards 2021-01-03 13:33:51 +01:00
Frank Denis 0f54b2b34c Automatic relay selection 2021-01-03 13:01:44 +01:00
Frank Denis 79cb9451bd Remove log messages that are not really needed 2021-01-02 22:59:21 +01:00
Frank Denis 662b4c0c62 Make staticcheck happier 2021-01-02 22:55:16 +01:00
Frank Denis af80f57a58 Increase timeouts on retry 2021-01-02 22:31:47 +01:00
Frank Denis 996ea0dd89 Don't print the whole response 2021-01-02 22:28:00 +01:00
glitsj16 8a9e61d6cd
Fix typo (#1571) 2021-01-02 22:24:11 +01:00
Frank Denis fc82a6c05e Revamp dnscrypt-proxy -resolve 2021-01-02 22:20:52 +01:00
Frank Denis a584effbe9 Remove HTTPS record creation 2021-01-02 19:05:18 +01:00
Frank Denis 7ec5ed127e Repair server randomization 2021-01-02 19:04:53 +01:00
Frank Denis 5398dab58e Lower log level 2021-01-02 17:04:59 +01:00
Frank Denis 8f0b38f4c0 Double comments 2021-01-02 15:37:41 +01:00
Frank Denis 9f5c034c3d Add staticcheck.conf 2021-01-02 15:36:30 +01:00
Frank Denis ee5711fbd6 Disable captive portals by default 2021-01-02 15:22:58 +01:00
Frank Denis 56acb7b5ab Log when the ECS plugin is enabled 2021-01-02 15:10:30 +01:00
Frank Denis a713e1a517 Move captive portals config to a dedicated section
Add examples
2021-01-02 15:10:04 +01:00
Frank Denis 3b18058ae5 Add IPv6 cleanbrowsing servers 2021-01-02 12:53:10 +01:00
Ian Bashford 5b8c9c495f
register servers after loading statics (#1568) 2021-01-02 11:57:18 +01:00
Frank Denis b8d17debfd Remove final stops from errors 2021-01-02 11:16:12 +01:00
Frank Denis 2cdafa4bb3 Remove debug leftover 2021-01-02 10:24:32 +01:00
Frank Denis f245189f02 Handle captive portal names after coldstart 2021-01-01 21:39:17 +01:00
Ian Bashford 87fb44a588
Run from in memory cache updates (#1564)
* ConfigFile change to allowlist and blocklist

* revised names and warnings

* consistent file naming in kebab case, and generic use of blocklist and allowlist in cmoments for clarity

* update ci files

* impose maximum delay and document

* live update of servers

* update for source prefixes

* fixup test

* stop registerServers being called twice at startup

* prevent double registration at startup

* tidy function signature for loadSource

Co-authored-by: Ian Bashford <ianbashford@gmail.com>
2021-01-01 14:04:12 +01:00
Frank Denis 254a4a6532 Use , not | to match multiples items
Fixes #1558
2020-12-26 17:55:31 +01:00
Frank Denis 77f81cc8c2 Add recommendation for fallback resolvers in the example config
This is the same recommendation as c4d9860577/dnscrypt-proxy/serversInfo.go (L429-L432)

that has been here for a while as a comment, but having it in the configuration
file gives it more visibility.
2020-12-17 11:10:35 +01:00
Frank Denis c4d9860577 cloak plugin: return multiple the entire set of IPv4 or IPv6 addresses
Fixes #1547
2020-12-17 09:47:44 +01:00
Frank Denis a8a0677ea9 h1 -> http/1.x 2020-12-17 01:13:11 +01:00
Frank Denis 7d851366bb Do not only warn if the protocol is empty 2020-12-17 01:08:06 +01:00
Frank Denis 85e7dddc9b Move a few DNS things to dnsutils 2020-12-12 23:09:15 +01:00
Frank Denis a24b009667 Filler 2020-12-12 22:35:51 +01:00
Frank Denis d700ab6085 Nits 2020-12-12 22:19:09 +01:00
Frank Denis a384011e71 Support relays in static entries 2020-12-12 21:57:04 +01:00
Frank Denis 7f46f4820c Don't use distinct pointers for UDP and TCP relay addresses 2020-12-12 21:18:32 +01:00
Frank Denis ab8ebead34 Remove support for {ip|host}[:port] syntax for specifying a relay
It's very likely that no one ever used it.
2020-12-12 20:46:40 +01:00
Frank Denis fc785f9f69 Print details when an unsupported protocol is found 2020-12-11 12:26:05 +01:00
Frank Denis d6d8c37ef6 Format 2020-12-11 12:25:57 +01:00
Frank Denis 0d260d0e2d pattern_matcher: check exact matches first 2020-12-07 12:58:05 +01:00
Frank Denis 1239e64cd9 Correctly check for HTTPS type 2020-12-01 16:08:33 +01:00
Frank Denis b7dfdb1372 Factorize 2020-12-01 16:08:10 +01:00
Frank Denis 24a9539d08 Filter names on SVCB and HTTPS records in addition to CNAME 2020-12-01 16:00:18 +01:00
Frank Denis df8cfe3f3c dnsdist has been fixed 2020-11-30 14:31:30 +01:00
mibere f5827520d8
download mirror download.dnscrypt.net (#1527)
Files are locally hosted on download.dnscrypt.net. A cronjob updates the files every 3 hours, source is https://download.dnscrypt.info
download.dnscrypt.net has IPv4 and IPv6, DNSSEC, HTTPS
2020-11-27 22:35:27 +01:00
Frank Denis f9c11f0897 Allow arbitrary addresses to be set in listen_addresses
Only works on OpenBSD/FreeBSD/Linux (including Android)

Fixes #1362
2020-11-25 19:23:30 +01:00
Frank Denis 02a6ca1098 Keep .home in forwarding rules 2020-11-25 01:39:11 +01:00
petercooperjr 715c32f0fc
Change example forwarding rule to match recommended .home.arpa TLD (#1523)
The ".home" TLD was proposed at one point, and while it's probably not going to actually ever get delegated it's not best practice to just start using your own TLD. The .home.arpa domain has been specifically set aside for use in home networks (RFC 8375) and is probably the better example to put here.
2020-11-25 01:38:14 +01:00
Frank Denis 9e4131c6f7 Add ipv6.download.dnscrypt.info for testing 2020-11-23 21:10:22 +01:00
Ian Bashford 90a9a9d992
allowed ips plugin (#1510) 2020-11-15 20:59:58 +01:00
Frank Denis 6b6c6753aa Revert struct packing changes for the configuration
structlop is nice, but strips renames
2020-11-14 15:34:03 +01:00
Frank Denis 4fa643ef4d Repack structures to save some memory 2020-11-14 14:46:59 +01:00
lifenjoiner 078f69357e
Update example-dnscrypt-proxy.toml (#1489)
* Update lb_strategy usage

* Update example-dnscrypt-proxy.toml
2020-10-21 14:21:39 +02:00
Frank Denis 7a03369d01 Debug log certificate TTL 2020-10-12 17:58:08 +02:00
Frank Denis 8b72e58656 Make key exchange behaviors consistent 2020-09-21 02:14:17 +02:00
Frank Denis 687fe27371 Nits 2020-09-18 00:14:50 +02:00
Frank Denis 272984a640 Add support for EDNS-client-subnet
Fixes #1471
2020-09-18 00:11:26 +02:00
Frank Denis 4d7f253e6b Don't spawn new connections if we are full 2020-09-17 00:49:49 +02:00
Frank Denis 8411e5a91b Revert "Error out if the dns64 plugin is enabled without listening sockets"
This reverts commit b02649f774.
2020-09-17 00:45:48 +02:00
Frank Denis 4eab88c017 plugin_dns64: don't send queries to self
Fixes #1477
2020-09-17 00:44:37 +02:00
Frank Denis b460ca9fa8 Simplify hasAAAAQuestion 2020-09-17 00:24:04 +02:00
Frank Denis b02649f774 Error out if the dns64 plugin is enabled without listening sockets 2020-09-17 00:19:00 +02:00
Frank Denis c74b993cbb dns64: check the original question, not the returned one 2020-09-17 00:10:11 +02:00
Frank Denis 26505ab560 Merge declaration and assignment 2020-09-13 20:24:06 +02:00
Frank Denis 5a1b87130d Use single quotes for strings
Fixes #1466
2020-09-03 21:21:05 +02:00
Frank Denis d175642df3 Quad9 seems to have upgraded their dnsdist version! 2020-08-31 17:13:14 +02:00
Frank Denis fa5c55c64a Debug log query names 2020-08-09 13:09:37 +02:00
Frank Denis dadb38c32e Lower severity 2020-08-05 15:50:48 +02:00
Frank Denis 0ac96fec30 Add some logging back to fetchDoHServerInfo() 2020-08-05 15:39:30 +02:00
Frank Denis b583fb5314 Turns out that the "test." zone is directly served by the Tencent CDN
without hitting the actual resolvers.

So, we need to use a different test zone.
2020-08-05 15:03:16 +02:00
Frank Denis f3157b0a42 Check DoH servers with a query to a random name
The issue with benchmarking DoH servers is that some responses can
be directly served by a CDN, while others require a round trip to
the origin that can be significantly more expensive.

Random padding was an attempt at mitigating this. Unfortunately,
some servers (Tencent) ignore the padding. We end up with a query
for the root zone served by the Tencent CDN very quickly, but
anything else is orders of magnitude slower.

So, measure a query within the reserved "test." zone instead.
Caching resolvers should either know that "test." is undelegated,
or have it in their negative cache already, so this is unlikely to
trigger an actual query to authoritative servers.

Take it as an opportunity to check that we don't get anything but
a NXDOMAIN response for nonexistent domains.
2020-08-05 14:54:14 +02:00
Frank Denis 60d4c98f31 Unbreak running without a captive portal configuration file 2020-08-04 00:50:59 +02:00
Frank Denis f7f84fd871 Add ipv4only.arpa 2020-08-03 18:20:12 +02:00
Frank Denis 4424602e39 Start experimenting with better support for captive portals
MacOS (and probably Windows and other systems) tries to fetch a URL
before marking a network interface as available.

During this time, applications cannot use the interface at all, not
even bind their address.

When DNS queries are sent to dnscrypt-proxy, this causes the system
to wait for a response that can't come from the network, since we
hit a dead lock here.

The only option is to return hard-coded responses directly until
te interface is available.

The same captive portal configuration file can also serve a different
purpose.

Once the network is available, captive portal detection may not
work as expected if the answer is cached for too long. In fact, it
probably can't work at all since routers can't hijack DNS queries.

Once thing we can do is redirect the list of names used for captive
portal detection to the fallback resolvers. This may allow detection
to work as expected while still using a secure channel for all
other queries.
2020-08-03 18:05:42 +02:00
Frank Denis 210ba8c60f coldstart experiment 2020-08-03 15:40:39 +02:00
Frank Denis 162b51c791 Remove confusing "Domain exists: probably not, or blocked by the proxy" 2020-07-30 19:25:17 +02:00
Alison Winters 617629c180
initialize the log file before reporting config errors (#1426)
* initialize the log file before reporting config errors

* consistently return error instead of calling dlog.Fatal when parsing config
2020-07-27 16:01:44 +02:00
Frank Denis d3ff3a6bb1 Remove facebookgo/{atomicfile,pidfile}
Fixes #1411
2020-07-10 14:37:35 +02:00
Frank Denis 1a34c8d5ff Add max-stale cache control directive to requests 2020-07-09 21:42:35 +02:00
Frank Denis 8dd4612ea7 Don't use Lumberjack for non-regular files
Fixes #1407
2020-07-08 13:48:04 +02:00
Frank Denis 77a27a46a4 Rename the python script name in the example config 2020-07-08 12:05:42 +02:00
Ian Bashford af564522ec
Further block/allow updates (#1406)
* ConfigFile change to allowlist and blocklist

* revised names and warnings

* consistent file naming in kebab case, and generic use of blocklist and allowlist in cmoments for clarity

* update ci files

* further allow/blocklist updates

* improve language in comments

Co-authored-by: Ian Bashford <ianbashford@gmail.com>
2020-07-08 12:01:06 +02:00
Frank Denis 10710def50 Make loggers io.Writer implementations, not directly lumberjack objects 2020-07-08 11:36:58 +02:00
Frank Denis 7bec554709 Remove fritz.box after all 2020-07-08 11:03:45 +02:00
hugepants 038ebea0ed
Update broken_implementations with Quad9 -pri suffix (#1398) 2020-07-03 15:28:09 +02:00
hugepants 63c8f0610f
Update broken_implementations list with updated Quad9 v3 names (#1390) 2020-07-03 14:05:39 +02:00