summaryrefslogtreecommitdiffstats
path: root/network/dnscrypt-proxy
diff options
context:
space:
mode:
Diffstat (limited to 'network/dnscrypt-proxy')
-rw-r--r--network/dnscrypt-proxy/README20
-rw-r--r--network/dnscrypt-proxy/README.Slackware74
-rw-r--r--network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild95
-rw-r--r--network/dnscrypt-proxy/dnscrypt-proxy.default30
-rw-r--r--network/dnscrypt-proxy/dnscrypt-proxy.info18
-rw-r--r--network/dnscrypt-proxy/dnscrypt-proxy.toml508
-rw-r--r--network/dnscrypt-proxy/dnsmasq.conf21
-rw-r--r--network/dnscrypt-proxy/doinst.sh41
-rw-r--r--network/dnscrypt-proxy/named.conf153
-rw-r--r--network/dnscrypt-proxy/rc.dnscrypt-proxy182
-rw-r--r--network/dnscrypt-proxy/slack-desc2
11 files changed, 595 insertions, 549 deletions
diff --git a/network/dnscrypt-proxy/README b/network/dnscrypt-proxy/README
index 3e69789b36..0e857524f6 100644
--- a/network/dnscrypt-proxy/README
+++ b/network/dnscrypt-proxy/README
@@ -1,13 +1,11 @@
-dnscrypt-proxy is a tool for securing communications between a client and a DNS
-resolver. It provides a local service which can be used directly as your local
-resolver or as a DNS forwarder, encrypting and authenticating requests using the
-DNSCrypt protocol and passing them to an upstream server.
+DNSCrypt is a protocol that encrypts, authenticates and optionally
+anonymizes communications between a DNS client and a DNS resolver.
+It prevents DNS spoofing. It uses cryptographic signatures to verify
+that responses originate from the chosen DNS resolver and haven’t been
+tampered with.
-By default dnscrypt-proxy is configured to use a random DNS server; you will
-definitely want to change this.
+It is an open specification, with free and open source reference
+implementations, and it is not affiliated with any company nor
+organization.
-Note that google-go-lang is a compile-time dependency and is not needed during
-run-time.
-
-Be sure to read README.Slackware for information on configuring/running
-dnscrypt-proxy as a daemon!
+Free, DNSCrypt-enabled resolvers are available all over the world.
diff --git a/network/dnscrypt-proxy/README.Slackware b/network/dnscrypt-proxy/README.Slackware
index b5a6388c56..11336b5864 100644
--- a/network/dnscrypt-proxy/README.Slackware
+++ b/network/dnscrypt-proxy/README.Slackware
@@ -1,27 +1,34 @@
-A. Setup
+An init script and configuration file have been provided to run
+dnscrypt-proxy as a daemon. To configure dnscrypt-proxy, edit:
-An init script and configuration file have been provided to run dnscrypt-proxy
-as a daemon. To configure dnscrypt-proxy, edit
-/etc/dnscrypt-proxy/dnscrypt-proxy.toml with the desired settings. By default
-dnscrypt-proxy will use a random DNS server and will run on localhost
-(127.0.0.1), port 53.
+ /etc/dnscrypt-proxy/dnscrypt-proxy.toml
-The configuration file is setup to use a dnscrypt user by default. In order to
-use the default configuration you should create a dnscrypt user and group with
-the following commands:
+Remember to chmod +x /etc/rc.d/rc.dnscrypt-proxy before starting.
+
+By default dnscrypt-proxy will use a random DNS server, i have hardcoded
+some anonymizing relays to bounce the DNS querries around for increased
+privacy.
+Built in local caching is also enabled by default.
+The proxy will run on localhost 127.0.0.1 and ::1 port 53.
+If ipv6 is not required or available, it can be disabled in the config.
+
+The configuration file is setup to use a 'dnscrypt' user by default.
+In order to use the default configuration you should create a
+'dnscrypt' user and group with the following commands:
groupadd -g 293 dnscrypt
useradd -u 293 -g 293 -c "DNSCrypt" -d /run/dnscrypt -s /bin/false dnscrypt
-If you decide to use another user you should edit the USER setting in
-/etc/default/dnscrypt-proxy and the user_name setting in
-/etc/dnscrypt-proxy/dnscrypt-proxy.toml (there are example settings provided
-for the user 'nobody').
+If you decide to use another user you should edit the user_name setting
+in:
-In order to send all DNS requests through dnscrypt-proxy, you will need to
-update /etc/resolv.conf to point to localhost. If using dhcpcd, the easiest way
-to set dnscrypt-proxy as the primary (but not exclusive) dns resolver is to
-create file /etc/resolv.conf.head with the following line:
+ /etc/dnscrypt-proxy/dnscrypt-proxy.toml
+
+In order to send all DNS requests through dnscrypt-proxy, you will need
+to update /etc/resolv.conf to point to localhost. If using dhcpcd, the
+easiest way to set dnscrypt-proxy as the primary (but not exclusive)
+dns resolver is to create file /etc/resolv.conf.head with the following
+line:
nameserver 127.0.0.1
@@ -29,30 +36,27 @@ You may also have to add the following line to enable EDNS:
options edns0
-To start dnscrypt-proxy automatically at system start, add the following to
-/etc/rc.d/rc.local:
+It is also recommended to make the resolv.conf file immutable by
+issuing:
+
+ chattr +i /etc/resolv.conf
+
+To prevent the settings from being reset by dhcp or any other service.
+
+To start dnscrypt-proxy automatically at system start, add the following
+to:
+
+ /etc/rc.d/rc.local:
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy start
fi
-To properly stop dnscrypt-proxy on system shutdown, add the following to
-/etc/rc.d/rc.local_shutdown:
+To properly stop dnscrypt-proxy on system shutdown, add the following
+to:
+
+ /etc/rc.d/rc.local_shutdown:
if [ -x /etc/rc.d/rc.dnscrypt-proxy ]; then
/etc/rc.d/rc.dnscrypt-proxy stop
fi
-
-B. DNS Cache
-
-dnscrypt-proxy provides control over how it caches DNS queries via its
-configuration file. However, you can also run your own local caching DNS
-server. A sample configuration for dnsmasq (included with Slackware) is
-provided at /usr/doc/dnscrypt-proxy-@VERSION@/dnsmasq.conf. A sample
-configuration for bind/named that also does local DNSSEC validation (if
-supported by the upstream DNS server) is also provided at
-/usr/doc/dnscrypt-proxy-@VERSION@/named.conf. Both configurations run on port
-53, forwarding lookups to dnscrypt-proxy running on port 55. In order to use
-these configurations you will need to change the port dnscrypt-proxy runs on in
-/etc/dnscrypt-proxy/dnscrypt-proxy.toml. If you perform your own DNS caching,
-it makes sense to disable dnscrypt-proxy's caching in its configuration file.
diff --git a/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild b/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild
index 52f8059230..4b59f7799e 100644
--- a/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild
+++ b/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild
@@ -1,8 +1,9 @@
-#!/bin/sh
+#!/bin/bash
# Slackware build script for dnscrypt-proxy
-# Copyright 2019 T3slider <t3slider@gmail.com>
+# Copyright 2023 thnkman <thnkman@proton.me>
+# Based on Marco Bonetti's <sid77@slackware.it> tor script.
# All rights reserved.
#
# Redistribution and use of this script, with or without modification, is
@@ -22,17 +23,18 @@
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-# Thanks to Larry Hajali for work on README.Slackware, the basis for the sample
-# dnsmasq configuration, and the idea for an init script. His contributions
-# significantly improved the value of this script!
+cd $(dirname $0) ; CWD=$(pwd)
PRGNAM=dnscrypt-proxy
-VERSION=${VERSION:-2.0.25}
+VERSION=${VERSION:-2.1.5}
BUILD=${BUILD:-1}
TAG=${TAG:-_SBo}
+PKGTYPE=${PKGTYPE:-tgz}
-DOMAIN=github.com
-ORG=jedisct1
+DNSCRYPT_USER=${DNSCRYPT_USER:-dnscrypt}
+DNSCRYPT_UID=${DNSCRYPT_UID:-293}
+DNSCRYPT_GROUP=${DNSCRYPT_GROUP:-dnscrypt}
+DNSCRYPT_GID=${DNSCRYPT_GID:-293}
if [ -z "$ARCH" ]; then
case "$( uname -m )" in
@@ -42,32 +44,44 @@ if [ -z "$ARCH" ]; then
esac
fi
-CWD=$(pwd)
+if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then
+ echo "$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.$PKGTYPE"
+ exit 0
+fi
+
TMP=${TMP:-/tmp/SBo}
PKG=$TMP/package-$PRGNAM
OUTPUT=${OUTPUT:-/tmp}
-if [ "$ARCH" = "i586" ]; then
- LIBDIRSUFFIX=""
-elif [ "$ARCH" = "i686" ]; then
- LIBDIRSUFFIX=""
-elif [ "$ARCH" = "x86_64" ]; then
- LIBDIRSUFFIX="64"
-else
- LIBDIRSUFFIX=""
-fi
-
set -e
+bailout() {
+ echo -e "\nYou must have a $DNSCRYPT_USER user and $DNSCRYPT_GROUP group to run this script. "
+ echo -e "Something like this should suffice for most systems: "
+ echo -e "# groupadd -g $DNSCRYPT_GID $DNSCRYPT_GROUP "
+ echo -e "# useradd -u $DNSCRYPT_UID -g $DNSCRYPT_GID -c \"DNSCrypt-proxy\" -d /dev/null -s /bin/false $DNSCRYPT_USER \n"
+ exit 1
+}
+
+if ! grep -q "^$DNSCRYPT_USER:" /etc/passwd > /dev/null 2>&1 ; then
+ bailout
+elif ! grep -q "^$DNSCRYPT_GROUP:" /etc/group > /dev/null 2>&1 ; then
+ bailout
+fi
+
rm -rf $PKG
mkdir -p $TMP $PKG $OUTPUT
cd $TMP
rm -rf $PRGNAM-$VERSION
-mkdir -p $PRGNAM-$VERSION/src/$DOMAIN/$ORG
-cd $PRGNAM-$VERSION/src/$DOMAIN/$ORG
-tar xvf $CWD/$PRGNAM-$VERSION.tar.gz
-mv $PRGNAM-$VERSION $PRGNAM
-cd $PRGNAM
+if [[ $ARCH == i?86 ]]; then
+ tar xvf $CWD/$PRGNAM-linux_i386-$VERSION.tar.gz --transform="s/linux-i386/$PRGNAM-$VERSION/"
+elif [[ $ARCH == x86_64 ]]; then
+ tar xvf $CWD/$PRGNAM-linux_x86_64-$VERSION.tar.gz --transform="s/linux-x86_64/$PRGNAM-$VERSION/"
+else
+ echo "Architecture not supported"
+ exit 1
+fi
+cd $PRGNAM-$VERSION
chown -R root:root .
find -L . \
\( -perm 777 -o -perm 775 -o -perm 750 -o -perm 711 -o -perm 555 \
@@ -75,35 +89,28 @@ find -L . \
\( -perm 666 -o -perm 664 -o -perm 640 -o -perm 600 -o -perm 444 \
-o -perm 440 -o -perm 400 \) -exec chmod 644 {} \;
-export GOPATH="$TMP/$PRGNAM-$VERSION"
-
-go install -a -x ./...
-
-mkdir -p $PKG/usr/sbin
+mkdir -p $PKG/usr/bin \
+ $PKG/etc/{$PRGNAM,rc.d} \
+ $PKG/var/{log,run}/$PRGNAM
-install -m 755 "$TMP/$PRGNAM-$VERSION/bin/${PRGNAM}" $PKG/usr/sbin/${PRGNAM}
-
-find $PKG -print0 | xargs -0 file | grep -e "executable" -e "shared object" | grep ELF \
- | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null || true
-
-mkdir -p $PKG/var/log/$PRGNAM $PKG/etc/default $PKG/etc/$PRGNAM
-chmod 0700 $PKG/var/log/$PRGNAM
-sed "s/@VERSION@/$VERSION/" $CWD/$PRGNAM.default > $PKG/etc/default/$PRGNAM.new
-install -D -m 0755 $CWD/rc.$PRGNAM $PKG/etc/rc.d/rc.$PRGNAM.new
-install -D -m 0644 $CWD/$PRGNAM.toml $PKG/etc/$PRGNAM/$PRGNAM.toml.new
+cp -a ./*.txt $PKG/etc/$PRGNAM/
+install -D -m 0755 $PRGNAM $PKG/usr/bin/$PRGNAM
+install -D -m 0644 $CWD/$PRGNAM.toml $PKG/etc/$PRGNAM/$PRGNAM.toml
+install -D -m 0644 $CWD/rc.$PRGNAM $PKG/etc/rc.d/rc.$PRGNAM
mkdir -p $PKG/usr/doc/$PRGNAM-$VERSION
cp -a \
- ChangeLog LICENSE README.md utils $PRGNAM/example-* \
+ LICENSE \
$PKG/usr/doc/$PRGNAM-$VERSION
-sed "s/@VERSION@/$VERSION/g" $CWD/README.Slackware > $PKG/usr/doc/$PRGNAM-$VERSION/README.Slackware
-cat $CWD/dnsmasq.conf > $PKG/usr/doc/$PRGNAM-$VERSION/dnsmasq.conf
-cat $CWD/named.conf > $PKG/usr/doc/$PRGNAM-$VERSION/named.conf
+cat $CWD/README.Slackware > $PKG/usr/doc/$PRGNAM-$VERSION/README.Slackware
cat $CWD/$PRGNAM.SlackBuild > $PKG/usr/doc/$PRGNAM-$VERSION/$PRGNAM.SlackBuild
mkdir -p $PKG/install
cat $CWD/slack-desc > $PKG/install/slack-desc
cat $CWD/doinst.sh > $PKG/install/doinst.sh
+sed -i "s/DNSCRYPT_UID=.*$/DNSCRYPT_UID=$DNSCRYPT_UID/" $PKG/install/doinst.sh
+sed -i "s/DNSCRYPT_GID=.*$/DNSCRYPT_GID=$DNSCRYPT_GID/" $PKG/install/doinst.sh
+
cd $PKG
-/sbin/makepkg -l y -c n $OUTPUT/$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.${PKGTYPE:-tgz}
+/sbin/makepkg -p -l y -c n $OUTPUT/$PRGNAM-$VERSION-$ARCH-$BUILD$TAG.$PKGTYPE
diff --git a/network/dnscrypt-proxy/dnscrypt-proxy.default b/network/dnscrypt-proxy/dnscrypt-proxy.default
deleted file mode 100644
index 112202cc9e..0000000000
--- a/network/dnscrypt-proxy/dnscrypt-proxy.default
+++ /dev/null
@@ -1,30 +0,0 @@
-# /etc/default/dnscrypt-proxy
-
-# This file contains additional configuration settings for dnscrypt-proxy
-# (primary configuration belongs in the dnscrypt-proxy configuration file).
-# This file supports configuring and running multiple instances (see the bottom
-# of this file for a sample secondary configuration). However, note that
-# dnscrypt-proxy now automatically provides redundancy based on a pool of
-# available servers in its own configuration file. Under normal circumstances
-# you would only ever need one active configuration in this file, but support
-# for multiple independent servers has been maintained in case you have a need
-# for segregation of upstream servers.
-
-# DNSCRYPTCONFIG should be the path to the dnscrypt-proxy configuration file
-# for the given instance.
-DNSCRYPTCONFIG[0]="/etc/dnscrypt-proxy/dnscrypt-proxy.toml"
-
-# The pid file for this instance. PIDFILE must always be specified for each
-# instance!
-PIDFILE[0]="/run/dnscrypt-proxy/dnscrypt-proxy-0.pid"
-
-# The user to run the daemon. This should be the same user specified in the
-# config.
-#USER[0]="nobody"
-USER[0]="dnscrypt"
-
-# A simple example configuration for a second instance (note that this would
-# require a new dnscrypt-proxy configuration file)
-#DNSCRYPTCONFIG[1]="/etc/dnscrypt-proxy/dnscrypt-proxy-1.toml"
-#PIDFILE[1]="/run/dnscrypt-proxy/dnscrypt-proxy-1.pid"
-#USER[1]="dnscrypt"
diff --git a/network/dnscrypt-proxy/dnscrypt-proxy.info b/network/dnscrypt-proxy/dnscrypt-proxy.info
index add495f8cd..f4ba8b100e 100644
--- a/network/dnscrypt-proxy/dnscrypt-proxy.info
+++ b/network/dnscrypt-proxy/dnscrypt-proxy.info
@@ -1,10 +1,10 @@
PRGNAM="dnscrypt-proxy"
-VERSION="2.0.25"
-HOMEPAGE="https://github.com/jedisct1/dnscrypt-proxy"
-DOWNLOAD="https://github.com/jedisct1/dnscrypt-proxy/archive/2.0.25/dnscrypt-proxy-2.0.25.tar.gz"
-MD5SUM="1c92cedfc8d4ea7dc21b1abd5e93478c"
-DOWNLOAD_x86_64=""
-MD5SUM_x86_64=""
-REQUIRES="google-go-lang"
-MAINTAINER="T3slider"
-EMAIL="t3slider@gmail.com"
+VERSION="2.1.5"
+HOMEPAGE="https://github.com/DNSCrypt/dnscrypt-proxy"
+DOWNLOAD="https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/2.1.5/dnscrypt-proxy-linux_i386-2.1.5.tar.gz"
+MD5SUM="edbd10c9d3be0e81976203c77902f339"
+DOWNLOAD_x86_64="https://github.com/DNSCrypt/dnscrypt-proxy/releases/download/2.1.5/dnscrypt-proxy-linux_x86_64-2.1.5.tar.gz"
+MD5SUM_x86_64="8190b0d10841aea11f74caf77dbc2c39"
+REQUIRES=""
+MAINTAINER="thnkman"
+EMAIL="thnkman@proton.me"
diff --git a/network/dnscrypt-proxy/dnscrypt-proxy.toml b/network/dnscrypt-proxy/dnscrypt-proxy.toml
index 5b4e99a89d..182429bd67 100644
--- a/network/dnscrypt-proxy/dnscrypt-proxy.toml
+++ b/network/dnscrypt-proxy/dnscrypt-proxy.toml
@@ -21,17 +21,23 @@
## Servers from the "public-resolvers" source (see down below) can
## be viewed here: https://dnscrypt.info/public-servers
##
-## If this line is commented, all registered servers matching the require_* filters
-## will be used.
+## The proxy will automatically pick working servers from this list.
+## Note that the require_* filters do NOT apply when using this setting.
+##
+## By default, this list is empty and all registered servers matching the
+## require_* filters will be used instead.
##
-## The proxy will automatically pick the fastest, working servers from the list.
## Remove the leading # first to enable this; lines starting with # are ignored.
# server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
## List of local addresses and ports to listen to. Can be IPv4 and/or IPv6.
-## Note: When using systemd socket activation, choose an empty set (i.e. [] ).
+## Example with both IPv4 and IPv6:
+## listen_addresses = ['127.0.0.1:53', '[::1]:53']
+##
+## To listen to all IPv4 addresses, use `listen_addresses = ['0.0.0.0:53']`
+## To listen to all IPv4+IPv6 addresses, use `listen_addresses = ['[::]:53']`
listen_addresses = ['127.0.0.1:53', '[::1]:53']
@@ -46,35 +52,37 @@ max_clients = 250
## Note (2): this feature is not compatible with systemd socket activation.
## Note (3): when using -pidfile, the PID file directory must be writable by the new user
-# user_name = 'nobody'
user_name = 'dnscrypt'
-## Require servers (from static + remote sources) to satisfy specific properties
+## Require servers (from remote sources) to satisfy specific properties
# Use servers reachable over IPv4
ipv4_servers = true
# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
-ipv6_servers = false
+ipv6_servers = true
# Use servers implementing the DNSCrypt protocol
dnscrypt_servers = true
# Use servers implementing the DNS-over-HTTPS protocol
-doh_servers = true
+doh_servers = false
+
+# Use servers implementing the Oblivious DoH protocol
+odoh_servers = false
## Require servers defined by remote sources to satisfy specific properties
# Server must support DNS security extensions (DNSSEC)
-require_dnssec = false
+require_dnssec = true
# Server must not log user queries (declarative)
require_nolog = true
-# Server must not enforce its own blacklist (for parental control, ads blocking...)
-require_nofilter = true
+# Server must not enforce its own blocklist (for parental control, ads blocking...)
+require_nofilter = false
# Server names to avoid even if they match all criteria
disabled_server_names = []
@@ -93,18 +101,21 @@ force_tcp = false
## Uncomment the following line to route all TCP connections to a local Tor node
## Tor doesn't support UDP, so set `force_tcp` to `true` as well.
-# proxy = "socks5://127.0.0.1:9050"
+# proxy = 'socks5://127.0.0.1:9050'
## HTTP/HTTPS proxy
## Only for DoH servers
-# http_proxy = "http://127.0.0.1:8888"
+# http_proxy = 'http://127.0.0.1:8888'
-## How long a DNS query will wait for a response, in milliseconds
+## How long a DNS query will wait for a response, in milliseconds.
+## If you have a network with *a lot* of latency, you may need to
+## increase this. Startup may be slower if you do so.
+## Don't increase it too much. 10000 is the highest reasonable value.
-timeout = 2500
+timeout = 5000
## Keepalive for HTTP (HTTPS, HTTP/2) queries, in seconds
@@ -112,19 +123,31 @@ timeout = 2500
keepalive = 30
-## Use the REFUSED return code for blocked responses
-## Setting this to `false` means that some responses will be lies.
-## Unfortunately, `false` appears to be required for Android 8+
+## Add EDNS-client-subnet information to outgoing queries
+##
+## Multiple networks can be listed; they will be randomly chosen.
+## These networks don't have to match your actual networks.
+
+# edns_client_subnet = ["0.0.0.0/0", "2001:db8::/32"]
+
-refused_code_in_responses = false
+## Response for blocked queries. Options are `refused`, `hinfo` (default) or
+## an IP response. To give an IP response, use the format `a:<IPv4>,aaaa:<IPv6>`.
+## Using the `hinfo` option means that some responses will be lies.
+## Unfortunately, the `hinfo` option appears to be required for Android 8+
+# blocked_query_response = 'refused'
-## Load-balancing strategy: 'p2' (default), 'ph', 'first' or 'random'
+
+## Load-balancing strategy: 'p2' (default), 'ph', 'p<n>', 'first' or 'random'
+## Randomly choose 1 of the fastest 2, half, n, 1 or all live servers by latency.
+## The response quality still depends on the server itself.
# lb_strategy = 'p2'
## Set to `true` to constantly try to estimate the latency of all the resolvers
## and adjust the load-balancing parameters accordingly, or to `false` to disable.
+## Default is `true` that makes 'p2' `lb_strategy` work well.
# lb_estimator = true
@@ -134,12 +157,20 @@ refused_code_in_responses = false
# log_level = 2
-## log file for the application
+## Log file for the application, as an alternative to sending logs to
+## the standard system logging service (syslog/Windows event log).
+##
+## This file is different from other log files, and will not be
+## automatically rotated by the application.
-# log_file = 'dnscrypt-proxy.log'
log_file = '/var/log/dnscrypt-proxy/dnscrypt-proxy.log'
+## When using a log file, only keep logs from the most recent launch.
+
+# log_file_latest = true
+
+
## Use the system logger (syslog on Unix, Event Log on Windows)
# use_syslog = true
@@ -154,7 +185,7 @@ cert_refresh_delay = 240
## This may improve privacy but can also have a significant impact on CPU usage
## Only enable if you don't have a lot of network load
-# dnscrypt_ephemeral_keys = false
+dnscrypt_ephemeral_keys = true
## DoH: Disable TLS session tickets - increases privacy but also latency
@@ -167,6 +198,8 @@ cert_refresh_delay = 240
## 49195 = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
## 52392 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
## 52393 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+## 4865 = TLS_AES_128_GCM_SHA256
+## 4867 = TLS_CHACHA20_POLY1305_SHA256
##
## On non-Intel CPUs such as MIPS routers and ARM systems (Android, Raspberry Pi...),
## the following suite improves performance.
@@ -178,34 +211,49 @@ cert_refresh_delay = 240
# tls_cipher_suite = [52392, 49199]
-## Fallback resolver
-## This is a normal, non-encrypted DNS resolver, that will be only used
-## for one-shot queries when retrieving the initial resolvers list, and
-## only if the system DNS configuration doesn't work.
-## No user application queries will ever be leaked through this resolver,
-## and it will not be used after IP addresses of resolvers URLs have been found.
-## It will never be used if lists have already been cached, and if stamps
-## don't include host names without IP addresses.
-## It will not be used if the configured system DNS works.
-## A resolver supporting DNSSEC is recommended. This may become mandatory.
+## Bootstrap resolvers
+##
+## These are normal, non-encrypted DNS resolvers, that will be only used
+## for one-shot queries when retrieving the initial resolvers list and if
+## the system DNS configuration doesn't work.
+##
+## No user queries will ever be leaked through these resolvers, and they will
+## not be used after IP addresses of DoH resolvers have been found (if you are
+## using DoH).
+##
+## They will never be used if lists have already been cached, and if the stamps
+## of the configured servers already include IP addresses (which is the case for
+## most of DoH servers, and for all DNSCrypt servers and relays).
+##
+## They will not be used if the configured system DNS works, or after the
+## proxy already has at least one usable secure resolver.
##
-## People in China may need to use 114.114.114.114:53 here.
-## Other popular options include 8.8.8.8 and 1.1.1.1.
+## Resolvers supporting DNSSEC are recommended, and, if you are using
+## DoH, bootstrap resolvers should ideally be operated by a different entity
+## than the DoH servers you will be using, especially if you have IPv6 enabled.
+##
+## People in China may want to use 114.114.114.114:53 here.
+## Other popular options include 8.8.8.8, 9.9.9.9 and 1.1.1.1.
+##
+## If more than one resolver is specified, they will be tried in sequence.
+##
+## TL;DR: put valid standard resolver addresses here. Your actual queries will
+## not be sent there. If you're using DNSCrypt or Anonymized DNS and your
+## lists are up to date, these resolvers will not even be used.
-fallback_resolver = '9.9.9.9:53'
+bootstrap_resolvers = ['9.9.9.9:53', '8.8.8.8:53']
-## Never let dnscrypt-proxy try to use the system DNS settings;
-## unconditionally use the fallback resolver.
+## Always use the bootstrap resolver before the system DNS settings.
-ignore_system_dns = false
+ignore_system_dns = true
## Maximum time (in seconds) to wait for network connectivity before
## initializing the proxy.
## Useful if the proxy is automatically started at boot, and network
## connectivity is not guaranteed to be immediately available.
-## Use 0 to not test for connectivity at all,
+## Use 0 to not test for connectivity at all (not recommended),
## and -1 to wait as much as possible.
netprobe_timeout = 60
@@ -219,7 +267,7 @@ netprobe_timeout = 60
## On other operating systems, the connection will be initialized
## but nothing will be sent at all.
-netprobe_address = "9.9.9.9:53"
+netprobe_address = '9.9.9.9:53'
## Offline mode - Do not use any remote encrypted servers.
@@ -229,9 +277,19 @@ netprobe_address = "9.9.9.9:53"
# offline_mode = false
+## Additional data to attach to outgoing queries.
+## These strings will be added as TXT records to queries.
+## Do not use, except on servers explicitly asking for extra data
+## to be present.
+## encrypted-dns-server can be configured to use this for access control
+## in the [access_control] section
+
+# query_meta = ['key1:value1', 'key2:value2', 'token:MySecretToken']
+
+
## Automatic log files rotation
-# Maximum log files size in MB
+# Maximum log files size in MB - Set to 0 for unlimited.
log_files_max_size = 10
# How long to keep backup files, in days
@@ -246,13 +304,34 @@ log_files_max_backups = 1
# Filters #
#########################
+## Note: if you are using dnsmasq, disable the `dnssec` option in dnsmasq if you
+## configure dnscrypt-proxy to do any kind of filtering (including the filters
+## below and blocklists).
+## You can still choose resolvers that do DNSSEC validation.
+
+
## Immediately respond to IPv6-related queries with an empty response
## This makes things faster when there is no IPv6 connectivity, but can
## also cause reliability issues with some stub resolvers.
-## Do not enable if you added a validating resolver such as dnsmasq in front
-## of the proxy.
-block_ipv6 = false
+block_ipv6 = true
+
+
+## Immediately respond to A and AAAA queries for host names without a domain name
+
+block_unqualified = true
+
+
+## Immediately respond to queries for local zones instead of leaking them to
+## upstream resolvers (always causing errors or timeouts).
+
+block_undelegated = true
+
+
+## TTL for synthetic responses sent when a request has been blocked (due to
+## IPv6 or blocklists).
+
+reject_ttl = 10
@@ -260,9 +339,7 @@ block_ipv6 = false
# Route queries for specific domains to a dedicated set of servers #
##################################################################################
-## Example map entries (one entry per line):
-## example.com 9.9.9.9
-## example.net 9.9.9.9,8.8.8.8,1.1.1.1
+## See the `example-forwarding-rules.txt` file for an example
# forwarding_rules = 'forwarding-rules.txt'
@@ -276,12 +353,14 @@ block_ipv6 = false
## In addition to acting as a HOSTS file, it can also return the IP address
## of a different name. It will also do CNAME flattening.
##
-## Example map entries (one entry per line)
-## example.com 10.1.1.1
-## www.google.com forcesafesearch.google.com
+## See the `example-cloaking-rules.txt` file for an example
# cloaking_rules = 'cloaking-rules.txt'
+## TTL used when serving entries in cloaking-rules.txt
+
+# cloak_ttl = 600
+
###########################
@@ -295,12 +374,12 @@ cache = true
## Cache size
-cache_size = 512
+cache_size = 4096
## Minimum TTL for cached entries
-cache_min_ttl = 600
+cache_min_ttl = 2400
## Maximum TTL for cached entries
@@ -319,6 +398,51 @@ cache_neg_max_ttl = 600
+########################################
+# Captive portal handling #
+########################################
+
+[captive_portals]
+
+## A file that contains a set of names used by operating systems to
+## check for connectivity and captive portals, along with hard-coded
+## IP addresses to return.
+
+# map_file = 'example-captive-portals.txt'
+
+
+
+##################################
+# Local DoH server #
+##################################
+
+[local_doh]
+
+## dnscrypt-proxy can act as a local DoH server. By doing so, web browsers
+## requiring a direct connection to a DoH server in order to enable some
+## features will enable these, without bypassing your DNS proxy.
+
+## Addresses that the local DoH server should listen to
+
+# listen_addresses = ['127.0.0.1:3000']
+
+
+## Path of the DoH URL. This is not a file, but the part after the hostname
+## in the URL. By convention, `/dns-query` is frequently chosen.
+## For each `listen_address` the complete URL to access the server will be:
+## `https://<listen_address><path>` (ex: `https://127.0.0.1/dns-query`)
+
+# path = '/dns-query'
+
+
+## Certificate file and key - Note that the certificate has to be trusted.
+## See the documentation (wiki) for more information.
+
+# cert_file = 'localhost.pem'
+# cert_key_file = 'localhost.pem'
+
+
+
###############################
# Query logging #
###############################
@@ -327,7 +451,8 @@ cache_neg_max_ttl = 600
[query_log]
- ## Path to the query log file (absolute, or relative to the same directory as the executable file)
+ ## Path to the query log file (absolute, or relative to the same directory as the config file)
+ ## Can be set to /dev/stdout in order to log to the standard output.
# file = 'query.log'
@@ -353,7 +478,7 @@ cache_neg_max_ttl = 600
[nx_log]
- ## Path to the query log file (absolute, or relative to the same directory as the executable file)
+ ## Path to the query log file (absolute, or relative to the same directory as the config file)
# file = 'nx.log'
@@ -365,10 +490,10 @@ cache_neg_max_ttl = 600
######################################################
-# Pattern-based blocking (blacklists) #
+# Pattern-based blocking (blocklists) #
######################################################
-## Blacklists are made of one pattern per line. Example of valid patterns:
+## Blocklists are made of one pattern per line. Example of valid patterns:
##
## example.com
## =example.com
@@ -377,20 +502,20 @@ cache_neg_max_ttl = 600
## ads*.example.*
## ads*.example[0-9]*.com
##
-## Example blacklist files can be found at https://download.dnscrypt.info/blacklists/
-## A script to build blacklists from public feeds can be found in the
-## `utils/generate-domains-blacklists` directory of the dnscrypt-proxy source code.
+## Example blocklist files can be found at https://download.dnscrypt.info/blocklists/
+## A script to build blocklists from public feeds can be found in the
+## `utils/generate-domains-blocklists` directory of the dnscrypt-proxy source code.
-[blacklist]
+[blocked_names]
- ## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)
+ ## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
- # blacklist_file = 'blacklist.txt'
+ # blocked_names_file = 'blocked-names.txt'
## Optional path to a file logging blocked queries
- # log_file = 'blocked.log'
+ # log_file = 'blocked-names.log'
## Optional log format: tsv or ltsv (default: tsv)
@@ -400,25 +525,25 @@ cache_neg_max_ttl = 600
###########################################################
-# Pattern-based IP blocking (IP blacklists) #
+# Pattern-based IP blocking (IP blocklists) #
###########################################################
-## IP blacklists are made of one pattern per line. Example of valid patterns:
+## IP blocklists are made of one pattern per line. Example of valid patterns:
##
## 127.*
## fe80:abcd:*
## 192.168.1.4
-[ip_blacklist]
+[blocked_ips]
- ## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)
+ ## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
- # blacklist_file = 'ip-blacklist.txt'
+ # blocked_ips_file = 'blocked-ips.txt'
## Optional path to a file logging blocked queries
- # log_file = 'ip-blocked.log'
+ # log_file = 'blocked-ips.log'
## Optional log format: tsv or ltsv (default: tsv)
@@ -428,26 +553,53 @@ cache_neg_max_ttl = 600
######################################################
-# Pattern-based whitelisting (blacklists bypass) #
+# Pattern-based allow lists (blocklists bypass) #
######################################################
-## Whitelists support the same patterns as blacklists
-## If a name matches a whitelist entry, the corresponding session
+## Allowlists support the same patterns as blocklists
+## If a name matches an allowlist entry, the corresponding session
## will bypass names and IP filters.
##
## Time-based rules are also supported to make some websites only accessible at specific times of the day.
-[whitelist]
+[allowed_names]
+
+ ## Path to the file of allow list rules (absolute, or relative to the same directory as the config file)
+
+ # allowed_names_file = 'allowed-names.txt'
+
+
+ ## Optional path to a file logging allowed queries
- ## Path to the file of whitelisting rules (absolute, or relative to the same directory as the executable file)
+ # log_file = 'allowed-names.log'
- # whitelist_file = 'whitelist.txt'
+
+ ## Optional log format: tsv or ltsv (default: tsv)
+
+ # log_format = 'tsv'
- ## Optional path to a file logging whitelisted queries
- # log_file = 'whitelisted.log'
+#########################################################
+# Pattern-based allowed IPs lists (blocklists bypass) #
+#########################################################
+
+## Allowed IP lists support the same patterns as IP blocklists
+## If an IP response matches an allow ip entry, the corresponding session
+## will bypass IP filters.
+##
+## Time-based rules are also supported to make some websites only accessible at specific times of the day.
+
+[allowed_ips]
+ ## Path to the file of allowed ip rules (absolute, or relative to the same directory as the config file)
+
+ # allowed_ips_file = 'allowed-ips.txt'
+
+
+ ## Optional path to a file logging allowed queries
+
+ # log_file = 'allowed-ips.log'
## Optional log format: tsv or ltsv (default: tsv)
@@ -460,13 +612,12 @@ cache_neg_max_ttl = 600
##########################################
## One or more weekly schedules can be defined here.
-## Patterns in the name-based blocklist can optionally be followed with @schedule_name
+## Patterns in the name-based blocked_names file can optionally be followed with @schedule_name
## to apply the pattern 'schedule_name' only when it matches a time range of that schedule.
##
-## For example, the following rule in a blacklist file:
+## For example, the following rule in a blocklist file:
## *.youtube.* @time-to-sleep
-## would block access to YouTube only during the days, and period of the days
-## define by the 'time-to-sleep' schedule.
+## would block access to YouTube during the times defined by the 'time-to-sleep' schedule.
##
## {after='21:00', before= '7:00'} matches 0:00-7:00 and 21:00-0:00
## {after= '9:00', before='18:00'} matches 9:00-18:00
@@ -507,43 +658,200 @@ cache_neg_max_ttl = 600
## must include the prefixes.
##
## If the `urls` property is missing, cache files and valid signatures
-## must be already present; This doesn't prevent these cache files from
+## must already be present. This doesn't prevent these cache files from
## expiring after `refresh_delay` hours.
+## Cache freshness is checked every 24 hours, so values for 'refresh_delay'
+## of less than 24 hours will have no effect.
+## A maximum delay of 168 hours (1 week) is imposed to ensure cache freshness.
[sources]
## An example of a remote source from https://github.com/DNSCrypt/dnscrypt-resolvers
[sources.'public-resolvers']
- urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
- cache_file = 'public-resolvers.md'
- minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
- refresh_delay = 72
- prefix = ''
-
- ## Quad9 over DNSCrypt - https://quad9.net/
+ urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/public-resolvers.md', 'https://download.dnscrypt.net/resolvers-list/v3/public-resolvers.md']
+ cache_file = 'public-resolvers.md'
+ minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+ refresh_delay = 72
+ prefix = ''
+
+ ## Anonymized DNS relays
+
+ [sources.'relays']
+ urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/relays.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/relays.md', 'https://download.dnscrypt.net/resolvers-list/v3/relays.md']
+ cache_file = 'relays.md'
+ minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+ refresh_delay = 72
+ prefix = ''
+
+ ## ODoH (Oblivious DoH) servers and relays
+
+ # [sources.'odoh-servers']
+ # urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-servers.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-servers.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/odoh-servers.md', 'https://download.dnscrypt.net/resolvers-list/v3/odoh-servers.md']
+ # cache_file = 'odoh-servers.md'
+ # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+ # refresh_delay = 24
+ # prefix = ''
+ # [sources.'odoh-relays']
+ # urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/odoh-relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/odoh-relays.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/odoh-relays.md', 'https://download.dnscrypt.net/resolvers-list/v3/odoh-relays.md']
+ # cache_file = 'odoh-relays.md'
+ # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+ # refresh_delay = 24
+ # prefix = ''
+
+ ## Quad9
# [sources.quad9-resolvers]
- # urls = ["https://www.quad9.net/quad9-resolvers.md"]
- # minisign_key = "RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN"
- # cache_file = "quad9-resolvers.md"
- # refresh_delay = 72
- # prefix = "quad9-"
+ # urls = ['https://www.quad9.net/quad9-resolvers.md']
+ # minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN'
+ # cache_file = 'quad9-resolvers.md'
+ # prefix = 'quad9-'
## Another example source, with resolvers censoring some websites not appropriate for children
## This is a subset of the `public-resolvers` list, so enabling both is useless
# [sources.'parental-control']
- # urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/parental-control.md', 'https://download.dnscrypt.info/resolvers-list/v2/parental-control.md']
- # cache_file = 'parental-control.md'
- # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+ # urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/parental-control.md', 'https://download.dnscrypt.info/resolvers-list/v3/parental-control.md', 'https://ipv6.download.dnscrypt.info/resolvers-list/v3/parental-control.md', 'https://download.dnscrypt.net/resolvers-list/v3/parental-control.md']
+ # cache_file = 'parental-control.md'
+ # minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+
+
+
+#########################################
+# Servers with known bugs #
+#########################################
+
+[broken_implementations]
+
+# Cisco servers currently cannot handle queries larger than 1472 bytes, and don't
+# truncate reponses larger than questions as expected by the DNSCrypt protocol.
+# This prevents large responses from being received over UDP and over relays.
+#
+# Older versions of the `dnsdist` server software had a bug with queries larger
+# than 1500 bytes. This is fixed since `dnsdist` version 1.5.0, but
+# some server may still run an outdated version.
+#
+# The list below enables workarounds to make non-relayed usage more reliable
+# until the servers are fixed.
+
+fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'cleanbrowsing-adult', 'cleanbrowsing-adult-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-security', 'cleanbrowsing-security-ipv6']
+
+
+
+#################################################################
+# Certificate-based client authentication for DoH #
+#################################################################
+
+# Use a X509 certificate to authenticate yourself when connecting to DoH servers.
+# This is only useful if you are operating your own, private DoH server(s).
+# 'creds' maps servers to certificates, and supports multiple entries.
+# If you are not using the standard root CA, an optional "root_ca"
+# property set to the path to a root CRT file can be added to a server entry.
+
+[doh_client_x509_auth]
+
+#
+# creds = [
+# { server_name='*', client_cert='client.crt', client_key='client.key' }
+# ]
+
+
+
+################################
+# Anonymized DNS #
+################################
+
+[anonymized_dns]
+
+## Routes are indirect ways to reach DNSCrypt servers.
+##
+## A route maps a server name ("server_name") to one or more relays that will be
+## used to connect to that server.
+##
+## A relay can be specified as a DNS Stamp (either a relay stamp, or a
+## DNSCrypt stamp) or a server name.
+##
+## The following example routes "example-server-1" via `anon-example-1` or `anon-example-2`,
+## and "example-server-2" via the relay whose relay DNS stamp is
+## "sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM".
+##
+## !!! THESE ARE JUST EXAMPLES !!!
+##
+## Review the list of available relays from the "relays.md" file, and, for each
+## server you want to use, define the relays you want connections to go through.
+##
+## Carefully choose relays and servers so that they are run by different entities.
+##
+## "server_name" can also be set to "*" to define a default route, for all servers:
+## { server_name='*', via=['anon-example-1', 'anon-example-2'] }
+##
+## If a route is ["*"], the proxy automatically picks a relay on a distinct network.
+## { server_name='*', via=['*'] } is also an option, but is likely to be suboptimal.
+##
+## Manual selection is always recommended over automatic selection, so that you can
+## select (relay,server) pairs that work well and fit your own criteria (close by or
+## in different countries, operated by different entities, on distinct ISPs...)
+
+ routes = [
+ { server_name='ams-dnscrypt-nl', via=['sdns://gRE4OS4zOC4xMzEuMzg6NDM0Mw', 'sdns://gQ4zNy4xMjAuMTQyLjExNQ', 'sdns://gQ8xMjguMTI3LjEwNC4xMDg'] },
+ { server_name='ams-dnscrypt-nl-ipv6', via=['sdns://gQ4zNy4xMjAuMTQyLjExNQ', 'sdns://gRpbMmEwYzpiOWMwOmY6NDUxZDo6MV06NDM0Mw', 'sdns://gQ8xMjguMTI3LjEwNC4xMDg'] }
+ ]
+
+
+# Skip resolvers incompatible with anonymization instead of using them directly
+
+skip_incompatible = true
+
+
+# If public server certificates for a non-conformant server cannot be
+# retrieved via a relay, try getting them directly. Actual queries
+# will then always go through relays.
+
+# direct_cert_fallback = false
+
+
+
+###############################
+# DNS64 #
+###############################
+
+## DNS64 is a mechanism for synthesizing AAAA records from A records.
+## It is used with an IPv6/IPv4 translator to enable client-server
+## communication between an IPv6-only client and an IPv4-only server,
+## without requiring any changes to either the IPv6 or the IPv4 node,
+## for the class of applications that work through NATs.
+##
+## There are two options to synthesize such records:
+## Option 1: Using a set of static IPv6 prefixes;
+## Option 2: By discovering the IPv6 prefix from DNS64-enabled resolver.
+##
+## If both options are configured - only static prefixes are used.
+## (Ref. RFC6147, RFC6052, RFC7050)
+##
+## Do not enable unless you know what DNS64 is and why you need it, or else
+## you won't be able to connect to anything at all.
+
+[dns64]
+
+## (Option 1) Static prefix(es) as Pref64::/n CIDRs.
+# prefix = ['64:ff9b::/96']
+
+## (Option 2) DNS64-enabled resolver(s) to discover Pref64::/n CIDRs.
+## These resolvers are used to query for Well-Known IPv4-only Name (WKN) "ipv4only.arpa." to discover only.
+## Set with your ISP's resolvers in case of custom prefixes (other than Well-Known Prefix 64:ff9b::/96).
+## IMPORTANT: Default resolvers listed below support Well-Known Prefix 64:ff9b::/96 only.
+# resolver = ['[2606:4700:4700::64]:53', '[2001:4860:4860::64]:53']
+
+########################################
+# Static entries #
+########################################
## Optional, local, static list of additional servers
## Mostly useful for testing your own servers.
[static]
- # [static.'google']
- # stamp = 'sdns://AgUAAAAAAAAAAAAOZG5zLmdvb2dsZS5jb20NL2V4cGVyaW1lbnRhbA'
+ # [static.'myserver']
+ # stamp = 'sdns://AQcAAAAAAAAAAAAQMi5kbnNjcnlwdC1jZXJ0Lg'
diff --git a/network/dnscrypt-proxy/dnsmasq.conf b/network/dnscrypt-proxy/dnsmasq.conf
deleted file mode 100644
index 9700cb2df9..0000000000
--- a/network/dnscrypt-proxy/dnsmasq.conf
+++ /dev/null
@@ -1,21 +0,0 @@
-# Use dnsmasq as a caching DNS forwarder to dnscrypt-proxy. This configuration
-# assumes dnscrypt-proxy is running on port 55.
-
-# Never forward plain names (without a dot or domain part)
-domain-needed
-
-# Never forward addresses in the non-routed address spaces.
-bogus-priv
-
-# Don't use /etc/resolv.conf. Forward all queries to dnscrypt-proxy.
-no-resolv
-
-# Use the resolver on localhost port 55 (dnscrypt-proxy)
-server=127.0.0.1#55
-
-# Listen on localhost. Default port 53
-listen-address=127.0.0.1
-
-# Pass on the upstream DNSSEC flag. Only enable this if you trust the upstream
-# resolver.
-#proxy-dnssec
diff --git a/network/dnscrypt-proxy/doinst.sh b/network/dnscrypt-proxy/doinst.sh
index e264e34a56..c648875656 100644
--- a/network/dnscrypt-proxy/doinst.sh
+++ b/network/dnscrypt-proxy/doinst.sh
@@ -1,27 +1,18 @@
-config() {
- NEW="$1"
- OLD="$(dirname $NEW)/$(basename $NEW .new)"
- # If there's no config file by that name, mv it over:
- if [ ! -r $OLD ]; then
- mv $NEW $OLD
- elif [ "$(cat $OLD | md5sum)" = "$(cat $NEW | md5sum)" ]; then
- # toss the redundant copy
- rm $NEW
- fi
- # Otherwise, we leave the .new copy for the admin to consider...
-}
+#!/bin/bash
-preserve_perms() {
- NEW="$1"
- OLD="$(dirname $NEW)/$(basename $NEW .new)"
- if [ -e $OLD ]; then
- cp -a $OLD ${NEW}.incoming
- cat $NEW > ${NEW}.incoming
- mv ${NEW}.incoming $NEW
- fi
- config $NEW
-}
+# dnscrypt-proxy writes files to its data directories after
+# dropping privileges. This ensures $DNSCRYPT_USER can write
+# files to these directories, without having to change default
+# root:root in slackware.
+#
+# This is a workaround, might not be a elegant solution.
-preserve_perms etc/rc.d/rc.dnscrypt-proxy.new
-config etc/default/dnscrypt-proxy.new
-config etc/dnscrypt-proxy/dnscrypt-proxy.toml.new
+PRGNAM=dnscrypt-proxy
+DNSCRYPT_UID=293
+DNSCRYPT_GID=293
+
+chown $DNSCRYPT_UID:$DNSCRYPT_GID etc/$PRGNAM/*
+
+setfacl -m u:$DNSCRYPT_UID:rwx etc/$PRGNAM
+setfacl -m u:$DNSCRYPT_UID:rwx var/run/$PRGNAM
+setfacl -m u:$DNSCRYPT_UID:rwx var/log/$PRGNAM
diff --git a/network/dnscrypt-proxy/named.conf b/network/dnscrypt-proxy/named.conf
deleted file mode 100644
index b416855f26..0000000000
--- a/network/dnscrypt-proxy/named.conf
+++ /dev/null
@@ -1,153 +0,0 @@
-options {
- directory "/var/named";
- /*
- * If there is a firewall between you and nameservers you want
- * to talk to, you might need to uncomment the query-source
- * directive below. Previous versions of BIND always asked
- * questions using port 53, but BIND 8.1 uses an unprivileged
- * port by default.
- */
- // query-source address * port 53;
- forwarders { 127.0.0.1 port 55; };
- forward only;
- dnssec-enable yes;
- dnssec-validation auto;
- dnssec-lookaside auto;
- allow-transfer { "none"; };
- allow-query { 127.0.0.1; };
- listen-on { 127.0.0.1; };
-};
-
-//
-// a caching only nameserver config
-//
-zone "." IN {
- type hint;
- file "caching-example/named.root";
-};
-
-zone "localhost" IN {
- type master;
- file "caching-example/localhost.zone";
- allow-update { none; };
-};
-
-zone "0.0.127.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-// RFC 1918. These shouldn't be necessary but empty-zones-enable isn't
-// working properly...
-zone "10.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "16.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "17.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "18.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "19.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "20.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "21.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "22.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "23.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "24.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "25.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "26.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "27.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "28.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "29.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "30.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "31.172.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-zone "168.192.in-addr.arpa" IN {
- type master;
- file "caching-example/named.local";
- allow-update { none; };
-};
-
-logging {
- category edns-disabled { null; };
-};
diff --git a/network/dnscrypt-proxy/rc.dnscrypt-proxy b/network/dnscrypt-proxy/rc.dnscrypt-proxy
index 1aa68260b9..49cd4dc984 100644
--- a/network/dnscrypt-proxy/rc.dnscrypt-proxy
+++ b/network/dnscrypt-proxy/rc.dnscrypt-proxy
@@ -1,134 +1,76 @@
-#!/bin/bash
-
-CONFIGFILE="/etc/default/dnscrypt-proxy"
-DAEMON="/usr/sbin/dnscrypt-proxy"
-
-. $CONFIGFILE
-
-start_instance() {
- if [ ! -r ${DNSCRYPTCONFIG[$1]} ]; then
- echo "No configuration for instance $1 found!"
- return
- fi
- if [ -z ${PIDFILE[$1]} ]; then
- echo "No PID configuration for instance $1 found!"
- return
- fi
- if [ -z ${USER[$1]} ]; then
- echo "No user configuration for instance $1 found!"
- return
- fi
- if [ -r ${PIDFILE[$1]} ]; then
- echo "dnscrypt-proxy (instance $1) already running!"
- return
- fi
-
- mkdir -p $(dirname ${PIDFILE[$1]})
- # The child (unprivileged) process needs write access or the PID will not
- # be written.
- chmod 0700 $(dirname ${PIDFILE[$1]})
- chown ${USER[$1]} $(dirname ${PIDFILE[$1]})
-
- # The new Go-based dnscrypt-proxy no longer has the ability to daemonize.
- # In the absence of a standard Slackware daemon tool we'll use nohup. :(
- nohup $DAEMON -config ${DNSCRYPTCONFIG[$1]} -pidfile ${PIDFILE[$1]} >> /dev/null 2>&1 &
-}
+#!/bin/sh
-stop_instance() {
- if [ ! -r ${DNSCRYPTCONFIG[$1]} ]; then
- echo "No configuration for instance $1 found!"
- return
- fi
- if [ -z ${PIDFILE[$1]} ]; then
- echo "No PID configuration for instance $1 found!"
- return
- fi
- if [ ! -r ${PIDFILE[$1]} ]; then
- echo "dnscrypt-proxy (instance $1) is not running!"
- return
- fi
- echo "Stopping dnscrypt-proxy (instance $1)..."
- kill $(cat ${PIDFILE[$1]})
-}
+# Init file for dnscrypt-proxy
-status_instance() {
- if [ ! -r ${DNSCRYPTCONFIG[$1]} ]; then
- echo "No configuration for instance $1 found!"
- return
- fi
- if [ -z ${PIDFILE[$1]} ]; then
- echo "No PID configuration for instance $1 found!"
- return
- fi
- if [ ! -r ${PIDFILE[$1]} ]; then
- echo "dnscrypt-proxy (instance $1) is not running."
- return
- fi
- PID=$(cat ${PIDFILE[$1]})
- if [ -z "$PID" ]; then
- echo "PID file is empty! dnscrypt-proxy (instance $1) does not appear to be running, but there is a stale PID file."
- elif kill -0 $PID ; then
- echo "dnscrypt-proxy (instance $1) is running."
- else
- echo "dnscrypt-proxy (instance $1) is not running, but there is a stale PID file."
- fi
-}
+CONFDIR="/etc/dnscrypt-proxy"
+LOGDIR="/var/log/dnscrypt-proxy"
+RUNDIR="/var/run/dnscrypt-proxy"
+
+OPTS="-config $CONFDIR/dnscrypt-proxy.toml -pidfile $RUNDIR/dnscrypt-proxy.pid -logfile $LOGDIR/dnscrypt-proxy.log"
+
+PID=$(cat /var/run/dnscrypt-proxy/dnscrypt-proxy.pid 2>/dev/null)
start() {
- for i in `/usr/bin/seq 0 $((${#DNSCRYPTCONFIG[@]}-1))`
- do
- start_instance $i
- done
+ echo "Starting DNSCrypt-proxy"
+ /usr/bin/dnscrypt-proxy $OPTS &
}
stop() {
- for i in `/usr/bin/seq 0 $((${#DNSCRYPTCONFIG[@]}-1))`
- do
- stop_instance $i
- done
+ echo "Stopping DNSCrypt-proxy"
+
+if [ -z $PID ]; then
+ echo "Not running"
+ exit 0
+fi
+
+if kill -15 $PID 2>/dev/null; then
+ echo "Stopped"
+ rm $RUNDIR/dnscrypt-proxy.pid 2>/dev/null
+else
+ sleep 1
+if kill -9 $PID 2>/dev/null; then
+ echo "Killed"
+ rm $RUNDIR/dnscrypt-proxy.pid 2>/dev/null
+else
+ echo "Error"
+ exit 1
+fi
+fi
+
}
status() {
- for i in `/usr/bin/seq 0 $((${#DNSCRYPTCONFIG[@]}-1))`
- do
- status_instance $i
- done
+
+if [ -z $PID ]; then
+ echo "Not running"
+ exit 0
+else
+ echo "Running"
+ exit 0
+fi
+
}
case "$1" in
- 'start')
- start
- ;;
- 'stop')
- stop
- ;;
- 'restart')
- stop
- start
- ;;
- 'status')
- status
- ;;
- *_start)
- INSTANCE=`echo $1 | /bin/cut -d '_' -f 1`
- start_instance $INSTANCE
- ;;
- *_stop)
- INSTANCE=`echo $1 | /bin/cut -d '_' -f 1`
- stop_instance $INSTANCE
- ;;
- *_restart)
- INSTANCE=`echo $1 | /bin/cut -d '_' -f 1`
- stop_instance $INSTANCE
- sleep 1
- start_instance $INSTANCE
- ;;
- *_status)
- INSTANCE=`echo $1 | /bin/cut -d '_' -f 1`
- status_instance $INSTANCE
- ;;
- *)
- echo "Usage: $0 {start|stop|restart|status|#_start|#_stop|#_restart}"
- exit 1
- ;;
+
+start)
+ start
+ ;;
+
+stop)
+ stop
+;;
+
+restart)
+ stop
+ sleep 3
+ start
+;;
+
+status)
+ status
+;;
+
+*)
+ echo "Usage: $0 (start|stop|restart|status)"
esac
diff --git a/network/dnscrypt-proxy/slack-desc b/network/dnscrypt-proxy/slack-desc
index 46cdd370c5..092cd543f4 100644
--- a/network/dnscrypt-proxy/slack-desc
+++ b/network/dnscrypt-proxy/slack-desc
@@ -13,7 +13,7 @@ dnscrypt-proxy: your local resolver or as a DNS forwarder, encrypting and
dnscrypt-proxy: authenticating requests using the DNSCrypt protocol and passing them
dnscrypt-proxy: to an upstream DNSCrypt-enabled server.
dnscrypt-proxy:
-dnscrypt-proxy: https://github.com/jedisct1/dnscrypt-proxy
dnscrypt-proxy:
dnscrypt-proxy:
dnscrypt-proxy:
+dnscrypt-proxy: https://github.com/DNSCrypt/dnscrypt-proxy
generated by cgit v1.2.3 (git 2.32.0) at 2024-04-27 13:42:29 +0200