DNScrypt-proxy 2

Recent Commits

• Frank Denis (16 Jun 26)

  Import circl

• Frank Denis (16 Jun 26)

  Implement pqdnscrypt

• Frank Denis (09 Jun 26)

  Resolve against the origin rather than the document URL

• Frank Denis (06 Jun 26)

  Format

• Frank Denis (06 Jun 26)

  Fix cycles detection in cloaking rules Detect actual cycles in the name-target graph instead of rejecting every target that matches any cloak rule. Fixes #3238

• Frank Denis (05 Jun 26)

  Nits

• Frank Denis (05 Jun 26)

  Validate DNS response questions Quickly reject received DNS responses whose question name, type, or class does not match the original query. Apply the check to the central response path, manual DNS exchanges, forwarding, and DoH/ODoH server probes. Suggested by Kun-Ta Chu, thanks!

• Frank Denis (04 Jun 26)

  Fix TCP fallback for truncated forwarded queries miekg/dns v2 can return both a partial response with the TC bit set and an unpack error for truncated UDP replies. Treat that case as a valid TCP fallback trigger instead of dropping the forwarded query, and use a fresh timeout context for the TCP retry.

• Frank Denis (28 May 26)

  Simplify

• Frank Denis (26 May 26)

  Update GitHub workflows to use Zizmor

• Frank Denis (24 May 26)

  Add a Makefile

• Frank Denis (24 May 26)

  Bump

• Frank Denis (23 May 26)

  Add odoh test

• Frank Denis (23 May 26)

  odoh: harden 401 refresh path against panics, races, and bad state

• Frank Denis (23 May 26)

  odoh: coalesce key refreshes on 401 and remove blocking sleep A hostile or misbehaving ODoH relay can return HTTP 401 for every query. The proxy reacted by forcing a key refresh (which fails through the same relay) and then sleeping the calling goroutine for ten seconds. Under load every request goroutine ended up parked in that sleep, and the proxy stopped answering anyone, not just the clients of the bad server.

• Frank Denis (23 May 26)

  Reponse plugins reject reponses without a question

• Frank Denis (23 May 26)

  Drop responses that fail plugin processing Return nil from the resolver callback when ApplyResponsePlugins errors, and stop suppressing unpack errors for truncated packets.

• Frank Denis (23 May 26)

  Merge branch 'master' of github.com:DNSCrypt/dnscrypt-proxy * 'master' of github.com:DNSCrypt/dnscrypt-proxy: Fix TOCTOU race in refreshServer (#3224)

• Frank Denis (23 May 26)

  Merge IPCrypt algorithm normalization * fix/double-tolower: Normalize IP encryption algorithm once Fix double strings.ToLower in ipcrypt.go

• Frank Denis (23 May 26)

  Normalize IP encryption algorithm once

• HKLCF (23 May 26)

  Fix TOCTOU race in refreshServer (#3224) Combine the check-and-append into a single locked section to prevent duplicate server entries when refreshServer is called concurrently from refresh() and processODoHQuery(). Closes #3207 Co-authored-by: hklcf <[email protected]>

• Frank Denis (23 May 26)

  Fix data race on internalResolverReady field Use atomic.Bool instead of a plain bool to synchronize access from the cert-refresh worker goroutines and the resolver path. Originally submitted by hklcf in #3223. Closes #3205

• hklcf (23 May 26)

  Fix double strings.ToLower in ipcrypt.go Use already-normalized config.Algorithm value in the switch statement instead of calling strings.ToLower a second time. Closes #3215

• Frank Denis (21 May 26)

  xtransport: improve HTTP connection reuse Decouple the HTTP idle-pool lifetime from the keepalive config knob so connections stay warm for 90 seconds regardless, Also raise MaxIdleConns from 1 to 16 so multi-resolver setups don't re-handshake on every server rotation. Also drain the HTTP/3 transport's idle connections during rebuild, like we did with HTTP/2.

• Frank Denis (21 May 26)

  -resolve: report incomplete DNSSEC support

• Frank Denis (18 May 26)

  Update deps

• Frank Denis (18 May 26)

  Update comment

• lifenjoiner (18 May 26)

  Don't cache dashboard HTML pages (#3183) Fix #3181

• Frank Denis (05 May 26)

  Web UI: ditch JSON-P. Use fetch() for everything, it's 2026.

• Frank Denis (03 May 26)

  Update dependencies and actions