DNScrypt-proxy 2

Recent Commits

• Frank Denis(13 Aug 26)

  Web UI: Remove CORS headers THe idea was that other applications could use the websockets to display the information their own way, but I'm not sure this is really used in practice

• Frank Denis(10 Aug 26)

  Logger: restore original behavior If the server runs as root or as a dedicated user, I still want to be able to read the query log as a non-root user.

• Frank Denis(06 Aug 26)

  Remove interface enumeration Enumerating the interfaces is not free, especially on Windows where every address lookup goes through the IP Helper service, so we sample slowly. Losing a minute before rotating our client key after a network change is harmless; burning CPU cycles every few seconds on an idle machine is not.

• Frank Denis(01 Aug 26)

  Simplify

• Frank Denis(01 Aug 26)

  Add a test for #3305

• Frank Denis(01 Aug 26)

  Match suffix rules at label boundaries Suffix rules are stored as-is, just reversed in a critbit trie. So the longest prefix can end inside a DNS label, and hide a shorter rule that actually matches the name. To handle that and prevent adversarial names with many labels to cause many repeated searches, we allowed only two lookups per match. That was designed for common usage patterns, where names were expected to be domain names, not host names. But there's a clean way to prevent an unbounded number of matches and properly match any rules: just append a dot to the stored suffix keys (and reversed query names). It acts as a label separator, so the longest prefix can find the specific valid suffix with as ingle lookup. Fixes #3305

• Frank Denis(30 Jul 26)

  Improve portable network change detection

• Frank Denis(29 Jul 26)

  Improve autocloser workflow

• Frank Denis(22 Jul 26)

  PQ: pad resumed UDP queries to the regular question size target Also discard oversized tickets and fall back to TCP when a query cannot fit a datagram.

• Frank Denis(22 Jul 26)

  Forwarding: only use TCP with bootstrap resolvers Everything else is just sent to local devices, so UDP is fine. Fixes #3295

• Frank Denis(19 Jul 26)

  Add the version number to the UI web pages

• Frank Denis(18 Jul 26)

  Bump

• Frank Denis(18 Jul 26)

  Improve examples

• Frank Denis(18 Jul 26)

  Real TCP queries dial a fresh connection every time

• Frank Denis(18 Jul 26)

  Start benchmarking before Write(), not the setup time

• Frank Denis(18 Jul 26)

  Stop counting PQ certs transfer time in the startup benchmark

• Frank Denis(18 Jul 26)

  Support $PROXY in forwarding rules Fixes #2441

• Frank Denis(18 Jul 26)

  Update github actions

• Frank Denis(18 Jul 26)

  Update miekg/dns

• Frank Denis(18 Jul 26)

  Fix PQ certificate fallback on fragmented UDP paths Try the rollover-sized certificate query over UDP first and return as soon as the small query succeeds so that a truncated response can trigger TCP fallback instead of waiting for large UDP probes to time out. We keep relayed UDP packets at the intended size after accounting for the Anonymized DNSCrypt header. When retrying through a relay over TCP, retain a rollover-sized inner query because the relay still forwards it to the resolver over UDP and applies the anti-amplification thing. Preserve the UDP RTT when TCP is used only to complete certificate retrieval, so resolver latency does not incorrectly appear to be the TCP fallback latency.

• Frank Denis(13 Jul 26)

  UI: limit the size of top domains map

• Frank Denis(13 Jul 26)

  Improve ODoH diagnostics

• Frank Denis(13 Jul 26)

  Update CodeQL action

• Frank Denis(13 Jul 26)

  Sync deps

• Frank Denis(13 Jul 26)

  Update deps

• Frank Denis(13 Jul 26)

  Bump

• Frank Denis(13 Jul 26)

  Mention that dnscrypt_servers also affects PQDNSCrypt

• Frank Denis(13 Jul 26)

  Reuse PQ key pairs

• Frank Denis(13 Jul 26)

  ephemeral key pairs are for X25519

• Frank Denis(13 Jul 26)

  Update README.md to include PQ stuff