NextDNS

Recent Commits

• Olivier Poitrey(05 Aug 26)

  bug: handle OS detection failures and unsupported ASUSWRT

• Olivier Poitrey(05 Aug 26)

  bug: restore resolved DNS after network changes Fixes #1108

• Olivier Poitrey(05 Aug 26)

  bug: avoid duplicate port=0 on Synology Fixes #1119

• Olivier Poitrey(05 Aug 26)

  bug: isolate stalled upstream requests Limit concurrent network queries per resolver and reject excess proxy requests without blocking listeners. Preserve capacity for cached, local, and independently routed answers while keeping admission failures out of endpoint health accounting. Fixes #1122

• Sean Floyd(04 Aug 26)

  refactor: drop the internal/dnsmessage fork for golang.org/x/net (#1121) The fork was a ~3000-line copy of golang.org/x/net/dns/dnsmessage kept for two things upstream once lacked: structured SVCB/HTTPS parsing and the byte offset of an EDNS option. Both are now moot. x/net v0.57.0 -- already a direct dependency, pulled in by the maintainer in #1115 -- ships SVCB support (golang/go#43790, merged Oct 2025), more complete than the fork's, and it is the parser the Go standard library's own resolver already links, so nothing is duplicated by using it. Keeping a hand-synced copy of a parser for untrusted network input is pure liability: it silently drifts and misses upstream hardening, as a recent name-length amplification fix showed. A behavioural audit backs the swap: the fork and x/net (message.go plus svcb.go) share 169 top-level functions, 152 of them byte-identical. Of the 17 that differ, six are the SVCB/HTTPS implementation x/net now owns, one is unpackOPTResource whose only change is the line o.DataOffset = off, one is Name.unpack, and the rest are idiom drift such as binary.BigEndian versus hand-rolled shifts. Name.unpack makes the drift argument concrete: x/net applies the golang/go#77540 name-length check inside the unpack loop, while the fork only checks after the loop has appended. Dropping the fork picks that hardening up for free. The fork also carried API x/net has no equivalent for (Parser.CurrentOffset, NewNameBytes, RawResource, Builder.Resource, OPTResource.Pack), none of it referenced anywhere in nextdns, which is what makes this a clean delete rather than a port. The only fork API this repo used was the SVCB params (ported to the identically-valued SVCParam* names) and Option.DataOffset. DataOffset served one purpose: neutering the client's EDNS Client Subnet in place so it is not forwarded upstream. x/net's Option carries the parsed data but not its offset, so the offset is recovered by walking to the OPT rdata (optRDataStart) and tracking each option's position in lockstep with the parser. That is exact rather than a search, so it cannot be diverted onto lookalike bytes in the name or after the record, and does not depend on a well-formed rdlen. Behaviour is preserved, not assumed: a 3400-case differential of query.New against the fork -- random queries with ECS v4/v6, MAC and junk options, truncations, and crafted lookalike/decoy/understated-rdlen payloads -- shows zero divergence. The non-OPT SkipAdditional skip from #1120 is carried over rather than reverted, and both of its regression tests pass unchanged against the x/net parser. On top of those, resolver/query gains unit coverage of parsing, ECS extraction and neutering including those adversarial shapes, plus a fuzz target over the OPT walker (16M executions, no panic). Co-authored-by: Claude Opus 5 (1M context) <[email protected]>

• Sean Floyd(30 Jul 26)

  fix(query): stop an infinite loop on a non-OPT additional record (#1120) parse() scans the additional section for the OPT record but never consumed a record that was not OPT. The dnsmessage parser rewinds an unconsumed resource header, so the next AdditionalHeader call re-read the same header and the loop spun forever. Any well-formed query with a non-OPT additional record -- a bare A record is enough -- hangs query.New, and proxy/udp.go runs one query.New per inbound datagram, so a single unsolicited packet pins a CPU with no amplification or handshake. Skip the non-OPT record so the parser advances. SkipAdditional's error is propagated to match the loop's existing handling of a header parse error; a malformed record now fails the query rather than hanging it. The regression test is timeout-guarded because the bug hangs rather than returns; a second test covers a non-OPT record sitting before the OPT, so the skip must still find the OPT and extract the ECS peer IP. Co-authored-by: Claude Opus 5 (1M context) <[email protected]>

• Raymoz101(12 Jul 26)

  feat: make the nextdns command available on PATH on Firewalla (#1118) install.sh places the Firewalla binary at /home/pi/.firewalla/config/nextdns/nextdns (bin_location) and, unlike other platforms, creates no symlink in a PATH directory, so the documented 'nextdns status/log/...' commands do not work as typed. A one-time symlink would not help either: /usr/local on Firewalla is a memory-backed overlay cleared at every reboot, so the link must be refreshed from the run script's start action, which executes at every boot via post_main.d. Also remove the pidfile left behind by pre-systemd versions of this script; nothing reads it anymore and it is misleading when debugging. Co-authored-by: Claude Fable 5 <[email protected]>

• dependabot[bot](11 Jul 26)

  chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#1115) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.56.0 to 0.57.0. - [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Raymoz101(11 Jul 26)

  bug: fix Firewalla service killed at boot and left unsupervised (#1113) On Firewalla, the generated run script started the daemon as a detached background process tracked by a pidfile. This had three failure modes: - At boot the script is executed from firewalla.service (Type=oneshot, KillMode=control-group, RemainAfterExit=no), so the daemon started inside that unit's control group and was killed by systemd's cgroup cleanup as soon as the unit's start-up run exited, leaving the daemon down after every reboot. With the router-mode dnsmasq snippet (which uses no-resolv) this is a total DNS outage. Reproduction on a Firewalla Gold (systemd 249): systemd-run --unit=t -p Type=oneshot -p KillMode=control-group \ /bin/sh -c 'sleep 300 </dev/null >/dev/null 2>&1 &' # seconds later the sleep process is gone - The pidfile lives under /home/pi/firewalla/run on persistent storage and survives reboots. is_running() only checked that some process with the stored PID existed, so a recycled PID made start report "Already started" without starting anything, and stop could kill an unrelated process. - A crashed daemon was never restarted. Run the daemon as a transient systemd unit instead: systemd-run escapes the oneshot unit's control group, Restart=on-failure provides crash recovery, and no pidfile is needed. Firewalla is Ubuntu-based, so systemd is always present. The script keeps the same interface and output contract ("Already started"/"Running"/"Stopped", exit codes), so the Go Status/Start/Stop/Restart implementations are unchanged. Co-authored-by: Claude Fable 5 <[email protected]>

• dependabot[bot](11 Jul 26)

  chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 (#1116) Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.46.0 to 0.47.0. - [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• dependabot[bot](11 Jul 26)

  chore(deps): bump github.com/dgraph-io/ristretto/v2 from 2.4.0 to 2.4.2 (#1117) Bumps [github.com/dgraph-io/ristretto/v2](https://github.com/dgraph-io/ristretto) from 2.4.0 to 2.4.2. - [Release notes](https://github.com/dgraph-io/ristretto/releases) - [Changelog](https://github.com/dgraph-io/ristretto/blob/main/CHANGELOG.md) - [Commits](https://github.com/dgraph-io/ristretto/compare/v2.4.0...v2.4.2) --- updated-dependencies: - dependency-name: github.com/dgraph-io/ristretto/v2 dependency-version: 2.4.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Raymoz101(10 Jul 26)

  feat: add Firewalla dnsmasq lease file to DHCP discovery (#1114) Firewalla's firerouter writes dnsmasq DHCP leases to /home/pi/.router/run/dhcp/dnsmasq.leases, which is not in the probed lease file list, so lease-based client-name discovery never engages on Firewalla and naming relies solely on the redis-based discovery's 5-minute refresh. The path cannot exist on other platforms, so the entry is inert elsewhere. Co-authored-by: Claude Fable 5 <[email protected]>

• Sean Floyd(09 Jul 26)

  fix(endpoint): serve queries lock-free during endpoint tests (#1111) Manager held m.mu.Lock() across blocking DoH I/O in findBestEndpointLocked (endpoint discovery/probing) while getActiveEndpoint, the per-query hot path, took m.mu.RLock(). A hung endpoint test therefore blocked every DNS query for up to DefaultBackgroundTestTimeout (30s) -- a total DNS blackout, cached names included -- with the daemon still alive and status OK, recoverable only by restart. Likely the root cause behind #196, #699 and #737. Make Manager.activeEndpoint an atomic.Pointer and read it lock-free in getActiveEndpoint so queries keep using the current endpoint while a test runs. The write lock still serializes tests but no longer gates queries. Also: - bound the cold-start bootstrap with the caller context (cancellable lock + bounded test) so a first-query hang can't block forever; - switch mu to sync.Mutex now that nothing RLocks it, with a comment guarding against reintroducing the stall; - guard DOHEndpoint's lazy transport init/close, a data race the lock-free read newly exposes (go test -race flags it on master); - fix a latent lock leak on the bootstrap error path. Verified: TestManager_QueryNotBlockedByBackgroundTest and TestDOHEndpoint_ConcurrentRoundTripAndClose fail on master and pass with the fix; go test -race -count=10 ./resolver/endpoint/ is green. Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Nitish Agarwal(18 Jun 26)

  feat: add dinit init system support (#1105) Detect dinit as PID 1 via /proc/1/comm and write a dinit service description to /etc/dinit.d/<name>. Environment is passed via an env-file sidecar (/etc/dinit.d/<name>.env) since dinit service descriptions do not support inline env directives. Enable/disable at boot and drive start/stop/restart/status via dinitctl.

• Nitish Agarwal(17 Jun 26)

  feat: warn when client discovery is disabled by loopback-only listen (#1104) When report-client-info is enabled but nextdns listens only on a loopback address, client discovery is silently skipped. Devices then appear in the NextDNS dashboard with random IDs and no hostnames, with nothing in the logs to explain why. Add a Warningf log line in that branch so the misconfiguration is visible at startup.

• Nitish Agarwal(17 Jun 26)

  feat: add shell completion command (#1106) Add `nextdns completion <bash|zsh|fish>` that emits a shell completion script for the given shell. Covers top-level commands (derived from the commands table) and config subcommands (list, set, edit, wizard). - completion.go: pure completionScript() generator + thin command wrapper - completion_test.go: unit tests for all three shells and error cases - main.go: register completion command; move commands slice to init() to avoid an initialization cycle - README.md: document how to install the completion script

• dependabot[bot](14 Jun 26)

  chore(deps): bump golang.org/x/net from 0.53.0 to 0.56.0 (#1103) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.53.0 to 0.56.0. - [Commits](https://github.com/golang/net/compare/v0.53.0...v0.56.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Olivier Poitrey(03 Jun 26)

  chore: upgrade go verson to 1.26.4

• dependabot[bot](18 Apr 26)

  chore(deps): bump golang.org/x/net from 0.52.0 to 0.53.0 (#1084) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.52.0 to 0.53.0. - [Commits](https://github.com/golang/net/compare/v0.52.0...v0.53.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

• Olivier Poitrey(18 Apr 26)

  bug: strip CIDR from OpenWrt DHCP option DNS address (#1082)

• Olivier Poitrey(13 Apr 26)

  bug: reset endpoint probe timeouts per candidate Create and cancel a fresh timeout context for each endpoint probe so one candidate cannot leak its expired deadline into later probes.

• Olivier Poitrey(13 Apr 26)

  bug: synchronize netstatus checker state Synchronize checker startup and shared state updates so Notify and Stop cannot race on the global cancel function or previous interface snapshot.

• Olivier Poitrey(13 Apr 26)

  bug: refresh DHCP data under a write lock Move DHCP cache refresh onto a write-locked path so concurrent lookups no longer mutate shared maps while only holding an RLock.

• Olivier Poitrey(13 Apr 26)

  bug: guard zero inflight request limits Treat a configured inflight limit of zero as the default limit so the proxy does not create an unbuffered semaphore channel and deadlock on the first request.

• Olivier Poitrey(13 Apr 26)

  bug: bound idle TCP client reads Set a read deadline before consuming each TCP DNS query so an idle or slow client cannot hold an inflight slot indefinitely and starve the proxy.

• Olivier Poitrey(09 Apr 26)

  chore: pin CI Go setup action to 1.26.2

• Olivier Poitrey(06 Apr 26)

  Disable openwrt 24 backport

• Olivier Poitrey(16 Mar 26)

  chore: use apk for OpenWrt 25.12 installs Fixes #1073

• Olivier Poitrey(16 Mar 26)

  Add reconcile backport CI check

• Olivier Poitrey(16 Mar 26)

  Add reconcile script for OpenWRT