aboutsummaryrefslogtreecommitdiff
path: root/network
diff options
context:
space:
mode:
authorDave Woodfall <dave@slackbuilds.org>2020-04-23 16:36:42 +0100
committerWilly Sudiarto Raharjo <willysr@slackbuilds.org>2020-04-24 08:18:57 +0700
commit69d0081ab96a7fee349a7f3e154cee8ee941f146 (patch)
tree1d7c3d3fd0a122386e9b8a08c523c2d05536a474 /network
parentadfcd9d8cc629c6096d8bb69eb35acf14bcf839e (diff)
network/dnscrypt-proxy: Updated for version 2.0.42.
Signed-off-by: Willy Sudiarto Raharjo <willysr@slackbuilds.org>
Diffstat (limited to 'network')
-rw-r--r--network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild6
-rw-r--r--network/dnscrypt-proxy/dnscrypt-proxy.info6
-rw-r--r--network/dnscrypt-proxy/dnscrypt-proxy.toml259
3 files changed, 214 insertions, 57 deletions
diff --git a/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild b/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild
index 52f80592301a5..01a89c316eead 100644
--- a/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild
+++ b/network/dnscrypt-proxy/dnscrypt-proxy.SlackBuild
@@ -27,7 +27,7 @@
# significantly improved the value of this script!
PRGNAM=dnscrypt-proxy
-VERSION=${VERSION:-2.0.25}
+VERSION=${VERSION:-2.0.42}
BUILD=${BUILD:-1}
TAG=${TAG:-_SBo}
@@ -67,7 +67,7 @@ mkdir -p $PRGNAM-$VERSION/src/$DOMAIN/$ORG
cd $PRGNAM-$VERSION/src/$DOMAIN/$ORG
tar xvf $CWD/$PRGNAM-$VERSION.tar.gz
mv $PRGNAM-$VERSION $PRGNAM
-cd $PRGNAM
+cd $TMP/$PRGNAM-$VERSION
chown -R root:root .
find -L . \
\( -perm 777 -o -perm 775 -o -perm 750 -o -perm 711 -o -perm 555 \
@@ -79,6 +79,8 @@ export GOPATH="$TMP/$PRGNAM-$VERSION"
go install -a -x ./...
+cd $TMP/$PRGNAM-$VERSION/src/$DOMAIN/$ORG/$PRGNAM
+
mkdir -p $PKG/usr/sbin
install -m 755 "$TMP/$PRGNAM-$VERSION/bin/${PRGNAM}" $PKG/usr/sbin/${PRGNAM}
diff --git a/network/dnscrypt-proxy/dnscrypt-proxy.info b/network/dnscrypt-proxy/dnscrypt-proxy.info
index add495f8cd5d0..99c27a29ac750 100644
--- a/network/dnscrypt-proxy/dnscrypt-proxy.info
+++ b/network/dnscrypt-proxy/dnscrypt-proxy.info
@@ -1,8 +1,8 @@
PRGNAM="dnscrypt-proxy"
-VERSION="2.0.25"
+VERSION="2.0.42"
HOMEPAGE="https://github.com/jedisct1/dnscrypt-proxy"
-DOWNLOAD="https://github.com/jedisct1/dnscrypt-proxy/archive/2.0.25/dnscrypt-proxy-2.0.25.tar.gz"
-MD5SUM="1c92cedfc8d4ea7dc21b1abd5e93478c"
+DOWNLOAD="https://github.com/jedisct1/dnscrypt-proxy/archive/2.0.42/dnscrypt-proxy-2.0.42.tar.gz"
+MD5SUM="9892c5d281b57c5f315d2f95cd6c33d8"
DOWNLOAD_x86_64=""
MD5SUM_x86_64=""
REQUIRES="google-go-lang"
diff --git a/network/dnscrypt-proxy/dnscrypt-proxy.toml b/network/dnscrypt-proxy/dnscrypt-proxy.toml
index 5b4e99a89db15..0da38f82720e8 100644
--- a/network/dnscrypt-proxy/dnscrypt-proxy.toml
+++ b/network/dnscrypt-proxy/dnscrypt-proxy.toml
@@ -21,19 +21,22 @@
## Servers from the "public-resolvers" source (see down below) can
## be viewed here: https://dnscrypt.info/public-servers
##
-## If this line is commented, all registered servers matching the require_* filters
-## will be used.
+## The proxy will automatically pick working servers from this list.
+## Note that the require_* filters do NOT apply when using this setting.
+##
+## By default, this list is empty and all registered servers matching the
+## require_* filters will be used instead.
##
-## The proxy will automatically pick the fastest, working servers from the list.
## Remove the leading # first to enable this; lines starting with # are ignored.
# server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
## List of local addresses and ports to listen to. Can be IPv4 and/or IPv6.
-## Note: When using systemd socket activation, choose an empty set (i.e. [] ).
+## Example with both IPv4 and IPv6:
+## listen_addresses = ['127.0.0.1:53', '[::1]:53']
-listen_addresses = ['127.0.0.1:53', '[::1]:53']
+listen_addresses = ['127.0.0.1:53']
## Maximum number of simultaneous client connections to accept
@@ -93,18 +96,21 @@ force_tcp = false
## Uncomment the following line to route all TCP connections to a local Tor node
## Tor doesn't support UDP, so set `force_tcp` to `true` as well.
-# proxy = "socks5://127.0.0.1:9050"
+# proxy = 'socks5://127.0.0.1:9050'
## HTTP/HTTPS proxy
## Only for DoH servers
-# http_proxy = "http://127.0.0.1:8888"
+# http_proxy = 'http://127.0.0.1:8888'
-## How long a DNS query will wait for a response, in milliseconds
+## How long a DNS query will wait for a response, in milliseconds.
+## If you have a network with *a lot* of latency, you may need to
+## increase this. Startup may be slower if you do so.
+## Don't increase it too much. 10000 is the highest reasonable value.
-timeout = 2500
+timeout = 5000
## Keepalive for HTTP (HTTPS, HTTP/2) queries, in seconds
@@ -112,11 +118,12 @@ timeout = 2500
keepalive = 30
-## Use the REFUSED return code for blocked responses
-## Setting this to `false` means that some responses will be lies.
-## Unfortunately, `false` appears to be required for Android 8+
+## Response for blocked queries. Options are `refused`, `hinfo` (default) or
+## an IP response. To give an IP response, use the format `a:<IPv4>,aaaa:<IPv6>`.
+## Using the `hinfo` option means that some responses will be lies.
+## Unfortunately, the `hinfo` option appears to be required for Android 8+
-refused_code_in_responses = false
+# blocked_query_response = 'refused'
## Load-balancing strategy: 'p2' (default), 'ph', 'first' or 'random'
@@ -167,6 +174,8 @@ cert_refresh_delay = 240
## 49195 = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
## 52392 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
## 52393 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+## 4865 = TLS_AES_128_GCM_SHA256
+## 4867 = TLS_CHACHA20_POLY1305_SHA256
##
## On non-Intel CPUs such as MIPS routers and ARM systems (Android, Raspberry Pi...),
## the following suite improves performance.
@@ -178,34 +187,35 @@ cert_refresh_delay = 240
# tls_cipher_suite = [52392, 49199]
-## Fallback resolver
-## This is a normal, non-encrypted DNS resolver, that will be only used
+## Fallback resolvers
+## These are normal, non-encrypted DNS resolvers, that will be only used
## for one-shot queries when retrieving the initial resolvers list, and
## only if the system DNS configuration doesn't work.
-## No user application queries will ever be leaked through this resolver,
-## and it will not be used after IP addresses of resolvers URLs have been found.
-## It will never be used if lists have already been cached, and if stamps
+## No user application queries will ever be leaked through these resolvers,
+## and they will not be used after IP addresses of resolvers URLs have been found.
+## They will never be used if lists have already been cached, and if stamps
## don't include host names without IP addresses.
-## It will not be used if the configured system DNS works.
-## A resolver supporting DNSSEC is recommended. This may become mandatory.
+## They will not be used if the configured system DNS works.
+## Resolvers supporting DNSSEC are recommended.
##
## People in China may need to use 114.114.114.114:53 here.
## Other popular options include 8.8.8.8 and 1.1.1.1.
+##
+## If more than one resolver is specified, they will be tried in sequence.
-fallback_resolver = '9.9.9.9:53'
+fallback_resolvers = ['9.9.9.9:53', '8.8.8.8:53']
-## Never let dnscrypt-proxy try to use the system DNS settings;
-## unconditionally use the fallback resolver.
+## Always use the fallback resolver before the system DNS settings.
-ignore_system_dns = false
+ignore_system_dns = true
## Maximum time (in seconds) to wait for network connectivity before
## initializing the proxy.
## Useful if the proxy is automatically started at boot, and network
## connectivity is not guaranteed to be immediately available.
-## Use 0 to not test for connectivity at all,
+## Use 0 to not test for connectivity at all (not recommended),
## and -1 to wait as much as possible.
netprobe_timeout = 60
@@ -219,7 +229,7 @@ netprobe_timeout = 60
## On other operating systems, the connection will be initialized
## but nothing will be sent at all.
-netprobe_address = "9.9.9.9:53"
+netprobe_address = '9.9.9.9:53'
## Offline mode - Do not use any remote encrypted servers.
@@ -229,9 +239,19 @@ netprobe_address = "9.9.9.9:53"
# offline_mode = false
+## Additional data to attach to outgoing queries.
+## These strings will be added as TXT records to queries.
+## Do not use, except on servers explicitly asking for extra data
+## to be present.
+## encrypted-dns-server can be configured to use this for access control
+## in the [access_control] section
+
+# query_meta = ["key1:value1", "key2:value2", "token:MySecretToken"]
+
+
## Automatic log files rotation
-# Maximum log files size in MB
+# Maximum log files size in MB - Set to 0 for unlimited.
log_files_max_size = 10
# How long to keep backup files, in days
@@ -246,23 +266,42 @@ log_files_max_backups = 1
# Filters #
#########################
+## Note: if you are using dnsmasq, disable the `dnssec` option in dnsmasq if you
+## configure dnscrypt-proxy to do any kind of filtering (including the filters
+## below and blacklists).
+## You can still choose resolvers that do DNSSEC validation.
+
+
## Immediately respond to IPv6-related queries with an empty response
## This makes things faster when there is no IPv6 connectivity, but can
## also cause reliability issues with some stub resolvers.
-## Do not enable if you added a validating resolver such as dnsmasq in front
-## of the proxy.
block_ipv6 = false
+## Immediately respond to A and AAAA queries for host names without a domain name
+
+block_unqualified = true
+
+
+## Immediately respond to queries for local zones instead of leaking them to
+## upstream resolvers (always causing errors or timeouts).
+
+block_undelegated = true
+
+
+## TTL for synthetic responses sent when a request has been blocked (due to
+## IPv6 or blacklists).
+
+reject_ttl = 600
+
+
##################################################################################
# Route queries for specific domains to a dedicated set of servers #
##################################################################################
-## Example map entries (one entry per line):
-## example.com 9.9.9.9
-## example.net 9.9.9.9,8.8.8.8,1.1.1.1
+## See the `example-forwarding-rules.txt` file for an example
# forwarding_rules = 'forwarding-rules.txt'
@@ -276,12 +315,13 @@ block_ipv6 = false
## In addition to acting as a HOSTS file, it can also return the IP address
## of a different name. It will also do CNAME flattening.
##
-## Example map entries (one entry per line)
-## example.com 10.1.1.1
-## www.google.com forcesafesearch.google.com
+## See the `example-cloaking-rules.txt` file for an example
# cloaking_rules = 'cloaking-rules.txt'
+## TTL used when serving entries in cloaking-rules.txt
+
+# cloak_ttl = 600
###########################
@@ -295,12 +335,12 @@ cache = true
## Cache size
-cache_size = 512
+cache_size = 4096
## Minimum TTL for cached entries
-cache_min_ttl = 600
+cache_min_ttl = 2400
## Maximum TTL for cached entries
@@ -319,6 +359,37 @@ cache_neg_max_ttl = 600
+##################################
+# Local DoH server #
+##################################
+
+[local_doh]
+
+## dnscrypt-proxy can act as a local DoH server. By doing so, web browsers
+## requiring a direct connection to a DoH server in order to enable some
+## features will enable these, without bypassing your DNS proxy.
+
+## Addresses that the local DoH server should listen to
+
+# listen_addresses = ['127.0.0.1:3000']
+
+
+## Path of the DoH URL. This is not a file, but the part after the hostname
+## in the URL. By convention, `/dns-query` is frequently chosen.
+## For each `listen_address` the complete URL to access the server will be:
+## `https://<listen_address><path>` (ex: `https://127.0.0.1/dns-query`)
+
+# path = "/dns-query"
+
+
+## Certificate file and key - Note that the certificate has to be trusted.
+## See the documentation (wiki) for more information.
+
+# cert_file = "localhost.pem"
+# cert_key_file = "localhost.pem"
+
+
+
###############################
# Query logging #
###############################
@@ -327,7 +398,8 @@ cache_neg_max_ttl = 600
[query_log]
- ## Path to the query log file (absolute, or relative to the same directory as the executable file)
+ ## Path to the query log file (absolute, or relative to the same directory as the config file)
+ ## On non-Windows systems, can be /dev/stdout to log to the standard output (also set log_files_max_size to 0)
# file = 'query.log'
@@ -353,7 +425,7 @@ cache_neg_max_ttl = 600
[nx_log]
- ## Path to the query log file (absolute, or relative to the same directory as the executable file)
+ ## Path to the query log file (absolute, or relative to the same directory as the config file)
# file = 'nx.log'
@@ -383,7 +455,7 @@ cache_neg_max_ttl = 600
[blacklist]
- ## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)
+ ## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
# blacklist_file = 'blacklist.txt'
@@ -411,7 +483,7 @@ cache_neg_max_ttl = 600
[ip_blacklist]
- ## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)
+ ## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
# blacklist_file = 'ip-blacklist.txt'
@@ -439,7 +511,7 @@ cache_neg_max_ttl = 600
[whitelist]
- ## Path to the file of whitelisting rules (absolute, or relative to the same directory as the executable file)
+ ## Path to the file of whitelisting rules (absolute, or relative to the same directory as the config file)
# whitelist_file = 'whitelist.txt'
@@ -465,8 +537,7 @@ cache_neg_max_ttl = 600
##
## For example, the following rule in a blacklist file:
## *.youtube.* @time-to-sleep
-## would block access to YouTube only during the days, and period of the days
-## define by the 'time-to-sleep' schedule.
+## would block access to YouTube during the times defined by the 'time-to-sleep' schedule.
##
## {after='21:00', before= '7:00'} matches 0:00-7:00 and 21:00-0:00
## {after= '9:00', before='18:00'} matches 9:00-18:00
@@ -507,7 +578,7 @@ cache_neg_max_ttl = 600
## must include the prefixes.
##
## If the `urls` property is missing, cache files and valid signatures
-## must be already present; This doesn't prevent these cache files from
+## must already be present. This doesn't prevent these cache files from
## expiring after `refresh_delay` hours.
[sources]
@@ -518,17 +589,24 @@ cache_neg_max_ttl = 600
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
+ prefix = ''
+
+ ## Anonymized DNS relays
+
+ [sources.'relays']
+ urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/relays.md', 'https://download.dnscrypt.info/resolvers-list/v2/relays.md']
+ cache_file = 'relays.md'
+ minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''
## Quad9 over DNSCrypt - https://quad9.net/
# [sources.quad9-resolvers]
- # urls = ["https://www.quad9.net/quad9-resolvers.md"]
- # minisign_key = "RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN"
- # cache_file = "quad9-resolvers.md"
- # refresh_delay = 72
- # prefix = "quad9-"
+ # urls = ['https://www.quad9.net/quad9-resolvers.md']
+ # minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN'
+ # cache_file = 'quad9-resolvers.md'
+ # prefix = 'quad9-'
## Another example source, with resolvers censoring some websites not appropriate for children
## This is a subset of the `public-resolvers` list, so enabling both is useless
@@ -540,10 +618,87 @@ cache_neg_max_ttl = 600
+#########################################
+# Servers with known bugs #
+#########################################
+
+[broken_implementations]
+
+# Cisco servers currently cannot handle queries larger than 1472 bytes, and don't
+# truncate reponses larger than questions as expected by the DNSCrypt protocol.
+# This prevents large responses from being received over UDP and over relays.
+#
+# The `dnsdist` server software drops client queries larger than 1500 bytes.
+# They are aware of it and are working on a fix.
+#
+# The list below enables workarounds to make non-relayed usage more reliable
+# until the servers are fixed.
+
+fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri', 'cleanbrowsing-adult', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security']
+
+
+
+
+################################
+# TLS Client Authentication #
+################################
+
+# This is only useful if you are operating your own, private DoH server(s).
+# (for DNSCrypt, see the `query_meta` feature instead)
+
+[tls_client_auth]
+
+# creds = [
+# { server_name='myserver', client_cert='client.crt', client_key='client.key' }
+# ]
+
+
+
+################################
+# Anonymized DNS #
+################################
+
+[anonymized_dns]
+
+## Routes are indirect ways to reach DNSCrypt servers.
+##
+## A route maps a server name ("server_name") to one or more relays that will be
+## used to connect to that server.
+##
+## A relay can be specified as a DNS Stamp (either a relay stamp, or a
+## DNSCrypt stamp), an IP:port, a hostname:port, or a server name.
+##
+## The following example routes "example-server-1" via `anon-example-1` or `anon-example-2`,
+## and "example-server-2" via the relay whose relay DNS stamp
+## is "sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM".
+##
+## !!! THESE ARE JUST EXAMPLES !!!
+##
+## Review the list of available relays from the "relays.md" file, and, for each
+## server you want to use, define the relays you want connections to go through.
+##
+## Carefully choose relays and servers so that they are run by different entities.
+##
+## "server_name" can also be set to "*" to define a default route, but this is not
+## recommended. If you do so, keep "server_names" short and distinct from relays.
+
+# routes = [
+# { server_name='example-server-1', via=['anon-example-1', 'anon-example-2'] },
+# { server_name='example-server-2', via=['sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM'] }
+# ]
+
+
+# skip resolvers incompatible with anonymization instead of using them directly
+
+skip_incompatible = false
+
+
+
+
## Optional, local, static list of additional servers
## Mostly useful for testing your own servers.
[static]
- # [static.'google']
- # stamp = 'sdns://AgUAAAAAAAAAAAAOZG5zLmdvb2dsZS5jb20NL2V4cGVyaW1lbnRhbA'
+ # [static.'myserver']
+ # stamp = 'sdns:AQcAAAAAAAAAAAAQMi5kbnNjcnlwdC1jZXJ0Lg'