Upgrade 2.1.18 - #1
Open
caixingcheng wants to merge 269 commits into
Open
caixingcheng wants to merge 269 commits into
caixingcheng wants to merge 269 commits into
Conversation
Previously, handleColdStartClient would error out due to a truncated legitimate maximum-size EDNS0 query.
Do not truncate buffer size of client UDP datagrams
Reset dnsId on retries
Do not leak a a UDP socket if quic.DialEarly fails
Fix inverted nil-check in cache file resolution
To16() can return IPv4-mapped addresses.
* 'master' of github.com:DNSCrypt/dnscrypt-proxy: Do not leak fd when DialUDP succeeds but Write fails
- Fix critical privacy leak: Replace system DNS lookups with encrypted resolution - Prevent cloaking rule bypass when upstream server fails - Fix IPv4/IPv6 filtering to handle both types correctly - Add error handling for empty IP lists before slicing - Separate caching for IPv4 and IPv6 responses - Add proper timeout for resolver queries - Fix systemd socket mode to properly populate listenAddresses - Extend read locking scope in PluginCloak
* 'master' of github.com:DNSCrypt/dnscrypt-proxy: Fix inverted nil-check in cache file resolution
Set http2Transport.ReadIdleTimeout and AllowHTTP correctly
This commit enhances the robustness of DNS resolution and connection establishment: - Cache multiple IP addresses per hostname instead of randomly selecting one - Implement retry logic with exponential backoff for DNS queries (3 attempts) - Try all cached IPs sequentially when establishing connections - Add fallback to stale cached IPs when fresh resolution fails
Enable `systemctl reload` to send reload signal
Commit message correctly described intention but code was the opposite and would result in nil pointer dereference panic, same boolean inversion that DNSCrypt#2979 was correcting. I'm more interested in the fact no test case exercises this code path to catch either of these, but that's a separate task.
After noticeBegin, the UDP->TCP retry path returned early on Encrypt error without notifying failure. Invoke serverInfo.noticeFailure() before returning to keep begin/failure pairing and avoid skewed observability metrics.
Instead of trying to decrypt junk (and then return an error, but not the right one.
flag.Int is never nil, so the flag's default value silently overrode netprobe_timeout from the TOML file
Not to the server
Even if this is not the full set of IPs.
Not really necessary, since responses are authenticated, but useful to spot broken server implementations.
Try the rollover-sized certificate query over UDP first and return as soon as the small query succeeds so that a truncated response can trigger TCP fallback instead of waiting for large UDP probes to time out. We keep relayed UDP packets at the intended size after accounting for the Anonymized DNSCrypt header. When retrying through a relay over TCP, retain a rollover-sized inner query because the relay still forwards it to the resolver over UDP and applies the anti-amplification thing. Preserve the UDP RTT when TCP is used only to complete certificate retrieval, so resolver latency does not incorrectly appear to be the TCP fallback latency.
jasonlyc
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.