mirror of
https://github.com/DNSCrypt/dnscrypt-proxy.git
synced 2024-09-11 21:17:40 +03:00
452 lines
20 KiB
Plaintext
452 lines
20 KiB
Plaintext
* Version 2.0.44
|
|
- More updates to the set of block lists, thanks again to IceCodeNew.
|
|
- Netprobes and listening sockets are now ignored when the `-list`,
|
|
`-list-all`, `-show-certs` or `-check` command-line switches are used.
|
|
- `tls_client_auth` was renamed to `doh_client_x509_auth`. A section
|
|
with the previous name is temporarily ignored if empty, but will error
|
|
out if not.
|
|
- Unit tests are now working on 32-bit systems. Thanks to Will Elwood
|
|
and @lifenjoiner.
|
|
|
|
* Version 2.0.43
|
|
- Built-in support for DNS64 translation has been implemented.
|
|
(Contributed by Sergey Smirnov, thanks!)
|
|
- Connections to DoH servers can be authenticated using TLS client
|
|
certificates (Contributed by Kevin O'Sullivan, thanks!)
|
|
- Multiple stamps are now allowed for a single server in resolvers
|
|
and relays lists.
|
|
- Android: the time zone for log files is now set to the system
|
|
time zone.
|
|
- Quite a lot of updates and additions have been made to the
|
|
example domain block lists. Thanks to `IceCodeNew`!
|
|
- Cached configuration files can now be temporarily used if
|
|
they are out of date, but bootstraping is impossible. Contributed by
|
|
`lifenjoiner`, thanks!
|
|
- Precompiled macOS binaries are now notarized.
|
|
- `generate-domains-blacklists` now tries to deduplicate entries
|
|
clobbered by wildcard rules. Thanks to `Huhni`!
|
|
- `generate-domains-blacklists` can now directly write lists to a
|
|
file with the `-o` command-line option.
|
|
- cache files are now downloaded as the user the daemon will be running
|
|
as. This fixes permission issues at startup time.
|
|
- Forwarded queries are now subject to global timeouts, and can be
|
|
forced to use TCP.
|
|
- The `ct` parameter has been removed from DoH queries, as Google doesn't
|
|
require it any more.
|
|
- Service installation is now supported on FreeBSD.
|
|
- When stored into a file, service logs now only contain data from the most
|
|
recent launch. This can be changed with the new `log_file_latest` option.
|
|
- Breaking change: the `tls_client_auth` section was renamed to
|
|
`doh_client_x509_auth`. If you had a tls_client_auth section in the
|
|
configuration file, it needs to be updated.
|
|
|
|
* Version 2.0.42
|
|
- The current versions of the `dnsdist` load balancer (presumably used
|
|
by quad9, cleanbrowsing, qualityology, freetsa.org, ffmuc.net,
|
|
opennic-bongobow, sth-dnscrypt-se, ams-dnscrypt-nl and more)
|
|
is preventing queries over 1500 bytes from being received over UDP.
|
|
Temporary workarounds have been introduced to improve reliability
|
|
with these resolvers for regular DNSCrypt. Unfortunately, anonymized
|
|
DNS cannot be reliable until the issue is fixed server-side. `dnsdist`
|
|
authors are aware of it and are working on a fix.
|
|
- New option in the `[anonymized_dns]` section: `skip_incompatible`,
|
|
to ignore resolvers incompatible with Anonymized DNS instead of
|
|
using them without a relay.
|
|
- The server latency benchmark is faster while being able to perform
|
|
more retries if necessary.
|
|
- Continuous integration has been moved to GitHub Actions.
|
|
|
|
* Version 2.0.41
|
|
- Precompiled ARM binaries are compatible with ARMv5 CPUs. The
|
|
default arm builds were not compatible with older CPUs when compiled
|
|
with Go 1.14. mips64 binaries are explicitly compiled with `softfloat`
|
|
to improve compatibility.
|
|
- Quad9 seems to be only blocking fragmented queries over UDP for
|
|
some networks. They have been removed from the default list of broken
|
|
resolvers; runtime detection of support for fragments should now do
|
|
the job.
|
|
- Runtime detection of support for fragments was actually enabled.
|
|
|
|
* Version 2.0.40
|
|
- Servers blocking fragmented queries are now automatically detected.
|
|
- The server name is now only present in query logs when an actual
|
|
upstream servers was required to resolve a query.
|
|
- TLS client authentication has been added for DoH.
|
|
- The Firefox plugin is now skipped for connections coming from the
|
|
local DoH server.
|
|
- DoH RTT computation is now more accurate, especially when CDNs are
|
|
in the middle.
|
|
- The forwarding plugin is now more reliable, and handles retries over
|
|
TCP.
|
|
|
|
* Version 2.0.39
|
|
- The Firefox Local DoH service didn't properly work in version 2.0.38;
|
|
this has been fixed. Thanks to Simon Brand for the report!
|
|
|
|
* Version 2.0.38
|
|
- Entries from lists (forwarding, blacklists, whitelists) now support
|
|
inline comments.
|
|
- Reliability improvement: queries over UDP are retried after a timeout
|
|
instead of solely relying on the client.
|
|
- Reliability improvement: during temporary network outages, cached records
|
|
are now served even if they are stale.
|
|
- Bug fix: SOCKS proxies and DNS relays can be combined.
|
|
- New feature: multiple fallback resolvers are now supported (see the
|
|
new `fallback_resolvers` option. Note that `fallback_resolver` is
|
|
still supported for backward compatibility).
|
|
- Windows: the service can be installed with a configuration file
|
|
stored separately from the application.
|
|
- Security (affecting DoH): precompiled binaries of dnscrypt-proxy 2.0.37 are
|
|
built using Go 1.13.7 that fixes a TLS certificate parsing issue present in
|
|
previous versions of the compiler.
|
|
|
|
* Version 2.0.36
|
|
- New option: `block_undelegated`. When enabled, `dnscrypt-proxy` will
|
|
directly respond to queries for locally-served zones (https://sk.tl/2QqB971U)
|
|
and nonexistent zones that should have been kept local, but are frequently
|
|
leaked. This reduces latency and improves privacy.
|
|
- Conformance: the `DO` bit is now set in synthetic responses if it was
|
|
set in a question, and the `AD` bit is cleared.
|
|
- The `miegkg/dns` module was updated to version 1.1.26, that fixes a
|
|
security issue affecting non-encrypted/non-authenticated DNS traffic. In
|
|
`dnscrypt-proxy`, this only affects the forwarding feature.
|
|
|
|
* Version 2.0.35
|
|
- New option: `block_unqualified` to block `A`/`AAAA` queries with
|
|
unqualified host names. These will very rarely get an answer from upstream
|
|
resolvers, but can leak private information to these, as well as to root
|
|
servers.
|
|
- When a `CNAME` pointer is blocked, the original query name is now logged
|
|
along with the pointer. This makes it easier to know what the original
|
|
query name, so it can be whitelisted, or what the pointer was, so it
|
|
can be removed from the blacklist.
|
|
|
|
* Version 2.0.34
|
|
- Blacklisted names are now also blocked if they appear in `CNAME`
|
|
pointers.
|
|
- `dnscrypt-proxy` can now act as a local DoH *server*. Firefox can
|
|
be configured to use it, so that ESNI can be enabled without bypassing
|
|
your DNS proxy.
|
|
|
|
* Version 2.0.33
|
|
- Fixes an issue that caused some valid queries to return `PARSE_ERROR`.
|
|
|
|
* Version 2.0.32
|
|
- On certificate errors, the server name is now logged instead of the
|
|
provider name, which is generally more useful.
|
|
- IP addresses for DoH servers that require DNS lookups are now cached
|
|
for at least 12 hours.
|
|
- `ignore_system_dns` is now set to `true` by default.
|
|
- A workaround for a bug in Cisco servers has been implemented.
|
|
- A corrupted or incomplete resolvers list is now ignored, keeping the
|
|
last good known cached list until the next update. In addition, logging was
|
|
improved and unit tests were also added. Awesome contribution from William
|
|
Elwood, thanks!
|
|
- On Windows, the network probe immediately returned instead of blocking
|
|
if `netprobe_timeout` was set to `-1`. This has been fixed.
|
|
- Expired cached IP addresses now have a grace period, to avoid breaking the
|
|
service if they temporarily can't be refreshed.
|
|
- On Windows, the service now returns immediately, solving a long-standing
|
|
issue when initialization took more than 30 seconds ("The service did not
|
|
respond to the start or control request in a timely fashion"). Fantastic
|
|
work by Alison Winters, thanks!
|
|
- The `SERVER_ERROR` error code has been split into two new error codes:
|
|
`NETWORK_ERROR` (self-explanatory) and `SERVFAIL` (a response was returned,
|
|
but it includes a `SERVFAIL` error code).
|
|
- Responses are now always compressed.
|
|
|
|
* Version 2.0.31
|
|
- This version fixes two regressions introduced in version 2.0.29:
|
|
DoH server couldn't be reached over IPv6 any more, and the proxy
|
|
couldn't be interrupted while servers were being benchmarked.
|
|
|
|
* Version 2.0.30
|
|
- This version fixes a startup issue introduced in version 2.0.29,
|
|
on systems for which the service cannot be automatically installed
|
|
(such as OpenBSD and FreeBSD). Reported by @5ch17 and Vinícius Zavam,
|
|
and fixed by Will Elwood, thanks!
|
|
|
|
* Version 2.0.29
|
|
- Support for Anonymized DNS has been added!
|
|
- Wait before stopping, fixing an issue with Unbound (thanks to
|
|
Vladimir Bauer)
|
|
- DNS stamps are now included in the -list-all -json ouptut
|
|
- The netprobe_timeout setting from the configuration file or
|
|
command-line was ignored. This has been fixed.
|
|
- The TTL or cloaked entries can now be adjusted (thanks to Markus
|
|
Linnala)
|
|
- Cached IP address from DoH servers now expire (thanks to Markus
|
|
Linnala)
|
|
- DNSCrypt certificates can be fetched over Tor and SOCKS proxies
|
|
- Retries over TCP are faster
|
|
- Improved logging (thanks to Alison Winters)
|
|
- Ignore non-TXT records in certificate responses (thanks to Vladimir
|
|
Bauer)
|
|
- A lot of internal cleanups, thanks to Markus Linnala.
|
|
|
|
* Version 2.0.28
|
|
- Invalid server entries are now skipped instead of preventing a
|
|
source from being used. Thanks to Alison Winters for the contribution!
|
|
- Truncated responses are immediately retried over TCP instead of
|
|
waiting for the client to retry. This reduces the latency for large
|
|
responses.
|
|
- Responses sent to the local network are assumed to support at least
|
|
1252 bytes packets, and use optional information from EDNS up to 4096
|
|
bytes. This also reduces latency.
|
|
- Logging improvements: servers are not logged for cached, synthetic
|
|
and cloaked responses. And the forwarder is logged instead of the
|
|
regular server for forwarded responses.
|
|
|
|
* Version 2.0.27
|
|
- The X25519 implementation was changed from using the Go standard
|
|
implementation to using Cloudflare's CIRCL library. Unfortunately,
|
|
CIRCL appears to be broken on big-endian systems. That change has been
|
|
reverted.
|
|
- All the dependencies have been updated.
|
|
|
|
* Version 2.0.26
|
|
- A new plugin was added to prevent Firefox from bypassing the system
|
|
DNS settings.
|
|
- New configuration parameter to set how to respond to blocked
|
|
queries: `blocked_query_response`. Responses can now be empty record
|
|
sets, REFUSED response codes, or predefined IPv4 and/or IPv6 addresses.
|
|
- The `refused_code_in_responses` and `blocked_query_response` options
|
|
have been folded into a new `blocked_query_response` option.
|
|
- The fallback resolver is now accessed using TCP if `force_tcp` has
|
|
been set to `true`.
|
|
- CPU usage when enabling DNSCrypt ephemeral keys has been reduced.
|
|
- New command-line option: `-show-certs` to print DoH certificate
|
|
hashes.
|
|
- Solaris packages are now provided.
|
|
- DoH servers on a non-standard port, with stamps that don't include
|
|
IP addresses, and without working system resolvers can now be properly
|
|
bootstrapped.
|
|
- A new option, `query_meta`, is now available to add optional records
|
|
to client queries.
|
|
|
|
* Version 2.0.25
|
|
- The example IP address for network probes didn't work on Windows.
|
|
The example configuration file has been updated and the fallback
|
|
resolver IP is now used when no netprobe address has been configured.
|
|
|
|
* Version 2.0.24
|
|
- The query log now includes the time it took to complete the
|
|
transaction, the name of the resolver that sent the response and if
|
|
the response was served from the cache. Thanks to Ferdinand Holzer for
|
|
his help!
|
|
- The list of resolvers, sorted by latency, is now printed after all
|
|
the resolvers have been probed.
|
|
- The "fastest" load-balancing strategy has been renamed to "first".
|
|
- On Windows, a nul byte is sent to the netprobe address. This is
|
|
required to check for connectivity on this platform. Thanks to Mathias
|
|
Berchtold.
|
|
- The Malwaredomainlist URL was updated to directly parse the host
|
|
list. Thanks to Encrypted.Town.
|
|
- The Python script to generate lists of blacklisted domains is now
|
|
compatible both with Python 2 and Python 3. Thanks to Simon R.
|
|
- A warning is now displayed for DoH is requested but the server
|
|
doesn't speak HTTP/2.
|
|
- A crash with loaded-balanced sets of cloaked names was fixed.
|
|
Thanks to @inkblotadmirer for the report.
|
|
- Resolvers are now tried in random order to avoid favoring the first
|
|
ones at startup.
|
|
|
|
* Version 2.0.23
|
|
- Binaries for FreeBSD/armv7 are now available.
|
|
- .onion servers are now automatically ignored if Tor routing is not
|
|
enabled.
|
|
- Caching of server addresses has been improved, especially when
|
|
using proxies.
|
|
- DNSCrypt communications are now automatically forced to using TCP
|
|
when a SOCKS proxy has been set up.
|
|
|
|
* Version 2.0.22
|
|
- The previous version had issues with the .org TLD when used in
|
|
conjunction with dnsmasq. This has been fixed.
|
|
|
|
* Version 2.0.21
|
|
- The change to run the Windows service as `NT AUTHORITY\NetworkService`
|
|
has been reverted, as it was reported to break logging (Windows only).
|
|
|
|
* Version 2.0.20
|
|
- Startup is now *way* faster, especially when using DoH servers.
|
|
- A new action: `CLOAK` is logged when queries are being cloaked.
|
|
- A cloaking rule can now map to multiple IPv4 and IPv6 addresses,
|
|
with load-balancing.
|
|
- New option: `refused_code_in_responses` to return (or not) a
|
|
`REFUSED` code on blacklisted queries. This is disabled by default, in
|
|
order to work around a bug in Android Pie.
|
|
- Time-based restrictions are now properly handled in the
|
|
generate-domains-blacklist.py script.
|
|
- Other improvements have been made to the `generate-domains-blacklist.py`
|
|
script.
|
|
- The Windows service is now installed as `NT AUTHORITY\NetworkService`.
|
|
|
|
* Version 2.0.19
|
|
- The value for `netprobe_timeout` was read from the command-line, but
|
|
not from the configuration file any more. This is a regression introduced
|
|
in the previous version, that has been fixed.
|
|
- The default value for netprobe timeouts has been raised to 60 seconds.
|
|
- A hash of the body is added to query parameters when sending DoH
|
|
queries with the POST method in order to work around badly configured
|
|
proxies.
|
|
|
|
* Version 2.0.18
|
|
- Official builds now support TLS 1.3.
|
|
- The timeout for the initial connectivity check can now be set from
|
|
the command line.
|
|
- An `Accept:` header is now always sent with `GET` queries.
|
|
- BOMs are now ignored in configuration files.
|
|
- In addition to SOCKS, HTTP and HTTPS proxies are now supported for
|
|
DoH servers.
|
|
|
|
* Version 2.0.17
|
|
- Go >= 1.11 is now supported
|
|
- The flipside is that Windows XP is not supported any more :(
|
|
- When dropping privileges, there is no supervisor process any more.
|
|
- DNS options used to be cleared from DNS queries, with the exception
|
|
of flags and payload sizes. This is not the case any more.
|
|
- DoH queries are smaller, since workarounds are not required any more
|
|
after Google updated their implementation.
|
|
|
|
* Version 2.0.16
|
|
- On Unix-like systems, the server can run as an unprivileged user,
|
|
and the main process will automatically restart if an error occurs.
|
|
- pledge() on OpenBSD.
|
|
- New "offline" mode to serve queries locally without contacting any
|
|
upstream servers. This can be especially useful along with the
|
|
cloaking module for local development.
|
|
- New logo.
|
|
- TTL of OPT records is properly ignored by the caching module.
|
|
- The proxy doesn't quit any more if new TCP connections cannot be
|
|
created.
|
|
|
|
* Version 2.0.15
|
|
- Support for proxies (HTTP/SOCKS) was added. All it takes to route
|
|
all TCP queries to Tor is add `proxy = "socks5://127.0.0.1:9050"` to
|
|
the configuration file.
|
|
- Querylog files have a new record indicating the outcome of each
|
|
transaction.
|
|
- Pre-built binaries for Linux are statically linked on all
|
|
architectures.
|
|
|
|
* Version 2.0.14
|
|
- Supports DNS-over-HTTPS draft 08.
|
|
- Netprobes don't use port 0 by default, as this causes issues with
|
|
Little Snitch and FreeBSD.
|
|
|
|
* Version 2.0.13
|
|
- This version fixes a crash when using DoH for queries whose size
|
|
were a multiple of the block size. Reported by @char101, thanks!
|
|
|
|
* Version 2.0.12
|
|
- Further compatibility fixes for Alpine Linux/i386 and Android/i386
|
|
have been made. Thanks to @aead for his help!
|
|
- The proxy will now wait for network connectivity before starting.
|
|
This is useful if the proxy is automatically started at boot, possibly
|
|
before the network is fully configured.
|
|
- The IPv6 blocking module now returns synthetic SOA records to
|
|
improve compatibility with downstream resolvers and stub resolvers.
|
|
|
|
* Version 2.0.11
|
|
- This release fixes a long-standing bug that caused the proxy to
|
|
block or crash when Position-Independent Executables were produced.
|
|
This bug only showed up when compiled on (not for) Alpine Linux and
|
|
Android, for some CPU architectures.
|
|
- New configuration settings: cache_neg_min_ttl and
|
|
cache_neg_max_ttl, to clamp the negative caching TTL.
|
|
|
|
* Version 2.0.10
|
|
- This version fixes a crash when an incomplete size is sent by a
|
|
local client for a query over TCP.
|
|
- Slight performance improvement of DNSCrypt on non-Intel CPUs such
|
|
as Raspberry Pi.
|
|
|
|
* Version 2.0.9
|
|
- Whitelists have been implemented: one a name matches a pattern in
|
|
the whitelist, rules from the name-based and IP-based blacklists will
|
|
be bypassed. Whitelists support the same patterns as blacklists, as
|
|
well as time-based rules, so that some website can be normally
|
|
blocked, but accessible on specific days or times of the day.
|
|
- Lists are now faster to load, and large lists require significantly
|
|
less memory than before.
|
|
- New options have been added to disable TLS session tickets as well
|
|
as use a specific cipher suite. See the example configuration file for
|
|
a recommended configuration to speed up DoH servers on ARM such as
|
|
Android devices and Raspberry Pi.
|
|
- The `-service install` command now remembers what the current
|
|
directory was when the service was installed, in order to later load
|
|
configuration files with relative paths.
|
|
- DoH: The "Cache-Control: max-age" header is now ignored.
|
|
- Patterns can now be prefixed with `=` to do exact matching:
|
|
`=example.com` matches `example.com` but will not match `www.example.com`.
|
|
- Patterns are now fully supported by the cloaking module.
|
|
- A new option was added to use a specific cipher suite instead of
|
|
the server's provided one. Using RSA+ChaChaPoly over ECDSA+AES-GCM has
|
|
shown to decrease CPU usage and latency when connecting to Cloudflare,
|
|
especially on Mips and ARM systems.
|
|
- The ephemeral keys mode of dnscrypt-proxy v1.x was reimplemented: this
|
|
creates a new unique key for every single query.
|
|
|
|
* Version 2.0.8
|
|
- Multiple URLs can be defined for a source in order to improve
|
|
resiliency when servers are temporarily unreachable.
|
|
- Connections over IPv6 will be preferred over IPv4 for DoH servers
|
|
when using a fallback resolver if `ipv6_servers` is set.
|
|
- Improvements have been made to the example systemd configuration
|
|
files.
|
|
- The chacha20 implementation was updated to possibly fix a bug on
|
|
Android/x86.
|
|
- `generate-domains-blacklist.py` can now parse dnsmasq-style rules.
|
|
- FreeBSD/arm builds have been added.
|
|
- `dnscrypt-proxy -list -json` and `-list-all -json` now include the
|
|
remove servers names and IP addresses.
|
|
|
|
* Version 2.0.7
|
|
- Bug fix: optional ports were not properly parsed with IPv6
|
|
addresses -- thanks to @bleeee for the report and fix.
|
|
- Bug fix: truncate TCP queries to the prefixed length.
|
|
- Certificates are force-refreshed after a time jump (e.g. when a
|
|
system resumes from hibernation).
|
|
|
|
* Version 2.0.6
|
|
- Automatic log files rotation was finally implemented.
|
|
- A new -pidfile command-line option to write the PID file was added.
|
|
|
|
* Version 2.0.5
|
|
- Fixes a crash occasionally happening when using DoH servers, with
|
|
stamps not containing any IP addresses, a DNSSEC-signed name, a
|
|
non-working system DNS configuration, and a fallback server supporting
|
|
DNSSEC.
|
|
|
|
* Version 2.0.4
|
|
- Fixes a regression with truncated packets. Thanks to @mazesy and
|
|
@the-w1nd for spotting a case triggering this!
|
|
|
|
* Version 2.0.3
|
|
- Load balancing: resolvers that respond promptly, but with bogus
|
|
responses are now gradually removed from the preferred pool.
|
|
- Due to popular request, Android binaries are now available! Thanks
|
|
to @sporif for his help on getting these built.
|
|
- Binaries are built using Go 1.10-final.
|
|
|
|
* Version 2.0.2
|
|
- Properly error out on FreeBSD and other platforms where built-in
|
|
service installation is not supported yet.
|
|
- Improved load-balancing algorithm, which should result in lower
|
|
latency.
|
|
|
|
* Version 2.0.1
|
|
- Cached source data were not redownloaded if the proxy was used
|
|
without interruption. This has been fixed.
|
|
- If the network is down at startup time, fall back to cached source
|
|
data, even if is it out of date, and schedule an immediate update
|
|
after the networks is back.
|
|
- RTT estimation for DNS-over-HTTP/2 servers was off. This has been
|
|
fixed.
|
|
- The generate-domains-blacklist script now has a configurable
|
|
timeout value, and can produce time-based rules.
|
|
- The timeout parameter in the example configuration file didn't had
|
|
the correct name; this has been fixed.
|
|
- Cache: TTLs are now decreasing.
|