network/dnscrypt-proxy: Updated for version 2.0.42.
Signed-off-by: Willy Sudiarto Raharjo <willysr@slackbuilds.org>
This commit is contained in:
Dave Woodfall
Willy Sudiarto Raharjo
parent
adfcd9d8cc
commit
69d0081ab9
|
|
@ -27,7 +27,7 @@
|
|||
# significantly improved the value of this script!
|
||||
|
||||
PRGNAM=dnscrypt-proxy
|
||||
VERSION=${VERSION:-2.0.25}
|
||||
VERSION=${VERSION:-2.0.42}
|
||||
BUILD=${BUILD:-1}
|
||||
TAG=${TAG:-_SBo}
|
||||
|
||||
|
|
@ -67,7 +67,7 @@ mkdir -p $PRGNAM-$VERSION/src/$DOMAIN/$ORG
|
|||
cd $PRGNAM-$VERSION/src/$DOMAIN/$ORG
|
||||
tar xvf $CWD/$PRGNAM-$VERSION.tar.gz
|
||||
mv $PRGNAM-$VERSION $PRGNAM
|
||||
cd $PRGNAM
|
||||
cd $TMP/$PRGNAM-$VERSION
|
||||
chown -R root:root .
|
||||
find -L . \
|
||||
\( -perm 777 -o -perm 775 -o -perm 750 -o -perm 711 -o -perm 555 \
|
||||
|
|
@ -79,6 +79,8 @@ export GOPATH="$TMP/$PRGNAM-$VERSION"
|
|||
|
||||
go install -a -x ./...
|
||||
|
||||
cd $TMP/$PRGNAM-$VERSION/src/$DOMAIN/$ORG/$PRGNAM
|
||||
|
||||
mkdir -p $PKG/usr/sbin
|
||||
|
||||
install -m 755 "$TMP/$PRGNAM-$VERSION/bin/${PRGNAM}" $PKG/usr/sbin/${PRGNAM}
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
PRGNAM="dnscrypt-proxy"
|
||||
VERSION="2.0.25"
|
||||
VERSION="2.0.42"
|
||||
HOMEPAGE="https://github.com/jedisct1/dnscrypt-proxy"
|
||||
DOWNLOAD="https://github.com/jedisct1/dnscrypt-proxy/archive/2.0.25/dnscrypt-proxy-2.0.25.tar.gz"
|
||||
MD5SUM="1c92cedfc8d4ea7dc21b1abd5e93478c"
|
||||
DOWNLOAD="https://github.com/jedisct1/dnscrypt-proxy/archive/2.0.42/dnscrypt-proxy-2.0.42.tar.gz"
|
||||
MD5SUM="9892c5d281b57c5f315d2f95cd6c33d8"
|
||||
DOWNLOAD_x86_64=""
|
||||
MD5SUM_x86_64=""
|
||||
REQUIRES="google-go-lang"
|
||||
|
|
|
|||
|
|
@ -21,19 +21,22 @@
|
|||
## Servers from the "public-resolvers" source (see down below) can
|
||||
## be viewed here: https://dnscrypt.info/public-servers
|
||||
##
|
||||
## If this line is commented, all registered servers matching the require_* filters
|
||||
## will be used.
|
||||
## The proxy will automatically pick working servers from this list.
|
||||
## Note that the require_* filters do NOT apply when using this setting.
|
||||
##
|
||||
## By default, this list is empty and all registered servers matching the
|
||||
## require_* filters will be used instead.
|
||||
##
|
||||
## The proxy will automatically pick the fastest, working servers from the list.
|
||||
## Remove the leading # first to enable this; lines starting with # are ignored.
|
||||
|
||||
# server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
|
||||
|
||||
|
||||
## List of local addresses and ports to listen to. Can be IPv4 and/or IPv6.
|
||||
## Note: When using systemd socket activation, choose an empty set (i.e. [] ).
|
||||
## Example with both IPv4 and IPv6:
|
||||
## listen_addresses = ['127.0.0.1:53', '[::1]:53']
|
||||
|
||||
listen_addresses = ['127.0.0.1:53', '[::1]:53']
|
||||
listen_addresses = ['127.0.0.1:53']
|
||||
|
||||
|
||||
## Maximum number of simultaneous client connections to accept
|
||||
|
|
@ -93,18 +96,21 @@ force_tcp = false
|
|||
## Uncomment the following line to route all TCP connections to a local Tor node
|
||||
## Tor doesn't support UDP, so set `force_tcp` to `true` as well.
|
||||
|
||||
# proxy = "socks5://127.0.0.1:9050"
|
||||
# proxy = 'socks5://127.0.0.1:9050'
|
||||
|
||||
|
||||
## HTTP/HTTPS proxy
|
||||
## Only for DoH servers
|
||||
|
||||
# http_proxy = "http://127.0.0.1:8888"
|
||||
# http_proxy = 'http://127.0.0.1:8888'
|
||||
|
||||
|
||||
## How long a DNS query will wait for a response, in milliseconds
|
||||
## How long a DNS query will wait for a response, in milliseconds.
|
||||
## If you have a network with *a lot* of latency, you may need to
|
||||
## increase this. Startup may be slower if you do so.
|
||||
## Don't increase it too much. 10000 is the highest reasonable value.
|
||||
|
||||
timeout = 2500
|
||||
timeout = 5000
|
||||
|
||||
|
||||
## Keepalive for HTTP (HTTPS, HTTP/2) queries, in seconds
|
||||
|
|
@ -112,11 +118,12 @@ timeout = 2500
|
|||
keepalive = 30
|
||||
|
||||
|
||||
## Use the REFUSED return code for blocked responses
|
||||
## Setting this to `false` means that some responses will be lies.
|
||||
## Unfortunately, `false` appears to be required for Android 8+
|
||||
## Response for blocked queries. Options are `refused`, `hinfo` (default) or
|
||||
## an IP response. To give an IP response, use the format `a:<IPv4>,aaaa:<IPv6>`.
|
||||
## Using the `hinfo` option means that some responses will be lies.
|
||||
## Unfortunately, the `hinfo` option appears to be required for Android 8+
|
||||
|
||||
refused_code_in_responses = false
|
||||
# blocked_query_response = 'refused'
|
||||
|
||||
|
||||
## Load-balancing strategy: 'p2' (default), 'ph', 'first' or 'random'
|
||||
|
|
@ -167,6 +174,8 @@ cert_refresh_delay = 240
|
|||
## 49195 = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
## 52392 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
## 52393 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
|
||||
## 4865 = TLS_AES_128_GCM_SHA256
|
||||
## 4867 = TLS_CHACHA20_POLY1305_SHA256
|
||||
##
|
||||
## On non-Intel CPUs such as MIPS routers and ARM systems (Android, Raspberry Pi...),
|
||||
## the following suite improves performance.
|
||||
|
|
@ -178,34 +187,35 @@ cert_refresh_delay = 240
|
|||
# tls_cipher_suite = [52392, 49199]
|
||||
|
||||
|
||||
## Fallback resolver
|
||||
## This is a normal, non-encrypted DNS resolver, that will be only used
|
||||
## Fallback resolvers
|
||||
## These are normal, non-encrypted DNS resolvers, that will be only used
|
||||
## for one-shot queries when retrieving the initial resolvers list, and
|
||||
## only if the system DNS configuration doesn't work.
|
||||
## No user application queries will ever be leaked through this resolver,
|
||||
## and it will not be used after IP addresses of resolvers URLs have been found.
|
||||
## It will never be used if lists have already been cached, and if stamps
|
||||
## No user application queries will ever be leaked through these resolvers,
|
||||
## and they will not be used after IP addresses of resolvers URLs have been found.
|
||||
## They will never be used if lists have already been cached, and if stamps
|
||||
## don't include host names without IP addresses.
|
||||
## It will not be used if the configured system DNS works.
|
||||
## A resolver supporting DNSSEC is recommended. This may become mandatory.
|
||||
## They will not be used if the configured system DNS works.
|
||||
## Resolvers supporting DNSSEC are recommended.
|
||||
##
|
||||
## People in China may need to use 114.114.114.114:53 here.
|
||||
## Other popular options include 8.8.8.8 and 1.1.1.1.
|
||||
##
|
||||
## If more than one resolver is specified, they will be tried in sequence.
|
||||
|
||||
fallback_resolver = '9.9.9.9:53'
|
||||
fallback_resolvers = ['9.9.9.9:53', '8.8.8.8:53']
|
||||
|
||||
|
||||
## Never let dnscrypt-proxy try to use the system DNS settings;
|
||||
## unconditionally use the fallback resolver.
|
||||
## Always use the fallback resolver before the system DNS settings.
|
||||
|
||||
ignore_system_dns = false
|
||||
ignore_system_dns = true
|
||||
|
||||
|
||||
## Maximum time (in seconds) to wait for network connectivity before
|
||||
## initializing the proxy.
|
||||
## Useful if the proxy is automatically started at boot, and network
|
||||
## connectivity is not guaranteed to be immediately available.
|
||||
## Use 0 to not test for connectivity at all,
|
||||
## Use 0 to not test for connectivity at all (not recommended),
|
||||
## and -1 to wait as much as possible.
|
||||
|
||||
netprobe_timeout = 60
|
||||
|
|
@ -219,7 +229,7 @@ netprobe_timeout = 60
|
|||
## On other operating systems, the connection will be initialized
|
||||
## but nothing will be sent at all.
|
||||
|
||||
netprobe_address = "9.9.9.9:53"
|
||||
netprobe_address = '9.9.9.9:53'
|
||||
|
||||
|
||||
## Offline mode - Do not use any remote encrypted servers.
|
||||
|
|
@ -229,9 +239,19 @@ netprobe_address = "9.9.9.9:53"
|
|||
# offline_mode = false
|
||||
|
||||
|
||||
## Additional data to attach to outgoing queries.
|
||||
## These strings will be added as TXT records to queries.
|
||||
## Do not use, except on servers explicitly asking for extra data
|
||||
## to be present.
|
||||
## encrypted-dns-server can be configured to use this for access control
|
||||
## in the [access_control] section
|
||||
|
||||
# query_meta = ["key1:value1", "key2:value2", "token:MySecretToken"]
|
||||
|
||||
|
||||
## Automatic log files rotation
|
||||
|
||||
# Maximum log files size in MB
|
||||
# Maximum log files size in MB - Set to 0 for unlimited.
|
||||
log_files_max_size = 10
|
||||
|
||||
# How long to keep backup files, in days
|
||||
|
|
@ -246,23 +266,42 @@ log_files_max_backups = 1
|
|||
# Filters #
|
||||
#########################
|
||||
|
||||
## Note: if you are using dnsmasq, disable the `dnssec` option in dnsmasq if you
|
||||
## configure dnscrypt-proxy to do any kind of filtering (including the filters
|
||||
## below and blacklists).
|
||||
## You can still choose resolvers that do DNSSEC validation.
|
||||
|
||||
|
||||
## Immediately respond to IPv6-related queries with an empty response
|
||||
## This makes things faster when there is no IPv6 connectivity, but can
|
||||
## also cause reliability issues with some stub resolvers.
|
||||
## Do not enable if you added a validating resolver such as dnsmasq in front
|
||||
## of the proxy.
|
||||
|
||||
block_ipv6 = false
|
||||
|
||||
|
||||
## Immediately respond to A and AAAA queries for host names without a domain name
|
||||
|
||||
block_unqualified = true
|
||||
|
||||
|
||||
## Immediately respond to queries for local zones instead of leaking them to
|
||||
## upstream resolvers (always causing errors or timeouts).
|
||||
|
||||
block_undelegated = true
|
||||
|
||||
|
||||
## TTL for synthetic responses sent when a request has been blocked (due to
|
||||
## IPv6 or blacklists).
|
||||
|
||||
reject_ttl = 600
|
||||
|
||||
|
||||
|
||||
##################################################################################
|
||||
# Route queries for specific domains to a dedicated set of servers #
|
||||
##################################################################################
|
||||
|
||||
## Example map entries (one entry per line):
|
||||
## example.com 9.9.9.9
|
||||
## example.net 9.9.9.9,8.8.8.8,1.1.1.1
|
||||
## See the `example-forwarding-rules.txt` file for an example
|
||||
|
||||
# forwarding_rules = 'forwarding-rules.txt'
|
||||
|
||||
|
|
@ -276,12 +315,13 @@ block_ipv6 = false
|
|||
## In addition to acting as a HOSTS file, it can also return the IP address
|
||||
## of a different name. It will also do CNAME flattening.
|
||||
##
|
||||
## Example map entries (one entry per line)
|
||||
## example.com 10.1.1.1
|
||||
## www.google.com forcesafesearch.google.com
|
||||
## See the `example-cloaking-rules.txt` file for an example
|
||||
|
||||
# cloaking_rules = 'cloaking-rules.txt'
|
||||
|
||||
## TTL used when serving entries in cloaking-rules.txt
|
||||
|
||||
# cloak_ttl = 600
|
||||
|
||||
|
||||
###########################
|
||||
|
|
@ -295,12 +335,12 @@ cache = true
|
|||
|
||||
## Cache size
|
||||
|
||||
cache_size = 512
|
||||
cache_size = 4096
|
||||
|
||||
|
||||
## Minimum TTL for cached entries
|
||||
|
||||
cache_min_ttl = 600
|
||||
cache_min_ttl = 2400
|
||||
|
||||
|
||||
## Maximum TTL for cached entries
|
||||
|
|
@ -319,6 +359,37 @@ cache_neg_max_ttl = 600
|
|||
|
||||
|
||||
|
||||
##################################
|
||||
# Local DoH server #
|
||||
##################################
|
||||
|
||||
[local_doh]
|
||||
|
||||
## dnscrypt-proxy can act as a local DoH server. By doing so, web browsers
|
||||
## requiring a direct connection to a DoH server in order to enable some
|
||||
## features will enable these, without bypassing your DNS proxy.
|
||||
|
||||
## Addresses that the local DoH server should listen to
|
||||
|
||||
# listen_addresses = ['127.0.0.1:3000']
|
||||
|
||||
|
||||
## Path of the DoH URL. This is not a file, but the part after the hostname
|
||||
## in the URL. By convention, `/dns-query` is frequently chosen.
|
||||
## For each `listen_address` the complete URL to access the server will be:
|
||||
## `https://<listen_address><path>` (ex: `https://127.0.0.1/dns-query`)
|
||||
|
||||
# path = "/dns-query"
|
||||
|
||||
|
||||
## Certificate file and key - Note that the certificate has to be trusted.
|
||||
## See the documentation (wiki) for more information.
|
||||
|
||||
# cert_file = "localhost.pem"
|
||||
# cert_key_file = "localhost.pem"
|
||||
|
||||
|
||||
|
||||
###############################
|
||||
# Query logging #
|
||||
###############################
|
||||
|
|
@ -327,7 +398,8 @@ cache_neg_max_ttl = 600
|
|||
|
||||
[query_log]
|
||||
|
||||
## Path to the query log file (absolute, or relative to the same directory as the executable file)
|
||||
## Path to the query log file (absolute, or relative to the same directory as the config file)
|
||||
## On non-Windows systems, can be /dev/stdout to log to the standard output (also set log_files_max_size to 0)
|
||||
|
||||
# file = 'query.log'
|
||||
|
||||
|
|
@ -353,7 +425,7 @@ cache_neg_max_ttl = 600
|
|||
|
||||
[nx_log]
|
||||
|
||||
## Path to the query log file (absolute, or relative to the same directory as the executable file)
|
||||
## Path to the query log file (absolute, or relative to the same directory as the config file)
|
||||
|
||||
# file = 'nx.log'
|
||||
|
||||
|
|
@ -383,7 +455,7 @@ cache_neg_max_ttl = 600
|
|||
|
||||
[blacklist]
|
||||
|
||||
## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)
|
||||
## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
|
||||
|
||||
# blacklist_file = 'blacklist.txt'
|
||||
|
||||
|
|
@ -411,7 +483,7 @@ cache_neg_max_ttl = 600
|
|||
|
||||
[ip_blacklist]
|
||||
|
||||
## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)
|
||||
## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)
|
||||
|
||||
# blacklist_file = 'ip-blacklist.txt'
|
||||
|
||||
|
|
@ -439,7 +511,7 @@ cache_neg_max_ttl = 600
|
|||
|
||||
[whitelist]
|
||||
|
||||
## Path to the file of whitelisting rules (absolute, or relative to the same directory as the executable file)
|
||||
## Path to the file of whitelisting rules (absolute, or relative to the same directory as the config file)
|
||||
|
||||
# whitelist_file = 'whitelist.txt'
|
||||
|
||||
|
|
@ -465,8 +537,7 @@ cache_neg_max_ttl = 600
|
|||
##
|
||||
## For example, the following rule in a blacklist file:
|
||||
## *.youtube.* @time-to-sleep
|
||||
## would block access to YouTube only during the days, and period of the days
|
||||
## define by the 'time-to-sleep' schedule.
|
||||
## would block access to YouTube during the times defined by the 'time-to-sleep' schedule.
|
||||
##
|
||||
## {after='21:00', before= '7:00'} matches 0:00-7:00 and 21:00-0:00
|
||||
## {after= '9:00', before='18:00'} matches 9:00-18:00
|
||||
|
|
@ -507,7 +578,7 @@ cache_neg_max_ttl = 600
|
|||
## must include the prefixes.
|
||||
##
|
||||
## If the `urls` property is missing, cache files and valid signatures
|
||||
## must be already present; This doesn't prevent these cache files from
|
||||
## must already be present. This doesn't prevent these cache files from
|
||||
## expiring after `refresh_delay` hours.
|
||||
|
||||
[sources]
|
||||
|
|
@ -518,17 +589,24 @@ cache_neg_max_ttl = 600
|
|||
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
|
||||
cache_file = 'public-resolvers.md'
|
||||
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
|
||||
prefix = ''
|
||||
|
||||
## Anonymized DNS relays
|
||||
|
||||
[sources.'relays']
|
||||
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/relays.md', 'https://download.dnscrypt.info/resolvers-list/v2/relays.md']
|
||||
cache_file = 'relays.md'
|
||||
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
|
||||
refresh_delay = 72
|
||||
prefix = ''
|
||||
|
||||
## Quad9 over DNSCrypt - https://quad9.net/
|
||||
|
||||
# [sources.quad9-resolvers]
|
||||
# urls = ["https://www.quad9.net/quad9-resolvers.md"]
|
||||
# minisign_key = "RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN"
|
||||
# cache_file = "quad9-resolvers.md"
|
||||
# refresh_delay = 72
|
||||
# prefix = "quad9-"
|
||||
# urls = ['https://www.quad9.net/quad9-resolvers.md']
|
||||
# minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN'
|
||||
# cache_file = 'quad9-resolvers.md'
|
||||
# prefix = 'quad9-'
|
||||
|
||||
## Another example source, with resolvers censoring some websites not appropriate for children
|
||||
## This is a subset of the `public-resolvers` list, so enabling both is useless
|
||||
|
|
@ -540,10 +618,87 @@ cache_neg_max_ttl = 600
|
|||
|
||||
|
||||
|
||||
#########################################
|
||||
# Servers with known bugs #
|
||||
#########################################
|
||||
|
||||
[broken_implementations]
|
||||
|
||||
# Cisco servers currently cannot handle queries larger than 1472 bytes, and don't
|
||||
# truncate reponses larger than questions as expected by the DNSCrypt protocol.
|
||||
# This prevents large responses from being received over UDP and over relays.
|
||||
#
|
||||
# The `dnsdist` server software drops client queries larger than 1500 bytes.
|
||||
# They are aware of it and are working on a fix.
|
||||
#
|
||||
# The list below enables workarounds to make non-relayed usage more reliable
|
||||
# until the servers are fixed.
|
||||
|
||||
fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri', 'cleanbrowsing-adult', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security']
|
||||
|
||||
|
||||
|
||||
|
||||
################################
|
||||
# TLS Client Authentication #
|
||||
################################
|
||||
|
||||
# This is only useful if you are operating your own, private DoH server(s).
|
||||
# (for DNSCrypt, see the `query_meta` feature instead)
|
||||
|
||||
[tls_client_auth]
|
||||
|
||||
# creds = [
|
||||
# { server_name='myserver', client_cert='client.crt', client_key='client.key' }
|
||||
# ]
|
||||
|
||||
|
||||
|
||||
################################
|
||||
# Anonymized DNS #
|
||||
################################
|
||||
|
||||
[anonymized_dns]
|
||||
|
||||
## Routes are indirect ways to reach DNSCrypt servers.
|
||||
##
|
||||
## A route maps a server name ("server_name") to one or more relays that will be
|
||||
## used to connect to that server.
|
||||
##
|
||||
## A relay can be specified as a DNS Stamp (either a relay stamp, or a
|
||||
## DNSCrypt stamp), an IP:port, a hostname:port, or a server name.
|
||||
##
|
||||
## The following example routes "example-server-1" via `anon-example-1` or `anon-example-2`,
|
||||
## and "example-server-2" via the relay whose relay DNS stamp
|
||||
## is "sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM".
|
||||
##
|
||||
## !!! THESE ARE JUST EXAMPLES !!!
|
||||
##
|
||||
## Review the list of available relays from the "relays.md" file, and, for each
|
||||
## server you want to use, define the relays you want connections to go through.
|
||||
##
|
||||
## Carefully choose relays and servers so that they are run by different entities.
|
||||
##
|
||||
## "server_name" can also be set to "*" to define a default route, but this is not
|
||||
## recommended. If you do so, keep "server_names" short and distinct from relays.
|
||||
|
||||
# routes = [
|
||||
# { server_name='example-server-1', via=['anon-example-1', 'anon-example-2'] },
|
||||
# { server_name='example-server-2', via=['sdns://gRIxMzcuNzQuMjIzLjIzNDo0NDM'] }
|
||||
# ]
|
||||
|
||||
|
||||
# skip resolvers incompatible with anonymization instead of using them directly
|
||||
|
||||
skip_incompatible = false
|
||||
|
||||
|
||||
|
||||
|
||||
## Optional, local, static list of additional servers
|
||||
## Mostly useful for testing your own servers.
|
||||
|
||||
[static]
|
||||
|
||||
# [static.'google']
|
||||
# stamp = 'sdns://AgUAAAAAAAAAAAAOZG5zLmdvb2dsZS5jb20NL2V4cGVyaW1lbnRhbA'
|
||||
# [static.'myserver']
|
||||
# stamp = 'sdns:AQcAAAAAAAAAAAAQMi5kbnNjcnlwdC1jZXJ0Lg'
|
||||
|
|
|
|||
Loading…
Reference in New Issue