DNSCrypt is reborn!

[DonnyJohnny]

I have tested and confirmed that for now this v2 alpha5 do not support local dnssec validation. Only dnscrypt.
So you need to disable dnssec support in the router GUI at LAN, DHCP Server.

 

[M@rco]

Question...
I used to be able to see the dnscrypt-proxy log. Like recieving cert and proxying to... now these I can’t see the log in syslog. Anyone know why?

Maybe because logging to syslogd isn't yet implemented?

Planned features

• Flexible logging

 

[M@rco]

@DonnyJohnny Maybe you can pipe the output of dnscrypt-proxy to logger, to have it show up in syslog, for the time being?

 

[M@rco]

I use this in dnsmasq.conf.add:

no-resolv
server=127.0.0.1#65053

What are the implications of binding dnsmasq to a different port than 53? Will local dns resolving still work, for example?

 

[XIII]

What are the implications of binding dnsmasq to a different port than 53? Will local dns resolving still work, for example?

I had/have this setup with the old/regular version of DNSCrypt.

I’m not sure I’m familiar with local DNS resolving. Is that the device name you choose plus the local domain you choose? Example: pc & home.lan, so pc.home.lan? That works with the regular setup, but I don’t think I tried with version 2.

My guess is the behavior will be the same.

 

[M@rco]

Is that the device name you choose plus the local domain you choose?

Yes, exactly.

That works with the regular setup, but I don’t think I tried with version 2.

My guess is the behavior will be the same.

Okay, thanks. I will give it a try myself.

 

[DonnyJohnny]

@DonnyJohnny Maybe you can pipe the output of dnscrypt-proxy to logger, to have it show up in syslog, for the time being?

Kindly advise how do I do that?

This v2... other than able to see log during the initial start up of dnscrypt, I don’t see any log file being generate. Checked /etc , /tmp, /jffs area.
How do I tail the dnscrypt-proxy log?

 

[M@rco]

Haven't tried it myself yet, as I haven't had time to play with alpha5, but when you start it manually, I think you should be able to use

./dnscrypt-proxy | logger -t dnscrypt &

or, if you start it from a startup script when booting, I think you can simply add

  | logger -t dnscrypt &

right behind the line where you launch dnscrypt-proxy during boot. There's a space before | as well.

As for tailing the logfile, I'm not sure where it's logging currently. I did notice (while playing around with the Win64 executable) that there's a command line parameter for logging verbosity level, which made me think it had to be logging somewhere...

Please share your findings. I'll probably have another go at it tomorrow and let you know if I find something useful.

 

[DonnyJohnny]

Haven't tried it myself yet, as I haven't had time to play with alpha5, but when you start it manually, I think you should be able to use

./dnscrypt-proxy | logger -t dnscrypt &

or, if you start it from a startup script when booting, I think you can simply add

  | logger -t dnscrypt &

right behind the line where you launch dnscrypt-proxy during boot. There's a space before | as well.

As for tailing the logfile, I'm not sure where it's logging currently. I did notice (while playing around with the Win64 executable) that there's a command line parameter for logging verbosity level, which made me think it had to be logging somewhere...

Please share your findings. I'll probably have another go at it tomorrow and let you know if I find something useful.

Nothing happening in syslog

/jffs/dnscrypt-proxy/linux-arm/dnscrypt-proxy -config /jffs/dnscrypt-proxy/linux-arm/dnscrypt-proxy.toml -loglevel 1 | logger -t dnscrypt &

[2018-01-14 14:50:00] [-] [INFO] Loading source information from cache file [dnscrypt-resolvers.csv]
[2018-01-14 14:50:00] [-] [INFO] Loading source information from cache file [dnscrypt-resolvers.csv.minisig]
[2018-01-14 14:50:00] [-] [NOTICE] Source [https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v1/dnscrypt-resolvers.csv] loaded
[2018-01-14 14:50:00] [-] [INFO] Adding [d0wn-nl-ns4] to the set of wanted resolvers
[2018-01-14 14:50:00] [-] [INFO] Adding [d0wn-us-ns4] to the set of wanted resolvers
[2018-01-14 14:50:00] [-] [INFO] Adding [dnscrypt.eu-nl] to the set of wanted resolvers
[2018-01-14 14:50:00] [-] [INFO] Adding [dnscrypt.org-fr] to the set of wanted resolvers
[2018-01-14 14:50:00] [-] [INFO] Adding [ventricle.us] to the set of wanted resolvers

By the way for people who want to know where to place the command for autostart after router reboot. You can place them at “firewall-start” or “post-mount” user script. Anything for it seems not to work for me. Tell me about it.

 

[M@rco]

Nothing happening in syslog

Strange. I tested it quickly prior to posting, by redirecting the output on the terminal created by Skynet (first thing I could think of, sorry) and the whole menu showed up in syslog. Not sure why it wouldn't work. Maybe one of the experienced coders like @Adamm or @thelonelycoder can point us in the right direction, I just don't have enough knowledge. I just get there by trial and error and thought this would work...

 

[thelonelycoder]

Strange. I tested it quickly prior to posting, by redirecting the output on the terminal created by Skynet (first thing I could think of, sorry) and the whole menu showed up in syslog. Not sure why it wouldn't work. Maybe one of the experienced coders like @Adamm or @thelonelycoder can point us in the right direction, I just don't have enough knowledge. I just get there by trial and error and thought this would work...

If a log facility is set and it's not the syslog, then it likely logs to /var/log/
Otherwise you'd have to start it with the correct params to direct it to syslog. Look through the conf files in /etc/dns..., maybe you can set it there.

 

[M@rco]

If a log facility is set and it's not the syslog, then it likely logs to /var/log/
Otherwise you'd have to start it with the correct params to direct it to syslog. Look through the conf files in /etc/dns..., maybe you can set it there.

Thanks for your reply. Assuming logging isn't fully implemented/configurable in dnscrypt-proxy v2 yet (as suggested in the planned features), is the following command correct to send the output, generated on screen when executing the binary, to syslog?

./dnscrypt-proxy | logger -t dnscrypt &

 

[thelonelycoder]

Thanks for your reply. Assuming logging isn't fully implemented/configurable in dnscrypt-proxy v2 yet (as suggested in the planned features), is the following command correct to send the output, generated on screen when executing the binary, to syslog?

./dnscrypt-proxy | logger -t dnscrypt &

If there's anything it prints, you could try this:

./dnscrypt-proxy | logger -t dnscrypt-proxy "$@" &

 

[M@rco]

Nothing happening in syslog

@DonnyJohnny: You could try the suggestion by @thelonelycoder in the post above, see if that works. I can't try it myself until tomorrow unfortunately. I'll try to find out whether it's logging elsewhere as suggested as well.

 

[skeal]

@DonnyJohnny: You could try the suggestion by @thelonelycoder in the post above, see if that works. I can't try it myself until tomorrow unfortunately. I'll try to find out whether it's logging elsewhere as suggested as well.

You guys are doing awesome man keep up the great work!!

 

[M@rco]

Okay, a bit of progress...

This didn't work unfortunately:

If there's anything it prints, you could try this:

./dnscrypt-proxy | logger -t dnscrypt-proxy "$@" &

It still prints the output only to the terminal, nothing to syslog.

However, the following does output to syslog:

./dnscrypt-proxy 2>&1 | logger -t dnscrypt-proxy &

Which results in: (your results might look different, the excerpt below has been copied from papertrail.com)

Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] Source [https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v1/dnscrypt-resolvers.csv] loaded
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt.default.ns1.adguard.com.] Valid cert found: [ef0cdaa6887f24c8d7f38584bfa96bc9e92e0094e4a6bd3670bb76e6f85d4603]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.dnsrec.meo.ws.] Valid cert found: [e7376400d64607207d9d29aba4c9070c4546cef70cfed62f41e9feaac58f6376]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [FATAL] listen udp 127.0.0.1:53: bind: address already in use

I created /jffs/configs/dnsmasq.conf.add (didn't exist?) and added

no-resolv
server=127.0.0.1#65053

which appears in /etc/dnsmasq.conf after a reboot. However, when starting dnscrypt-proxy, I still get the same fatal error:

Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [FATAL] listen udp 127.0.0.1:53: bind: address already in use

Any suggestions?

 

[thelonelycoder]

Okay, a bit of progress...

This didn't work unfortunately:



It still prints the output only to the terminal, nothing to syslog.

However, the following does output to syslog:

marco@RT-AC68U:/tmp/mnt/USB/dnscrypt-proxy# ./dnscrypt-proxy | logger -t dnscrypt-proxy "$@" &

Which results in: (your results might look different, the excerpt below has been copied from papertrail.com)

Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] Source [https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v1/dnscrypt-resolvers.csv] loaded
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt.default.ns1.adguard.com.] Valid cert found: [ef0cdaa6887f24c8d7f38584bfa96bc9e92e0094e4a6bd3670bb76e6f85d4603]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.dnsrec.meo.ws.] Valid cert found: [e7376400d64607207d9d29aba4c9070c4546cef70cfed62f41e9feaac58f6376]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [NOTICE] [2.dnscrypt-cert.fr.dnscrypt.org.] Valid cert found: [ac708439648371fd8cfe27d0da9e88b31e23b0258859fda24acba08a6f7d8954]
Jan 15 09:15:30 RT-AC68U dnscrypt-proxy: [2018-01-15 08:15:30] [-] [FATAL] listen udp 127.0.0.1:53: bind: address already in use

I created /jffs/configs/dnsmasq.conf.add (didn't exist?) and added

no-resolv
server=127.0.0.1#65053

which appears in /etc/dnsmasq.conf after a reboot. However, when starting dnscrypt-proxy, I still get the same fatal error:



Any suggestions?

./dnscrypt-proxy | logger -t dnscrypt-proxy "$@" &
would only print once anyway.

 

[M@rco]

./dnscrypt-proxy | logger -t dnscrypt-proxy "$@" &
would only print once anyway.

Sorry, pasted the wrong line. This is what works (edited post above):

marco@RT-AC68U:/tmp/mnt/USB/dnscrypt-proxy# ./dnscrypt-proxy 2>&1 | logger -t dnscrypt-proxy &

 

[DonnyJohnny]

Sorry, pasted the wrong line. This is what works (edited post above):

marco@RT-AC68U:/tmp/mnt/USB/dnscrypt-proxy# ./dnscrypt-proxy 2>&1 | logger -t dnscrypt-proxy &

It works!!
At least for now, during reboot, we can see log if successful.

 

[DonnyJohnny]

U need to edit the dnscrypt-proxy.toml to change the listening port to 65053. As of now, I don’t know how to restart dnscrypt-proxy. I used TOP command and KILL command to stop dnscrypt-proxy and start the dnscrypt-proxy again to refresh update of the toml configuration.
For any update of dnsmasq.conf.add, you can use service restart_dnsmasq to load them up.

You can also set dnssec-proxy in dnsmasq.conf.add if u want. Provided resolver use dnssec.

I find this v2 easy to use. And seems efficient. I have 4 resolvers and I listen to 4 socket ports.

Set cache to 386. Memory usage is around 10.4mb. Compare to previous dnscrypt-proxy. It is almost 10x more... but given it support multi-core feature.. why not...