Following rules have been applied:
- script starts with shebang !#/bin/sh followed by blank line,
- script ends with exit 0 prepended by blank line,
- only stderr of adduser, addgroup or passwd is redirected to /dev/null,
- getent passwd/group instances has been removed,
- manual checking of file and group existence has been removed,
- `|| true` instances has been removed.
Comments and line wrapping have been preserved.
Malformed packets could cause the OpenDNS deviceid, OpenDNS set-client-ip, blocking and
AAAA blocking plugins to use uninitialized pointers, leading to a denial of service or
possibly code execution.
The vulnerable code is present since dnscrypt-proxy 1.1.0.
OpenDNS users and people using dnscrypt-proxy in order to block domain names and
IP addresses should upgrade as soon as possible.
New feature: public-key based client authentication (-K), for private and
commercial DNS services to securely authenticate the sender of a query no
matter what the source IP address is, without altering the DNS query.
* Version 1.4.0:
- Security: versions 0.11 to 1.3.3 were vulnerable to a denial of
service when running out of output buffer space.
/sbin/setup-dnscrypt now also sets the correct loopback address if
unbound is removed outside of the script.
I did a little more testing on the /sbin/setup-dnscrypt script (once I
knew I could install the APK's I made). This fixes previous bugs with
setting up dns caching (a 2nd loopback is created & the proxy now
listens on 127.0.0.2:40 by default if caching is enabled). Errors in
setting up & starting the services are also fixed.
Complete patch to bump dnscrypt-proxy to version 1.33
Minor changes to APKBUILD to build with the new sources & make-depends.
confd / initd changed to include the additional configurations to set the alternative
resolver ip / public keys.
Separate patch created to build dnscrypt's dependency libsodium / libsodium-dev
(as it no longer forms part of dnscrypt's sources).
Post-install script is just status / info using the $STRONG / $RED / $GREEN
system colours.
Added /sbin/setup-dnscrypt for changing the resolver dnscrypt queries &
optionally installing unbound for dns caching. This also uses the system terminal
colours. This no longer makes any changes to init.d, it only updates conf.d
