Arch Linux

av

Member

Registered: 2012-03-17

Posts: 32

DNSCrypt proxy fails after upgrade

Hello,

Checking the services' status gives me this:

Unable to load the configuration file [dnscrypt-proxy.toml] -- Maybe use the -config command-line switch?

Does anyone know what may be causing this?

4ronie4

Member

Registered: 2015-09-24

Posts: 20

Re: DNSCrypt proxy fails after upgrade

I'm also having problems with 2.0.14 version, but not the same. DNS queries don't work and the systemd status reports no error.

r3b311i0n

Member

From: Sri Lanka

Registered: 2016-04-06

Posts: 26

Website

Re: DNSCrypt proxy fails after upgrade

The systemd units were revised with the 2.0.13 update. Stop and disable dnscrypt-proxy.service and use dnscrypt-proxy.socket.

EDIT:

Version 2.0.14-2 has fixed the issue.

Last edited by r3b311i0n (2018-05-21 17:38:14)

Batou

Member

Registered: 2017-01-03

Posts: 262

Re: DNSCrypt proxy fails after upgrade

FYI, DNSCrypt-Proxy was switched from 1.x branch to 2.x branch. It's a completely different client. It's written in Go (as opposed to 1.x which is written in C) and the configuration and everything else is completely different.

My suggestion is to backup, do a complete removal of dnscrypt-proxy and then search the system for leftovers of old files and delete them. Then do a reinstall.

Edit: The way this "upgrade" was handled (by the DNSCrypt project) is completely unacceptable. There were no warnings or anything. This package used to have its own entry under DNSCrypt-Proxy2 but now that package doesn't exist and was replaced with DNSCrypt-Proxy. Someone just replaced the packages and issued no guidance on how to handle the switch-over. I would have been somewhat OK with this if these two packages were compatible. But they're not and the new package hasn't been thoroughly security audited either.

Edit2: Even the defaults set by this neew client are dubious and don't instill confidence. By default, this new client has google and cloudflare DNS servers in its active server array. If you're using DNSCrypt, you probably don't want to use these servers that log and track and correlate everything.

Last edited by Batou (2018-05-22 15:58:22)

---

Please vote for all the AUR packages you're using. You can mass-vote for all of them by doing: "pacman -Qqm | xargs aurvote -v" (make sure to run "aurvote --configure"  first)

r3b311i0n

Member

From: Sri Lanka

Registered: 2016-04-06

Posts: 26

Website

Re: DNSCrypt proxy fails after upgrade

The switch to DNSCrypt v2 happened a month and a half ago and switching from v1 to v2 was pretty painless (for me anyway). Also, the default active servers are set to be automatic (use fastest), Google, Cloudflare, etc. are commented out and require_nolog and require_nofilter are both set to true which makes DNSCrypt not use censored or logging DNS servers.

ljgdasfhk

Member

Registered: 2018-05-22

Posts: 5

Re: DNSCrypt proxy fails after upgrade

After starting the system, dnscrypt works.
But when connecting to the Internet by
dhcpcd enp0s20u10
dnscrypt is down and has to be restarted
systemctl restart dnscrypt-proxy.service

SOCKET

[Unit]
Description=DNSCrypt-proxy socket
Documentation=https://github.com/jedisct1/dnscrypt-proxy/wiki
Before=nss-lookup.target
Wants=nss-lookup.target network-online.target

[Socket]
ListenStream=127.0.0.1:53
ListenDatagram=127.0.0.1:53
NoDelay=true
DeferAcceptSec=1

[Install]
WantedBy=sockets.target

SERVICE

[Unit]
Description=DNSCrypt-proxy client
Documentation=https://github.com/jedisct1/dnscrypt-proxy/wiki
After=network.target
Wants=network-online.target nss-lookup.target
Before=nss-lookup.target

[Service]
NonBlocking=true
ExecStart=/usr/bin/dnscrypt-proxy --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
ProtectHome=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
DynamicUser=yes
CacheDirectory=dnscrypt-proxy
LogsDirectory=dnscrypt-proxy
RuntimeDirectory=dnscrypt-proxy
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

A week ago everything worked. The package needs a rollback.

Last edited by ljgdasfhk (2018-05-23 13:12:00)

ljgdasfhk

Member

Registered: 2018-05-22

Posts: 5

Re: DNSCrypt proxy fails after upgrade

downgrade dnscrypt-proxy
to dnscrypt-proxy-2.0.14-1-x86_64.pkg.tar.xz
and now all work fine

ljgdasfhk

Member

Registered: 2018-05-22

Posts: 5

Re: DNSCrypt proxy fails after upgrade

the following method also helps
systemctl disable dnscrypt-proxy.socket
reboot

mxfm

Member

Registered: 2015-10-23

Posts: 166

Re: DNSCrypt proxy fails after upgrade

FYI, DNSCrypt-Proxy was switched from 1.x branch to 2.x branch. It's a completely different client. It's written in Go (as opposed to 1.x which is written in C) and the configuration and everything else is completely different.

My suggestion is to backup, do a complete removal of dnscrypt-proxy and then search the system for leftovers of old files and delete them. Then do a reinstall.

Edit: The way this "upgrade" was handled (by the DNSCrypt project) is completely unacceptable. There were no warnings or anything. This package used to have its own entry under DNSCrypt-Proxy2 but now that package doesn't exist and was replaced with DNSCrypt-Proxy. Someone just replaced the packages and issued no guidance on how to handle the switch-over. I would have been somewhat OK with this if these two packages were compatible. But they're not and the new package hasn't been thoroughly security audited either.

+1

Silently replacing 'old' dnscrypt-proxy with 'new' one which has completely different options was inappropriate. Initially I made it to work manually and after some packages updates (within two days) it started to work out of the box with default parameters (as systemd service). I was closely watching all issues of dnscrypt-proxy in bugzilla. From my memory there was around 3-4 issues, but on my machine dnscrypt-proxy works normally.