dnscrypt-proxy2: example blocklist is enabled by default and blocks legitimate APIs

Open Beginner friendly
  • Is something wrong?
#31,291 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
Under an hour
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Domain
build-system, networking

Research direction

The change belongs in net/dnscrypt-proxy2/Makefile, where the install step runs a sed around line 60 that enables blocked_names_file in dnscrypt-proxy.toml. Keep copying the blocklist file, but leave that setting commented out as upstream does, then check the resulting config. Done when a fresh install leaves the setting commented and telemetry.googleapis.com resolves through the proxy. Confirm the maintainer agrees to the policy change before opening a pull request.

Written by the indexing model from the issue text.

Description

Package Name

dnscrypt-proxy2

Maintainer

@BKPepe

OpenWrt Version

SNAPSHOT (master, net/dnscrypt-proxy2/Makefile line 60); also seen on a 21.02 based build

OpenWrt Target/Subtarget

Not target specific, it comes from the package install step (seen on a GL-X3000)

Steps to Reproduce
  1. Install dnscrypt-proxy2 and use it as the resolver.
  2. Look up telemetry.googleapis.com or stats.googleapis.com through it.
  3. The query is answered with "This query has been locally blocked by dnscrypt-proxy".
Actual Behaviour

The package installs upstream's example blocklist as /etc/dnscrypt-proxy2/blocked-names.txt and enables it in dnscrypt-proxy.toml at install time (the sed in net/dnscrypt-proxy2/Makefile, line 60 on master). Upstream ships this file as example-blocked-names.txt, to show the pattern syntax, and keeps blocked_names_file commented out.

The patterns are plain prefixes, so besides trackers they match legitimate business endpoints. Some names that fail on a router with the package installed:

  • telemetry.googleapis.com and telemetry.<region>.rep.googleapis.com: the Google Cloud Telemetry API, where applications send their own traces, logs and metrics over OTLP;
  • stats.googleapis.com;
  • any ad.*, tag.*, stats.*, telemetry.* or tracker.* name under a company's own domain.

I don't think it protects anyone much. Real trackers use many other names, while the ones above are services businesses rely on and pay for. What the list does is break them silently: the query gets "This query has been locally blocked by dnscrypt-proxy", so the application only sees a host that doesn't resolve, which looks like a network problem.

For many users it is also invisible. GL.iNet firmware, for example, runs this package when you pick Encrypted DNS in its admin panel, and the panel has no setting for the blocklist. It took me a while to trace a "could not resolve host" error for telemetry.googleapis.com down to this file.

Would it be possible to install the file but leave blocked_names_file commented out, as upstream does, please? Anyone who wants name blocking can enable it with one line, and everyone else gets the DNS answers they expect. Happy to open a PR with that change if it helps.

Confirmation Checklist
Dominant language
Makefile
Stars
4.7k
Forks
4k
Avg merge
2d 4h
Merged PRs (30d)
251

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openwrt/packages

All issues in openwrt/packages

Similar issues

More Build System issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.