Skip to content

Commit aadb49c

Browse files
MizzickMizzick
committed
Merge branch 'refs/heads/master' into ADG-11407-add-docker-release
2 parents 701d29b + 01dd10e commit aadb49c

22 files changed

+572
-478
lines changed

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,15 @@ See also the [v0.107.73 GitHub milestone][ms-v0.107.73].
1717
1818
NOTE: Add new changes BELOW THIS COMMENT.
1919
-->
20+
21+
### Fixed
22+
23+
- Incorrect client IP logging in failed authentication attempts when using a proxy ([#8198]).
24+
25+
- Incorrect logger behavior in case `-v` flag is added.
26+
27+
[#8198]: https://github.com/AdguardTeam/AdGuardHome/issues/8198
28+
2029
<!--
2130
NOTE: Add new changes ABOVE THIS COMMENT.
2231
-->

‎client/src/__locales/en.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@
289289
"encryption_key_input": "Copy/paste your PEM-encoded private key for your certificate here.",
290290
"encryption_key_invalid": "This is an invalid {{type}} private key",
291291
"encryption_key_source_content": "Paste the private key contents",
292-
"encryption_key_source_path": "Set a private key file",
292+
"encryption_key_source_path": "Set a private key file path",
293293
"encryption_key_valid": "This is a valid {{type}} private key",
294294
"encryption_plain_dns_desc": "Plain DNS is enabled by default. You can disable it to force all devices to use encrypted DNS. To do this, you must enable at least one encrypted DNS protocol",
295295
"encryption_plain_dns_enable": "Enable plain DNS",

‎go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ module github.com/AdguardTeam/AdGuardHome
33
go 1.25.7
44

55
require (
6-
github.com/AdguardTeam/dnsproxy v0.78.2
6+
github.com/AdguardTeam/dnsproxy v0.79.0
77
github.com/AdguardTeam/golibs v0.35.8
8-
github.com/AdguardTeam/urlfilter v0.23.1
8+
github.com/AdguardTeam/urlfilter v0.23.2
99
github.com/NYTimes/gziphandler v1.1.1
1010
github.com/ameshkov/dnscrypt/v2 v2.4.0
1111
github.com/bluele/gcache v0.0.2
@@ -93,18 +93,18 @@ require (
9393
go.opentelemetry.io/otel/metric v1.40.0 // indirect
9494
go.opentelemetry.io/otel/trace v1.40.0 // indirect
9595
go.yaml.in/yaml/v3 v3.0.4 // indirect
96-
golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 // indirect
96+
golang.org/x/exp/typeparams v0.0.0-20260212183809-81e46e3db34a // indirect
9797
golang.org/x/mod v0.33.0 // indirect
9898
golang.org/x/sync v0.19.0 // indirect
99-
golang.org/x/telemetry v0.0.0-20260211150929-9f66fae5fbe0 // indirect
99+
golang.org/x/telemetry v0.0.0-20260213145524-e0ab670178e1 // indirect
100100
golang.org/x/term v0.40.0 // indirect
101101
golang.org/x/text v0.34.0 // indirect
102102
golang.org/x/tools v0.42.0 // indirect
103103
golang.org/x/vuln v1.1.4 // indirect
104104
gonum.org/v1/gonum v0.17.0 // indirect
105105
google.golang.org/genai v1.46.0 // indirect
106106
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
107-
google.golang.org/grpc v1.78.0 // indirect
107+
google.golang.org/grpc v1.79.1 // indirect
108108
google.golang.org/protobuf v1.36.11 // indirect
109109
gopkg.in/yaml.v3 v3.0.1 // indirect
110110
honnef.co/go/tools v0.6.1 // indirect

‎go.sum‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs=
44
cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA=
55
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
66
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
7-
github.com/AdguardTeam/dnsproxy v0.78.2 h1:g+ba4vh72hAv9zIE+OPSEnu77utSKxIF6u2jNhYAR7g=
8-
github.com/AdguardTeam/dnsproxy v0.78.2/go.mod h1:gwr+7Dc0e7QddQLC9JLGjL5NSKcqw0ESsNMRI5Q67Ps=
7+
github.com/AdguardTeam/dnsproxy v0.79.0 h1:wvNTny4u6x95bWGRyyqr1PVkHbYyAhPsv4EvnqVlmf4=
8+
github.com/AdguardTeam/dnsproxy v0.79.0/go.mod h1:gwr+7Dc0e7QddQLC9JLGjL5NSKcqw0ESsNMRI5Q67Ps=
99
github.com/AdguardTeam/golibs v0.35.8 h1:KsyF3SWwj05Ey4GiAWU6FGD9oJTDNMp1ixVdS+Nw50M=
1010
github.com/AdguardTeam/golibs v0.35.8/go.mod h1:kuLQ0yNRTl0Em2FmmXtSri7ZdVT7p62oojyc51RvP38=
11-
github.com/AdguardTeam/urlfilter v0.23.1 h1:ifoms1xhof83+IPz96NsZt0h8knXOlL/lNP1cHjndfE=
12-
github.com/AdguardTeam/urlfilter v0.23.1/go.mod h1:Fl4eR1sOdx/1kdBRIY8JZHb91h7uab1Wxz4YzJlXTMw=
11+
github.com/AdguardTeam/urlfilter v0.23.2-0.20260226112426-a60617ec1594 h1:VoT4UKSgRcbIpsCGLuVenMWFFdi1834SUkc9+hp5Ivs=
12+
github.com/AdguardTeam/urlfilter v0.23.2-0.20260226112426-a60617ec1594/go.mod h1:JteAKoeka1Yr2oZ3P94dqYBfPOHWyFaOcu3uZa9Yl+I=
13+
github.com/AdguardTeam/urlfilter v0.23.2 h1:EiS/PQZO/X2S6cduFW6BBoRLyjd6SqZj1ZiFbU1KaFE=
14+
github.com/AdguardTeam/urlfilter v0.23.2/go.mod h1:JteAKoeka1Yr2oZ3P94dqYBfPOHWyFaOcu3uZa9Yl+I=
1315
github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
1416
github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
1517
github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
@@ -209,8 +211,8 @@ golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
209211
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
210212
golang.org/x/exp v0.0.0-20260209203927-2842357ff358 h1:kpfSV7uLwKJbFSEgNhWzGSL47NDSF/5pYYQw1V0ub6c=
211213
golang.org/x/exp v0.0.0-20260209203927-2842357ff358/go.mod h1:R3t0oliuryB5eenPWl3rrQxwnNM3WTwnsRZZiXLAAW8=
212-
golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358 h1:qWFG1Dj7TBjOjOvhEOkmyGPVoquqUKnIU0lEVLp8xyk=
213-
golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358/go.mod h1:4Mzdyp/6jzw9auFDJ3OMF5qksa7UvPnzKqTVGcb04ms=
214+
golang.org/x/exp/typeparams v0.0.0-20260212183809-81e46e3db34a h1:n3SZDk8iNpMasCwQD7/0dIaCVf3gJiGZ9Rqa094jUN0=
215+
golang.org/x/exp/typeparams v0.0.0-20260212183809-81e46e3db34a/go.mod h1:PqrXSW65cXDZH0k4IeUbhmg/bcAZDbzNz3byBpKCsXo=
214216
golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
215217
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
216218
golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
@@ -237,8 +239,8 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
237239
golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
238240
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
239241
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
240-
golang.org/x/telemetry v0.0.0-20260211150929-9f66fae5fbe0 h1:QzfhCtBYkcd5z7ASCXt+QCvpVHFbOospIW31MZsypvM=
241-
golang.org/x/telemetry v0.0.0-20260211150929-9f66fae5fbe0/go.mod h1:g5NllXBEermZrmR51cJDQxmJUHUOfRAaNyWBM+R+548=
242+
golang.org/x/telemetry v0.0.0-20260213145524-e0ab670178e1 h1:QNaHp8YvpPswfDNxlCmJyeesxbGOgaKf41iT9/QrErY=
243+
golang.org/x/telemetry v0.0.0-20260213145524-e0ab670178e1/go.mod h1:NuITXsA9cTiqnXtVk+/wrBT2Ja4X5hsfGOYRJ6kgYjs=
242244
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
243245
golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
244246
golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
@@ -264,8 +266,8 @@ google.golang.org/genai v1.46.0 h1:RSsfeMaV30m8PxLOW4RUIb5ybw+mw+UBf1vSpsQTQbE=
264266
google.golang.org/genai v1.46.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
265267
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac=
266268
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
267-
google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
268-
google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
269+
google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
270+
google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
269271
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
270272
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
271273
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

‎internal/dnsforward/config.go‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"github.com/AdguardTeam/AdGuardHome/internal/aghtls"
2121
"github.com/AdguardTeam/AdGuardHome/internal/client"
2222
"github.com/AdguardTeam/dnsproxy/proxy"
23+
"github.com/AdguardTeam/dnsproxy/ratelimit"
2324
"github.com/AdguardTeam/dnsproxy/upstream"
2425
"github.com/AdguardTeam/golibs/container"
2526
"github.com/AdguardTeam/golibs/errors"
@@ -48,11 +49,11 @@ type Config struct {
4849

4950
// RatelimitSubnetLenIPv4 is a subnet length for IPv4 addresses used for
5051
// rate limiting requests.
51-
RatelimitSubnetLenIPv4 int `yaml:"ratelimit_subnet_len_ipv4"`
52+
RatelimitSubnetLenIPv4 uint `yaml:"ratelimit_subnet_len_ipv4"`
5253

5354
// RatelimitSubnetLenIPv6 is a subnet length for IPv6 addresses used for
5455
// rate limiting requests.
55-
RatelimitSubnetLenIPv6 int `yaml:"ratelimit_subnet_len_ipv6"`
56+
RatelimitSubnetLenIPv6 uint `yaml:"ratelimit_subnet_len_ipv6"`
5657

5758
// RatelimitWhitelist is the list of whitelisted client IP addresses.
5859
RatelimitWhitelist []netip.Addr `yaml:"ratelimit_whitelist"`
@@ -325,13 +326,14 @@ func (s *Server) newProxyConfig(ctx context.Context) (conf *proxy.Config, err er
325326
srvConf := s.conf
326327
trustedPrefixes := netutil.UnembedPrefixes(srvConf.TrustedProxies)
327328

329+
ratelimitMw, err := newRatelimitMw(s.baseLogger, srvConf)
330+
if err != nil {
331+
return nil, fmt.Errorf("ratelimit middleware: %w", err)
332+
}
333+
328334
conf = &proxy.Config{
329335
Logger: s.baseLogger.With(slogutil.KeyPrefix, aghslog.PrefixDNSProxy),
330336
HTTP3: srvConf.ServeHTTP3,
331-
Ratelimit: int(srvConf.Ratelimit),
332-
RatelimitSubnetLenIPv4: srvConf.RatelimitSubnetLenIPv4,
333-
RatelimitSubnetLenIPv6: srvConf.RatelimitSubnetLenIPv6,
334-
RatelimitWhitelist: srvConf.RatelimitWhitelist,
335337
RefuseAny: srvConf.RefuseAny,
336338
TrustedProxies: netutil.SliceSubnetSet(trustedPrefixes),
337339
CacheMinTTL: srvConf.CacheMinTTL,
@@ -342,7 +344,7 @@ func (s *Server) newProxyConfig(ctx context.Context) (conf *proxy.Config, err er
342344
UpstreamConfig: srvConf.UpstreamConfig,
343345
PrivateRDNSUpstreamConfig: srvConf.PrivateRDNSUpstreamConfig,
344346
BeforeRequestHandler: s,
345-
RequestHandler: s.handleDNSRequest,
347+
RequestHandler: ratelimitMw.Wrap(s),
346348
HTTPSServerName: aghhttp.UserAgent(),
347349
EnableEDNSClientSubnet: srvConf.EDNSClientSubnet.Enabled,
348350
MaxGoroutines: srvConf.MaxGoroutines,
@@ -395,6 +397,29 @@ func (s *Server) newProxyConfig(ctx context.Context) (conf *proxy.Config, err er
395397
return conf, nil
396398
}
397399

400+
// newRatelimitMw returns the ratelimit middleware. In case of invalid
401+
// ratelimit configuration returns an error. l must not be nil.
402+
func newRatelimitMw(
403+
l *slog.Logger,
404+
conf ServerConfig,
405+
) (mw proxy.Middleware, err error) {
406+
if conf.Ratelimit == 0 {
407+
return proxy.MiddlewareFunc(proxy.PassThrough), nil
408+
}
409+
410+
rlConf := &ratelimit.Config{
411+
Logger: l.With(slogutil.KeyPrefix, "ratelimit"),
412+
Ratelimit: uint(conf.Ratelimit),
413+
SubnetLenIPv4: conf.RatelimitSubnetLenIPv4,
414+
SubnetLenIPv6: conf.RatelimitSubnetLenIPv6,
415+
}
416+
if err = rlConf.Validate(); err != nil {
417+
return nil, fmt.Errorf("invalid configuration: %w", err)
418+
}
419+
420+
return ratelimit.NewMiddleware(rlConf), nil
421+
}
422+
398423
// prepareCacheConfig prepares the cache configuration and returns an error if
399424
// there is one.
400425
func prepareCacheConfig(

‎internal/dnsforward/dns64_internal_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ func newRR(tb testing.TB, name string, qtype uint16, ttl uint32, val any) (rr dn
6363
return rr
6464
}
6565

66-
func TestServer_HandleDNSRequest_dns64(t *testing.T) {
66+
func TestServer_ServeDNS_dns64(t *testing.T) {
6767
t.Parallel()
6868

6969
const (

0 commit comments

Comments
 (0)