Merge pull request #419 from safing/fix/patch-set-8

Update config options and add fallback dns check

netenv/online-status.go

@@ -39,6 +39,9 @@ var (
 	DNSTestDomain     = "one.one.one.one."
 	DNSTestExpectedIP = net.IPv4(1, 1, 1, 1)
 
+	DNSFallbackTestDomain     = "dns-check.safing.io."
+	DNSFallbackTestExpectedIP = net.IPv4(0, 65, 67, 75) // Ascii: \0ACK
+
 	// SpecialCaptivePortalDomain is the domain name used to point to the detected captive portal IP
 	// or the captive portal test IP. The default value should be overridden by the resolver package,
 	// which defines the custom internal domain name to use.
@@ -47,7 +50,8 @@ var (
 	// ConnectivityDomains holds all connectivity domains. This slice must not be modified.
 	ConnectivityDomains = []string{
 		SpecialCaptivePortalDomain,
-		"one.one.one.one.", // Internal DNS Check
+		DNSTestDomain,         // Internal DNS Check
+		DNSFallbackTestDomain, // Internal DNS Check
 
 		// Windows
 		"dns.msftncsi.com.", // DNS Check
@@ -438,12 +442,9 @@ func checkOnlineStatus(ctx context.Context) {
 
 	// 3) resolve a query
 
-	// make DNS request
+	// Check with primary dns check domain.
 	ips, err := net.LookupIP(DNSTestDomain)
-	if err != nil {
-		updateOnlineStatus(StatusSemiOnline, nil, "dns check query failed")
-		return
-	}
+	if err == nil {
 		// check for expected response
 		for _, ip := range ips {
 			if ip.Equal(DNSTestExpectedIP) {
@@ -451,6 +452,21 @@ func checkOnlineStatus(ctx context.Context) {
 				return
 			}
 		}
+	}
+
+	// If that did not work, check with fallback dns check domain.
+	ips, err = net.LookupIP(DNSFallbackTestDomain)
+	if err != nil {
+		updateOnlineStatus(StatusLimited, nil, "dns fallback check query failed")
+		return
+	}
+	// check for expected response
+	for _, ip := range ips {
+		if ip.Equal(DNSFallbackTestExpectedIP) {
+			updateOnlineStatus(StatusOnline, nil, "all checks passed")
+			return
+		}
+	}
 	// unexpected response
 	updateOnlineStatus(StatusSemiOnline, nil, "dns check query response mismatched")
 }

profile/config.go

@@ -521,7 +521,7 @@ Current Features:
 Please note that if you are using the system resolver, bypass attempts might be additionally blocked there too.`,
 		OptType:        config.OptTypeInt,
 		ExpertiseLevel: config.ExpertiseLevelUser,
-		ReleaseLevel:   config.ReleaseLevelBeta,
+		ReleaseLevel:   config.ReleaseLevelStable,
 		DefaultValue:   status.SecurityLevelsAll,
 		PossibleValues: status.SecurityLevelValues,
 		Annotations: config.Annotations{

updates/config.go

@@ -59,12 +59,6 @@ func registerConfig() error {
 				Description: "Dangerous development releases for testing random things and experimenting. Only use temporarily and when instructed.",
 				Value:       helper.ReleaseChannelStaging,
 			},
-			// TODO: Remove as soon as everyone has switched away.
-			{
-				Name:        "Special (Deprecated!)",
-				Description: "This channel has been deprecated. If selected, the Stable channel will be used instead.",
-				Value:       "special",
-			},
 		},
 		Annotations: config.Annotations{
 			config.DisplayOrderAnnotation: -4,