Minor Release

This contains security hardening and bug fixes.

Security

• Bumped golang.org/x/text to v0.40.0 to address GO-2026-5970
• Discarded upstream answers whose question does not echo the request - defense in depth against cache poisoning. A compromised or misbehaving upstream could return an answer for a different name (e.g. records for attacker.example in response to a query for victim.example), which would be cached under the legitimate request key and served to later queries. The answer is now validated against the request's question (case-insensitive name plus Qtype/Qclass, per RFC 1035 §4.1.2) before it is served or cached; a mismatch is logged at debug level and the upstream is skipped, failing safe to the next upstream or SERVFAIL

Fixed

• Partitioned the DNS cache by EDNS Client Subnet (ECS). With cache_enable = true, one cache entry was shared by every client asking the same name against the same upstream, so a response tailored for subnet A could be served to subnet B (returning the wrong CDN/policy answer, per RFC 7871 §7.3). Both cache paths are now keyed by a canonical ECS tuple so different subnets never share an entry, while same-subnet queries still share one
• Fixed the DoQ resolver corrupting upstream responses by calling SetReply on the already-unpacked answer, which forced the RCODE to NOERROR and overwrote the Question section. This masked upstream failures from the proxy's failover logic (a SERVFAIL looked like a successful empty response) and corrupted the Question served to clients. Only the downstream transaction ID is now restored, preserving the upstream RCODE, Question, and answers - matching the DoH and DoT resolvers
• Treated the 464XLAT CLAT source range as local rather than WAN. On IPv6-only cellular carriers and iPhone hotspots, local DNS queries can arrive with a source in the RFC 7335 IPv4 Service Continuity Prefix (192.0.0.0/29), which was classified as a WAN client and refused when allow_wan_clients was unset (the default), breaking DNS resolution on the affected connection. The 192.0.0.0/29 range is now recognized as local
• Preserved the fallback listener port across config reload in macOS DNS-intercept mode. When mDNSResponder owns *:53, ctrld falls back to 127.0.0.1:5354, but an hourly CD config reload reverted the in-memory port to 53 while the listener stayed on 5354, causing an endless watchdog "force reload" loop and dig timeouts. The actual bound listener IP/port is now restored into the in-memory config after reload
• Skipped internal logging in --silent mode. In cd mode, --silent still created and grew a log file and reset the global log level back to debug, overriding the level --silent had set. ctrld now neither creates the internal log file nor writes debug logs when silent is set
• Restored system DNS during an invalid-device uninstall, so DNS is no longer left pointing at the stopped listener when uninstalling with an invalid device

Release v1.5.5 Latest

Latest

Compare

Choose a tag to compare

Minor Release

This contains some bug fixes.

Fixed

• Fix macOS pf watchdog exec storms.
• Add Windows NRPT recovery circuit breaker to prevent recovery loop.

Release v1.5.4

Compare

Choose a tag to compare

Minor Release

This contains new features, significant performance improvements, and bug fixes.

Security

• Upgraded quic-go to v0.59.1 to address CVE-2026-40898

• Rejected oversized upstream DNS responses on the DoH, DoH3, and DoQ paths — these previously used io.ReadAll on attacker-controlled responses before enforcing any protocol-level limit, allowing a malicious or compromised upstream to force unbounded buffering. Bodies are now capped at dns.MaxMsgSize (and non-200 DoH error bodies are bounded as well)

• Validated DNS-over-QUIC response framing (RFC 9250) — the resolver previously assumed at least two bytes were present and could panic on truncated or malicious replies; the length prefix is now validated and framing failures retire the connection from the pool

• Rate-limited PIN attempts on the control socket to provide defense-in-depth against brute-force if an attacker gains socket access

• Switched temp file creation to os.CreateTemp for symlink-safe writes, preventing symlink attacks on systems without fs.protected_symlinks (e.g. embedded routers)

• Switched internal/router/dnsmasq to text/template instead of html/template, since the generated config is plain text

Improved

• Shared a single QUIC transport and UDP socket across DoQ dials so parallel dial and reconnect churn no longer allocate a socket per attempt or leak sockets; the query stream's send side is now closed before reading the response per RFC 9250 §4.2

• Updated the Docker base image to bookworm

Fixed

• Refreshed macOS VPN DNS after pf stabilization

• Allowed intercept fallback for the default listener

• Flushed pf states after a forced DNS intercept reload

Release v1.5.3

Compare

Choose a tag to compare

Minor Release

This release contains a bug fix for Windows platform.

Fixed

• Fixes Windows DNS-intercept behavior for AD/internal split-rule domains during sleep/wake or VPN adapter settling without relying on a fixed timeout.

Release v1.5.2

Compare

Choose a tag to compare

Minor Release

This contains bug fixes and a new diagnostic command.

Added

• Added ctrld log tail command for live log streaming — streams runtime debug logs to the terminal in real-time, similar to tail -f. Supports --lines/-n flag to control initial context lines
• Added WFP loopback protect for VPN block-outside-dns in dns intercept mode.

Improved

• Configured QUIC keep-alive for DoQ connections — sends periodic PING frames (KeepAlivePeriod: 15s) on idle pooled connections, keeping them alive across NAT rebinding and proactively detecting dead paths before the next query hits a stale connection

Fixed

• Fixed handle leak in hasLocalDnsServerRunning() on Windows — the process snapshot handle from CreateToolhelp32Snapshot was not being closed, leaking a handle on every call

• Fixed dnsFromResolvConf not filtering loopback IPs — the continue statement only broke out of the inner loop, allowing loopback addresses (e.g. 127.0.0.1) through. This caused ctrld to use itself as bootstrap DNS when already installed as the system resolver, creating a self-referential loop

• Fixed IPv6 VPN DNS server addresses not formatted correctly on macOS — upstreamConfigFor() passed bare IPv6 addresses to net.Dial without brackets or port, causing too many colons in address errors and immediate failure for all IPv6 VPN DNS queries

• Fixed DNS responses failing with sendmsg: invalid argument for IPv6-sourced clients on macOS — the pf nat rule on lo0 inet6 did not match packets arriving via the rdr chain as inet4, so the client's global IPv6 source address was preserved, and the kernel rejected responses from [::1]:53 to non-loopback destinations

• Fixed VPN DNS queries routed over wrong source interface on macOS — when a VPN client (e.g. FortiClient) was active, DNS queries to LAN servers used the VPN tunnel IP as source, making responses unroutable. Combined with the IPv6 bugs, this cascaded into complete VPN DNS failure and VPN disconnection

• Fixed DoQ queries failing with idle timeout errors — pooled QUIC connections that timed out server-side now trigger a transparent retry with a fresh connection instead of propagating the error

• Fixed DoQ queries failing with too many open streams — replaced non-blocking OpenStream with OpenStreamSync, which waits for the server's MAX_STREAMS credit replenishment instead of racing against it. Added StreamLimitReachedError as a retry condition for defense-in-depth when the stream credit wait times outetS

• Fixed a crash in SetSelfIP triggered by network transitions before clientinfo initialization.

• Fixed a recovery race condition, reduce worst-case recovery from ~30s to <3s.

Release v1.5.1

Compare

Choose a tag to compare

Major Release

This contains new features, significant performance improvements, and bug fixes.

Added

• Added DNS intercept mode (--intercept-mode=dns|hard|off) — a major new feature that intercepts all DNS traffic on the system and routes it through ctrld

  • macOS: pf-based interception with route-to lo0 + rdr rules, _ctrld group exemption, watchdog auto-heal for Parallels VM pf corruption, and IPv6 DNS blocking
  • Windows: dual-mode support — NRPT for standard DNS interception, WFP sublayer with callout filters for hard interception
  • VPN DNS split routing — discovers DNS servers from F5 BIG-IP, Tailscale, Network Extension VPNs, and traditional VPN adapters; handles split vs full tunnel detection; cleans up stale exemptions on VPN disconnect
  • Recovery bypass for captive portals and probe-based interception verification

• Added robust platform-specific username detection for Control D metadata (macOS: directory services/console user, Linux: loginctl/utmp/passwd, Windows: WTS/registry/token)

• Added hostname hints in provisioning metadata for API-side fallback, allowing the server to repair generic hostnames

Improved

• Implemented connection pooling for DoQ (QUIC) — eliminates per-query handshake overhead by reusing connections, matching DoH3 performance

• Implemented connection pooling for DoT (TLS) — eliminates per-query TLS handshake overhead by reusing connections

• Improved DNS server discovery for domain-joined Windows machines — non-physical adapters with matching DNS suffix are now considered valid for remote VPN scenarios

• Consolidated network change monitoring into a single goroutine for simpler, more reliable handling

Fixed

• Fixed macOS hostname detection — uses scutil ComputerName instead of os.Hostname(), which returns generic names like "Mac.lan" when Private Wi-Fi Address is enabled

• Fixed DoT connection validation — connections are now checked before reuse to prevent io.EOF errors from server-side idle timeouts

• Fixed handling of empty and invalid IP addresses to prevent panics when processing client info

• Fixed a data race in transport rebootstrap using a three-state atomic instead of a boolean flag

Release v1.5.0

Compare

Choose a tag to compare

Minor Release

This contains new features, improvements and bug fixes.

Added

• We’ve updated ctrld to send system metadata when calling the Control D API, allowing for a more seamless and personalized UX.
• Added new documentation for internal runtime logging to clarify how it works and how it interacts with other logging configurations.

Improvements

• Upgrade the quic-go library to v0.57.1 to resolve a critical bug in parsing HTTP3 frame header.

Fixes

• Fixed a bug where DoH3 connections were closed incorrectly, preventing ctrld from recovering during network outages.

Release v1.4.9

Compare

Choose a tag to compare

Minor Release

This contains improvements and bug fixes.

Improvements

• Upgrade the quic-go library to v0.56.0 to improve API usability and resolve several critical bugs.

Fixes

• Fixed a bug that allowed the root domain to be passed to systemd-resolved, which subsequently caused DNS resolution failure on Linux.
• Fixed a bug where log flags were not processed during a reloading operation, causing internal runtime logging to fail after the reload completed.

Release v1.4.8

Compare

Choose a tag to compare

Minor Release

This contains new features and improvements.

Added

• Make RFC1918 listener spawning opt-in via --rfc1918 flag instead of automatic behavior.
• Add the Darwin 15.5 upgrade issue to the known issues documentation.
• The mobile library can now be initiated with a provision ID and custom hostname.

Improvements

• Upgrade the quic-go library to v0.54.0 to improve API usability and resolve several bugs.

Fixes

• A bug was fixed where ctrld would incorrectly listen on RFC1918 addresses associated with virtual interfaces. This behavior caused unnecessary delays in resolving DNS queries, especially when those virtual interfaces were not active.

Release v1.4.7

Compare

Choose a tag to compare

Minor Release

This contains improvements and bug fixes.

Added

• Support for OPNsense 25.1.7 was added via a new lease file (@jquick).

Improvements

• Moved network monitoring creation to a dedicated goroutine for better performance and to ensure only a single instance is started.

Fixed

• Corrected an issue where Windows domain join status was not being detected properly.
• Addressed a bug where the upstream process check failed when attempting to process large DNS responses.

Release v1.4.6

Compare

Choose a tag to compare