Unable to start dnscyrpt as a service on MacOS Sonoma

[ravensorrow]

Greetings!

I installed dnscrypt-proxy via Homebrew as it's version matched the latest available from dnscrypt-proxy binaries

chris@Dark-Matter:~$ brew info dnscrypt-proxy | grep bottled
==> dnscrypt-proxy: stable 2.1.5 (bottled), HEAD
chris@Dark-Matter:~$

If I run /usr/local/sbin/dnscrypt-proxy -config /usr/local/etc/dnscrypt-proxy.toml as my $USER, it just exits, if I run it as $ROOT it remains resident.

Now the real issue comes when I try to install and start dnscrypt as a service.

Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -check -config /usr/local/etc/dnscrypt-proxy.toml
Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -version
2.1.5
Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -service install
[2024-01-01 17:18:17] [NOTICE] Installed as a service. Use `-service start` to start
Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -service start
[2024-01-01 17:18:21] [FATAL] Failed to start DNSCrypt client proxy: "launchctl" failed with stderr: Load failed: 5: Input/output error
Try running `launchctl bootstrap` as root for richer errors.
Dark-Matter:LaunchDaemons root#

This got me into investigating, and while I have not found a viable solution/workaround yet, I did notice that /Library/LaunchDaemons/dnscrypt-proxy.plist shows the config w/o a hard-coded path. Homebrew follows basic MacOS/*BSD conventions by putting the binary in /usr/local/sbin and the config file in /usr/local/etc/. If the binary doesn't know to look in /usr/local/etc, then the plist needs to tell it to.

Original plist

        <array>
                <string>/usr/local/sbin/dnscrypt-proxy</string>
                <string>-config</string>
                <string>dnscrypt-proxy.toml</string>
        </array>

Corrected plist

        <array>
                <string>/usr/local/sbin/dnscrypt-proxy</string>
                <string>-config</string>
                <string>/usr/local/etc/dnscrypt-proxy.toml</string>
        </array>

The above correct does not solve the issue of starting dnscrypt as a service.

Dark-Matter:LaunchDaemons root# pwd
/Library/LaunchDaemons
Dark-Matter:LaunchDaemons root# plutil dnscrypt-proxy.plist
dnscrypt-proxy.plist: OK
Dark-Matter:LaunchDaemons root#

So the Launchd property list file is technically formatted correctly. At this point is when I ran out of steam and fresh ideas and hit google again. My first hit was my AHA! moment! I was sent to an Apple: StackExchange link and the answer clued me in. dv5e is talking about how start/load are depreciated in lieu of enable/kickstart. This made my think, what if I just unloaded the plist and tried to start the daemon as instructed?

Dark-Matter:LaunchDaemons root# vim dnscrypt-proxy.plist
Dark-Matter:LaunchDaemons root# launchctl unload dnscrypt-proxy.plist
Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -service start
[2024-01-01 17:46:12] [NOTICE] Service started
Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -resolve google.com
[2024-01-01 17:47:02] [FATAL] Unable to load the configuration file [dnscrypt-proxy.toml] -- Maybe use the -config command-line switch?
Dark-Matter:LaunchDaemons root# ps aux | grep dns
root             65046   0.0  0.0 34121296    684 s001  S+    5:47PM   0:00.00 grep dns
_mdnsresponder     222   0.0  0.0 33979504  12712   ??  Ss   10Dec23  46:49.33 /usr/sbin/mDNSResponder
root             64974   0.0  0.0 35636356  10148   ??  Ss    5:46PM   0:00.04 /usr/local/sbin/dnscrypt-proxy -config /usr/local/etc/dnscrypt-proxy.toml
Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -resolve yahoo.co.uk
[2024-01-01 17:48:23] [FATAL] Unable to load the configuration file [dnscrypt-proxy.toml] -- Maybe use the -config command-line switch?
Dark-Matter:LaunchDaemons root#

The vim cmd is where I implemented my correction to hard code the path to the config file. As you can see from my 'ps aux | grep dns, it **is** running. But it's not responding. This also doesn't address that when -service installis invoked, it's also loading thednscrypt-proxy.plistwhich appears to be a problem. Further reading from the A:SE page suggestskickstart -kp`

-k will kill running processes based on the plist
-p will print the new PID (potentially useful)

Dark-Matter:LaunchDaemons root# launchctl enable system/dnscrypt-proxy
Dark-Matter:LaunchDaemons root# launchctl kickstart system/dnscrypt-proxy
Dark-Matter:LaunchDaemons root# launchctl kickstart -kp system/dnscrypt-proxy
service spawned with pid: 66055
Dark-Matter:LaunchDaemons root# /usr/local/sbin/dnscrypt-proxy -resolve yahoo.co.uk
[2024-01-01 18:01:50] [FATAL] Unable to load the configuration file [dnscrypt-proxy.toml] -- Maybe use the -config command-line switch?
Dark-Matter:LaunchDaemons root# host yahoo.co.uk
yahoo.co.uk has address 98.137.11.157
yahoo.co.uk has address 180.222.102.156
yahoo.co.uk has address 74.6.143.18
yahoo.co.uk has address 87.248.100.208
yahoo.co.uk has address 202.165.107.57
yahoo.co.uk has address 74.6.231.14
yahoo.co.uk mail is handled by 10 mx-eu.mail.am0.yahoodns.net.
Dark-Matter:LaunchDaemons root# dig yahoo.co.uk

; <<>> DiG 9.10.6 <<>> yahoo.co.uk
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17015
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;yahoo.co.uk.                   IN      A

;; ANSWER SECTION:
yahoo.co.uk.            2388    IN      A       98.137.11.157
yahoo.co.uk.            2388    IN      A       180.222.102.156
yahoo.co.uk.            2388    IN      A       74.6.143.18
yahoo.co.uk.            2388    IN      A       87.248.100.208
yahoo.co.uk.            2388    IN      A       202.165.107.57
yahoo.co.uk.            2388    IN      A       74.6.231.14

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jan 01 18:02:11 EST 2024
;; MSG SIZE  rcvd: 136

Dark-Matter:LaunchDaemons root# ps aux | grep dnsc
root             66293   0.0  0.0 34121296    688 s001  S+    6:04PM   0:00.00 grep dnsc
root             66055   0.0  0.0 35645380  11392   ??  Ss    6:01PM   0:00.06 /usr/local/sbin/dnscrypt-proxy -config /usr/local/etc/dnscrypt-proxy.toml
Dark-Matter:LaunchDaemons root#

So, I only have 1 matching process running and the PID matches what launchctl said it spawned. It IS working, but -resolve I'm willing to wager is looking at a relative local path and not the hard-coded path.

P.S. I chose yahoo.co.uk as my test just because it's not a URL I go to, so I didn't want to risk the result being cached anywhere.

[lifenjoiner]

1. /usr/local/sbin/dnscrypt-proxy -config /usr/local/etc/dnscrypt-proxy.toml -service install should work without modifying the plist file manually.
2. Try /usr/local/sbin/dnscrypt-proxy -config /usr/local/etc/dnscrypt-proxy.toml -resolve google.com. -resolve needs to read the listen_addresses from the config file. This is different from host and dig.

The default config file path is dnscrypt-proxy.toml, which means in the same directory with the executable. Don't omit to specify the config file, if it is not in the same directory.

[ravensorrow]

I'll come back to this this weekend and test. My MacOS setup is at my girlfriend's house. Mine is Windows (and that works as expected/intended).