Read a length-prefixed string. Returns (string, new_offset).

Encode a string using LP (length-prefixed) format.

Encode a string using LP (length-prefixed) format.

Parse the properties byte into flags.

Read a variable-length-prefixed list of items. Returns (list, new_offset).

RebuildStats recomputes all resolver_stats from test_results. Call this once to migrate existing data, or to fix any inconsistencies.

Encode items using VLP format.

Encode items using VLP format.

Parse VLP (variable-length-prefixed) data.

Parse VLP (variable-length-prefixed) data.

buildCertQuery builds a TXT certificate query for name, padded to padTo bytes.

parseDBTime parses a time string from the database, handling both RFC3339 format (returned by go-sqlite3 driver) and the space-separated format used w

Read a length-prefixed string.

sendDNSQuery sends a DNS query over an established connection and returns the response. The caller must set the connection deadline before calling thi

Write a length-prefixed string.

buildAnonPacket constructs an anonymized DNSCrypt packet

Connect to server via TLS and return TBS certificate hashes for certs sent by server.

packTXTRR unescapes a TXT record string from the dns library Copied from dnscrypt-proxy's dnsutils.go

Parse a DNS stamp string into a DNSStamp object.

Parse DER length encoding at the given offset.

Parse DER length encoding at the given offset. Returns (content_length, length_field_size) where length_field_size is the number of byte

raceUDPProbes sends every probe to addr on its own UDP socket at the same time and returns the first response that reads back. Racing a large PQ-frien

Read a variable-length-prefixed list.

"DNSC" validateDNSCryptCert validates a DNSCrypt certificate Certificate format (124 bytes minimum): - Magic: 4 bytes ("DNSC") - ES Version: 2 bytes (

validateDNSCryptResponse validates the DNS response and extracts DNSCrypt certificates

validateRelayResponse checks that the response contains valid DNSCrypt certificate TXT records

Write a variable-length-prefixed list.

ClearResolverErrors updates all failed tests for a resolver to successful, setting their RTT to 0 and clearing error messages, then rebuilds stats. Re

GetTestCount returns the total number of test results and the timestamp of the most recent one

Optimize runs VACUUM to reclaim disk space and checkpoints the WAL file.

PruneOldTests removes test results older than the given duration and updates stats accordingly. Also removes resolvers that have no remaining test res

RebuildStatsIfNeeded rebuilds stats only if the table is empty but test_results has data.

RemoveResolver removes a resolver by name along with all its test results, stamps, and stats. Returns an error if the resolver is not found.

RemoveStaleResolvers removes resolvers that haven't had a successful response in the given duration. Only removes resolvers that have had at least one

RemoveUnreliableResolvers removes all resolvers with reliability below the given percentage threshold. Returns the names of removed resolvers.

Add or replace the IP address in a DoH stamp.

Decode a DNS stamp from its sdns:// URL format.

Decode a DNS stamp from its sdns:// URL format.

Encode binary data to a DNS stamp URL.

filterFailures returns resolvers where the last test failed. A resolver is considered failing if it has a LastFail time that is more recent than LastS

Format IP address for stamp: IPv6 must be in brackets.

Format a public key as colon-separated hex groups.

Connect to server via TLS and return TBS certificate hashes for certs sent by server. Args: host: IP address or hostname to connect

Extract the host and port to connect to for TLS.

Extract the host and port to connect to for TLS.

Extract and hash the TBS (To Be Signed) certificate data.

Extract and hash the TBS (To Be Signed) certificate data. The TBS certificate is the portion of the certificate that is signed, excludin

migrateSchema migrates from the old schema (stamp column in test_results) to the new normalized schema (stamps table with stamp_id reference).

padCertQueryTo adds EDNS0 padding so the wire-format query reaches at least padTo bytes.

Parse a DNS stamp string into a DNSStamp object.

Parse a DNS stamp and return its details as a dictionary.

Print stamp information in a readable format.

Process a resolver file and update DoH stamps for a specific resolver.

Process the markdown file and update outdated certificate hashes.

Read the markdown file, find the resolver, add cert hashes to its stamps.

Read length-prefixed bytes. Returns (bytes, new_offset).

Serialize the stamp back to sdns:// string format.

Serialize the stamp back to sdns:// string format.

validateDoHCertHashes validates that at least one certificate in the TLS chain matches one of the hashes specified in the stamp. This follows the same