Ensure that PK prefixes don't match the Anonymized DNSCrypt query magic

src/anomymized_dns.rs

@@ -0,0 +1,2 @@
+pub const ANONYMIZED_DNSCRYPT_QUERY_MAGIC: [u8; 10] =
+    [0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00];

src/dnscrypt_certs.rs

@@ -1,3 +1,4 @@
+use crate::anomymized_dns::*;
 use crate::config::*;
 use crate::crypto::*;
 use crate::dnscrypt::*;
@@ -105,7 +106,12 @@ pub struct DNSCryptEncryptionParams {
 
 impl DNSCryptEncryptionParams {
     pub fn new(provider_kp: &SignKeyPair, cache_capacity: usize) -> Self {
-        let resolver_kp = CryptKeyPair::new();
+        let mut resolver_kp;
+        while {
+            resolver_kp = CryptKeyPair::new();
+            resolver_kp.pk.as_bytes()
+                == &ANONYMIZED_DNSCRYPT_QUERY_MAGIC[..DNSCRYPT_QUERY_MAGIC_SIZE]
+        } {}
         let dnscrypt_cert = DNSCryptCert::new(&provider_kp, &resolver_kp);
         let cache = ClockProCache::new(cache_capacity).unwrap();
         DNSCryptEncryptionParams {

src/main.rs

@@ -22,6 +22,7 @@ extern crate serde_big_array;
 #[macro_use]
 extern crate prometheus;
 
+mod anomymized_dns;
 mod blacklist;
 mod cache;
 mod config;