Subject: [Doh] Public endpoints to draft-13 please?

From: Daniel Stenberg <[email-masked]>
Date: Mon, 13 Aug 2018 14:54:33 +0200 (CEST)

Hi,

I'm keeping a little list of public DoH servers [1]. Today I tried them all 
with my draft-13 compliant client and noticed that three out of seven servers 
in the list don't like "application/dns-message" as Content-Type, even though 
it's been documented since about the draft-07 time frame or so.

This isn't ideal for interop.

This email is just to highlight the situation and for me to beg that if you 
run such a server you update it soon so that we all play by the same book!

Thanks,

[1] = 
https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers

-- 

  / daniel.haxx.se

---

From: Star Brilliant <[email-masked]>
Date: Tue, 14 Aug 2018 00:08:13 +0000

> https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers

It seems that Firefox 61 is rejecting "application/dns-message" Content-Type. It fails silently unless you set verbosity to max and watch the terminal for error log.

Related issue: https://github.com/m13253/dns-over-https/issues/15 (I have not forwarded this issue to Mozilla upstream.)

Does anyone know if Firefox has fixed it now?

---

From: Patrick McManus <[email-masked]>
Date: Mon, 13 Aug 2018 20:22:18 -0400

63 has the update. it might get backported to 62. I presume the RFC will
bring everyone to the same level.

On Mon, Aug 13, 2018 at 8:08 PM, Star Brilliant <[email-masked]> wrote:

> It seems that Firefox 61 is rejecting "application/dns-message"
> Content-Type. It fails silently unless you set verbosity to max and watch
> the terminal for error log.
>
> Related issue: https://github.com/m13253/dns-over-https/issues/15 (I have
> not forwarded this issue to Mozilla upstream.)
>
> _______________________________________________
> Doh mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/doh
>

---

From: Star Brilliant <[email-masked]>
Date: Tue, 14 Aug 2018 00:33:31 +0000

On Tue, Aug 14, 2018 at 10:22 AM Patrick McManus <[email-masked]> wrote:
>
> 63 has the update. it might get backported to 62. I presume the RFC will bring everyone to the same level.
>

That's absolutely great!

A simple User-Agent check would be able to deal with Firefox 60-62 then.

---

From: Ben Schwartz <[email-masked]>
Date: Mon, 20 Aug 2018 10:53:45 -0400

Our experimental service (https://dns.google.com/experimental{?dns}) should
now be draft-13 compliant.  Please let me know if you find any other
problems with it.

---

From: manu tman <[email-masked]>
Date: Mon, 20 Aug 2018 08:30:40 -0700

\o/
Thanks Ben!

On Mon, Aug 20, 2018 at 7:54 AM Ben Schwartz <bemasc=
[email-masked]> wrote:

> Our experimental service (https://dns.google.com/experimental{?dns})
> should now be draft-13 compliant.  Please let me know if you find any other
> problems with it.
>

---

From: bert hubert <[email-masked]>
Date: Tue, 21 Aug 2018 16:09:17 +0200

The PowerDNS dnsdist experimental DNS over HTTPS service is now also up:

https://doh.powerdns.org/{?dns}

It runs to the dnsdist branch that can be found on
https://github.com/ahupowerdns/pdns/tree/dnsdist-doh

Configuration:

addDOHLocal("136.144.215.158:443", 
	"/etc/letsencrypt/live/doh.powerdns.org/fullchain.pem", 
	"/etc/letsencrypt/live/doh.powerdns.org/privkey.pem")

It is compliant with the latest version of the draft, and interoperates with
Firefox nightly. 

The service may be unavailable from time to time, but I use it for most of
my own web browsing, so there is sort of an SLA on it ;-)

If there are any problems, please let me know.

	Bert

---

From: manu tman <[email-masked]>
Date: Tue, 21 Aug 2018 13:30:39 -0700

Great stuff!

I have added some integration test between doh-proxy's stub code and the
known servers:
https://github.com/facebookexperimental/doh-proxy/commit/9bb8ef2835832d3c2f3113652e00a919486afa91

Currently, it is only failing against
SecureDNS.eu (timeout)
CleanBrowsing (seems to not support draft-13 yet)

Otherwise, it is passing the rest of the publicly known servers from
https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers

Manu

On Tue, Aug 21, 2018 at 7:09 AM bert hubert <[email-masked]>
wrote:

> should

---

From: Daniel Stenberg <[email-masked]>
Date: Tue, 21 Aug 2018 23:01:27 +0200 (CEST)

> CleanBrowsing (seems to not support draft-13 yet)

This one actually "works" with my test draft-13 client but it takes 15(!) 
seconds to respond...

-- 

  / daniel.haxx.se

---

From: manu tman <[email-masked]>
Date: Tue, 21 Aug 2018 14:59:57 -0700

> This one actually "works" with my test draft-13 client but it takes 15(!)

<facepalm>
oh... my bad, I forgot the trailing `/`...
https://github.com/facebookexperimental/doh-proxy/commit/5115c524b0e695abd40f08c37218fb57276cbd5e
</facepalm>

---

From: Star Brilliant <[email-masked]>
Date: Tue, 21 Aug 2018 22:29:29 +0000

> https://github.com/ahupowerdns/pdns/tree/dnsdist-doh

Hi Bert,

It's great to see DoH support in PowerDNS! Thank you for your work!
I have glanced the code and find that you have builtin EDNS Client Subnet support. That's really awesome.

I would like to know, does it support detecting ECS by X-Forwarded-For or X-Real-IP header? (Seems not yet, through my glance at the code.) This feature might be useful when DoH server is behind an HTTP load balancer; or the user uses DoH server outside their country to avoid nationwide Internet censorship.

An effective method is to search in the order of "dnsMsg.getECS(), X-Forwarded-For.each(), X-Real-IP, socket.getRemoteAddr()" and find the first available global unicast IP. [1] (Or the policy can be customized or disabled with Lua.)

Another issue is the cipher blacklist. [2] HTTP/2 has blacklisted a large number of cipher suites. [3] And since we don't need to be compatible, is it okay just to blacklist TLSv1.0 and TLSv1.1 with older cipher suites and enforce PFS?

Notes:
[1]: My simple implementation: https://github.com/m13253/dns-over-https/blob/ea0a769389f177fb7279cbf2b434c781cd17bb05/doh-server/server.go#L189
[2]: Server test score by SSL Labs: https://www.ssllabs.com/ssltest/analyze.html?d=doh.powerdns.org
[3]: HTTP/2 cipher blacklist: https://http2.github.io/http2-spec/#BadCipherSuites

Best regards,
Star Brilliant

---

From: Tony Finch <[email-masked]>
Date: Wed, 22 Aug 2018 12:36:46 +0100

I've updated https://github.com/fanf2/doh101/ so it works with Firefox
Nightly TRR. It's running on https://doh101.dev.dns.cam.ac.uk/{?dns}
which is only accessible over IPv6 and is likely to go away soon when I
have finished fiddling around with it.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties: West 5 or 6, becoming variable 3 or 4, then southwest 5 or 6 later.
Slight or moderate. Rain at first. Good, occasionally poor at first.