3 ms·

Very cool. It's a bummer it only works in Firefox with DoH, though. I couldn't find an explanation for why that is in the associated changeset[1]. (I would use

Very cool. It's a bummer it only works in Firefox with DoH, though. I couldn't find an explanation for why that is in the associated changeset[1]. (I would use DoH on my devices, but I run a local resolver for filtering purposes. The local resolver then connects to a global NS via DoH, but my local devices use plain old DNS.) [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1623126 https://bugzilla.mozilla.org/show_bug.cgi?id=1623126

sillystuff 3y ago
Depending on your local resolver, you possibly can provide DoH on localhost as well? I'm using unbound, and it was trivial to also provide DoH on localhost with a funky port, so 443 localhost remains available for other things (my motivation was that firefox also doesn't support ESNI without a DoH resolver; I assume this is still true for ECH as well, but haven't re-visited). For firefox, you can use a self-signed cert on your resolver (firefox did not work with ed25519, it did work with NIST P-256; I wanted a small key for lower overhead [having to use TLS + HTTP encapsulation for a resolver on localhost bothered me in irrational ways, and I was determined to minimize the overhead, even if the rational part of my brain said the overhead difference was too negligible to matter]). Add it with: edit-> settings -> (search "cert" in 'find in settings') -> view certificates -> (server tab) -> add exception -> enter the url: https://localhost:4353/dns-query https://localhost:4353/dns-query ensure "permanent" is checked The file, "cert_override.txt" is created by firefox after adding the cert exception, which can be copied to other profiles for provisioning. The gui DoH config will create the following in about:config which can be used for provisioning with user.js: network.trr.uri https://localhost:4353/dns-query network.trr.bootstrapAddress 127.0.0.1 network.trr.mode 3 trr true (network.trr.custom_uri is not used for anything but display in the gui) network.trr.custom_uri https://localhost:4353/dns-query I don't think chromium requires DoH for ESNI / HTTPSSVC, so it can just use plain-text localhost:53 as before. If it does need DoH for this, I do not know the equivalent to the above config, for chromium.
thayne 3y ago
It's because Firefox uses its own dns resolver when it uses DoH, but if DoH is disabled it just calls getaddrinfo from libc to look up a domain. And unfortunately getaddrinfo is a very minimal API, that doesn't have any way to resolve arbitrary record types like HTTPS or SVCB, it just returns ip addresses. There is a bug[1] for supporting HTTPS records when using the system dns, but I haven't seen much progress on it. And sadly, it probably requires different code for each OS. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1852752 https://bugzilla.mozilla.org/show_bug.cgi?id=1852752
- deleted 3y ago
  [deleted]

sillystuff 3y ago

Depending on your local resolver, you possibly can provide DoH on localhost as well? I'm using unbound, and it was trivial to also provide DoH on localhost with a funky port, so 443 localhost remains available for other things (my motivation was that firefox also doesn't support ESNI without a DoH resolver; I assume this is still true for ECH as well, but haven't re-visited). For firefox, you can use a self-signed cert on your resolver (firefox did not work with ed25519, it did work with NIST P-256; I wanted a small key for lower overhead [having to use TLS + HTTP encapsulation for a resolver on localhost bothered me in irrational ways, and I was determined to minimize the overhead, even if the rational part of my brain said the overhead difference was too negligible to matter]). Add it with: edit-> settings -> (search "cert" in 'find in settings') -> view certificates -> (server tab) -> add exception -> enter the url: https://localhost:4353/dns-query https://localhost:4353/dns-query ensure "permanent" is checked The file, "cert_override.txt" is created by firefox after adding the cert exception, which can be copied to other profiles for provisioning. The gui DoH config will create the following in about:config which can be used for provisioning with user.js: network.trr.uri https://localhost:4353/dns-query network.trr.bootstrapAddress 127.0.0.1 network.trr.mode 3 trr true (network.trr.custom_uri is not used for anything but display in the gui) network.trr.custom_uri https://localhost:4353/dns-query I don't think chromium requires DoH for ESNI / HTTPSSVC, so it can just use plain-text localhost:53 as before. If it does need DoH for this, I do not know the equivalent to the above config, for chromium.

thayne 3y ago

It's because Firefox uses its own dns resolver when it uses DoH, but if DoH is disabled it just calls getaddrinfo from libc to look up a domain. And unfortunately getaddrinfo is a very minimal API, that doesn't have any way to resolve arbitrary record types like HTTPS or SVCB, it just returns ip addresses. There is a bug[1] for supporting HTTPS records when using the system dns, but I haven't seen much progress on it. And sadly, it probably requires different code for each OS. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1852752 https://bugzilla.mozilla.org/show_bug.cgi?id=1852752

deleted 3y ago
[deleted]