freeipa

#8314 IPA's DNS server should support DNS-over-HTTPS (DoH)
Opened by cheimes. Modified

Open
Close Issue

Request for enhancement

DNS-over-HTTPS is defined in RFC 8484. DoH provides a mechanism to tunnel DNS queries over HTTPS and HTTP/2 connection. Browsers such as Firefox and Chrome have added DoH supports.

  • https://tools.ietf.org/html/rfc8484
  • https://support.mozilla.org/en-US/kb/firefox-dns-over-https
  • https://support.google.com/chrome/a/thread/10152459

Implementation proposal

  • Package, ship, configure, and run a DoH proxy service on all IPA DNS servers. The DoH proxy should query the local DNS server instance and listen on localhost only.
  • Add a new hostname ipa-dns.{domain} that resolves to all IPA servers with DNS server and DoH server.
  • Either add a new server role DNS-over-HTTPS server or add ipaConfigString=DNS-over-HTTPS to DNS server role.
  • Update dns_update_system_records and IPASystemRecords to create entries for ipa-dns.{domain} based on the new role or config flag.
  • Configure Apache on DNS servers to support HTTP/2 and proxy HTTPS requests for https://ipa-dns.{domain}/dns-query to the DoH proxy.
  • Configure Firefox options network.trr.resolvers and network.trr.uri

Possible DoH servers

  1. https://github.com/jedisct1/rust-doh (Rust)
  2. http://trust-dns.org/ / https://github.com/bluejekyll/trust-dns (Rust)
  3. https://github.com/mikispag/dns-over-tls-forwarder (Golang)
  4. https://github.com/qdm12/cloudflare-dns-server (Golang)
  5. https://github.com/facebookexperimental/doh-proxy/ (Python)

rust-doh seems to be the best option. It's two years old (older than final version of RFC 8484), simple, under active development, and under MIT license. The doh-proxy Python package is written in asyncio and uses aiohttp + dnspython to do heavy lifting. The glue code is straight forward.

--no-default-features ensures that rust-doh is compiled without rustls.

$ cargo build --release --no-default-features
   Compiling libc v0.2.69
   Compiling proc-macro2 v1.0.12
   Compiling unicode-xid v0.2.0
   Compiling cfg-if v0.1.10
   Compiling syn v1.0.19
   Compiling memchr v2.3.3
   Compiling log v0.4.8
   Compiling futures-core v0.3.4
   Compiling slab v0.4.2
   Compiling proc-macro-nested v0.1.4
   Compiling futures-sink v0.3.4
   Compiling proc-macro-hack v0.5.15
   Compiling scopeguard v1.1.0
   Compiling smallvec v1.4.0
   Compiling fnv v1.0.6
   Compiling bytes v0.5.4
   Compiling futures-task v0.3.4
   Compiling pin-utils v0.1.0
   Compiling autocfg v1.0.0
   Compiling futures-io v0.3.4
   Compiling pin-project-lite v0.1.5
   Compiling lazy_static v1.4.0
   Compiling itoa v0.4.5
   Compiling httparse v1.3.4
   Compiling fs_extra v1.1.0
   Compiling cc v1.0.52
   Compiling try-lock v0.2.2
   Compiling byteorder v1.3.4
   Compiling bitflags v1.2.1
   Compiling anyhow v1.0.28
   Compiling tower-service v0.3.0
   Compiling unicode-width v0.1.7
   Compiling strsim v0.8.0
   Compiling base64 v0.12.1
   Compiling ansi_term v0.11.0
   Compiling vec_map v0.8.2
   Compiling futures-channel v0.3.4
   Compiling lock_api v0.3.4
   Compiling http v0.2.1
   Compiling textwrap v0.11.0
   Compiling indexmap v1.3.2
   Compiling want v0.3.0
   Compiling quote v1.0.4
   Compiling net2 v0.2.34
   Compiling parking_lot_core v0.7.2
   Compiling iovec v0.1.4
   Compiling num_cpus v1.13.0
   Compiling time v0.1.43
   Compiling atty v0.2.14
   Compiling mio v0.6.22
   Compiling parking_lot v0.10.2
   Compiling http-body v0.3.1
   Compiling clap v2.33.0
   Compiling tokio v0.2.20
   Compiling jemalloc-sys v0.3.2
   Compiling tokio-util v0.3.1
   Compiling jemallocator v0.3.2
   Compiling futures-macro v0.3.4
   Compiling pin-project-internal v0.4.13
   Compiling futures-util v0.3.4
   Compiling futures-executor v0.3.4
   Compiling h2 v0.2.5
   Compiling futures v0.3.4
   Compiling pin-project v0.4.13
   Compiling hyper v0.13.5
   Compiling libdoh v0.3.2 (/home/heimes/dev/rust/rust-doh/src/libdoh)
   Compiling doh-proxy v0.3.2 (/home/heimes/dev/rust/rust-doh)
    Finished release [optimized] target(s) in 2m 13s

$ ./target/release/doh-proxy --help
doh-proxy 0.3.2
Frank Denis <github@pureftpd.org>
A DNS-over-HTTPS (DoH) proxy
USAGE:
    doh-proxy [FLAGS] [OPTIONS]
FLAGS:
    -K, --disable-keepalive    Disable keepalive
    -P, --disable-post         Disable POST queries
    -h, --help                 Prints help information
    -V, --version              Prints version information
OPTIONS:
    -E, --err-ttl <err_ttl>                          TTL for errors, in seconds [default: 2]
    -l, --listen-address <listen_address>            Address to listen to [default: 127.0.0.1:3000]
    -b, --local-bind-address <local_bind_address>    Address to connect from
    -c, --max-clients <max_clients>                  Maximum number of simultaneous clients [default: 512]
    -X, --max-ttl <max_ttl>                          Maximum TTL, in seconds [default: 604800]
    -T, --min-ttl <min_ttl>                          Minimum TTL, in seconds [default: 10]
    -p, --path <path>                                URI path [default: /dns-query]
    -u, --server-address <server_address>            Address to connect to [default: 9.9.9.9:53]
    -t, --timeout <timeout>                          Timeout, in seconds [default: 10]

doh-proxy

$ sudo systemctl start systemd-resolved
$ python3 -m venv /tmp/venv
$ /tmp/venv/bin/pip install doh-proxy
$ $ /tmp/venv/bin/doh-httpproxy --port 10080 --trusted --upstream-resolver 127.0.0.53 --level WARN
======== Running on http://[::1]:10080 ========
(Press CTRL+C to quit)

$ ab -n10000 -c 50 http://[::1]:10080/dns-query?dns=AAABAAABAAAAAAABA2FwaQZnaXRodWIDY29tAAAcAAEAACkQAAAAAAAACAAIAAQAAQAA
Benchmarking ::1 (be patient)
Completed 1000 requests
Completed 2000 requests
Completed 3000 requests
Completed 4000 requests
Completed 5000 requests
Completed 6000 requests
Completed 7000 requests
Completed 8000 requests
Completed 9000 requests
Completed 10000 requests
Finished 10000 requests
Server Software:        Python/3.7
Server Hostname:        ::1
Server Port:            10080
Document Path:          /dns-query?dns=AAABAAABAAAAAAABA2FwaQZnaXRodWIDY29tAAAcAAEAACkQAAAAAAAACAAIAAQAAQAA
Document Length:        43 bytes
Concurrency Level:      50
Time taken for tests:   8.806 seconds
Complete requests:      10000
Failed requests:        0
Total transferred:      1920000 bytes
HTML transferred:       430000 bytes
Requests per second:    1135.60 [#/sec] (mean)
Time per request:       44.029 [ms] (mean)
Time per request:       0.881 [ms] (mean, across all concurrent requests)
Transfer rate:          212.93 [Kbytes/sec] received
Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0    1   0.5      1       8
Processing:    18   43   4.2     42      78
Waiting:        8   41   4.2     40      76
Total:         19   44   4.4     42      83
Percentage of the requests served within a certain time (ms)
  50%     42
  66%     43
  75%     44
  80%     46
  90%     49
  95%     51
  98%     55
  99%     62
 100%     83 (longest request)
Metadata
None
None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.