Pdns: dnsdist: support DoT and DoH downstream servers

[Chaz6]

• Program: dnsdist
• Issue type: Feature request

Short description

It would be useful to allow a more flexible downstream configuration, allowing use of DNS-over-TLS and DNS-over-HTTPS servers.

Usecase

Allow use of encrypted downstream dns servers for privacy protection. For instance, many platforms such as Android Pie only allow the use of a single server, so this would allow multiple servers to be used with health checks and balancing policies.

Description

An example configuration snippet follows:-

newServer({url="https://dns.google:443/dns-query", source="[2001:db8::53]@eth1", type=doh, name="google-doh"})
newServer({address="unicast.censurfridns.dk:853", type=dot, name="cfd-dot"})
newServer({address="8.8.8.8:53", type=udp, name="google-udp"})
newServer({address="8.8.8.8:53", type=tcp, name="google-tcp"})

[rgacogne]

DNS over TLS toward backends will likely happen in 1.5.0 as I already have a branch with preliminary support for it. DNS over HTTPS toward backends seems a lot more unlikely to happen at the moment.

[appliedprivacy]

the DoT part is also in #6454

[keimond]

newServer({url="https://dns.google:443/dns-query", type=doh, name="google-doh"})
produces
Fatal Lua error: [string "chunk"]:1: Caught exception: boost::bad_get: failed value get using boost::get
with 1.4.0-rc3
I'm on CentOS 7, my boost package is boost-1.53.0-27.el7.x86_64... I'm curious if anyone might know off hand why I'm getting that error ?

[omoerbeek]

Read what @rgacogne wrote.The feature is not yet available. DoT to backend might happen in dnsdist 1.5, DoH to backend likely not.

[keimond]

Wow yeah sorry should have read that more than once... well that works DoT is better than no encryption!

[stintel]

DNS over TLS toward backends will likely happen in 1.5.0 as I already have a branch with preliminary support for it. DNS over HTTPS toward backends seems a lot more unlikely to happen at the moment.

@rgacogne any progress on that branch? I just gave 1.5.0-rc1 a try but seems your work didn't make it in there.

[rgacogne]

It did not make it into 1.5.0, sorry about that. It will definitely happen in 1.6.0, though, and I hope to have it in an alpha soon after the final 1.5.0 release.

[stintel]

It did not make it into 1.5.0, sorry about that. It will definitely happen in 1.6.0, though, and I hope to have it in an alpha soon after the final 1.5.0 release.

No worries. Good to hear it will land in 1.6.0, thanks for the update and keep up the good work!

[johnhtodd]

While it may not be part of the commonly-used specifications currently utilized by centralized resolvers (yet) it may be useful for many enterprise (and even large DNS shops) to have a username and password pairing for access control or customized views. (Certainly for DoH, less clear on DoT implementation)