starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 03:05:51 +03:00

[GH-ISSUE #503] DNS Queries over HTTPS (DOH), tracking #209

New issue

Closed

opened 2026-03-07 22:48:33 +03:00 by kerem · 12 comments

kerem commented

2026-03-07 22:48:33 +03:00

Owner

Originally created by @rumpelsepp on GitHub (May 31, 2018).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/503

I just wanted to create a tracking issue for this. Since last month or so, mozilla is experimenting with this.

https://datatracker.ietf.org/doc/draft-ietf-doh-dns-over-https/
https://groups.google.com/forum/#!msg/mozilla.dev.platform/_8OAKUHso0c/QUhjVYz3CAAJ
https://bugzilla.mozilla.org/show_bug.cgi?id=1446404

One could argue that an HTTP library could be used for this; the advantage of having this also in TRust-DNS would be the unification of the API for different transports.

Originally created by @rumpelsepp on GitHub (May 31, 2018). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/503 I just wanted to create a tracking issue for this. Since last month or so, mozilla is experimenting with this. https://datatracker.ietf.org/doc/draft-ietf-doh-dns-over-https/ https://groups.google.com/forum/#!msg/mozilla.dev.platform/_8OAKUHso0c/QUhjVYz3CAAJ https://bugzilla.mozilla.org/show_bug.cgi?id=1446404 One could argue that an HTTP library could be used for this; the advantage of having this also in TRust-DNS would be the unification of the API for different transports.

kerem

2026-03-07 22:48:33 +03:00

closed this issue
added the
enhance

crate:resolver
labels

kerem commented

2026-03-07 22:48:49 +03:00

Author

Owner

@bluejekyll commented on GitHub (May 31, 2018):

Are you looking for the Resolver or Server support for this?

Edit: Gah, I should have read the title more closely... :)

@bluejekyll commented on GitHub (May 31, 2018): Are you looking for the Resolver or Server support for this? Edit: Gah, I should have read the title more closely... :)

kerem commented

2026-03-07 22:48:54 +03:00

Author

Owner

@rumpelsepp commented on GitHub (Jun 1, 2018):

:) Since the RFC is not yet released, I thought it might be useful to have an issue to track its status.

@rumpelsepp commented on GitHub (Jun 1, 2018): :) Since the RFC is not yet released, I thought it might be useful to have an issue to track its status.

kerem commented

2026-03-07 22:48:59 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 7, 2018):

Ok, I've started work on this. I'm planning to directly use the https://crates.io/crates/h2 library for this support. The work looks something like this:

create the trust-dns/https crate
implement the HttpsClientStream wrapper for h2::client
integrate HttpsClientStream into trust-dns
integrate HttpsClientStream into trust-dns-resolver
implement the HttpsStream wrapper for h2::server
integrate HttpsStream into trust-dns-server

@bluejekyll commented on GitHub (Jun 7, 2018): Ok, I've started work on this. I'm planning to directly use the https://crates.io/crates/h2 library for this support. The work looks something like this: - [x] create the `trust-dns/https` crate - [x] implement the `HttpsClientStream` wrapper for `h2::client` - [x] integrate `HttpsClientStream` into `trust-dns` - [x] integrate `HttpsClientStream` into `trust-dns-resolver` - [x] implement the `HttpsStream` wrapper for `h2::server` - [x] integrate `HttpsStream` into `trust-dns-server`

kerem commented

2026-03-07 22:49:05 +03:00

Author

Owner

@briansmith commented on GitHub (Jun 7, 2018):

integrate HttpsClientStream into trust-dns-resolver

It would be great if there could be a way to avoid building HttpsClientStream, and all its dependencies, when building trust-dns-resolver.

@briansmith commented on GitHub (Jun 7, 2018): > integrate HttpsClientStream into trust-dns-resolver It would be great if there could be a way to avoid building HttpsClientStream, and all its dependencies, when building trust-dns-resolver.

kerem commented

2026-03-07 22:49:10 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 7, 2018):

This will be optional in the Resolver like the dns-over-tls features, and default to off. Do you have more concerns than that?

@bluejekyll commented on GitHub (Jun 7, 2018): This will be optional in the Resolver like the dns-over-tls features, and default to off. Do you have more concerns than that?

kerem commented

2026-03-07 22:49:15 +03:00

Author

Owner

@briansmith commented on GitHub (Jun 7, 2018):

This will be optional in the Resolver like the dns-over-tls features, and default to off.

Sounds good.

Do you have more concerns than that?

Nope!

@briansmith commented on GitHub (Jun 7, 2018): > This will be optional in the Resolver like the dns-over-tls features, and default to off. Sounds good. > Do you have more concerns than that? Nope!

kerem commented

2026-03-07 22:49:20 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 17, 2018):

FYI, I think the HttpsClientStream is done. before merging, I'm going to see what some of the underlying changes look like to support in the Resolver.

@bluejekyll commented on GitHub (Jun 17, 2018): FYI, I think the HttpsClientStream is done. before merging, I'm going to see what some of the underlying changes look like to support in the Resolver.

kerem commented

2026-03-07 22:49:25 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 24, 2018):

Ok, with #519 there is now a viable implementation of DNS-over-HTTPS in TRust-DNS.

I had to hack around what appears to be a poor abstraction over the IO streams. I want to look into that in a little more detail to see if there is a better solution, so this isn't landing yet.

Also, note that this initial implementation will only support Rustls for the TLS implementation.

@bluejekyll commented on GitHub (Jun 24, 2018): Ok, with #519 there is now a viable implementation of DNS-over-HTTPS in TRust-DNS. I had to hack around what appears to be a poor abstraction over the IO streams. I want to look into that in a little more detail to see if there is a better solution, so this isn't landing yet. Also, note that this initial implementation will only support Rustls for the TLS implementation.

kerem commented

2026-03-07 22:49:30 +03:00

Author

Owner

@rumpelsepp commented on GitHub (Jun 25, 2018):

Thank you so much for your hard work!

@rumpelsepp commented on GitHub (Jun 25, 2018): Thank you so much for your hard work!

kerem commented

2026-03-07 22:49:35 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 29, 2018):

That took a while, but #520 is going to be the path to merging. This is gets rid of the unnecessary Vec that was holding all the H2 responses, instead passing that back with a oneshot channel. There's some additional cleanup I want to do, but this is starting to look good.

Once this is all clean, the resolver will be merged, then I'll start working on the server/client.

@bluejekyll commented on GitHub (Jun 29, 2018): That took a while, but #520 is going to be the path to merging. This is gets rid of the unnecessary Vec that was holding all the H2 responses, instead passing that back with a oneshot channel. There's some additional cleanup I want to do, but this is starting to look good. Once this is all clean, the resolver will be merged, then I'll start working on the server/client.

kerem commented

2026-03-07 22:49:40 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jul 9, 2018):

I just merged #520

This means that master now has dns-over-https support for the Resolver. It currently only works with rustls and requires the dns-over-https feature to be enabled. I'll open some bugs for supporting the Client and the Server at some point in the future.

@bluejekyll commented on GitHub (Jul 9, 2018): I just merged #520 This means that master now has dns-over-https support for the Resolver. It currently only works with `rustls` and requires the `dns-over-https` feature to be enabled. I'll open some bugs for supporting the Client and the Server at some point in the future.

kerem commented

2026-03-07 22:49:45 +03:00

Author

Owner

@bluejekyll commented on GitHub (Oct 5, 2018):

This was resolved completely in #557

@bluejekyll commented on GitHub (Oct 5, 2018): This was resolved completely in #557

kerem referenced this issue

2026-03-15 22:16:39 +03:00

[GH-ISSUE #209] [Server] DNSSEC doesn't want to work #393

kerem referenced this issue

2026-03-15 22:17:31 +03:00