[GH-ISSUE #2015] trust-dns quic client can not querry trust-dns quic server #852

Open
opened 2026-03-16 00:34:51 +03:00 by kerem · 11 comments
Owner

Originally created by @LuckyTurtleDev on GitHub (Sep 3, 2023).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2015

Describe the bug
I have notify some strange behavior if I am hosting tls and quic dns server using the server crate.
Dependent on the client some protocols do not work.

tls quic
kdig not works works
crab-hole works not works
android works unsupported

kdig is a dig clone with quic, tls, https support.
carb-hole is a pi-hole clone using trust dns (trust_dns_server::store::forwarder).


Debug output of client crab-hole instance trying to querry server crab-hole via quic (kdig --udp--> carb-hole(client) --quic--> carb-hole(server) --tls-> cloudflare).

crab-hole-crab-hole-1  | 2023-09-02T13:16:57Z  ⚙️ DEBUG crab_hole            > LowerQuery { name: LowerName(Name("example.com.")), original: Query { name: Name("example.com."), query_type: A, query_class: IN } }
crab-hole-crab-hole-1  | 2023-09-02T13:16:57Z  ⚙️ DEBUG rustls::client::hs   > No cached session for DnsName(DnsName(DnsName("dns.luckyturtle.dev")))
crab-hole-crab-hole-1  | 2023-09-02T13:16:57Z  ⚙️ DEBUG rustls::client::hs   > Not resuming any session
crab-hole-crab-hole-1  | 2023-09-02T13:16:57Z  ⚙️ DEBUG rustls::client::hs   > No cached session for DnsName(DnsName(DnsName("dns.luckyturtle.dev")))
crab-hole-crab-hole-1  | 2023-09-02T13:16:57Z  ⚙️ DEBUG rustls::client::hs   > Not resuming any session
crab-hole-crab-hole-1  | 2023-09-02T13:16:57Z  ⚙️ DEBUG rustls::client::hs   > No cached session for DnsName(DnsName(DnsName("dns.luckyturtle.dev")))
crab-hole-crab-hole-1  | 2023-09-02T13:16:57Z  ⚙️ DEBUG rustls::client::hs   > Not resuming any session

crab-hole server log (quic):

crab-hole_1  | 2023-09-03T14:18:35Z  ⚙️ DEBUG rustls::server::hs                                > decided upon suite TLS13_AES_256_GCM_SHA384
crab-hole_1  | 2023-09-03T14:18:35Z  ⚙️ DEBUG quinn_proto::endpoint                             > handshake failed: the cryptographic handshake failed: error 120: peer doesn't support any known protocol
crab-hole_1  | 2023-09-03T14:18:35Z  ⚙️ DEBUG rustls::server::hs                                > decided upon suite TLS13_AES_256_GCM_SHA384
crab-hole_1  | 2023-09-03T14:18:35Z  ⚙️ DEBUG quinn_proto::endpoint                             > handshake failed: the cryptographic handshake failed: error 120: peer doesn't support any known protocol
crab-hole_1  | 2023-09-03T14:18:35Z  ⚙️ DEBUG rustls::server::hs                                > decided upon suite TLS13_AES_256_GCM_SHA384
crab-hole_1  | 2023-09-03T14:18:35Z  ⚙️ DEBUG quinn_proto::endpoint                             > handshake failed: the cryptographic handshake failed: error 120: peer doesn't support any known protocol

kdig logs (issue of kdig see https://github.com/bluejekyll/trust-dns/issues/2015#issuecomment-1705392625 )

output of kdig using tls (kdig --tls--> carb-hole(server) --tls-> cloudflare)

❯ kdig +tls example.com @dns.luckyturtle.dev:8853
;; WARNING: TLS, handshake failed (A TLS fatal alert has been received.)
;; WARNING: TLS, handshake failed (The specified session has been invalidated for some reason.)
;; ERROR: failed to query server dns.luckyturtle.dev@8853(TCP)

carb-hole sever log if using kdig via tls:

crab-hole_1  | 2023-09-03T14:21:34Z  ⚙️ DEBUG trust_dns_server::server::server_future           > starting TLS request from: [SOME_IP]:57222
crab-hole_1  | 2023-09-03T14:21:34Z  ⚙️ DEBUG rustls::server::hs                                > decided upon suite TLS13_AES_256_GCM_SHA384
crab-hole_1  | 2023-09-03T14:21:34Z  ⚙️ DEBUG trust_dns_server::server::server_future           > tls handshake src: [SOME_IP]:57222 error: peer doesn't support any known protocol
crab-hole_1  | 2023-09-03T14:21:35Z  ⚙️ DEBUG trust_dns_server::server::server_future           > starting TLS request from: [SOME_IP]:15417
crab-hole_1  | 2023-09-03T14:21:35Z  ⚙️ DEBUG trust_dns_server::server::server_future           > tls handshake src: [SOME_IP]:15417 error: tls handshake eof

To Reproduce

client crab-hole:

version: '3.3'
services:
    crab-hole:
        image: 'ghcr.io/luckyturtledev/crab-hole:v0.1'
        ports:
            - "8053:8053/udp"
        environment:
            - RUST_LOG=debug
        volumes:
            - './config.toml:/data/config.toml:ro'

client config

[blocklist]
include_subdomains = true
lists = []

[[downstream]]
protocol = "udp"
listen = "[::]"
port = 8053

[[upstream.name_servers]]
socket_addr = "185.163.118.254:853"
protocol = "quic"
tls_dns_name = "dns.luckyturtle.dev"

server crab-hole docker-compose

version: '3.3'
services:
    crab-hole:
        image: 'ghcr.io/luckyturtledev/crab-hole:v0.1'
        ports:
            - "127.0.0.1:8080:80/tcp"
            - "853:853/udp"
            - "8853:853/tcp"
        environment:
            - RUST_LOG=debug
        volumes:
            - './data:/data'
            - './config.toml:/data/config.toml:ro'
            - "dns.luckyturtle.dev:/cert:ro"

server crab-hole config

[blocklist]
include_subdomains = true
lists = [
	"https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts",
	"https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt"
]

[api]
port = 80
listen = "[::]"
show_doc = false

[[downstream]]
protocol = "quic"
listen = "[::]"
port = 853
certificate = "/cert/dns.luckyturtle.dev.crt"
key = "/cert/dns.luckyturtle.dev.key"
dns_hostname = "dns.luckyturtle.dev"

[[downstream]]
protocol = "tls"
listen = "[::]"
port = 853
certificate = "/cert/dns.luckyturtle.dev.crt"
key = "/cert/dns.luckyturtle.dev.key"

[[upstream.name_servers]]
socket_addr = "[2606:4700:4700::1111]:853"
protocol = "tls"
tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com"
trust_nx_responses = false

[[upstream.name_servers]]
socket_addr = "[2606:4700:4700::1001]:853"
protocol = "tls"
tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com"
trust_nx_responses = false

[[upstream.name_servers]]
socket_addr = "1.1.1.1:853"
protocol = "tls"
tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com"
trust_nx_responses = false

[[upstream.name_servers]]
socket_addr = "1.0.0.1:853"
protocol = "tls"
tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com"
trust_nx_responses = false

Expected behavior
successful request

System:

  • OS-Client: arch linux
  • OS-Server: Debian 5.10.162-1
  • Architecture-Client: x86_64
  • Architecture-Server: x86_64
  • rustc version: 1.72.0

Version:
Crate: server
Version: 0.23.0

Originally created by @LuckyTurtleDev on GitHub (Sep 3, 2023). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2015 **Describe the bug** I have notify some strange behavior if I am hosting tls and quic dns server using the server crate. Dependent on the client some protocols do not work. | | tls | quic | |---|---|---| | kdig |not works | works | | crab-hole | works | not works | | android | works | unsupported | kdig is a dig clone with quic, tls, https support. [carb-hole](https://github.com/LuckyTurtleDev/crab-hole) is a pi-hole clone using trust dns (trust_dns_server::store::forwarder). ------- Debug output of client crab-hole instance trying to querry server crab-hole via quic (kdig --udp--> carb-hole(client) --quic-⚡-> carb-hole(server) --tls-> cloudflare). <details> ``` crab-hole-crab-hole-1 | 2023-09-02T13:16:57Z ⚙️ DEBUG crab_hole > LowerQuery { name: LowerName(Name("example.com.")), original: Query { name: Name("example.com."), query_type: A, query_class: IN } } crab-hole-crab-hole-1 | 2023-09-02T13:16:57Z ⚙️ DEBUG rustls::client::hs > No cached session for DnsName(DnsName(DnsName("dns.luckyturtle.dev"))) crab-hole-crab-hole-1 | 2023-09-02T13:16:57Z ⚙️ DEBUG rustls::client::hs > Not resuming any session crab-hole-crab-hole-1 | 2023-09-02T13:16:57Z ⚙️ DEBUG rustls::client::hs > No cached session for DnsName(DnsName(DnsName("dns.luckyturtle.dev"))) crab-hole-crab-hole-1 | 2023-09-02T13:16:57Z ⚙️ DEBUG rustls::client::hs > Not resuming any session crab-hole-crab-hole-1 | 2023-09-02T13:16:57Z ⚙️ DEBUG rustls::client::hs > No cached session for DnsName(DnsName(DnsName("dns.luckyturtle.dev"))) crab-hole-crab-hole-1 | 2023-09-02T13:16:57Z ⚙️ DEBUG rustls::client::hs > Not resuming any session ``` crab-hole server log (quic): ``` crab-hole_1 | 2023-09-03T14:18:35Z ⚙️ DEBUG rustls::server::hs > decided upon suite TLS13_AES_256_GCM_SHA384 crab-hole_1 | 2023-09-03T14:18:35Z ⚙️ DEBUG quinn_proto::endpoint > handshake failed: the cryptographic handshake failed: error 120: peer doesn't support any known protocol crab-hole_1 | 2023-09-03T14:18:35Z ⚙️ DEBUG rustls::server::hs > decided upon suite TLS13_AES_256_GCM_SHA384 crab-hole_1 | 2023-09-03T14:18:35Z ⚙️ DEBUG quinn_proto::endpoint > handshake failed: the cryptographic handshake failed: error 120: peer doesn't support any known protocol crab-hole_1 | 2023-09-03T14:18:35Z ⚙️ DEBUG rustls::server::hs > decided upon suite TLS13_AES_256_GCM_SHA384 crab-hole_1 | 2023-09-03T14:18:35Z ⚙️ DEBUG quinn_proto::endpoint > handshake failed: the cryptographic handshake failed: error 120: peer doesn't support any known protocol ``` </details> ------- <details> <summary> kdig logs (issue of kdig see https://github.com/bluejekyll/trust-dns/issues/2015#issuecomment-1705392625 ) </summary> output of kdig using tls (kdig --tls-⚡-> carb-hole(server) --tls-> cloudflare) ``` ❯ kdig +tls example.com @dns.luckyturtle.dev:8853 ;; WARNING: TLS, handshake failed (A TLS fatal alert has been received.) ;; WARNING: TLS, handshake failed (The specified session has been invalidated for some reason.) ;; ERROR: failed to query server dns.luckyturtle.dev@8853(TCP) ``` carb-hole sever log if using kdig via tls: ``` crab-hole_1 | 2023-09-03T14:21:34Z ⚙️ DEBUG trust_dns_server::server::server_future > starting TLS request from: [SOME_IP]:57222 crab-hole_1 | 2023-09-03T14:21:34Z ⚙️ DEBUG rustls::server::hs > decided upon suite TLS13_AES_256_GCM_SHA384 crab-hole_1 | 2023-09-03T14:21:34Z ⚙️ DEBUG trust_dns_server::server::server_future > tls handshake src: [SOME_IP]:57222 error: peer doesn't support any known protocol crab-hole_1 | 2023-09-03T14:21:35Z ⚙️ DEBUG trust_dns_server::server::server_future > starting TLS request from: [SOME_IP]:15417 crab-hole_1 | 2023-09-03T14:21:35Z ⚙️ DEBUG trust_dns_server::server::server_future > tls handshake src: [SOME_IP]:15417 error: tls handshake eof ``` </details> **To Reproduce** <details> client crab-hole: ``` version: '3.3' services: crab-hole: image: 'ghcr.io/luckyturtledev/crab-hole:v0.1' ports: - "8053:8053/udp" environment: - RUST_LOG=debug volumes: - './config.toml:/data/config.toml:ro' ``` client config ```toml [blocklist] include_subdomains = true lists = [] [[downstream]] protocol = "udp" listen = "[::]" port = 8053 [[upstream.name_servers]] socket_addr = "185.163.118.254:853" protocol = "quic" tls_dns_name = "dns.luckyturtle.dev" ``` --------- server crab-hole docker-compose ``` version: '3.3' services: crab-hole: image: 'ghcr.io/luckyturtledev/crab-hole:v0.1' ports: - "127.0.0.1:8080:80/tcp" - "853:853/udp" - "8853:853/tcp" environment: - RUST_LOG=debug volumes: - './data:/data' - './config.toml:/data/config.toml:ro' - "dns.luckyturtle.dev:/cert:ro" ``` server crab-hole config ```toml [blocklist] include_subdomains = true lists = [ "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts", "https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt" ] [api] port = 80 listen = "[::]" show_doc = false [[downstream]] protocol = "quic" listen = "[::]" port = 853 certificate = "/cert/dns.luckyturtle.dev.crt" key = "/cert/dns.luckyturtle.dev.key" dns_hostname = "dns.luckyturtle.dev" [[downstream]] protocol = "tls" listen = "[::]" port = 853 certificate = "/cert/dns.luckyturtle.dev.crt" key = "/cert/dns.luckyturtle.dev.key" [[upstream.name_servers]] socket_addr = "[2606:4700:4700::1111]:853" protocol = "tls" tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com" trust_nx_responses = false [[upstream.name_servers]] socket_addr = "[2606:4700:4700::1001]:853" protocol = "tls" tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com" trust_nx_responses = false [[upstream.name_servers]] socket_addr = "1.1.1.1:853" protocol = "tls" tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com" trust_nx_responses = false [[upstream.name_servers]] socket_addr = "1.0.0.1:853" protocol = "tls" tls_dns_name = "1dot1dot1dot1.cloudflare-dns.com" trust_nx_responses = false ``` </details> **Expected behavior** successful request **System:** - OS-Client: arch linux - OS-Server: Debian 5.10.162-1 - Architecture-Client: x86_64 - Architecture-Server: x86_64 - rustc version: 1.72.0 **Version:** Crate: server Version: 0.23.0
Author
Owner

@djc commented on GitHub (Sep 4, 2023):

Looks like you're not setting the ALPN protocol correctly for TLS/QUIC implementations.

<!-- gh-comment-id:1705392625 --> @djc commented on GitHub (Sep 4, 2023): Looks like you're not setting the ALPN protocol correctly for TLS/QUIC implementations.
Author
Owner

@LuckyTurtleDev commented on GitHub (Sep 4, 2023):

@djc is calling register_tls_listener and register_quic_listener not enough?
Why do i need to configure ALPN manual after binding and register an tls port?

I have not found anything at the doc of trust-dns-server about ALPN.

<!-- gh-comment-id:1705644705 --> @LuckyTurtleDev commented on GitHub (Sep 4, 2023): @djc is calling [`register_tls_listener`](https://docs.rs/trust-dns-server/latest/trust_dns_server/server/struct.ServerFuture.html#method.register_tls_listener) and [`register_quic_listener`](https://docs.rs/trust-dns-server/latest/trust_dns_server/server/struct.ServerFuture.html#method.register_quic_listener) not enough? Why do i need to configure ALPN manual after binding and register an tls port? I have [not found anything](https://docs.rs/trust-dns-server/latest/trust_dns_server/index.html?search=ALPN) at the doc of trust-dns-server about ALPN.
Author
Owner

@djc commented on GitHub (Sep 4, 2023):

According to your logs, the server is saying that the client didn't set any protocols it understands.

<!-- gh-comment-id:1705679476 --> @djc commented on GitHub (Sep 4, 2023): According to your logs, the server is saying that the client didn't set any protocols it understands.
Author
Owner

@LuckyTurtleDev commented on GitHub (Sep 4, 2023):

So the kdig seems to use the wrong ALPN. So I should report this kdig instead.

But trust-dns should be able to querry trust-dns via quic.

<!-- gh-comment-id:1705688781 --> @LuckyTurtleDev commented on GitHub (Sep 4, 2023): So the kdig seems to use the wrong ALPN. So I should report this kdig instead. But trust-dns should be able to querry trust-dns via quic.
Author
Owner

@bluejekyll commented on GitHub (Sep 5, 2023):

trust-dns should be working when communicating with it's libraries to the server. We have test coverage for this in https://github.com/bluejekyll/trust-dns/blob/main/bin/tests/named_quic_tests.rs. Is the certificate not being validated correctly?

<!-- gh-comment-id:1707110216 --> @bluejekyll commented on GitHub (Sep 5, 2023): trust-dns should be working when communicating with it's libraries to the server. We have test coverage for this in https://github.com/bluejekyll/trust-dns/blob/main/bin/tests/named_quic_tests.rs. Is the certificate not being validated correctly?
Author
Owner

@bluejekyll commented on GitHub (Sep 5, 2023):

ALPN on the Client is set here: github.com/bluejekyll/trust-dns@202fe2a8a4/crates/proto/src/quic/quic_client_stream.rs (L240-L247)

I don't think the ALPN is configurable on the server right now, that is set here: github.com/bluejekyll/trust-dns@202fe2a8a4/crates/proto/src/quic/quic_server.rs (L51)

The ALPN for quic is defined here: github.com/bluejekyll/trust-dns@202fe2a8a4/crates/proto/src/quic/quic_stream.rs (L24)

<!-- gh-comment-id:1707117874 --> @bluejekyll commented on GitHub (Sep 5, 2023): ALPN on the Client is set here: https://github.com/bluejekyll/trust-dns/blob/202fe2a8a4cade9df2789ae52fee2ce91749a1a7/crates/proto/src/quic/quic_client_stream.rs#L240-L247 I don't think the ALPN is configurable on the server right now, that is set here: https://github.com/bluejekyll/trust-dns/blob/202fe2a8a4cade9df2789ae52fee2ce91749a1a7/crates/proto/src/quic/quic_server.rs#L51 The ALPN for quic is defined here: https://github.com/bluejekyll/trust-dns/blob/202fe2a8a4cade9df2789ae52fee2ce91749a1a7/crates/proto/src/quic/quic_stream.rs#L24
Author
Owner

@LuckyTurtleDev commented on GitHub (Sep 6, 2023):

Is the certificate not being validated correctly?

At least kdig have no issue with it. I am currently not sure what I can do. Quic is currently not widely used, which make it difficult to test it, witch other clients/servers.

<!-- gh-comment-id:1708158015 --> @LuckyTurtleDev commented on GitHub (Sep 6, 2023): > Is the certificate not being validated correctly? At least kdig have no issue with it. I am currently not sure what I can do. Quic is currently not widely used, which make it difficult to test it, witch other clients/servers.
Author
Owner

@djc commented on GitHub (Sep 6, 2023):

See also #1990?

<!-- gh-comment-id:1708210135 --> @djc commented on GitHub (Sep 6, 2023): See also #1990?
Author
Owner

@bluejekyll commented on GitHub (Sep 6, 2023):

@LuckyTurtleDev, do you think you could try this with the current main line branch after this change was put in, #2005?

<!-- gh-comment-id:1708790410 --> @bluejekyll commented on GitHub (Sep 6, 2023): @LuckyTurtleDev, do you think you could try this with the current `main` line branch after this change was put in, #2005?
Author
Owner

@LuckyTurtleDev commented on GitHub (Sep 6, 2023):

I will try out this tomorrow.

<!-- gh-comment-id:1708940500 --> @LuckyTurtleDev commented on GitHub (Sep 6, 2023): I will try out this tomorrow.
Author
Owner

@bluejekyll commented on GitHub (Sep 7, 2023):

Actually, you might want to wait, see this comment, I'm not sure it's the root cause of this issue, but it could be related: https://github.com/bluejekyll/trust-dns/issues/1990#issuecomment-1708936961

<!-- gh-comment-id:1709328297 --> @bluejekyll commented on GitHub (Sep 7, 2023): Actually, you might want to wait, see this comment, I'm not sure it's the root cause of this issue, but it could be related: https://github.com/bluejekyll/trust-dns/issues/1990#issuecomment-1708936961
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/hickory-dns#852
No description provided.