mirror of
https://github.com/hickory-dns/hickory-dns.git
synced 2026-04-25 03:05:51 +03:00
[GH-ISSUE #2015] trust-dns quic client can not querry trust-dns quic server #852
Labels
No labels
blocked
breaking-change
bug
bug:critical
bug:tests
cleanup
compliance
compliance
compliance
crate:all
crate:client
crate:native-tls
crate:proto
crate:recursor
crate:resolver
crate:resolver
crate:rustls
crate:server
crate:util
dependencies
docs
duplicate
easy
easy
enhance
enhance
enhance
feature:dns-over-https
feature:dns-over-quic
feature:dns-over-tls
feature:dnsssec
feature:global_lb
feature:mdns
feature:tsig
features:edns
has workaround
ops
perf
platform:WASM
platform:android
platform:fuchsia
platform:linux
platform:macos
platform:windows
pull-request
question
test
tools
tools
trust
unclear
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/hickory-dns#852
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @LuckyTurtleDev on GitHub (Sep 3, 2023).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2015
Describe the bug
I have notify some strange behavior if I am hosting tls and quic dns server using the server crate.
Dependent on the client some protocols do not work.
kdig is a dig clone with quic, tls, https support.
carb-hole is a pi-hole clone using trust dns (trust_dns_server::store::forwarder).
Debug output of client crab-hole instance trying to querry server crab-hole via quic (kdig --udp--> carb-hole(client) --quic-⚡-> carb-hole(server) --tls-> cloudflare).
crab-hole server log (quic):
kdig logs (issue of kdig see https://github.com/bluejekyll/trust-dns/issues/2015#issuecomment-1705392625 )
output of kdig using tls (kdig --tls-⚡-> carb-hole(server) --tls-> cloudflare)
carb-hole sever log if using kdig via tls:
To Reproduce
client crab-hole:
client config
server crab-hole docker-compose
server crab-hole config
Expected behavior
successful request
System:
Version:
Crate: server
Version: 0.23.0
@djc commented on GitHub (Sep 4, 2023):
Looks like you're not setting the ALPN protocol correctly for TLS/QUIC implementations.
@LuckyTurtleDev commented on GitHub (Sep 4, 2023):
@djc is calling
register_tls_listenerandregister_quic_listenernot enough?Why do i need to configure ALPN manual after binding and register an tls port?
I have not found anything at the doc of trust-dns-server about ALPN.
@djc commented on GitHub (Sep 4, 2023):
According to your logs, the server is saying that the client didn't set any protocols it understands.
@LuckyTurtleDev commented on GitHub (Sep 4, 2023):
So the kdig seems to use the wrong ALPN. So I should report this kdig instead.
But trust-dns should be able to querry trust-dns via quic.
@bluejekyll commented on GitHub (Sep 5, 2023):
trust-dns should be working when communicating with it's libraries to the server. We have test coverage for this in https://github.com/bluejekyll/trust-dns/blob/main/bin/tests/named_quic_tests.rs. Is the certificate not being validated correctly?
@bluejekyll commented on GitHub (Sep 5, 2023):
ALPN on the Client is set here:
github.com/bluejekyll/trust-dns@202fe2a8a4/crates/proto/src/quic/quic_client_stream.rs (L240-L247)I don't think the ALPN is configurable on the server right now, that is set here:
github.com/bluejekyll/trust-dns@202fe2a8a4/crates/proto/src/quic/quic_server.rs (L51)The ALPN for quic is defined here:
github.com/bluejekyll/trust-dns@202fe2a8a4/crates/proto/src/quic/quic_stream.rs (L24)@LuckyTurtleDev commented on GitHub (Sep 6, 2023):
At least kdig have no issue with it. I am currently not sure what I can do. Quic is currently not widely used, which make it difficult to test it, witch other clients/servers.
@djc commented on GitHub (Sep 6, 2023):
See also #1990?
@bluejekyll commented on GitHub (Sep 6, 2023):
@LuckyTurtleDev, do you think you could try this with the current
mainline branch after this change was put in, #2005?@LuckyTurtleDev commented on GitHub (Sep 6, 2023):
I will try out this tomorrow.
@bluejekyll commented on GitHub (Sep 7, 2023):
Actually, you might want to wait, see this comment, I'm not sure it's the root cause of this issue, but it could be related: https://github.com/bluejekyll/trust-dns/issues/1990#issuecomment-1708936961