Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

QUIC support #6

Open
pforemski opened this issue Oct 13, 2016 · 5 comments
Open

QUIC support #6

pforemski opened this issue Oct 13, 2016 · 5 comments

Comments

@pforemski
Copy link
Owner

DNS over QUIC is the reason why I started the project. Implementation would require a decent QUIC client library for Go, which I believe isn't available yet.

@pforemski pforemski modified the milestone: dingo 0.13 Oct 13, 2016
@pforemski
Copy link
Owner Author

I wait for a QUIC client library in pure Go from the quic-go project: quic-go/quic-go#310 (comment)

@heri16
Copy link
Contributor

heri16 commented Nov 11, 2016

+1

@pforemski
Copy link
Owner Author

Started in e3f018d - works but with some issues.

@gripedthumbtacks
Copy link

QUIC support still seems broken. Here is an example error msg

i/o timeout (Client.Timeout exceeded while awaiting headers)

@gripedthumbtacks
Copy link

gripedthumbtacks commented Nov 29, 2017

So, there is a chicken and egg problem here. In order to utilize QUIC support, the QUIC crypto negotiation requires a DNS lookup, but where is that supposed to be handled if all DNS traffic is being filtered and only going over dingo? Do you see the issue? When using non-quic mode, you can set -gdns:server 1.2.3.4 or whatever IP address there to bypass the DNS lookup required to bootstrap dingo. However, there is no way to pass a static IP address to the -quic option, so when the QUIC protocol attempts to negotiate with dns.google.com, for instance, dingo attempts to perform a DNS lookup on that host. Attempting to bypass this using -gdns:sni and/or -gdns:host with a static IP will fail since the Google servers reject IP virtual hosts (for legitimate security reasons and QUIC client cannot easily verify the certificate chain). The question is, where is this QUIC DNS lookup being generated in the code (or is it in an upstream library) and can there be a bypass like the -gdns:server option to bypass the DNS lookup and pass an IP for the QUIC crypto negotiation to skip the DNS lookup?

QUIC appears to be using the -gdns:host value. So, I would propose a change that when -quic is enabled, the QUIC crypto negotiation utilize the -gdns:server value if it is a static IP address in place of the QUIC DNS lookup. Or, add a separate -qdns:host option that allows setting a static IP. Which do you prefer if we were to make a patch? Or do you have a preference?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants