AdguardTeam/AdGuardHome

Support Oblivious DNS over HTTPS (ODoH)

Open

#2,406 opened on Dec 8, 2020

View on GitHub
 (8 comments) (50 reactions) (0 assignees)Go (34,000 stars) (2,333 forks)batch import
P3: Mediumfeature requesthelp wanted

Description

Apple, Cloudflare & Fastly together have come up with something called oblivious DoH. This is to decouple a single provider knowing both the DNS query and user's IP when using DoH thereby increasing user's privacy

The way it works is you connect to a proxy which in turn forwards the query to DNS resolver. This way proxy would know the user's IP address but not the query and DNS resolver would know the query but not user IP.

image

This seems similar to anonymized DNScrypt https://github.com/AdguardTeam/AdGuardHome/issues/1226. Also, this doesn't prevent both proxy & DNS resolver colluding to de-anonymize users. Cloudflare have acknowledged this in their post.

Cloudflare's post on this: https://blog.cloudflare.com/oblivious-dns/ IETF Draft: https://tools.ietf.org/html/draft-pauly-dprive-oblivious-doh-03

Cloudflare has a Go library for oDOH https://github.com/cloudflare/odoh-go/

Contributor guide

Tech stack
go
Domain
backendsecurity
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
needs maintainer response
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
needs investigation
Prerequisites
Go programmingDNS and DoH conceptsFamiliarity with AdGuardHome codebase
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
20
Research direction
Examine the Cloudflare odoh go library and the IETF draft for ODoH protocol details. Review AdGuardHome's current DNS proxy and DoH implementation to identify integration points. Check issue comments for any maintainer input on preferred approach. Investigate proxy configuration and privacy guarantees.