AdguardTeam/AdGuardHome

Support Oblivious DNS over HTTPS (ODoH)

Open

#2,406 opened on 2020年12月8日

GitHub で見る
 (8 comments) (50 reactions) (0 assignees)Go (34,000 stars) (2,333 forks)batch import
P3: Mediumfeature requesthelp wanted

説明

Apple, Cloudflare & Fastly together have come up with something called oblivious DoH. This is to decouple a single provider knowing both the DNS query and user's IP when using DoH thereby increasing user's privacy

The way it works is you connect to a proxy which in turn forwards the query to DNS resolver. This way proxy would know the user's IP address but not the query and DNS resolver would know the query but not user IP.

image

This seems similar to anonymized DNScrypt https://github.com/AdguardTeam/AdGuardHome/issues/1226. Also, this doesn't prevent both proxy & DNS resolver colluding to de-anonymize users. Cloudflare have acknowledged this in their post.

Cloudflare's post on this: https://blog.cloudflare.com/oblivious-dns/ IETF Draft: https://tools.ietf.org/html/draft-pauly-dprive-oblivious-doh-03

Cloudflare has a Go library for oDOH https://github.com/cloudflare/odoh-go/

コントリビューターガイド

技術スタック
go
領域
backendsecurity
Issue 種別
feature
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
4
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
over 1 week
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
needs maintainer response
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
needs investigation
前提条件
Go programmingDNS and DoH conceptsFamiliarity with AdGuardHome codebase
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
20
調査方針
Examine the Cloudflare odoh go library and the IETF draft for ODoH protocol details. Review AdGuardHome's current DNS proxy and DoH implementation to identify integration points. Check issue comments for any maintainer input on preferred approach. Investigate proxy configuration and privacy guarantees.