DNS éçšã®ããŸããŸãªåŽé¢ã«ã€ããŠã¯ãèè
ããã§ã«å€ãã®èšäºã§ç¹°ãè¿ã觊ããŠããŸãã
æè¿ãŸã§ãDNS ãã©ãã£ãã¯ã®æãããªè匱æ§ã«ãããããããã³ã³ãã³ãã«åºåãåã蟌ãããšã§åå
¥ãå¢ããããšãããããã€ããŒåŽââã®æªæã®ããè¡çºãæ¿åºã®ã»ãã¥ãªãã£æ©é¢ãæ€é²ã«ãã£ãŠãäŸç¶ãšããŠã»ãšãã©ã®éšåãå¹³æã§éä¿¡ãããŠããŸããåãªãç¯çœªè
ã ãã§ãªãããã®ããã»ã¹
幞ããªããšã«ãç¶æ³ã¯å€ããã€ã€ãããŸãã ç¹ã«ã人æ°ã®ãã Firefox ãã©ãŠã¶ã®éçºè
ã¯ã
1. DNS-over-HTTPS ã®åé¡
äžèŠãããšãã€ã³ã¿ãŒããã ãœãããŠã§ã¢ãžã® DNS-over-HTTPS ã®å€§éå°å ¥ã®å§ãŸãã¯ãè¯å®çãªåå¿ããåŒãèµ·ãããŸããã ããããããèšãããããã«ãæªéã¯çŽ°éšã«å®¿ããŸãã
DoH ã®æ®åç¯å²ãå¶éããæåã®åé¡ã¯ãDoH ã Web ãã©ãã£ãã¯ã®ã¿ã«çŠç¹ãåœãŠãŠããããšã§ãã å®éãDoH ã®ããŒã¹ãšãªã HTTP ãããã³ã«ãšãã®çŸåšã®ããŒãžã§ã³ HTTP/2 ã¯ãWWW ã®åºç€ã§ãã ããããã€ã³ã¿ãŒãããã¯åãªããŠã§ãã§ã¯ãããŸããã é»åã¡ãŒã«ãããŸããŸãªã€ã³ã¹ã¿ã³ã ã¡ãã»ã³ãžã£ãŒããã¡ã€ã«è»¢éã·ã¹ãã ããã«ãã¡ãã£ã¢ ã¹ããªãŒãã³ã°ãªã©ãHTTP ã䜿çšããªã人æ°ã®ãããµãŒãã¹ã¯æ°å€ããããŸãã ãããã£ãŠãDoH ã®å€ããäžèœè¬ãšããŠèªèããŠããã«ããããããããã©ãŠã¶ ãã¯ãããžä»¥å€ã«ã¯è¿œå ã® (ãããŠäžå¿ èŠãª) åªåãªãã«ã¯é©çšã§ããªãããšãå€æããŸããã ã¡ãªã¿ã«ãå®å šãªæšæº TLS ãããã³ã«ã§æšæº DNS ãã©ãã£ãã¯ã®ã«ãã»ã«åãå®è£ ãã DNS-over-TLS ã¯ããã®åœ¹å²ã®ãã䟡å€ã®ããåè£ã®ããã«èŠããŸãã
XNUMX çªç®ã®åé¡ã¯ãXNUMX çªç®ã®åé¡ãããæœåšçã«ã¯ããã«é倧ã§ããããã©ãŠã¶èšå®ã§æå®ãããåäžã® DoH ãµãŒããŒã®äœ¿çšãåªå ããŠãDNS ã®åºæã®åæ£åãèšèšã«ããå®éã«æŸæ£ãããŠããããšã§ãã ç¹ã«ãMozilla 㯠Cloudflare ã®ãµãŒãã¹ã䜿çšããããšãæšå¥šããŠããŸãã åæ§ã®ãµãŒãã¹ã¯ãä»ã®èåãªã€ã³ã¿ãŒãããçã®äººç©ãç¹ã« Google ã«ãã£ãŠãéå§ãããŸããã çŸåšææ¡ãããŠãã圢åŒã§ã® DNS-over-HTTPS ã®å®è£ ã¯ãæ倧èŠæš¡ã®ãµãŒãã¹ã«å¯Ÿãããšã³ã ãŠãŒã¶ãŒã®äŸå床ãé«ããã ãã§ããããšãããããŸããã DNS ã¯ãšãªã®åæã«ãã£ãŠæäŸãããæ å ±ã«ãã£ãŠããã®ã¯ãšãªã«é¢ããããã«å€ãã®ããŒã¿ãåéããããã®ç²ŸåºŠãšé¢é£æ§ãåäžããããšã¯åšç¥ã®äºå®ã§ãã
ãã®ç¹ã«ãããŠãèè ã¯ãDNS-over-HTTPS ã§ã¯ãªããæ®éçã§å®å šã§ãã€ã³ã¿ãŒãããã®ãããªãéäžåãå©é·ããªãæ段ãšããŠãDNSSEC/DANE ãšãšãã« DNS-over-TLS ã®å€§èŠæš¡å®è£ ãæ¯æãç¶ããŠããŸãã DNS ãã©ãã£ãã¯ã®ã»ãã¥ãªãã£ã確ä¿ããŸãã æ®å¿µãªãããæãããªçç±ã«ãããDoH 代æ¿æ段ã®ãµããŒããã¯ã©ã€ã¢ã³ã ãœãããŠã§ã¢ã«è¿ éã«å€§éã«å°å ¥ããããšã¯æåŸ ã§ãããããã¯äŸç¶ãšããŠã»ãã¥ãªã㣠ãã¯ãããžæ奜家ã®é åã§ãã
ããããä»ã§ã¯ DoH ãããã®ã§ããããäŒæ¥ã«ããæœåšçãªç£èŠãèªç€Ÿã®ãµãŒããŒãä»ããŠèªç€Ÿã® DNS-over-HTTPS ãµãŒããŒã«éããŠãããDoH ã䜿çšããŠã¿ãŠã¯ãããã§ãããã?
2. DNS-over-HTTPS ãããã³ã«
åºæºã§èŠããš
æšæºã«åŸã£ãŠãHTTP/2 ãšå®å šãª TLS æ¥ç¶ã®ã¿ããµããŒããããŸãã
DNS ãªã¯ãšã¹ãã®éä¿¡ã¯ãæšæºã® GET ã¡ãœãããš POST ã¡ãœããã䜿çšããŠå®è¡ã§ããŸãã æåã®ã±ãŒã¹ã§ã¯ããªã¯ãšã¹ã㯠Base64URL ã§ãšã³ã³ãŒããããæååã«å€æãããXNUMX çªç®ã®ã±ãŒã¹ã§ã¯ããã€ããªåœ¢åŒã® POST ãªã¯ãšã¹ãã®æ¬æãéããŠå€æãããŸãã ãã®å ŽåãDNS èŠæ±ãšå¿çäžã«ç¹å¥ãª MIME ããŒã¿ ã¿ã€ãã䜿çšãããŸãã ã¢ããªã±ãŒã·ã§ã³/DNSã¡ãã»ãŒãž.
root@eprove:~ # curl -H 'accept: application/dns-message' 'https://my.domaint/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE' -v
* Trying 2001:100:200:300::400:443...
* TCP_NODELAY set
* Connected to eprove.net (2001:100:200:300::400) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /usr/local/share/certs/ca-root-nss.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=my.domain
* start date: Jul 22 00:07:13 2019 GMT
* expire date: Oct 20 00:07:13 2019 GMT
* subjectAltName: host "my.domain" matched cert's "my.domain"
* issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x801441000)
> GET /dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/2
> Host: eprove.net
> User-Agent: curl/7.65.3
> accept: application/dns-message
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200
< server: h2o/2.3.0-beta2
< content-type: application/dns-message
< cache-control: max-age=86274
< date: Thu, 12 Sep 2019 13:07:25 GMT
< strict-transport-security: max-age=15768000; includeSubDomains; preload
< content-length: 45
<
Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.
* Failed writing body (0 != 45)
* stopped the pause stream!
* Connection #0 to host eprove.net left intact
ã¿ã€ãã«ã«ãæ³šç® ãã£ãã·ã¥å¶åŸ¡: Web ãµãŒããŒããã®å¿çã«å«ãŸããŸãã ãã©ã¡ãŒã¿ã§ æ倧幎霢 è¿ããã DNS ã¬ã³ãŒãã® TTL å€ (ãŸãã¯ããããã®ã»ãããè¿ãããå Žåã¯æå°å€) ãå«ãŸããŸãã
äžèšã«åºã¥ããŠãDoH ãµãŒããŒã®æ©èœã¯ããã€ãã®æ®µéã§æ§æãããŸãã
- HTTPãªã¯ãšã¹ããåä¿¡ããŸãã ããã GET ã®å Žåã¯ãbase64URL ãšã³ã³ãŒããããã±ããããã³ãŒãããŸãã
- ãã®ãã±ããã DNS ãµãŒããŒã«éä¿¡ããŸãã
- DNSãµãŒããŒããå¿çãååŸãã
- åä¿¡ããã¬ã³ãŒãã®æå° TTL å€ãèŠã€ããŸãã
- HTTP çµç±ã§ã¯ã©ã€ã¢ã³ãã«å¿çãè¿ããŸãã
3. ç¬èªã® DNS-over-HTTPS ãµãŒããŒ
ç¬èªã® DNS-over-HTTPS ãµãŒããŒãå®è¡ããæãç°¡åãæéãå¹æçãªæ¹æ³ã¯ãHTTP/2 Web ãµãŒããŒã䜿çšããããšã§ãã
ãã®éžæã¯ãH2O èªäœã«çµ±åãããã€ã³ã¿ãŒããªã¿ã䜿çšããŠãç¬èªã® DoH ãµãŒããŒã®ãã¹ãŠã®ã³ãŒããå®å
šã«å®è£
ã§ãããšããäºå®ã«ãã£ãŠè£ä»ããããŸãã
root@beta:~ # uname -v
FreeBSD 12.0-RELEASE-p10 GENERIC
root@beta:~ # cd /usr/ports/www/h2o
root@beta:/usr/ports/www/h2o # make extract
===> License MIT BSD2CLAUSE accepted by the user
===> h2o-2.2.6 depends on file: /usr/local/sbin/pkg - found
===> Fetching all distfiles required by h2o-2.2.6 for building
===> Extracting for h2o-2.2.6.
=> SHA256 Checksum OK for h2o-h2o-v2.2.6_GH0.tar.gz.
===> h2o-2.2.6 depends on file: /usr/local/bin/ruby26 - found
root@beta:/usr/ports/www/h2o # cd work/h2o-2.2.6/deps/
root@beta:/usr/ports/www/h2o/work/h2o-2.2.6/deps # git clone https://github.com/iij/mruby-socket.git
ÐлПМОÑПваМОе в «mruby-socket»âŠ
remote: Enumerating objects: 385, done.
remote: Total 385 (delta 0), reused 0 (delta 0), pack-reused 385
ÐПлÑÑеМОе ПбÑекÑПв: 100% (385/385), 98.02 KiB | 647.00 KiB/s, гПÑПвП.
ÐпÑеЎелеМОе ОзЌеМеМОй: 100% (208/208), гПÑПвП.
root@beta:/usr/ports/www/h2o/work/h2o-2.2.6/deps # ll
total 181
drwxr-xr-x 9 root wheel 18 12 авг. 16:09 brotli/
drwxr-xr-x 2 root wheel 4 12 авг. 16:09 cloexec/
drwxr-xr-x 2 root wheel 5 12 авг. 16:09 golombset/
drwxr-xr-x 4 root wheel 35 12 авг. 16:09 klib/
drwxr-xr-x 2 root wheel 5 12 авг. 16:09 libgkc/
drwxr-xr-x 4 root wheel 26 12 авг. 16:09 libyrmcds/
drwxr-xr-x 13 root wheel 32 12 авг. 16:09 mruby/
drwxr-xr-x 5 root wheel 11 12 авг. 16:09 mruby-digest/
drwxr-xr-x 5 root wheel 10 12 авг. 16:09 mruby-dir/
drwxr-xr-x 5 root wheel 10 12 авг. 16:09 mruby-env/
drwxr-xr-x 4 root wheel 9 12 авг. 16:09 mruby-errno/
drwxr-xr-x 5 root wheel 14 12 авг. 16:09 mruby-file-stat/
drwxr-xr-x 5 root wheel 10 12 авг. 16:09 mruby-iijson/
drwxr-xr-x 5 root wheel 11 12 авг. 16:09 mruby-input-stream/
drwxr-xr-x 6 root wheel 11 12 авг. 16:09 mruby-io/
drwxr-xr-x 5 root wheel 10 12 авг. 16:09 mruby-onig-regexp/
drwxr-xr-x 4 root wheel 10 12 авг. 16:09 mruby-pack/
drwxr-xr-x 5 root wheel 10 12 авг. 16:09 mruby-require/
drwxr-xr-x 6 root wheel 10 12 ÑеМÑ. 16:10 mruby-socket/
drwxr-xr-x 2 root wheel 9 12 авг. 16:09 neverbleed/
drwxr-xr-x 2 root wheel 13 12 авг. 16:09 picohttpparser/
drwxr-xr-x 2 root wheel 4 12 авг. 16:09 picotest/
drwxr-xr-x 9 root wheel 16 12 авг. 16:09 picotls/
drwxr-xr-x 4 root wheel 8 12 авг. 16:09 ssl-conservatory/
drwxr-xr-x 8 root wheel 18 12 авг. 16:09 yaml/
drwxr-xr-x 2 root wheel 8 12 авг. 16:09 yoml/
root@beta:/usr/ports/www/h2o/work/h2o-2.2.6/deps # cd ../../..
root@beta:/usr/ports/www/h2o # make install clean
...
Web ãµãŒããŒã®æ§æã¯éåžžæšæºã§ãã
root@beta:/usr/ports/www/h2o # cd /usr/local/etc/h2o/
root@beta:/usr/local/etc/h2o # cat h2o.conf
# this sample config gives you a feel for how h2o can be used
# and a high-security configuration for TLS and HTTP headers
# see https://h2o.examp1e.net/ for detailed documentation
# and h2o --help for command-line options and settings
# v.20180207 (c)2018 by Max Kostikov http://kostikov.co e-mail: [email protected]
user: www
pid-file: /var/run/h2o.pid
access-log:
path: /var/log/h2o/h2o-access.log
format: "%h %v %l %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i""
error-log: /var/log/h2o/h2o-error.log
expires: off
compress: on
file.dirlisting: off
file.send-compressed: on
file.index: [ 'index.html', 'index.php' ]
listen:
port: 80
listen:
port: 443
ssl:
cipher-suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
cipher-preference: server
dh-file: /etc/ssl/dhparams.pem
certificate-file: /usr/local/etc/letsencrypt/live/eprove.net/fullchain.pem
key-file: /usr/local/etc/letsencrypt/live/my.domain/privkey.pem
hosts:
"*.my.domain":
paths: &go_tls
"/":
redirect:
status: 301
url: https://my.domain/
"my.domain:80":
paths: *go_tls
"my.domain:443":
header.add: "Strict-Transport-Security: max-age=15768000; includeSubDomains; preload"
paths:
"/dns-query":
mruby.handler-file: /usr/local/etc/h2o/h2odoh.rb
å¯äžã®äŸå€ã¯ URL ãã³ãã©ãŒã§ã / dns-query ããã¯ãmruby ã§æžããããã³ãã©ãŒ ãªãã·ã§ã³ãéããŠåŒã³åºããã DNS-over-HTTPS ãµãŒããŒãå®éã«æ åœããŸãã mruby.ãã³ãã©ãŒãã¡ã€ã«.
root@beta:/usr/local/etc/h2o # cat h2odoh.rb
# H2O HTTP/2 web server as DNS-over-HTTP service
# v.20190908 (c)2018-2019 Max Kostikov https://kostikov.co e-mail: [email protected]
proc {|env|
if env['HTTP_ACCEPT'] == "application/dns-message"
case env['REQUEST_METHOD']
when "GET"
req = env['QUERY_STRING'].gsub(/^dns=/,'')
# base64URL decode
req = req.tr("-_", "+/")
if !req.end_with?("=") && req.length % 4 != 0
req = req.ljust((req.length + 3) & ~3, "=")
end
req = req.unpack1("m")
when "POST"
req = env['rack.input'].read
else
req = ""
end
if req.empty?
[400, { 'content-type' => 'text/plain' }, [ "Bad Request" ]]
else
# --- ask DNS server
sock = UDPSocket.new
sock.connect("localhost", 53)
sock.send(req, 0)
str = sock.recv(4096)
sock.close
# --- find lowest TTL in response
nans = str[6, 2].unpack1('n') # number of answers
if nans > 0 # no DNS failure
shift = 12
ttl = 0
while nans > 0
# process domain name compression
if str[shift].unpack1("C") < 192
shift = str.index("x00", shift) + 5
if ttl == 0 # skip question section
next
end
end
shift += 6
curttl = str[shift, 4].unpack1('N')
shift += str[shift + 4, 2].unpack1('n') + 6 # responce data size
if ttl == 0 or ttl > curttl
ttl = curttl
end
nans -= 1
end
cc = 'max-age=' + ttl.to_s
else
cc = 'no-cache'
end
[200, { 'content-type' => 'application/dns-message', 'content-length' => str.size, 'cache-control' => cc }, [ str ] ]
end
else
[415, { 'content-type' => 'text/plain' }, [ "Unsupported Media Type" ]]
end
}
ãã®å ŽåãããŒã«ã« ãã£ãã·ã¥ ãµãŒããŒã DNS ãã±ããã®åŠçãæ
åœããããšã«æ³šæããŠãã ããã
root@beta:/usr/local/etc/h2o # local-unbound verison
usage: local-unbound [options]
start unbound daemon DNS resolver.
-h this help
-c file config file to read instead of /var/unbound/unbound.conf
file format is described in unbound.conf(5).
-d do not fork into the background.
-p do not create a pidfile.
-v verbose (more times to increase verbosity)
Version 1.8.1
linked libs: mini-event internal (it uses select), OpenSSL 1.1.1a-freebsd 20 Nov 2018
linked modules: dns64 respip validator iterator
BSD licensed, see LICENSE in source package for details.
Report bugs to [email protected]
root@eprove:/usr/local/etc/h2o # sockstat -46 | grep unbound
unbound local-unbo 69749 3 udp6 ::1:53 *:*
unbound local-unbo 69749 4 tcp6 ::1:53 *:*
unbound local-unbo 69749 5 udp4 127.0.0.1:53 *:*
unbound local-unbo 69749 6 tcp4 127.0.0.1:53 *:*
æ®ã£ãŠããã®ã¯ãH2O ãåèµ·åããŠãäœãèµ·ãããã確èªããããšã ãã§ãã
root@beta:/usr/local/etc/h2o # service h2o restart
Stopping h2o.
Waiting for PIDS: 69871.
Starting h2o.
start_server (pid:70532) starting now...
4.ãã¹ã
ããã§ããã¹ããªã¯ãšã¹ããå床éä¿¡ãããŠãŒãã£ãªãã£ã䜿çšããŠãããã¯ãŒã¯ãã©ãã£ãã¯ã調ã¹ãŠçµæã確èªããŠã¿ãŸããã tcpdump.
root@beta/usr/local/etc/h2o # curl -H 'accept: application/dns-message' 'https://my.domain/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE'
Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.
...
root@beta:~ # tcpdump -n -i lo0 udp port 53 -xx -XX -vv
tcpdump: listening on lo0, link-type NULL (BSD loopback), capture size 262144 bytes
16:32:40.420831 IP (tos 0x0, ttl 64, id 37575, offset 0, flags [none], proto UDP (17), length 57, bad cksum 0 (->e9ea)!)
127.0.0.1.21070 > 127.0.0.1.53: [bad udp cksum 0xfe38 -> 0x33e3!] 43981+ A? example.com. (29)
0x0000: 0200 0000 4500 0039 92c7 0000 4011 0000 ....E..9....@...
0x0010: 7f00 0001 7f00 0001 524e 0035 0025 fe38 ........RN.5.%.8
0x0020: abcd 0100 0001 0000 0000 0000 0765 7861 .............exa
0x0030: 6d70 6c65 0363 6f6d 0000 0100 01 mple.com.....
16:32:40.796507 IP (tos 0x0, ttl 64, id 37590, offset 0, flags [none], proto UDP (17), length 73, bad cksum 0 (->e9cb)!)
127.0.0.1.53 > 127.0.0.1.21070: [bad udp cksum 0xfe48 -> 0x43fa!] 43981 q: A? example.com. 1/0/0 example.com. A 93.184.216.34 (45)
0x0000: 0200 0000 4500 0049 92d6 0000 4011 0000 ....E..I....@...
0x0010: 7f00 0001 7f00 0001 0035 524e 0035 fe48 .........5RN.5.H
0x0020: abcd 8180 0001 0001 0000 0000 0765 7861 .............exa
0x0030: 6d70 6c65 0363 6f6d 0000 0100 01c0 0c00 mple.com........
0x0040: 0100 0100 0151 8000 045d b8d8 22 .....Q...].."
^C
2 packets captured
23 packets received by filter
0 packets dropped by kernel
åºåã¯ããªã¯ãšã¹ããã¢ãã¬ã¹ã解決ããæ¹æ³ã瀺ããŠããŸãã example.com ãåä¿¡ãããDNS ãµãŒããŒã«ãã£ãŠæ£åžžã«åŠçãããŸããã
ããšã¯ãFirefox ãã©ãŠã¶ã§ãµãŒããŒãã¢ã¯ãã£ãã«ããã ãã§ãã ãããè¡ãã«ã¯ãæ§æããŒãžã§ããã€ãã®èšå®ãå€æŽããå¿ èŠããããŸã çŽïŒèšå®.
ãŸããããã¯ãã©ãŠã¶ã DNS æ å ±ããªã¯ãšã¹ããã API ã®ã¢ãã¬ã¹ã§ãã network.trr.uriã ãŸããDNS ã«ã¢ã¯ã»ã¹ããã«ãã©ãŠã¶èªäœã䜿çšããŠå®å šãª IP 解決ãè¡ãããã«ããã® URL ãããã¡ã€ã³ IP ãæå®ããããšããå§ãããŸãã network.trr.bootstrapAddressã ãããŠæåŸã«ãã©ã¡ãŒã¿èªäœ ãããã¯ãŒã¯.trr.ã¢ãŒã DoH ã®äœ¿çšãå«ãã å€ãã3ãã«èšå®ãããšããã©ãŠã¶ã¯åå解決㫠DNS-over-HTTPS ã®ã¿ã䜿çšããããã«åŒ·å¶ãããŸããäžæ¹ãããä¿¡é Œæ§ãé«ãå®å šãªã2ã㯠DoH ãåªå ããæšæºã® DNS ã«ãã¯ã¢ããããã©ãŒã«ãã㯠ãªãã·ã§ã³ãšããŠæ®ããŸãã
5 å©çïŒ
èšäºã¯åœ¹ã«ç«ã¡ãŸããã? ããã§ã¯ãæ¥ããããããã«ãå¯ä»ãã©ãŒã ïŒäžèšïŒãéããŠãéã§æ¯æŽããŠãã ããã
åºæïŒ habr.com