Qaybaha kala duwan ee hawlgalka DNS ayaa horeba qoraagu si isdaba joog ah ugu taabtay tiro ka mid ah la daabacay oo qayb ka ah blogga. Isla markaana waxa xoogga la saaray mar walba hagaajinta ammaanka adeeggan muhiimka ah ee Internetka.
Ilaa dhawaan, in kasta oo baylahnimada cad ee taraafikada DNS, taas oo weli, inta badan, lagu kala qaado si cad, falalka xaasidnimo ee qayb ka mid ah bixiyeyaasha doonaya in ay kordhiyaan dakhligooda by gundhig advertising in content, hay'adaha ammaanka dawladda iyo faafreebka. iyo sidoo kale dembiilayaal fudud, habka , inkastoo ay jiraan teknoolojiyad kala duwan sida DNSSEC/DANE, DNScrypt, DNS-over-TLS iyo DNS-over-HTTPS, ayaa istaagay. Haddii xalalka server-ka, iyo qaar ka mid ah ay jireen muddo dheer, si weyn loo yaqaan oo la heli karo, taageeradooda software-ka macmiilka ayaa ka tagaysa wax badan oo la rabo.
Nasiib wanaag, xaaladdu way isbedelaysaa. Gaar ahaan, horumarinta browserka caanka ah ee Firefox ku saabsan qorshayaasha lagu suurtagelinayo habka taageerada sida caadiga ah (DoH) dhawaan. Tani waa inay gacan ka geysato ilaalinta taraafikada isticmaalaha WWW ee DNS hanjabaadaha kor ku xusan, laakiin waxay soo bandhigi kartaa kuwa cusub.
1. Dhibaatooyinka DNS-over-HTTPS
Jaleecada hore, bilawga bilawga ballaaran ee DNS-over-HTTPS ee software-ka internetka ayaa keena kaliya falcelin togan. Si kastaba ha ahaatee, Ibliisku, sida ay yiraahdaan, ayaa ku jira faahfaahinta.
Dhibaatada ugu horreysa ee xaddidaysa baaxadda isticmaalka baahsan ee DoH waa diiradda ay ku hayso oo keliya taraafikada shabakadda. Runtii, borotokoolka HTTP iyo nooca hadda HTTP/2, ee ay DoH ku salaysan tahay, ayaa ah saldhigga WWW. Laakin internetku maaha webka oo kaliya. Waxaa jira adeegyo badan oo caan ah, sida iimaylka, fariimaha degdega ah ee kala duwan, nidaamyada wareejinta faylka, qulqulka warbaahinta badan, iwm, kuwaas oo aan isticmaalin HTTP. Sidaa darteed, inkastoo fikradda qaar badan oo ka mid ah DoH ay tahay panacea, waxay soo baxday inay tahay mid aan la dabaqi karin iyada oo aan la helin dadaal dheeraad ah (iyo aan loo baahnayn) wax aan ahayn tiknoolajiyada browserka. Jid ahaan, DNS-over-TLS waxay u egtahay musharax aad ugu qalma doorkan, kaas oo hirgelinaya soo koobida taraafikada caadiga ah ee DNS ee nidaamka caadiga ah ee aaminka ah ee TLS.
Dhibaatada labaad, oo laga yaabo inay aad uga muhiimsan tahay tii hore, waa ka tagista dhabta ah ee maamul daadejinta ee DNS iyada oo loo marayo naqshadeynta isticmaalka hal server oo DoH ah oo lagu qeexay goobaha browserka. Gaar ahaan, Mozilla waxay soo jeedinaysaa isticmaalka adeegga Cloudflare. Adeeg kan la mid ah ayaa sidoo kale waxaa furay dad kale oo caan ah oo internetka ah, gaar ahaan Google. Waxay soo baxday in hirgelinta DNS-over-HTTPS ee qaabka hadda la soo jeediyay ay kordhiso kaliya ku-tiirsanaanta isticmaalayaasha dhamaadka adeegyada ugu weyn. Wax qarsoodi ah maaha in macluumaadka ay falanqaynta weydiimaha DNS ay bixin karaan ay ururin karaan xitaa xog badan oo ku saabsan, iyo sidoo kale kordhinta saxnimadeeda iyo ku habboonaanta.
Marka tan la eego, qoraagu wuxuu ahaa oo weli taageere u ah hirgelinta ballaaran ma aha DNS-over-HTTPS, laakiin ee DNS-over-TLS oo ay la socdaan DNSSEC/DANE oo ah mid caalami ah, ammaan ah oo aan ku habooneyn in la sii daro barta internetka macnaheedu si loo hubiyo amniga taraafikada DNS. Nasiib darro, sababo muuqda dartood, qofna ma filan karo in si degdeg ah loo soo bandhigo taageerada ballaaran ee DoH beddelka software-ka macmiilka, oo weli waa goobta xiiseeya tignoolajiyada amniga.
Laakiin maadaama aan hadda haysanno DoH, maxaad u isticmaali weyday ka dib markii aan ka baxsannay ilaalinta suurtagalka ah ee shirkadaha iyada oo loo marayo server-kooda server-ka DNS-over-HTTPS?
2. Nidaamka DNS-over-HTTPS
Haddii aad eegto halbeegga Sharaxaadda nidaamka DNS-over-HTTPS, waxaad arki kartaa inay tahay, runtii, API web kaas oo kuu oggolaanaya inaad ku soo koobto xirmo DNS caadiga ah ee borotokoolka HTTP/2. Tan waxaa lagu fuliyaa iyada oo loo marayo madax-madaxeedyo gaar ah oo HTTP ah, iyo sidoo kale beddelka qaabka binary ee xogta DNS la gudbiyo (eeg. iyo dukumentiyada xiga) oo galay foom kuu ogolaanaya inaad gudbiso oo aad hesho, iyo sidoo kale la shaqeyso xogta muhiimka ah ee lagama maarmaanka ah.
Marka loo eego heerka, kaliya HTTP/2 iyo isku xirka TLS ee sugan ayaa la taageeray.
Diridda codsiga DNS waxaa lagu samayn karaa iyadoo la isticmaalayo habka GET iyo POST ee caadiga ah. Xaaladda kowaad, codsiga waxa loo beddelaa xadhig ku xidhan base64URL, iyo tan labaad, iyada oo loo marayo jidhka codsiga POST oo ah qaab laba-geesood ah. Xaaladdan oo kale, nooca xogta MIME gaar ah ayaa la isticmaalaa inta lagu jiro codsiga DNS iyo jawaabta Codsiga/dns-fariinta.
root@eprove:~ # curl -H 'accept: application/dns-message' 'https://my.domaint/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE' -v
* Trying 2001:100:200:300::400:443...
* TCP_NODELAY set
* Connected to eprove.net (2001:100:200:300::400) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /usr/local/share/certs/ca-root-nss.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=my.domain
* start date: Jul 22 00:07:13 2019 GMT
* expire date: Oct 20 00:07:13 2019 GMT
* subjectAltName: host "my.domain" matched cert's "my.domain"
* issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x801441000)
> GET /dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE HTTP/2
> Host: eprove.net
> User-Agent: curl/7.65.3
> accept: application/dns-message
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
< HTTP/2 200
< server: h2o/2.3.0-beta2
< content-type: application/dns-message
< cache-control: max-age=86274
< date: Thu, 12 Sep 2019 13:07:25 GMT
< strict-transport-security: max-age=15768000; includeSubDomains; preload
< content-length: 45
<
Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.
* Failed writing body (0 != 45)
* stopped the pause stream!
* Connection #0 to host eprove.net left intactSidoo kale fiiro gaar ah u yeelo cinwaanka Xakamaynta kaydinta: jawaabta ka timid server-ka shabakada. In halbeegga da'da ugu badan waxay ka kooban tahay qiimaha TTL ee diiwaanka DNS ee la soo celiyay (ama qiimaha ugu yar haddii qayb iyaga ka mid ah la soo celinayo).
Sida kor ku xusan, shaqeynta server-ka DoH wuxuu ka kooban yahay dhowr marxaladood.
- Hel codsi HTTP Haddi ay tani tahay GET ka dibna baakadda ka codeing base64URL
- U dir xirmadan server-ka DNS
- Jawaab ka hel server-ka DNS
- Ka hel qiimaha ugu yar ee TTL ee diiwaannada la helay.
- U soo celi jawaabta macmiilka adigoo isticmaalaya HTTP.
3. Seerfarkaaga DNS-over-HTTPS
Habka ugu fudud, ugu dhaqsaha badan uguna wax ku oolka badan ee aad u maamuli karto server-kaaga DNS-over-HTTPS waa in aad adeegsato server-ka HTTP/2 , kaas oo uu qoraagu mar hore si kooban wax uga qoray (eeg "").
Doorashadan waxaa taageeraya xaqiiqda ah in dhammaan koodka server-kaaga DoH si buuxda loo hirgelin karo iyadoo la adeegsanayo turjumaanka lagu dhex daray H2O laftiisa . Marka lagu daro maktabadaha caadiga ah, si aad xogta ugu beddelato server-ka DNS, waxaad u baahan tahay (mrbgem) maktabadda Socket, kaas oo, nasiib wanaag, horay loogu daray nooca horumarinta hadda ee H2O 2.3.0-beta2 dekedaha FreeBSD. Si kastaba ha ahaatee, ma adka in lagu daro nooc kasta oo hore iyadoo la xirayo kaydka ilaa buugga /deps ka hor inta aan la ururin.
root@beta:~ # uname -v
FreeBSD 12.0-RELEASE-p10 GENERIC
root@beta:~ # cd /usr/ports/www/h2o
root@beta:/usr/ports/www/h2o # make extract
===> License MIT BSD2CLAUSE accepted by the user
===> h2o-2.2.6 depends on file: /usr/local/sbin/pkg - found
===> Fetching all distfiles required by h2o-2.2.6 for building
===> Extracting for h2o-2.2.6.
=> SHA256 Checksum OK for h2o-h2o-v2.2.6_GH0.tar.gz.
===> h2o-2.2.6 depends on file: /usr/local/bin/ruby26 - found
root@beta:/usr/ports/www/h2o # cd work/h2o-2.2.6/deps/
root@beta:/usr/ports/www/h2o/work/h2o-2.2.6/deps # git clone https://github.com/iij/mruby-socket.git
ΠΠ»ΠΎΠ½ΠΈΡΠΎΠ²Π°Π½ΠΈΠ΅ Π² Β«mruby-socketΒ»β¦
remote: Enumerating objects: 385, done.
remote: Total 385 (delta 0), reused 0 (delta 0), pack-reused 385
ΠΠΎΠ»ΡΡΠ΅Π½ΠΈΠ΅ ΠΎΠ±ΡΠ΅ΠΊΡΠΎΠ²: 100% (385/385), 98.02 KiB | 647.00 KiB/s, Π³ΠΎΡΠΎΠ²ΠΎ.
ΠΠΏΡΠ΅Π΄Π΅Π»Π΅Π½ΠΈΠ΅ ΠΈΠ·ΠΌΠ΅Π½Π΅Π½ΠΈΠΉ: 100% (208/208), Π³ΠΎΡΠΎΠ²ΠΎ.
root@beta:/usr/ports/www/h2o/work/h2o-2.2.6/deps # ll
total 181
drwxr-xr-x 9 root wheel 18 12 Π°Π²Π³. 16:09 brotli/
drwxr-xr-x 2 root wheel 4 12 Π°Π²Π³. 16:09 cloexec/
drwxr-xr-x 2 root wheel 5 12 Π°Π²Π³. 16:09 golombset/
drwxr-xr-x 4 root wheel 35 12 Π°Π²Π³. 16:09 klib/
drwxr-xr-x 2 root wheel 5 12 Π°Π²Π³. 16:09 libgkc/
drwxr-xr-x 4 root wheel 26 12 Π°Π²Π³. 16:09 libyrmcds/
drwxr-xr-x 13 root wheel 32 12 Π°Π²Π³. 16:09 mruby/
drwxr-xr-x 5 root wheel 11 12 Π°Π²Π³. 16:09 mruby-digest/
drwxr-xr-x 5 root wheel 10 12 Π°Π²Π³. 16:09 mruby-dir/
drwxr-xr-x 5 root wheel 10 12 Π°Π²Π³. 16:09 mruby-env/
drwxr-xr-x 4 root wheel 9 12 Π°Π²Π³. 16:09 mruby-errno/
drwxr-xr-x 5 root wheel 14 12 Π°Π²Π³. 16:09 mruby-file-stat/
drwxr-xr-x 5 root wheel 10 12 Π°Π²Π³. 16:09 mruby-iijson/
drwxr-xr-x 5 root wheel 11 12 Π°Π²Π³. 16:09 mruby-input-stream/
drwxr-xr-x 6 root wheel 11 12 Π°Π²Π³. 16:09 mruby-io/
drwxr-xr-x 5 root wheel 10 12 Π°Π²Π³. 16:09 mruby-onig-regexp/
drwxr-xr-x 4 root wheel 10 12 Π°Π²Π³. 16:09 mruby-pack/
drwxr-xr-x 5 root wheel 10 12 Π°Π²Π³. 16:09 mruby-require/
drwxr-xr-x 6 root wheel 10 12 ΡΠ΅Π½Ρ. 16:10 mruby-socket/
drwxr-xr-x 2 root wheel 9 12 Π°Π²Π³. 16:09 neverbleed/
drwxr-xr-x 2 root wheel 13 12 Π°Π²Π³. 16:09 picohttpparser/
drwxr-xr-x 2 root wheel 4 12 Π°Π²Π³. 16:09 picotest/
drwxr-xr-x 9 root wheel 16 12 Π°Π²Π³. 16:09 picotls/
drwxr-xr-x 4 root wheel 8 12 Π°Π²Π³. 16:09 ssl-conservatory/
drwxr-xr-x 8 root wheel 18 12 Π°Π²Π³. 16:09 yaml/
drwxr-xr-x 2 root wheel 8 12 Π°Π²Π³. 16:09 yoml/
root@beta:/usr/ports/www/h2o/work/h2o-2.2.6/deps # cd ../../..
root@beta:/usr/ports/www/h2o # make install clean
...Qaabeynta server-ka shabakadu guud ahaan waa heer.
root@beta:/usr/ports/www/h2o # cd /usr/local/etc/h2o/
root@beta:/usr/local/etc/h2o # cat h2o.conf
# this sample config gives you a feel for how h2o can be used
# and a high-security configuration for TLS and HTTP headers
# see https://h2o.examp1e.net/ for detailed documentation
# and h2o --help for command-line options and settings
# v.20180207 (c)2018 by Max Kostikov http://kostikov.co e-mail: [email protected]
user: www
pid-file: /var/run/h2o.pid
access-log:
path: /var/log/h2o/h2o-access.log
format: "%h %v %l %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i""
error-log: /var/log/h2o/h2o-error.log
expires: off
compress: on
file.dirlisting: off
file.send-compressed: on
file.index: [ 'index.html', 'index.php' ]
listen:
port: 80
listen:
port: 443
ssl:
cipher-suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
cipher-preference: server
dh-file: /etc/ssl/dhparams.pem
certificate-file: /usr/local/etc/letsencrypt/live/eprove.net/fullchain.pem
key-file: /usr/local/etc/letsencrypt/live/my.domain/privkey.pem
hosts:
"*.my.domain":
paths: &go_tls
"/":
redirect:
status: 301
url: https://my.domain/
"my.domain:80":
paths: *go_tls
"my.domain:443":
header.add: "Strict-Transport-Security: max-age=15768000; includeSubDomains; preload"
paths:
"/dns-query":
mruby.handler-file: /usr/local/etc/h2o/h2odoh.rbWaxa kaliya ee ka reeban waa maamulaha URL /dns-waydiin kaas oo server-kayaga DNS-over-HTTPS, oo ku qoran mruby oo loogu yeero ikhtiyaarka maamulaha, ayaa dhab ahaantii ka mas'uul ah mruby.handler-file.
root@beta:/usr/local/etc/h2o # cat h2odoh.rb
# H2O HTTP/2 web server as DNS-over-HTTP service
# v.20190908 (c)2018-2019 Max Kostikov https://kostikov.co e-mail: [email protected]
proc {|env|
if env['HTTP_ACCEPT'] == "application/dns-message"
case env['REQUEST_METHOD']
when "GET"
req = env['QUERY_STRING'].gsub(/^dns=/,'')
# base64URL decode
req = req.tr("-_", "+/")
if !req.end_with?("=") && req.length % 4 != 0
req = req.ljust((req.length + 3) & ~3, "=")
end
req = req.unpack1("m")
when "POST"
req = env['rack.input'].read
else
req = ""
end
if req.empty?
[400, { 'content-type' => 'text/plain' }, [ "Bad Request" ]]
else
# --- ask DNS server
sock = UDPSocket.new
sock.connect("localhost", 53)
sock.send(req, 0)
str = sock.recv(4096)
sock.close
# --- find lowest TTL in response
nans = str[6, 2].unpack1('n') # number of answers
if nans > 0 # no DNS failure
shift = 12
ttl = 0
while nans > 0
# process domain name compression
if str[shift].unpack1("C") < 192
shift = str.index("x00", shift) + 5
if ttl == 0 # skip question section
next
end
end
shift += 6
curttl = str[shift, 4].unpack1('N')
shift += str[shift + 4, 2].unpack1('n') + 6 # responce data size
if ttl == 0 or ttl > curttl
ttl = curttl
end
nans -= 1
end
cc = 'max-age=' + ttl.to_s
else
cc = 'no-cache'
end
[200, { 'content-type' => 'application/dns-message', 'content-length' => str.size, 'cache-control' => cc }, [ str ] ]
end
else
[415, { 'content-type' => 'text/plain' }, [ "Unsupported Media Type" ]]
end
}Fadlan la soco in server-ka caching ee deegaanka uu mas'uul ka yahay socodsiinta xirmooyinka DNS, kiiskan laga soo bilaabo qaybinta caadiga ah ee FreeBSD. Marka laga eego dhinaca amniga, tani waa xalka ugu fiican. Si kastaba ha ahaatee, ma jiraan wax kaa diidaya inaad beddesho localhost ciwaan ka duwan DNS oo aad doonayso inaad isticmaasho.
root@beta:/usr/local/etc/h2o # local-unbound verison
usage: local-unbound [options]
start unbound daemon DNS resolver.
-h this help
-c file config file to read instead of /var/unbound/unbound.conf
file format is described in unbound.conf(5).
-d do not fork into the background.
-p do not create a pidfile.
-v verbose (more times to increase verbosity)
Version 1.8.1
linked libs: mini-event internal (it uses select), OpenSSL 1.1.1a-freebsd 20 Nov 2018
linked modules: dns64 respip validator iterator
BSD licensed, see LICENSE in source package for details.
Report bugs to [email protected]
root@eprove:/usr/local/etc/h2o # sockstat -46 | grep unbound
unbound local-unbo 69749 3 udp6 ::1:53 *:*
unbound local-unbo 69749 4 tcp6 ::1:53 *:*
unbound local-unbo 69749 5 udp4 127.0.0.1:53 *:*
unbound local-unbo 69749 6 tcp4 127.0.0.1:53 *:*Waxa hadhay waa in dib loo bilaabo H2O oo aan aragno waxa ka soo baxa.
root@beta:/usr/local/etc/h2o # service h2o restart
Stopping h2o.
Waiting for PIDS: 69871.
Starting h2o.
start_server (pid:70532) starting now...4. Tijaabinta
Markaa, aan hubino natiijooyinka anagoo u dirayna codsi imtixaan mar kale oo aan eegno taraafikada shabakada adoo isticmaalaya utility tcpdump.
root@beta/usr/local/etc/h2o # curl -H 'accept: application/dns-message' 'https://my.domain/dns-query?dns=q80BAAABAAAAAAAAB2V4YW1wbGUDY29tAAABAAE'
Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.
...
root@beta:~ # tcpdump -n -i lo0 udp port 53 -xx -XX -vv
tcpdump: listening on lo0, link-type NULL (BSD loopback), capture size 262144 bytes
16:32:40.420831 IP (tos 0x0, ttl 64, id 37575, offset 0, flags [none], proto UDP (17), length 57, bad cksum 0 (->e9ea)!)
127.0.0.1.21070 > 127.0.0.1.53: [bad udp cksum 0xfe38 -> 0x33e3!] 43981+ A? example.com. (29)
0x0000: 0200 0000 4500 0039 92c7 0000 4011 0000 ....E..9....@...
0x0010: 7f00 0001 7f00 0001 524e 0035 0025 fe38 ........RN.5.%.8
0x0020: abcd 0100 0001 0000 0000 0000 0765 7861 .............exa
0x0030: 6d70 6c65 0363 6f6d 0000 0100 01 mple.com.....
16:32:40.796507 IP (tos 0x0, ttl 64, id 37590, offset 0, flags [none], proto UDP (17), length 73, bad cksum 0 (->e9cb)!)
127.0.0.1.53 > 127.0.0.1.21070: [bad udp cksum 0xfe48 -> 0x43fa!] 43981 q: A? example.com. 1/0/0 example.com. A 93.184.216.34 (45)
0x0000: 0200 0000 4500 0049 92d6 0000 4011 0000 ....E..I....@...
0x0010: 7f00 0001 7f00 0001 0035 524e 0035 fe48 .........5RN.5.H
0x0020: abcd 8180 0001 0001 0000 0000 0765 7861 .............exa
0x0030: 6d70 6c65 0363 6f6d 0000 0100 01c0 0c00 mple.com........
0x0040: 0100 0100 0151 8000 045d b8d8 22 .....Q...].."
^C
2 packets captured
23 packets received by filter
0 packets dropped by kernelSoosaarku wuxuu muujinayaa sida codsiga loo xalliyo ciwaanka example.com waxaa helay oo si guul leh uga shaqeeyay server-ka DNS.
Hadda waxa hadhay waa in aan ka hawl galno server-kayaga browserka Firefox-ka. Si tan loo sameeyo, waxaad u baahan tahay inaad bedesho dhowr habayn oo ku yaal boggaga qaabeynta ku saabsan: config.
Marka hore, kani waa ciwaanka API-ga kaas oo browserku ku codsan doono macluumaadka DNS network.trr.uri. Waxa kale oo lagu talinayaa in aad ka caddayso goobta IP-ga URL-kan si loo helo xalinta IP-ga ee sugan iyada oo la adeegsanayo browserka laftiisa iyada oo aan la gelin DNS gudaha network.trr.bootstrapCinwaanka. Ugu dambeyntiina, halbeegga laftiisa network.trr.mode oo ay ku jiraan isticmaalka DoH. Dejinta qiimaha "3" waxay ku qasbi doontaa browserka inuu isticmaalo si gaar ah DNS-over-HTTPS si loo xalliyo magaca, halka "2" aadka la isku halleyn karo oo ammaan ah ay mudnaanta siin doonto DoH, taasoo ka tagaysa raadinta caadiga ah ee DNS sida ikhtiyaarka dib-u-dhaca.
5. FAA'IIDO!
Maqaalku ma ahaa mid waxtar leh? Markaa fadlan ha ka xishoon oo lacag ku taageer foomka deeqda (hoos).
Source: www.habr.com