mirror of
https://github.com/pi-hole/FTL.git
synced 2026-08-20 23:07:31 +01:00
DL6ER
49fee227a9
Serve DNS-over-TLS (port 853) and DNS-over-HTTPS to downstream clients, so a Pi-hole can offer encrypted DNS on the LAN without a separate proxy. Decrypted queries are handed to dnsmasq over a loopback TCP connection - one reused per worker thread and closed when that thread exits - rather than through a direct `tcp_request()`/fork, so nothing unsafe runs off the listener threads. The real downstream client is carried into dnsmasq as a private EDNS option, MAC-bound to the query and trusted only from loopback, so the query is attributed to the actual client (per-client rate limits, groups, logging) and not to the loopback handoff. Only well-formed queries are attributed: one whose `OPT` record would drive dnsmasq's non-reentrant `rrfilter()` is rejected, and a query that cannot carry the attribution option fails closed rather than being forwarded unattributed. Access honors `dns.listeningMode` (`dotdoh_source_allowed`), so an on-by-default server is not an open resolver. DoH answers are padded to an RFC 8467 boundary only when the client asked for padding. New config keys `dns.dot` and `dns.doh` gate the two listeners. Covered by `test/dotdoh_server.bats` and the `dotdoh_regression` executable (built under ASan/UBSan). Signed-off-by: DL6ER <dl6er@dl6er.de>