`odoh-relay.edgecompute.app` not compatible with ODoH latest spec? #2483

ignoramous · 2023-09-14T15:34:44Z

ignoramous
Sep 14, 2023

I notice that odoh-relay.edgecompute.app (a relay advertised at odoh-relay.md) isn't functional with Cloudflare's ODoH endpoint odoh.cloudflare-dns.com/dns-query. I tried multiple odoh clients (incl dnscrypt-proxy), but no cookie. For demonstration, here's the error with the reference implementation of ODoH by Chris Wood et al: odoh-client-go.

./odoh-client odoh --domain www.cloudflare.com. --dnstype AAAA --target odoh.cloudflare-dns.com --proxy odoh-relay.edgecompute.app   
Did not obtain the correct headers from odoh.cloudflare-dns.com with response 
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>503 error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure</title>
  </head>
  <body>
    <h1>Error 503 error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure</h1>
    <p>error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure</p>
    <h3>Error 54113</h3>
    <p>Details: cache-del21748-DEL 1694704694 1026085661</p>
    <hr>
    <p>Varnish cache server</p>
  </body>
</html>

2023/09/14 20:48:15 Did not obtain the correct headers from odoh.cloudflare-dns.com with response 
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>503 error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure</title>
  </head>
  <body>
    <h1>Error 503 error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure</h1>
    <p>error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure</p>
    <h3>Error 54113</h3>
    <p>Details: cache-del21748-DEL 1694704694 1026085661</p>
    <hr>
    <p>Varnish cache server</p>
  </body>
</html>

# also down
➜  odoh-client-go git:(master) ✗ ./odoh-client odoh --domain www.cloudflare.com. --dnstype AAAA --target odoh.cloudflare-dns.com --proxy odoh1.surfdomeinen.nl             
^C

# works
➜ ./odoh-client odoh --domain www.cloudflare.com. --dnstype AAAA --target odoh.cloudflare-dns.com --proxy odoh-nl.alekberg.net 
;; opcode: QUERY, status: NOERROR, id: 47618
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.cloudflare.com.	IN	 AAAA

;; ANSWER SECTION:
www.cloudflare.com.	34	IN	AAAA	2606:4700::6810:7c60
www.cloudflare.com.	34	IN	AAAA	2606:4700::6810:7b60

(from #2482)

jedisct1 · 2023-09-14T15:55:22Z

jedisct1
Sep 14, 2023
Maintainer

Already discussed here: DNSCrypt/dnscrypt-resolvers#831

Unfortunately, this is not a protocol issue, but Cloudflare blocking it, presumably because it sent too much traffic.

3 replies

ignoramous Sep 14, 2023
Author

Sad. Is the code to deploy to Fastly open source?

jedisct1 Sep 14, 2023
Maintainer

Not yet, I need to clean it up a little bit, and more importantly, make it independent from Fastly's proprietary API.

I guess Cloudflare are rate limiting the entire IP ranges, so deploying another instance on Fastly wouldn't do much.

ignoramous Feb 12, 2024
Author

I guess Cloudflare are rate limiting the entire IP ranges, so deploying another instance on Fastly wouldn't do much.

Not sure if its helpful to debug on your end; but from a javascript proxy I deployed recently, I notice that https://odoh.cloudflare-dns.com/dns-query 301s to https://one.one.one.one/dns-query but following the redirect -- copying request.body as buffer (whatwg streams don't work) and re-setting request.headers -- gets me a 415 Unsupported Media Type instead. Clearly, odoh-nl.alekberg.net is doing something my proxy isn't.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`odoh-relay.edgecompute.app` not compatible with ODoH latest spec? #2483

{{title}}

Replies: 1 comment 3 replies

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

odoh-relay.edgecompute.app not compatible with ODoH latest spec? #2483

ignoramous Sep 14, 2023

Replies: 1 comment · 3 replies

jedisct1 Sep 14, 2023 Maintainer

ignoramous Sep 14, 2023 Author

jedisct1 Sep 14, 2023 Maintainer

ignoramous Feb 12, 2024 Author

`odoh-relay.edgecompute.app` not compatible with ODoH latest spec? #2483

ignoramous
Sep 14, 2023

Replies: 1 comment 3 replies

jedisct1
Sep 14, 2023
Maintainer

ignoramous Sep 14, 2023
Author

jedisct1 Sep 14, 2023
Maintainer

ignoramous Feb 12, 2024
Author