DNS.Resolvers should be used for DNS multiaddrs: /dnsaddr /dns /dns4 /dns6

[lidel]

Version

0.14.0

Bug description

DNS.Resolvers allows for setting DNS over HTTPS resolver per domain or globally (. catch-all).

Custom DNS resolver set there is:

• :green_circle: used when resolving DNSLink records (content addresses)
• :red_circle: NOT used when resolving /dnsaddr, /dns, /dns4, /dns6 multiaddrs (peer addresses).

Threat model

Peer addresses include /p2p/{libp2p-key}, which removes the surface for MITM, so no peer identity spoofing / tampering is possible.

However, a privacy/censorship concern remains. DNS resolver provided by the operating system (delegating queries to user's ISP in cleartext) may lie about IPs, or simply return no TXT records, which will block access to things like bootstrappers at /dnsaddr/bootstrap.libp2p.io/, effectively cutting off user from IPFS network.

How to reproduce

To confirm that DNS.Resolvers is used for DNSLink, but not for DNSAddr, set bootstrap to DNS-only peers AND set DNS resolver to invalid one (which should always fail):

  "Bootstrap": [
    "/dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDu7bfjPFoTZYxMNLWUQJyrVwtbZg5gBMjTezGAJN",
    "/dnsaddr/bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa",
    "/dnsaddr/bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb",
    "/dnsaddr/bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjYZcYW3dwt"
  ],
  "DNS": {
    "Resolvers": {
      ".": "https://dns.invalid/dns-query"
    }
  },

After rebooting your daemon (with fresh repo, no prior peers cached, no mdns):

• :+1: ipfs resolve /ipns/en.wikipedia-on-ipfs.org will fail with could not resolve name
• :-1: node starts fine and ipfs swarm connect /dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDu7bfjPFoTZYxMNLWUQJyrVwtbZg5gBMjTezGAJN will connect just fine.
  • invalid DoH resolved was not used – we expected connection to fail the same way dnslink did, but it worked. this means DNS.Resolvers are not applied to multiaddrs, only to DNSLink.

What is interesting, doing manual ipfs swarm connect /dnsaddr/ipfs.aergia.eu fails as expected:

$ ipfs swarm connect /dnsaddr/ipfs.aergia.eu
Error: Post "https://dns.invalid/dns-query": dial tcp: lookup dns.invalid on 1.1.1.1:53: no such host

So.. parts are wired up (manual swarm connect), parts are not (bootstrappers).

Expected behavior

DNS.Resolvers (if defined) should be used for resolving all DNS-based multiaddrs, namely:

• /dnsaddr
• /dns
• /dns4
• /dns6

Related

cc https://github.com/libp2p/go-libp2p/pull/1607

[matyapiro31]

My issue is very relevant, so I write here, 1:These DoH config has no fall back system. (eg: when cloudflare service is not available, I want to use another DoH service.) 2: Add DNS over TLS/QUIC support. DoQ is the safest way to get DNS. some non-ICANN service, such as OpenNIC provides only DoT.

[lidel]

@matyapiro31 fallback resolvers are tracked in #8173. Please fill a separate issue for TLS/QUIC transport support :pray: