DNS Stamp Bootstrapping Bug
Setting the default upstream DNS Resolver using a full DoH DNS Stamp (including the IP within the stamp), blocky should not need a bootstrap DNS resolver or fallback to the system resolver. i.e. Blocky has the domain and IP/A record already in the stamp.
Currently, it seems blocky doesn't realise when the stamp contains all the info needed (such as IP/A) and then tries to use a bootstrap or system resolver. This could be a security leak, or even allow third-parties to block the upstream resolver when using DoH, which DNS Stamp seeks to prevent.
e.g. This config with has full DNS Stamp (inc IP) using Mullvads DoH. No bootstrapping DNS configured:
```yaml
upstreams:
groups:
default:
- sdns://AgcAAAAAAAAACzE5NC4yNDIuMi4yAA9kbnMubXVsbHZhZC5uZXQKL2Rucy1xdWVyeQ
```
Leads to this console log:
```
INFO bootstrap: bootstrapDns is not configured, will use system resolver
```
You can [decode DNS Stamps here](https://dnscrypt.info/stamps/) and you'll see that the above stamp includes the domain and the IP, therefore not needing any boostrap or system resolver.
However, the following incomplete DoH stamp, does not include the optional IP and would need a bootstrap DNS or system resolver.
```
sdns://AgcAAAAAAAAAAAAPZG5zLm11bGx2YWQubmV0Ci9kbnMtcXVlcnk
```
Also, these Mullvad DNS stamps only include IPv4 IP's - is there a way to generate a stamp that has IPv6 as well as IPv4 in one stamp?
1 条评论