Http3 and Tor

[syphyr]

After reading the comment on 8523a92 , does http3 support tor proxy when when packets are converted to tcp ( force_tcp = true )?

[jedisct1]

I don't think Tor supports HTTP/3. By the way, HTTP/3 uses UDP, not TCP.

[syphyr]

I don't think Tor supports HTTP/3. By the way, HTTP/3 uses UDP, not TCP.

Correct, HTTP/3 uses UDP and Tor only supports TCP. I was just curious if dnscrypt was able to somehow convert HTTP/3 to support packets over TCP when force_tcp was enabled. Perhaps then this should be noted in the config.

[galpt]

Unless Tor supports UDP, I don't think using HTTP/3 over TCP is even okay to begin with.
Since those devs designed HTTP/3 to use UDP, the idea is to avoid head-of-line blocking which is caused by using TCP.
That isn't a problem anymore when streams are sent over UDP with QUIC making sure to retrieve the dropped packets if there's any.
So using TCP will make HTTP/3 quite useless as avoiding head-of-line blocking is quite the main benefit, other than 0-RTT and more.

[jedisct1]

0-RTT allows linkability (servers can link your VPN IPs to your real IPs for example) so this is not an advantage in the context of DNS privacy.

DNS over Tor also enables another form of linkability (the ability to link all the requests made by the same device).

So that would be the worst of both worlds.

Use Anonymized DNSCrypt. It's more efficient and doesn't have these issues.

[galpt]

Related to HTTP/3,
using dnscrypt-2.1.2, I couldn't get HTTP/3 to work.

D:\dnscrypt-2.1.2>dnscrypt-proxy
[2022-09-23 15:47:58] [NOTICE] dnscrypt-proxy 2.1.2
[2022-09-23 15:47:58] [NOTICE] Network connectivity detected
[2022-09-23 15:47:58] [NOTICE] Now listening to 0.0.0.0:53 [UDP]
[2022-09-23 15:47:58] [NOTICE] Now listening to 0.0.0.0:53 [TCP]
[2022-09-23 15:47:58] [NOTICE] Source [relays] loaded
[2022-09-23 15:47:58] [NOTICE] Source [public-resolvers] loaded
[2022-09-23 15:47:58] [NOTICE] Firefox workaround initialized
[2022-09-23 15:48:10] [INFO] [castella-0ms] [https://dns.0ms.run/dns-query]: Post "https://dns.0ms.run/dns-query?body_hash=67fd50990ae9aede4593e5efc94ef3cc173a452fe582d6deb17c9cb3f5a94873": lookup dns.0ms.run: no such host (Client.Timeout exceeded while awaiting headers)
[2022-09-23 15:48:10] [ERROR] Post "https://dns.0ms.run/dns-query?body_hash=67fd50990ae9aede4593e5efc94ef3cc173a452fe582d6deb17c9cb3f5a94873": lookup dns.0ms.run: no such host (Client.Timeout exceeded while awaiting headers)
[2022-09-23 15:48:10] [NOTICE] dnscrypt-proxy is waiting for at least one server to be reachable
[2022-09-23 15:48:28] [NOTICE] Stopped.

Prior to that, the upstream server (https://dns.0ms.run/dns-query) works just fine when dnscrypt is using HTTP/2,
and HTTP/3 also works fine with Chrome's built-in Use secure DNS feature with the following log:

Method:                POST
HTTP Version:       HTTP/3
Host:                     dns.0ms.run
Path:                      /dns-query
Query string:        Empty query string
User agent:           Chrome

Also tested with other DNS app such as Nebulo (android).
Again, HTTP/3 works just fine with the following log:

Method:                POST
HTTP Version:       HTTP/3
Host:                     dns.0ms.run
Path:                      /dns-query
Query string:        Empty query string
User agent:           com.frostnerd.smokescreen/80 (Linux; U; Android 12; en; CPH2217; Build/SP1A.210812.016; Cronet/104.0.5112.46)

I don't think something's wrong with the dnscrypt-proxy.toml as it's using the default that's already included inside dnscrypt-proxy-win64-2.1.2.zip.
Not sure either if I have to open a new Issue out of it. Still confused and need more confirmation from others if possible.

[galpt]

[static]

  [static.'castella-0ms']
    stamp = 'sdns://AgcAAAAAAAAAAAALZG5zLjBtcy5ydW4KL2Rucy1xdWVyeQ'

btw why the stamp though?

[jedisct1]

Since the stamp doesn't include any IP address, are the fallback resolvers able to resolve dns.0ms.run?

[galpt]

Not sure what's this fallback resolvers thing, but bootstrap_resolvers is set to ['1.1.1.1:53'].
Also, it's fine, it's not like I need to use http3 that bad.
Using http3 = false works fine with the dns.0ms.run stamp, so I'll stick with that.

[lifenjoiner]

Your server has 3 IPs resolved:

Answers:
        dns.0ms.run    .        410     A       172.67.72.133
        dns.0ms.run    .        410     A       104.26.1.178
        dns.0ms.run    .        410     A       104.26.0.178

Only 172.67.72.133 responses to both TCP and UDP, on my side.
dnscrypt-proxy needs http/2 (TCP) communication first to get config to upgrade to http/3 (UDP).
Most of the time, the other 2 IPs are adopted, and then timed out ...

[jedisct1]

Great investigation, @lifenjoiner !