Dns-over-Https TLS: handshake failure

[wjbridge]

Prerequisites

• [v] I am running the latest version
• [v] I checked the documentation and found no answer
• [v] I checked to make sure that this issue has not already been filed

Issue Details

• Version of AdGuard Home server:
  • v0.103.3, channel release, arch linux amd64
• How did you setup DNS configuration:
  • Router
• If it's a router or IoT, please write device model:
  • Netgear 7000 pointing to Adguard in docker container
• Operating system and version:
  • Ubuntu 20.04.1 LTS

Expected Behavior

Expected https-over-dns to work out of the box when making DNS queries. Getting TLS handshake errors

Actual Behavior

Getting TLS handshake failures for any dns-over-https url

• https://dns10.quad9.net/dns-query
• https://cloudflare-dns.com/dns-query

2020/10/13 19:51:28 [info] Couldn't request filter from URL https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt, skipping: Get "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt": couldn't initialize HTTP client or transport, cause: couldn't do a POST request to 'https://dns10.quad9.net:443/dns-query', cause: Get "https://dns10.quad9.net:443/dns-query?dns=gkwBAAABAAAAAAAACGlwdjRvbmx5BGFycGEAAAEAAQ": remote error: tls: handshake failure

2020/10/13 19:51:28 [error] os.Chtimes(): chtimes /opt/adguardhome/work/data/filters/1.txt: no such file or directory

2020/10/13 19:51:28 [info] Failed to update filter https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt: Get "https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt": couldn't initialize HTTP client or transport, cause: couldn't do a POST request to 'https://dns10.quad9.net:443/dns-query', cause: Get "https://dns10.quad9.net:443/dns-query?dns=gkwBAAABAAAAAAAACGlwdjRvbmx5BGFycGEAAAEAAQ": remote error: tls: handshake failure

Additional Information

• Same problem occurs on using the edge docker image
• Tried network type in docker as host and bridged
• Followed the docker setup for disabling the DNSStubListener=no
• Tried tls://dns.quad9.net but same problem
• Executed this command curl -H 'accept: application/dns-message' -v 'https://dns10.quad9.net:443/dns-query?dns=gkwBAAABAAAAAAAACGlwdjRvbmx5BGFycGEAAAEAAQ' and worked output was SSL certificate verify ok

[ameshkov]

Tbh I have no idea, you may need to capture tcpdump and see what's going on there

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[danlsgiga]

I'm having the same issue using the latest docker image

[ameshkov]

@danlsgiga what if you use a different upstream?

[danlsgiga]

Ok, never mind... it seems that I am using outdated URLs... none of the upstreams below is working:

https://dns10.quad9.net/dns-query
https://cloudflare-dns.com/dns-query
https://mozilla.cloudflare-dns.com/dns-query
https://dns.google/dns-query

After adding the ones published at https://kb.adguard.com/en/general/dns-providers all is good now!

Thanks and sorry for the noise!

[danlsgiga]

Actually, never mind once again... the issue is that my router is enforcing all DNS requests to go to OpenDNS and OpenDNS is categorizing those as Proxying... sorry again!

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.