DNS over TLS

[bassosimone]

This can be easily done by using https://github.com/ooni/netx.

[simonfrey]

I would like to work on this one, but as I am completely new to ooni, what is a DoT?

[bassosimone]

DoT is DNS over TLS. We want to specify a OONI test that resolves a domain name using this protocol and returns the results. We optionally want to include into the results low-level data from the netx OONI library, but this we can also do after we've all the plumbing in place.

I tried to sketch out what the MVP probably looks like:

• create a new file in https://github.com/ooni/spec/tree/master/nettests that describes the objective of this new experiment (nettest is a synonymous of experiment, btw). The main things that the spec should do are (1) describe the purpose of the experiment, (2) describe what input the experiment takes, (3) describe the output (or result or measurement) of the experiment. A good blueprint to start with is the tcp_connect spec.

• write a first prototype of the experiment that uses netx to resolve a specific domain name using a specific DoT resolver. By default we can probably use dns.quad9.net as resolver. The blueprint of a simple experiment is the experiment/example/example.go. See cmd/dnsclient for a simple piece of Go that shows how to use netx functionality to perform DoT lookups.

• once you have the netx-provided result of the DoT lookup, use this data to fill the measurement structure that you have defined inside the spec

• write a simple integration test for this functionality

Cheers!

[bassosimone]

Oh, BTW, since you said you are completely new to OONI: we're an open source project that measures interference to internet traffic (e.g. a specific website being blocked). In this issue, we want to introduce this new experiment for measuring whether the DoT protocol is working in a specific ISP, or, if it is blocked, how it is blocked. You can read more on OONI at https://ooni.torproject.org/about/.

[bassosimone]

@simonfrey do you need further assistance with this?

[bassosimone]

@simonfrey I have implemented a similar experiment (DNS over HTTPS). You can see at what I did and use it as a blueprint for implementing DNS over TLS.

The new spec I added is in ooni/spec#158 and the implementation is in #94.