通过 CoreDNS 将 DNS 转发到 Cloudflare 的 DNS-over-TLS

Question

我以using this Docker image 为例，尝试通过 TLS 设置安全 DNS 转发到 CloudFlare 的解析器。我正在使用 CoreDNS 1.5.0（最新），我的配置是这样的：

# CoreDNS Configuration

.:53 {
  forward . tls://1.1.1.1 tls://1.0.0.1 {
    tls_servername tls.cloudflare-dns.com
    policy sequential
    health_check 5s
  }

  log
}

我提出这样的要求：

root@8ef125545369:/# dig @127.0.0.1 google.com

; <<>> DiG 9.11.3-1ubuntu1.5-Ubuntu <<>> @127.0.0.1 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49802
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 090b0d7fadcdd8bb (echoed)
;; QUESTION SECTION:
;google.com.                    IN      A

;; Query time: 24 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Apr 08 19:29:30 UTC 2019
;; MSG SIZE  rcvd: 51

我没有得到答案。 CoreDNS 日志如下所示：

missioncontrol    | 2019-04-08T19:29:30.778Z [INFO] 127.0.0.1:39615 - 49802 "A IN google.com. udp 51 false 4096" NOERROR - 0 5.02365452s
missioncontrol    | 2019-04-08T19:29:35.759Z [INFO] 127.0.0.1:39615 - 49802 "A IN google.com. udp 51 false 4096" NOERROR - 0 5.00549558s

很明显，CoreDNS 正在接收请求，但我无法确定失败的原因。我的图像是ubuntu:bionic，并且安装了ca-certificates。我也可以使用openssl s_client 连接到1.1.1.1:443 而不会出现问题。

在设置从 CoreDNS 到 CloudFlare 解析器的 DNS-over-TLS 转发时，我是否缺少一些东西？

---

编辑

我已经在 Docker 容器外的主机操作系统上对此进行了测试，我看到了相同的功能，即它无法正常工作。

Answer 1

我通过在 Travis CI 中运行它再次对其进行了测试，它成功了；显然我的公司防火墙不喜欢 DNS-over-TLS。

我能够通过安装 knot-dnsutils（在 Ubuntu 18.04 上）并尝试直接查询 Cloudflare 来验证这一点：

$ kdig -d @1.0.0.1 +tls-ca +tls-host=cloudflare-dns.com google.com
;; DEBUG: Querying for owner(google.com.), class(1), type(1), server(1.0.0.1), port(853), protocol(TCP)
;; DEBUG: TLS, imported 133 system certificates
;; DEBUG: TLS, received certificate hierarchy:
;; DEBUG:  #1, C=US,ST=California,L=San Francisco,O=Cloudflare\, Inc.,CN=cloudflare-dns.com
;; DEBUG:      SHA-256 PIN: V6zes8hHBVwUECsHf7uV5xGM7dj3uMXIS9//7qC8+jU=
;; DEBUG:  #2, C=US,O=DigiCert Inc,CN=DigiCert ECC Secure Server CA
;; DEBUG:      SHA-256 PIN: PZXN3lRAy+8tBKk2Ox6F7jIlnzr2Yzmwqc3JnyfXoCw=
;; DEBUG: TLS, skipping certificate PIN check
;; DEBUG: TLS, The certificate is trusted.
;; WARNING: TLS, handshake failed (Error in the pull function.)

这是在公司网络中查询时发生的情况。从 Travis CI，我看到：

;; DEBUG: Querying for owner(google.com.), class(1), type(1), server(1.1.1.1), port(853), protocol(TCP)
;; DEBUG: TLS, imported 133 system certificates
;; DEBUG: TLS, received certificate hierarchy:
;; DEBUG:  #1, C=US,ST=California,L=San Francisco,O=Cloudflare\, Inc.,CN=cloudflare-dns.com
;; DEBUG:      SHA-256 PIN: V6zes8hHBVwUECsHf7uV5xGM7dj3uMXIS9//7qC8+jU=
;; DEBUG:  #2, C=US,O=DigiCert Inc,CN=DigiCert ECC Secure Server CA
;; DEBUG:      SHA-256 PIN: PZXN3lRAy+8tBKk2Ox6F7jIlnzr2Yzmwqc3JnyfXoCw=
;; DEBUG: TLS, skipping certificate PIN check
;; DEBUG: TLS, The certificate is trusted. 
;; TLS session (TLS1.2)-(ECDHE-ECDSA-SECP256R1)-(AES-256-GCM)
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 59442
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1
;; EDNS PSEUDOSECTION:
;; Version: 0; flags: ; UDP size: 1452 B; ext-rcode: NOERROR
;; PADDING: 69 B
;; QUESTION SECTION:
;; google.com.              IN  A
;; ANSWER SECTION:
google.com.             156 IN  A   172.217.5.14
;; Received 128 B
;; Time 2019-04-09 22:03:18 UTC
;; From 1.1.1.1@853(TCP) in 12.8 ms

不幸的是，公司防火墙显然阻止了此访问。