Implement DNS over TLS for local DNS resolving #2015
Conversation
|
不同DNS配置项的图标我已经在制作中了，如果不介意的话，可以随意使用 |
|
I think you can remove |
|
I suggest rename "Private DNS" to "Local TLS DNS" to avoid confusions with "Local DNS" option. |
|
Re：@madeye p.s.图标制作中有点慢，毕竟我不是专业的UI，做好后我会再次提交一次PR，到时候烦请再次查看，非常感谢 |
|
好的，稍等我修改下代码，因为android 9.0中官方将 dns-over-tls 功能在设置页面标识为private dns了，所以习惯性顺着走了_(:з」∠)_，稍等我马上再次提交修改完资源文件的PR |
|
The overall quality of this PR is quite good. I think it's fine to keep use |
|
或许，中文可以翻译做本地加密dns？，我先按local tls dns改着。。。。 |
|
我非常同意你的看法，代码中使用private_dns，对于其它代码贡献者而言是易读的，我现在正在修改UI上的显示（各String资源文件） |
There was a problem hiding this comment.
This proposal is set out to solve an issue that doesn't exist. DNS over TLS is aimed to preserve privacy instead of prevent DNS hijacking. Whilst a VPN is active, most (more on this later) DNS queries are already sent fully encrypted and hijacking is already impossible.
However, a subtlety is that in shadowsocks-android, DNS queries are also sent locally in overture so that we can selectively route DNS queries. I think a good way to do this is to read out system DNS using Network APIs so that users don't have to configure their DNS twice.
Your changes on overture's side looks good to me but this PR needs more work.
|
@Mygod 这点我不是很认同，虽然我也许可以做到在android 9.0上读取用户当前网络的dns配置，但这对于目前大部分主流机型还是8.0的用户是不友好的。且源码中原本的local dns也是硬编码在kotlin代码中的，并没有去读取用户当前网络的dns配置。 另，国内现在已经有不少支持dns-over-tls的解析服务器了（v2ex上可以搜到不少），现在就让用户能够使用上不是更好么？ |
|
I'm fine if you want to add a global option for Android 8 and below only, but either way it's absolutely unnecessary to make it a per-profile option. |
|
I agree that we can move the "private DNS" and "local DNS" option to global settings. I think TLS DNS is also useful for preventing hijacking of the local DNS, e.g. ISP ADs. However, we disabled cert check in overture for TLS DNS, which means the hijacking of TLS DNS is still possible here. |
|
额。。我的意思是我在阅读原本master分支的代码时，发现local dns的配置是写死的，我只是希望作为一个用户我可以在上层选择配置不同的local dns，以及是否加密，毕竟ss for android是一个有VPN代理功能的应用。原本我的设想是在local dns选项旁边增加一个check box，提供用户可以选择是否开启tls加密。 |
|
@MidoriInu1 as mentioned above by @Mygod, you can move these options to global settings instead, rather than put them in per-profile setting. |
|
Based on the discussions, here's a list of things that need changing before this PR can be merged, in the order of urgency.
The reason that local DNS is hardcoded is that local DNS should in principle change with system network changes and the current solution is a hack. If you wish to remove that hack, you are welcome to do so, but perhaps in another PR. |
| @@ -5,6 +5,9 @@ | |||
| <!-- misc --> | |||
| <string name="profile">"پروفایل"</string> | |||
| <string name="connection_test_testing">"در حال آزمایش…"</string> | |||
| <string name="remote_dns">"DNS از راه دور"</string> | |||
| <string name="local_dns">DNS محلی</string> | |||
| <string name="private_dns">"DNS خصوصی"</string> | |||
There was a problem hiding this comment.
Please do not add translations here. See here for more details on contributing translations.
There was a problem hiding this comment.
sorry。。。我并不知道i18n的资源需要单独提交至别处，抱歉。。。
There was a problem hiding this comment.
唔。。现阶段我是否应该将这些资源还原为英文，并通过faq提交翻译？
或者如果你们希望revert掉这次PR，我可以不用去还原其它string文件，在我新的尝试修改（修改到全局？）的分支上将他们排除出去，作为之后的faq提交？
|
唔，那我可能需要些时间去阅读全局设置项相关的代码，如果有需要的话可以revert掉我的提交。 |
|
No hurry, just follow the action items listed above and then we're happy to merge your PR. 😄 |
|
so......what should I do ?
但是local dns和private dns两者皆改为从系统设置抓取不可单独配置吗？还是？ 抱歉，我今天的工作进度有些delay，我需要先处理下工作。。 |
|
Please revert all changes to local DNS. If you want to make changes to local DNS, please do that in a separate PR and we will discuss there instead. You can do a global option and I will handle the obtaining configuration from Android 9+ automatically part when I got around to do that. |
|
so......what should I do ? now... 另：非常抱歉，今天真的不能再跟进了， |
Mygod
changed the title
|
I have updated the things to be done to get this merged. See #2015 (comment). |
Aha. It seems that TLS connection reuse in overture is my work. |
|
Superseded by #2096, in which overture was removed and DNS over TLS is supported on Android 9+. |
增加LocalDNS可在上层配置功能（原本地dns为代码硬编码）
响应Android 9.0号召，增加dns-over-tls，dns加密防劫持功能，上层可配置私人DNS
（是的，私人DNS就是google提倡的那个 private dns）
中间涉及到需要修改overtrue中部分代码，使底层支持dns-over-tls，所以拜托了我朋友（我老大），帮忙改写了对应的overture分支。
他那边应该已经提起PR了，请联合两个PR一起Review。
非常感谢。
对应的overtruePR：
shadowsocks/overture#3