From 5235b35e3f321fc1e273c39e19eae71bd0df7fcc Mon Sep 17 00:00:00 2001 From: Miek Gieben Date: Wed, 30 Sep 2020 17:17:24 +0200 Subject: [PATCH] doh support: make no TLS config fatal (#4162) without TLS you can't have a functioning DoH server as no client will be able to talk to it. Make this a fatal failure. Add some extra docs on how to start a DoH capable server. Signed-off-by: Miek Gieben --- README.md | 5 ++++- core/dnsserver/server_https.go | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index a8476a7b1..efb5def84 100644 --- a/README.md +++ b/README.md @@ -195,13 +195,16 @@ And for DNS over HTTP/2 (DoH) use: ~~~ corefile https://example.org { whoami + tls mycert mykey } ~~~ +Note that you must have the *tls* plugin configured as DoH requires that to be setup. + Specifying ports works in the same way: ~~~ txt -grpc://example.org:1443 { +grpc://example.org:1443 https://example.org:1444 { # ... } ~~~ diff --git a/core/dnsserver/server_https.go b/core/dnsserver/server_https.go index 621bdca24..fb5933815 100644 --- a/core/dnsserver/server_https.go +++ b/core/dnsserver/server_https.go @@ -38,6 +38,9 @@ func NewServerHTTPS(addr string, group []*Config) (*ServerHTTPS, error) { // Should we error if some configs *don't* have TLS? tlsConfig = conf.TLSConfig } + if tlsConfig == nil { + return nil, fmt.Errorf("DoH requires TLS to be configured, see the tls plugin") + } srv := &http.Server{ ReadTimeout: 5 * time.Second,