<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><style>body { line-height: 1.5; }blockquote { margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; }div.foxdiv20170419173032055200 { word-wrap: break-word; -webkit-line-break: after-white-space; }body { font-size: 10.5pt; font-family: 'Microsoft YaHei UI'; color: rgb(0, 0, 0); line-height: 1.5; }</style></head><body>
<div><span></span>Hi Sara,</div><div><br></div><div>Thanks for your advice. I followed your instructions : update stubby to 1.1.0 version and rebuild it. I use the <span style="font-size: 10.5pt; line-height: 1.5; background-color: window;">stubby_one_server.conf as you suggested. But I still encounter the same problem. I print the error msg as follows:</span></div><div><span style="font-size: 10.5pt; line-height: 1.5; background-color: window;"><br></span></div><div><span style="font-family: "" microsoft="" yahei="" ui'";="" font-size:="" 14px;="" color:="" rgb(0,="" 0,="" 0);="" background-color:="" rgb(255,="" 255,="" 255);="" font-weight:="" normal;="" font-style:="" normal;text-decoration:="" none;'="">[09:29:08.290308] => ENTRY: _getdns_submit_stub_request : MSG: 0x9122658 TYPE: 1<br>[09:29:08.290426] --- SETUP: upstream_select_stateful : Testing upstreams 0 0<br>[09:29:08.290436] --- SETUP: upstream_select_stateful : Testing upstreams 1 0<br>[09:29:08.290443] --- SETUP: upstream_connect : Getting upstream connection: 0x9121fec<br>[09:29:08.290448] --- SETUP: tcp_connect : Creating TCP connection: 0x9121fec<br>[09:29:08.290776] --- SETUP(TLS): tls_create_object : Hostname verification requested for: getdnsapi.net<br>[09:29:08.290790] --- SETUP(TLS): tls_create_object : <font color="#ff0000">ERROR: TLS Authentication functionality not available</font><br>[09:29:08.290802] --- CLEANUP: upstream_failed : FD: 5 Failure during connection setup = 1<br>[09:29:08.290822] --- SETUP: upstream_select_stateful : Testing upstreams 0 0<br>[09:29:08.290827] --- SETUP: upstream_select_stateful : Testing upstreams 1 3<br>[09:29:08.290832] ----- SCHEDULE: upstream_find_for_netreq : MSG: 0x9122658 No valid upstream! <br>[09:29:08.290840] GETDNS_DAEMON: *FAILURE* no valid transports or upstreams available!<br>Could not schedule query: None of the configured upstreams could be used to send queries on the specified transports<br></span></div>
<div><br></div><div>Regards,</div><div>Xiaomin</div><div><br></div><div><br></div><hr style="width: 210px; height: 1px;" color="#b5c4df" size="1" align="left">
<div><span><div style="MARGIN: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt"><div>xmgao@biigroup.cn</div></div></span></div>
<blockquote style="margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em;"><div> </div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"><div style="PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-SIZE: 12px;FONT-FAMILY:tahoma;COLOR:#000000; BACKGROUND: #efefef; PADDING-BOTTOM: 8px; PADDING-TOP: 8px"><div><b>From:</b> <a href="mailto:sara@sinodun.com">Sara Dickinson</a></div><div><b>Date:</b> 2017-04-19 16:34</div><div><b>To:</b> <a href="mailto:users@getdnsapi.net">libgetdns users list</a></div><div><b>Subject:</b> Re: [getdns-users] A question on stubby</div></div></div><div><div class="FoxDiv20170419173032055200"><br class=""><div><blockquote type="cite" class="" style="margin-top: 0px;"><div class="">On 19 Apr 2017, at 07:54, <a href="mailto:xmgao@biigroup.cn" class="">xmgao@biigroup.cn</a> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: 'Microsoft YaHei UI'; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span class=""></span><div style="margin: 0cm 0cm 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">Hello everyone,<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; text-align: justify; font-size: 10.5pt; font-family: Calibri, sans-serif;" class=""><span lang="EN-US" class="">I’m Xiaomin, a young engineer in this field. I’m trying to setup a DNS-over-TLS demo using Stubby recently. Now it works in opportunistic mode, but failed in strict mode with<span class="Apple-converted-space"> </span></span><span class="apple-converted-space"><span lang="EN-US" style="font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(51, 51, 51);" class=""> </span></span><span lang="EN-US" style="font-size: 9.5pt; font-family: Arial, sans-serif; color: rgb(51, 51, 51);" class="">'tls_authentication: GETDNS_AUTHENTICATION_REQUIRED' field. AFAIK, the server are using Let's encrypt cert, What should I do on client side(stubby) to verify the cert? Do I need make extra configuration on Stubby or openssl?</span><span lang="EN-US" class=""><o:p class=""></o:p></span></div></div></div></blockquote><br class=""></div><div>Hi Xiaomin,</div><div><br class=""></div><div>Thanks for your question. Can you let me know which version of Stubby you are using? I would recommend using the recent 1.1.0 release.</div><div><br class=""></div><div>To validate a nameserver Stubby needs one of</div><div>- an authentication domain name or</div><div>- a SPKI pin</div><div><br class=""></div><div>The easiest way to set up strict authentication is to use the default configuration file that is in the getdns source code in src/tools/stubby.conf which has this information in for several servers. Then tell Stubby where to find this file by using the ‘-C’ flag on the command line. I’ve attached the stubby.conf file here for reference. This configuration will run in Strict mode, using all the servers listed. </div><div><br class=""></div><div>If you want a simple demo then I suggest just using a single server that has a Let’s Encrypt certificate. I’ve created a file for that too using the getdns nameserver and attached it (stubby_one_server.conf). </div><div><br class=""></div><div>Hope this helps</div><div><br class=""></div><div>Regards</div><div><br class=""></div><div>Sara. </div><div><br class=""></div><div><br class=""></div><div><br class=""></div></div></div></blockquote>
</body></html>