{"action":"created","issue":{"url":"https://api.github.com/repos/pi-hole/FTL/issues/393","repository_url":"https://api.github.com/repos/pi-hole/FTL","labels_url":"https://api.github.com/repos/pi-hole/FTL/issues/393/labels{/name}","comments_url":"https://api.github.com/repos/pi-hole/FTL/issues/393/comments","events_url":"https://api.github.com/repos/pi-hole/FTL/issues/393/events","html_url":"https://github.com/pi-hole/FTL/issues/393","id":364652697,"node_id":"MDU6SXNzdWUzNjQ2NTI2OTc=","number":393,"title":"Provide option to drop ESNI records for blocked domains","user":{"login":"mhofman","id":86499,"node_id":"MDQ6VXNlcjg2NDk5","avatar_url":"https://avatars3.githubusercontent.com/u/86499?v=4","gravatar_id":"","url":"https://api.github.com/users/mhofman","html_url":"https://github.com/mhofman","followers_url":"https://api.github.com/users/mhofman/followers","following_url":"https://api.github.com/users/mhofman/following{/other_user}","gists_url":"https://api.github.com/users/mhofman/gists{/gist_id}","starred_url":"https://api.github.com/users/mhofman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhofman/subscriptions","organizations_url":"https://api.github.com/users/mhofman/orgs","repos_url":"https://api.github.com/users/mhofman/repos","events_url":"https://api.github.com/users/mhofman/events{/privacy}","received_events_url":"https://api.github.com/users/mhofman/received_events","type":"User","site_admin":false},"labels":[{"id":586268969,"node_id":"MDU6TGFiZWw1ODYyNjg5Njk=","url":"https://api.github.com/repos/pi-hole/FTL/labels/Discussion","name":"Discussion","color":"d4c5f9","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-09-27T21:04:28Z","updated_at":"2018-10-05T14:56:18Z","closed_at":null,"author_association":"NONE","body":"**In raising this issue, I confirm the following (please check boxes, eg [X]) Failure to fill the template will close your issue:**\r\n\r\n- [X] I have read and understood the [contributors guide](https://github.com/pi-hole/pi-hole/blob/master/CONTRIBUTING.md).\r\n- [X] The issue I am reporting can be *replicated*\r\n- [X] The issue I am reporting isn't a duplicate \r\n\r\n**How familiar are you with the codebase?:** \r\n\r\n_1_\r\n\r\n---\r\n\r\n**Expected / Actual Behaviour:**\r\nWhen combining Pi-Hole with @kvic-z pixelsrv-tls, the encrypted blocked connections can be answered by an HTTPS server instead of being completely dropped (`BLOCKINGMODE=IP`).\r\n\r\nThe way this works is that pixelsrv-tls generates a certificate dynamically that will match the Server Name sent in the SNI extension, which should end up passing verification by the client (if the CA used to generate such certificates is trusted).\r\n\r\nWith [ESNI (Encrypted Server Name Indication)](https://tools.ietf.org/html/draft-ietf-tls-esni-01) that is now getting [tested by CloudFlare and Mozilla](https://blog.cloudflare.com/esni/), the client sends the server name encrypted so pixel-srv would be unable to generate a matching certificate.\r\n\r\nWhile the connection will ultimately be blocked, the browser will attempt to establish such connections until it ultimately fails.\r\n\r\nWhat would be great is if for blocked domains, there could be an option to also block the corresponding ESNI record. Right now this could mean answering with NXDOMAIN to _esni.blocked.domain.\r\nIt is probably safe enough to enable by default.\r\n\r\n**Steps to reproduce:**\r\n- Block encryptedsni.com\r\n- Query type=TXT _esni.encryptedsni.com and observe a response\r\n\r\n**Additional Information:**\r\nAccording to [Mozilla bug 1473736](https://bugzilla.mozilla.org/show_bug.cgi?id=1473736), Firefox nightly 64.0a1 / 20180923100316 and newer is supposed to include changeset [52ee9ddf5060](https://hg.mozilla.org/integration/mozilla-inbound/rev/52ee9ddf5060) which adds support for esni. There is a new setting `network.security.esni.enabled` in `about:config`, but I currently can't get Firefox to perform ESNI.\r\nUntil then it's hard to see what the actual browser behavior is when encountering redirected traffic that has ESNI enabled. The spec implies that the browser should not fallback to send the SNI plaintext, but it's entirely possible they might do so at the beginning (or until the specs forbids it entirely)."},"comment":{"url":"https://api.github.com/repos/pi-hole/FTL/issues/comments/427394317","html_url":"https://github.com/pi-hole/FTL/issues/393#issuecomment-427394317","issue_url":"https://api.github.com/repos/pi-hole/FTL/issues/393","id":427394317,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzM5NDMxNw==","user":{"login":"Vednier","id":15080370,"node_id":"MDQ6VXNlcjE1MDgwMzcw","avatar_url":"https://avatars0.githubusercontent.com/u/15080370?v=4","gravatar_id":"","url":"https://api.github.com/users/Vednier","html_url":"https://github.com/Vednier","followers_url":"https://api.github.com/users/Vednier/followers","following_url":"https://api.github.com/users/Vednier/following{/other_user}","gists_url":"https://api.github.com/users/Vednier/gists{/gist_id}","starred_url":"https://api.github.com/users/Vednier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Vednier/subscriptions","organizations_url":"https://api.github.com/users/Vednier/orgs","repos_url":"https://api.github.com/users/Vednier/repos","events_url":"https://api.github.com/users/Vednier/events{/privacy}","received_events_url":"https://api.github.com/users/Vednier/received_events","type":"User","site_admin":false},"created_at":"2018-10-05T14:56:18Z","updated_at":"2018-10-05T14:56:18Z","author_association":"NONE","body":"> \r\n\r\nAdditional Information: According to Mozilla bug 1473736, Firefox nightly 64.0a1 / 20180923100316 and newer is supposed to include changeset 52ee9ddf5060 which adds support for esni. There is a new setting network.security.esni.enabled in about:config, but I currently can't get Firefox to perform ESNI. \r\n--\r\n\r\nNo, you wrong. This bug implements only \"necko\" (network library) part of ESNI, NSS (which handles actual cryptostuff) is still not ready for ESNI\r\n\r\nIts even stated in patch itself :\r\n\r\n+// Enable/disable sni encryption.\r\n+// Currently this does not work even if the pref is true, the nss part is\r\n+// missing.\r\n+pref(\"network.security.esni.enabled\", false);"}}
{"actor":{"display_login":"Vednier"}}