99 lines
3.9 KiB
Diff
99 lines
3.9 KiB
Diff
From: csagan5 <32685696+csagan5@users.noreply.github.com>
|
|
Date: Sat, 26 Sep 2020 14:23:19 +0100
|
|
Subject: DoH improvements
|
|
|
|
Enable secure mode by default
|
|
Always enforce DoH even with inconsistent system DNS configuration
|
|
|
|
License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
|
|
---
|
|
chrome/browser/net/secure_dns_config.cc | 2 +-
|
|
chrome/browser/net/stub_resolver_config_reader.cc | 3 +++
|
|
net/dns/dns_client.cc | 11 ++++++++---
|
|
net/dns/host_resolver_manager.cc | 1 +
|
|
4 files changed, 13 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/chrome/browser/net/secure_dns_config.cc b/chrome/browser/net/secure_dns_config.cc
|
|
--- a/chrome/browser/net/secure_dns_config.cc
|
|
+++ b/chrome/browser/net/secure_dns_config.cc
|
|
@@ -27,7 +27,7 @@ std::optional<net::SecureDnsMode> SecureDnsConfig::ParseMode(
|
|
if (name == kModeSecure) {
|
|
return net::SecureDnsMode::kSecure;
|
|
} else if (name == kModeAutomatic) {
|
|
- return net::SecureDnsMode::kAutomatic;
|
|
+ return net::SecureDnsMode::kSecure;
|
|
} else if (name == kModeOff) {
|
|
return net::SecureDnsMode::kOff;
|
|
}
|
|
diff --git a/chrome/browser/net/stub_resolver_config_reader.cc b/chrome/browser/net/stub_resolver_config_reader.cc
|
|
--- a/chrome/browser/net/stub_resolver_config_reader.cc
|
|
+++ b/chrome/browser/net/stub_resolver_config_reader.cc
|
|
@@ -83,6 +83,7 @@ enum class SecureDnsModeDetailsForHistogram {
|
|
|
|
#if BUILDFLAG(IS_WIN)
|
|
bool ShouldDisableDohForWindowsParentalControls() {
|
|
+ if ((true)) return false;
|
|
return GetWinParentalControls().web_filter;
|
|
}
|
|
#endif // BUILDFLAG(IS_WIN)
|
|
@@ -189,6 +190,7 @@ void StubResolverConfigReader::UpdateNetworkService(bool record_metrics) {
|
|
}
|
|
|
|
bool StubResolverConfigReader::ShouldDisableDohForManaged() {
|
|
+ if ((true)) return false;
|
|
// This function ignores cloud policies which are loaded on a per-profile basis.
|
|
#if BUILDFLAG(IS_ANDROID)
|
|
// Check for MDM/management/owner apps. android_has_owner_ is true if either a
|
|
@@ -217,6 +219,7 @@ bool StubResolverConfigReader::ShouldDisableDohForManaged() {
|
|
}
|
|
|
|
bool StubResolverConfigReader::ShouldDisableDohForParentalControls() {
|
|
+ if ((true)) return false;
|
|
if (parental_controls_testing_override_.has_value())
|
|
return parental_controls_testing_override_.value();
|
|
|
|
diff --git a/net/dns/dns_client.cc b/net/dns/dns_client.cc
|
|
--- a/net/dns/dns_client.cc
|
|
+++ b/net/dns/dns_client.cc
|
|
@@ -249,11 +249,14 @@ class DnsClientImpl : public DnsClient {
|
|
private:
|
|
std::optional<DnsConfig> BuildEffectiveConfig() const {
|
|
DnsConfig config;
|
|
- if (config_overrides_.OverridesEverything()) {
|
|
+ // in Bromite it is sufficient to have secure DoH enabled to give the overrides priority
|
|
+ if (config_overrides_.dns_over_https_config && config_overrides_.secure_dns_mode) {
|
|
config = config_overrides_.ApplyOverrides(DnsConfig());
|
|
} else {
|
|
- if (!system_config_)
|
|
+ if (!system_config_) {
|
|
+ LOG(WARNING) << "BuildEffectiveConfig(): no system configuration";
|
|
return std::nullopt;
|
|
+ }
|
|
|
|
config = config_overrides_.ApplyOverrides(system_config_.value());
|
|
}
|
|
@@ -268,8 +271,10 @@ class DnsClientImpl : public DnsClient {
|
|
if (config.unhandled_options)
|
|
config.nameservers.clear();
|
|
|
|
- if (!config.IsValid())
|
|
+ if (!config.IsValid()) {
|
|
+ LOG(WARNING) << "BuildEffectiveConfig(): invalid configuration";
|
|
return std::nullopt;
|
|
+ }
|
|
|
|
return config;
|
|
}
|
|
diff --git a/net/dns/host_resolver_manager.cc b/net/dns/host_resolver_manager.cc
|
|
--- a/net/dns/host_resolver_manager.cc
|
|
+++ b/net/dns/host_resolver_manager.cc
|
|
@@ -639,6 +639,7 @@ void HostResolverManager::SetDnsConfigOverrides(DnsConfigOverrides overrides) {
|
|
bool changed = dns_client_->SetConfigOverrides(std::move(overrides));
|
|
|
|
if (changed) {
|
|
+ LOG(INFO) << "triggering non-system DNS change";
|
|
NetworkChangeNotifier::TriggerNonSystemDnsChange();
|
|
|
|
// Only invalidate cache if new overrides have resulted in a config change.
|
|
--
|