[Critical - Fixed in 1.3.13] IP-based DoH3 endpoints use unencrypted DNS

[mon-jai]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce

compressed-video.1.mp4

Expected behavior
IP based DoH3 resolvers, like https://1.1.1.1/dns-query) should work. They worked before, but broken in the latest few versions.

The same endpoint works on Termux with the dig @1.1.1.1 +https google.com command.

Logs
dnsnet-log-dns.txt

Configs
dnsnet-1.3.11.json

Extra information

• Android Version 16 QPR3 Beta 2
• DNSNet Version 1.3.11

[mon-jai]

Attached the configs as well.

[t895]

It looks like I didn't consider users who have already appended "/dns-query" to the end of their doh3 servers. I'll make a patch to be more defensive against this (I append that automatically at the end of each query), but you can just remove that suffix to restore functionality for now.

[t895]

New patch will be out shortly
76eebac

[mon-jai]

...you can just remove that suffix to restore functionality for now.

This works partially.

However, DNSNet now seems to query without encryption (according to https://one.one.one.one/help/), even if the DoH toggle is enabled.

This might be related to the following code. It appears DnsRequester doesn't treat the endpoint as an HTTPS resolver when the first parameter is an IP address.

DNSNet/service/libnet_bindings/src/validation.rs

Lines 200 to 202 in 76eebac

	let mut stripped_server = unvalidated_server
	.strip_prefix("https://")
	.unwrap_or(&unvalidated_server);

DNSNet/service/libnet_bindings/src/validation.rs

Lines 248 to 253 in 76eebac

	let dns_requester = DnsRequester::new(
	stripped_server.to_owned(),
	path,
	sender_holder.clone(),
	index as u8,
	);

[t895]

Checking with 1.3.6 and 1.3.12, they both have the same result when using 1.1.1.1 and checking one.one.one.one/help

Using cloudflare-dns.com does not show this issue on that website

What's strange is that resolving addresses would not work at all if 1.1.1.1 did not respond with a valid doh3 response. I'll run a test to be sure though.

[t895]

Also, the https scheme is re-added during each request, but that doesn't matter since the doh3 protocol already encrypts requests forgot that you definitely need that for the request as per the spec

https://github.com/t895/DNSNet/blob/a-couple-updates/service%2Flibnet%2Fsrc%2Fbackend%2Fdoh3.rs#L65

[t895]

Ok yeah something is definitely wrong. It's loading the standard backend when it should be using the doh3 one.
I'm looking into it now, but use cloudflare-dns.com in the meantime.

[t895]

Fixed 5bb3f48
Thank you for the report
Another release will be out shortly because this is urgent

[mon-jai]

I can confirm both this bug and #179 are fixed on v1.3.13. Thank you very much for the app and your work!

[t895]

I really appreciate the report! I'll leave this issue pinned while it rolls out