Browse Source

stubby: add SPKI pin set for Cloudflare cert

Add an SPKI pin for Cloudflare to help prevent MITM and downgrade attacks,
as described in RFC7858 (DNS over TLS). The setup of SPKI and the specific
SHA256 certificate hash are taken from Cloudflare's DoT configuration guide
published at https://developers.cloudflare.com/1.1.1.1/dns-over-tls/.

Note that the certificate is valid to March 25th 2020, 13:00 CET, which
provides ample time for issuance of a backup pin to support future key
rollover.

Signed-off-by: Tony Ambardar <itugrok@yahoo.com>
lilik-openwrt-22.03
Tony Ambardar 6 years ago
committed by guidosarducci
parent
commit
1170686cba
1 changed files with 12 additions and 0 deletions
  1. +12
    -0
      net/stubby/files/stubby.yml

+ 12
- 0
net/stubby/files/stubby.yml View File

@ -24,8 +24,14 @@ upstream_recursive_servers:
# # Cloudflare IPv6 # # Cloudflare IPv6
- address_data: 2606:4700:4700::1111 - address_data: 2606:4700:4700::1111
tls_auth_name: "cloudflare-dns.com" tls_auth_name: "cloudflare-dns.com"
tls_pubkey_pinset:
- digest: "sha256"
value: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=
- address_data: 2606:4700:4700::1001 - address_data: 2606:4700:4700::1001
tls_auth_name: "cloudflare-dns.com" tls_auth_name: "cloudflare-dns.com"
tls_pubkey_pinset:
- digest: "sha256"
value: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=
# # Quad 9 IPv6 # # Quad 9 IPv6
# - address_data: 2620:fe::10 # - address_data: 2620:fe::10
@ -35,8 +41,14 @@ upstream_recursive_servers:
# # Cloudflare servers # # Cloudflare servers
- address_data: 1.1.1.1 - address_data: 1.1.1.1
tls_auth_name: "cloudflare-dns.com" tls_auth_name: "cloudflare-dns.com"
tls_pubkey_pinset:
- digest: "sha256"
value: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=
- address_data: 1.0.0.1 - address_data: 1.0.0.1
tls_auth_name: "cloudflare-dns.com" tls_auth_name: "cloudflare-dns.com"
tls_pubkey_pinset:
- digest: "sha256"
value: yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc=
# Quad 9 service # Quad 9 service
# - address_data: 9.9.9.10 # - address_data: 9.9.9.10


Loading…
Cancel
Save