AdguardTeam / AdguardTeam/AdGuardHome
Improve AGH safe browsing implementation
- Vorherrschende Sprache
- TypeScript
- Sterne
- 36.9k
- Forks
- 2.5k
- PR-Merge-Kennzahlen
- Keine gemergten PRs in 30 T.
Beschreibung
### Prerequisites
- [x] I am running the latest version
- [x] I checked the documentation and found no answer
- [x] I checked to make sure that this issue has not already been filed
### Issue Details
* **Version of AdGuard Home server:**
v0.105.2
* **How did you install AdGuard Home:**
Snapcraft
* **How did you setup DNS configuration:**
Dedicated server
* **CPU architecture:**
AMD64
* **Operating system and version:**
Debian 10
### Expected Behavior
AdGuard Home uses Google Safe Browsing Update API. Or a similar pre-cache can be implemented by AdGuard.
At a minimum, alert the Dashboard when the safe browsing query's performance is too low (due to poor network or blocking).
### Actual Behavior
AGH sends requests to the AdGuard Official Family Protection DNS server the first time each domain is queried. Unavailability or slow access to AdGuard DNS can significantly impact DNS query performance.
### Additional Information
After reading the AGH code, I found that the way AGH implements safe browsing is by sending queries to AdGuard's official "Family Protection" DNS server via DoH.
For the following reasons, I think the current implementation of safe browsing is not good and could probably be improved to enhance performance and privacy.
a. The authorities in mainland China have blocked well-known encrypted DNS providers, including AdGuard DNS, so it is almost impossible for mainland China users to use AGH safe browsing feature properly.
b. The Google Safe Browsing Update API allows clients to perform initial checks locally by enabling them to download a list of safe browsing hashes in advance. Only if they match will they need to send further requests to the server to perform the checks. This not only makes processing much faster but also improves privacy. The server does not know all of the client's browsing history.
c. Since AdGuard DNS's Anycast only covers a small portion of the world (relative to Google), turning on Safe Browsing in other areas will cause significant DNS query performance degradation.
When I received feedback from users, this issue was discovered that several of my AdGuard Home servers deployed in mainland China were experiencing serious performance issues. I checked the logs and found that AdGuard was taking more than 3000ms to process DNS queries.
Screenshot:

After reviewing the debug logs, I found that AdGuard Home was trying to send DNS requests to https://dns-family.adguard.com/dns-query, due to AdGuard DNS is fully blocked in mainland China, so servers in mainland China can't access AdGuard DNS.
PS: Google Safe Browsing is available in mainland China, the mainland Chinese government does not block it, and it also has servers in mainland China.
Besides, even if you do not use Google-related services for privacy reasons, you should consider other implementations than sending a request at every query.
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.