AdguardTeam / AdguardTeam/AdGuardHome

DoH is working even if deactivated

Open
#6,994 4 comments 0 reactions 0 assignees View on GitHub
waiting for data
Dominant language
TypeScript
Stars
36.9k
Forks
2.5k
PR merge metrics
No merged PRs in 30d

Description

### Prerequisites

- [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a) and found no answer

- [X] I have searched other issues and found no duplicates

- [X] I want to report a bug and not [ask a question or ask for help](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a)

- [X] I have set up AdGuard Home correctly and [configured clients to use it](https://github.com/AdguardTeam/AdGuardHome/wiki/Clients). (Use the [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions/categories/q-a) for help with installing and configuring clients.)

### Platform (OS and CPU architecture)

Linux, AMD64 (aka x86_64)

### Installation

Custom package (OpenWrt, HomeAssistant, etc; please mention in the description)

### Setup

On one machine

### AdGuard Home version

0.107.48

### Action

even when `tls: enabled: false`, the AGH server reply to DoH requests:

```bash
q example.com MX @https://adguard.example.com
example.com. 21h57m8s MX 0 .
```

full TLS config section:

```text
tls:
enabled: false
server_name: adguard.example.com
force_https: false
port_https: 13120
port_dns_over_tls: 853
port_dns_over_quic: 784
port_dnscrypt: 0
dnscrypt_config_file: ""
allow_unencrypted_doh: true
certificate_chain: ""
private_key: ""
certificate_path: /etc/yunohost/certs/adguard.example.com/crt.pem
private_key_path: /etc/yunohost/certs/adguard.example.com/key.pem
strict_sni_check: false
```

### Expected result

if `tls: enabled: false`, AGH should refuse any DoH requests, as stated in the interface:

![a screenshot of the 'Encryption settings' page of AGH. The 'Enable Encryption (HTTPS, DNS-over-HTTPS, and DNS-over-TLS)' setting is followed by this sentence: 'If encryption is enabled, AdGuard Home admin interface will work over HTTPS, and the DNS server will listen for requests over DNS-over-HTTPS and DNS-over-TLS.'](https://github.com/AdguardTeam/AdGuardHome/assets/6963387/7ec69e74-5117-4a8f-af20-be9b31e8ee8e)

### Actual result

Instead of refusing the DoH request, AGH reply with the right answer

The setting is working properly for DoT and DoQ

### Additional information and/or screenshots

The installation is using the [YunoHost package](https://github.com/YunoHost-Apps/adguardhome_ynh)
I'm one of its maintainers, btw

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.