unbound: DNS over HTTPS (DoH) Support (requires unbound to be made with libnghttp2)

Maintainer: @EricLuehrsen

Description:
Unbound has supported DoH since the 14th of Dec. 2020:

https://blog.apnic.net/2020/12/14/dns-over-https-in-unbound

https://unbound.docs.nlnetlabs.nl/en/latest/topics/privacy/dns-over-https.html

Openwrt's unbound package currently has support for DoT forwarding, while DoH support has yet to be implemented. The links above cover how to implement DoH with Unbound, but will require OpenSSL v1.0.2 or newer and the unbound package to be made with the nghttp2 library (libnghttp2).

I've opened another request with the luci-app-unbound package to implement the LuCI interface for this feature under Zones: #6931

Here are the instructions given in the article for reference:

The DoH implementation in Unbound requires TLS, and only works over HTTP/2. The query pipelining and out-of-order processing functionality that is provided by HTTP/2 streams is needed to be able to provide performance that is on par with DoT. The HTTP/2 capability is negotiated using Application-Layer Protocol Negotiation (ALPN) TLS extension, which is supported in OpenSSL from version 1.0.2 onward.

We decided to use the amazing nghttp2 library to handle the HTTP/2 framing layer. This library does not take care of any I/O handling, which makes it possible to easily integrate it in the existing Unbound event loop and TCP handling. Adding HTTP/2 on top of the existing TCP code makes it possible to also use the existing TCP configuration options for the DoH connections. These existing options include the number of allowed incoming TCP connections, the TCP timeout settings, and the limits on TCP connections per client IP address or netblock.

Using DoH in Unbound

As mentioned above, the nghttp2 library is required to use Unbound’s DoH functionality. Compiling and installing Unbound with libnghttp2 can be done using:

./configure --with-libnghttp2
make && make install

Enabling DoH in Unbound is as simple as configuring the TLS certificate and the corresponding private key that will be used for the connection, and configuring Unbound to listen on the HTTPS port:

server:
   interface: 127.0.0.1@443
   tls-service-key "key.pem"
   tls-service-pem: "cert.pem"

The port that Unbound will use for incoming DoH traffic is, by default, set to 443 and can be changed using the https-port configuration option.

Start with OpenWrt's unbound package and inspect how its build dependencies and configuration are defined. Verify the package can be built with libnghttp2 and supports Unbound's DoH settings, including the TLS certificate, private key, and HTTPS listener; the LuCI interface is tracked separately in luci issue #6931.