Package: doh-proxy
DNS Over HTTPS ProxyA set of python 3 scripts that supports proxying DNS over HTTPS as specified
in theIETF Draft draft-ietf-doh-dns-over-https.DOH provides a way to run encrypted DNS over HTTPS, a protocol which can freely
traverse firewalls when other encrypted mechanism may be blocked.The project comes with a set of 4 tools:doh-proxy: A service that receives DOH queries over HTTP2 and forwards them
to a recursive resolver.doh-httpproxy: Likedoh-proxybut uses HTTP instead of HTTP2.
The main intent is to run this behind a reverse proxy.doh-stub: A service that listens for DNS queries and forwards them to a DOH server.doh-client: A tool to perform a test DNS query against DOH server.See theCONTRIBUTINGfile for how to help out.DOH Proxy was created duringIETF Hackathon 100as a proof-of-concept and is not used at Facebook.You are welcome to use it, but be aware that support is limited and best-effort.InstallingTo install an already packaged version directly from PyPi:$pip3installdoh-proxyUsagedoh-proxydoh-proxyis a stand alone server answering DOH request. The proxy does not do
DNS recursion itself and rather forward the query to a full-featured DNS
recursive server or DNS caching server.By runningdoh-proxy, you can get and end-to-end DOH solution with minimal
setup.$sudodoh-proxy\--upstream-resolver=::1\--certfile=./fullchain.pem\--keyfile=./privkey.pemdoh-httpproxydoh-httpproxyis designed to be running behind a reverse proxy. In this setup
a reverse proxy such asNGINXwould be handling the
HTTPS/HTTP2 requests from the DOH clients and will forward them todoh-httpproxybackends.While this setup requires more upfront setup, it allows running DOH proxy
unprivileged and on multiple cores.$doh-httpproxy\--upstream-resolver=::1\--port8080\--listen-address::1doh-httpproxynow also supports TLS, that you can enable passing the
args--certfileand--keyfile(just likedoh-proxy)doh-stubdoh-stubis the piece of software that you would run on the clients. By
providing a local DNS server,doh-stubwill forward the DNS requests it
receives to a DOH server using an encrypted link.You can start a stub resolver with:$doh-stub\--listen-port5553\--listen-address::1\--domainfoo.bar\--remote-address::1and query it.$dig@::1-p5553example.comdoh-clientdoh-clientis just a test cli that can be used to quickly send a request to
a DOH server and dump the returned answer.$doh-client\--domaindns.dnsoverhttps.net\--qnamesigfail.verteiltesysteme.net\--dnssec
id37762opcodeQUERY
rcodeSERVFAIL
flagsQRRDRA
edns0eflagsDO
payload4096;QUESTION
sigfail.verteiltesysteme.net.INAAAA;ANSWER;AUTHORITY;ADDITIONAL

$doh-client\--domaindns.dnsoverhttps.net\--qnamesigok.verteiltesysteme.net\--dnssec
id49772opcodeQUERY
rcodeNOERROR
flagsQRRDRAAD
edns0eflagsDO
payload4096;QUESTION
sigok.verteiltesysteme.net.INAAAA;ANSWER
sigok.verteiltesysteme.net.60INAAAA2001:638:501:8efc::139
sigok.verteiltesysteme.net.60INRRSIGAAAA5360201801300300022017103103000230665verteiltesysteme.net.O7QgNZFBu3fULvBXwM39apv5nMehh51fmLOVEsC8qZUyxIbxo4eDLQt0JvPoPpFH5TbWdlm/jxq5x2/Kjw7yUdpohhiNmdoDOp7Y+RyHbf676FoC5Zko9uOAB7Pp8ERzqiT0QPt1ec12bM0XKQigfp+2Hy9wUuSNQmAzXS2s75k=;AUTHORITY;ADDITIONALDevelopmentRequirementspython >= 3.5aiohttpaioh2dnspythonBuildingDOH Proxy uses Python'setuptools to manage dependencies and build.To install its dependencies:$python3setup.pydevelopTo build:$python3setup.pybuildTo run unittests:$python3setup.pytestTo run the linter:$python3setup.pyflake8# Also run flake8 on the testing files$flake8testFrom within the root of the repository, you can test the proxy, stub and client respectively
by using the following commands:$sudoPYTHONPATH=../dohproxy/proxy.py...$PYTHONPATH=../dohproxy/httpproxy.py...$PYTHONPATH=../dohproxy/stub.py...$PYTHONPATH=../dohproxy/client.py...LicenseDOH Proxy is BSD-licensed.