commonshost / playdoh Goto Github PK

View Code? Open in Web Editor NEW

34.0 5.0 4.0 280 KB

🛢 DNS over HTTPS Trusted Root Resolver for Commons Host

Home Page: https://commons.host

JavaScript 100.00%

dns doh middleware

playdoh's Introduction

playdoh 🛢

Middleware for Node.js web servers to expose DNS over HTTPS (DoH).

Implement: DNS Queries over HTTPS (DoH) [RFC8484].

Demo: Try it with Firefox

Configure Firefox to use Commons Host DNS over HTTPS in 3 steps. Enjoy a more private and secure Internet.

Playdoh powers the 🐑 Commons Host DNS over HTTPS service running on >20 global edge servers. The service is free and public. No tampering, no filtering, no logging.

Using Firefox 64+

Open Preferences and under Network Settings press the Settings... button.
Check Enable DNS over HTTPS
Enter in the URL field: https://commons.host

Using Firefox 62

Browse to: about:config
Search: network.trr.
Configure:

Preference Name Value

network.trr.mode 2

network.trr.uri https://commons.host

Preference Name	Value
`network.trr.mode`	2
`network.trr.uri`	https://commons.host

Usage

Note: HTTP/2 is the minimum recommended version of HTTP for use with DoH.

const { playdoh } = require('playdoh')

// Defaults
const options = {
  // udp4 (IPv4) or udp6 (IPv6)
  protocol: 'udp4',

  // Defaults to 0.0.0.0 (udp4) or ::0 (udp6)
  localAddress: '',

  // Defaults to 127.0.0.1 (udp4) or ::1 (udp6)
  resolverAddress: '',

  // Standard DNS port
  resolverPort: 53,

  // Maximum DNS lookup duration
  timeout: 10000
}

const middleware = playdoh(options)

Returns: `middleware(request, response, next)`

The middleware function follows the Node.js convention and is compatible with most popular web server frameworks.

Options

`protocol`

Default: udp4

Can be either udp4 or udp6 to indicate whether to connect to the resolver over IPv4 or IPv6 respectively.

`localAddress`

Default: 0.0.0.0 (IPv4) or ::0 (IPv6)

The UDP socket is bound to this address.

Use a loopback IP address ('' empty string, localhost, 127.0.0.1, or ::1) to only accept local DNS resolver responses.

Use a wildcard IP address (0.0.0.0 or ::0) to accept remote DNS resolver responses.

`resolverAddress`

Default: 127.0.0.1 (IPv4) or ::1 (IPv6)

The IP address of the DNS resolver. Queries are sent via UDP.

See also: List of public DNS service operators on Wikipedia.

`resolverPort`

Default: 53

The port of the DNS resolver.

`timeout`

Default: 10000

Number of milliseconds to wait for a response from the DNS resolver.

Connect

const connect = require('connect')
const { createSecureServer } = require('http2')
const app = connect()
app.use(middleware)
const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem')
}
const server = createSecureServer(options, app)
server.listen(443)

Fastify

const fastify = require('fastify')({
  http2: true,
  https: {
    key: fs.readFileSync('server-key.pem'),
    cert: fs.readFileSync('server-cert.pem')
  }
})
fastify.use(middleware)
fastify.listen(443)

References

Credits

Made by Kenny Shen and Sebastiaan Deckers for 🐑 Commons Host.

playdoh's People

Contributors

Stargazers

Watchers

Forkers

sebdeckers ryanwild anusorn angrymouse

playdoh's Issues

Run both Node.js Current & LTS in CI

Reference:
https://docs.travis-ci.com/user/languages/javascript-with-nodejs/#specifying-nodejs-versions

EDNS

Should relay the client's IP to the DNS server.

EDNS0-Client-Subnet (GeoDNS)

DNS-over-HTTPS supports EDNS0-Client-Subnet protocol, which submits part of the client's IP address (/24 for IPv4, /56 for IPv6 by default) to the upstream server. This is useful for GeoDNS and CDNs to work, and is exactly the same configuration as most public DNS servers.

Keep in mind that /24 is not enough to track a single user, although it is precise enough to know the city where the user is located. If you think EDNS0-Client-Subnet is affecting your privacy, you can set no_ecs = true in /etc/dns-over-https/doh-client.conf, with the cost of slower video streaming or software downloading speed.

To ultilize ECS, X-Forwarded-For or X-Real-IP should be enabled on your HTTP service muxer. If your server is backed by unbound or bind, you probably want to configure it to enable the EDNS0-Client-Subnet feature as well.

https://github.com/m13253/dns-over-https#edns0-client-subnet-geodns

RFC 7871 – Client Subnet in DNS Queries – defines a mechanism for recursive resolvers like Google Public DNS to send partial client IP address information to authoritative DNS name servers. Content Delivery Networks (CDNs) and latency-sensitive services use this to give accurate geo-located responses when responding to name lookups coming through public DNS resolvers.

The RFC describes ECS features that authoritative name servers must implement; but implementers don’t always follow those requirements. There are also ECS operational and deployment issues the RFC does not address that can cause problems for resolvers like Google Public DNS that auto-detect ECS support in authoritative name servers, as well as resolvers that require ECS whitelisting, like OpenDNS.

https://developers.google.com/speed/public-dns/docs/ecs

DOH interop testing

Test against various DOH clients. So far Firefox 64 (Nightly) works fine.

https://github.com/curl/curl/wiki/DNS-over-HTTPS#supported-in-browsers-and-clients

Would be nice to support JSON as an alternative data format. Much easier to work with as developers or looking at the traffic in curl/inspector. Should be supported for parsing incoming requests (content-type header) as well as generating/translating responses (accept header).

RFC 8427 Representing DNS Messages in JSON

In-order execution?

Never did dgram stuff before. Does this ever close the stream? What if mkDnsQuery is called multiple times, are the answers matched with the queries somehow?

function mkDnsQuery( buf: Buffer ) {
  return new Promise(function( resolve, reject ) {
    socket.send(buf, 0, buf.length, 53, '192.168.1.1' )
    socket.on( 'message', function( message ) {
      resolve( message )
    })
    socket.on( 'error', function( err ) {
      reject( err );
    })
  })
}

Oblivious DoH?

Draft here: https://tools.ietf.org/html/draft-pauly-dprive-oblivious-doh-01

The gist of it:

Oblivious DoH requires, at a minimum:

   o  Two DoH servers, where one can act as an Oblivious Proxy, and the
      other can act as an Oblivious Target.

   o  Public keys for encrypting DNS queries that are passed from a
      client through a proxy to a target (Section 6).  These keys
      guarantee that only the intended Oblivious Target can decrypt
      client queries.

   o  Client ability to generate random [RFC4086] one-time-use symmetric
      keys to encrypt DNS responses.  These symmetric keys ensure that
      only the client will be able to decrypt the response from the
      Oblivious Target.  They are only used once to prevent the
      Oblivious Target from tracking clients based on keys.