noglitchyo/dealdoh

DNS-over-HTTPS proxy & client written in PHP to send DoH, DNSCrypt and GoogleDns queries

Dealdoh

Play with DNS over HTTPS and much more!

Dealdoh is a DNS-over-HTTPS (DoH) proxy and a library around DNS messaging written in PHP.

Overview

This library gives ability to proxy DoH requests and/or to send DNS queries with standard UDP/TCP and various modern and secure DNS protocols like DNSCrypt, DNS-over-HTTPS (DoH), GoogleDNS.

It attempts to achieve the following goals:

• provide high-compatibility with a large variety of DNS protocols.
• provide a well-designed abstraction layer for development around DNS in PHP.

Features

• DoH proxy middleware PSR-15/PSR-7 compliant.
• Create and forward DNS messages to different type of DNS upstream resolvers.
• Forward DNS query through multiple DNS upstream resolvers.
• Compatible with DNS protocols: RFC-1035 (Plain DNS over TCP/UDP), RFC-8484 (DoH), Google DoH API, DNSCrypt
• Abstraction layer around DNS development.
• Parse DNS stamps

Client

dealdoh-client is a CLI utility which offers a ready-to-use implementation of this library to send and forward DNS queries.

Library

Requirements

• PHP 7.3
• Web server
• Optional: HTTPS enabled with valid certificates (self-signed certificates can work but it depends of the DOH client making the queries)

Installation

• Run composer require noglitchyo/dealdoh

• DohResolverMiddleware::forward() method consumes PSR-7 ServerRequest. Some compatible implementations which can be used:

  • https://github.com/Nyholm/psr7 - composer require nyholm/psr7
  • https://github.com/guzzle/psr7 - composer require guzzle/psr7
  • https://github.com/zendframework/zend-diactoros - composer require zendframework/zend-diactoros

• Configure your application to call DohResolverMiddleware::forward()

• Testing the installation

As recommended in RFC-8484, usually, DoH client/server will send/receive DNS requests on the path: /dns-query. Your application should be configured to listen on this route.

A large variety of DoH client exists than can be used to test the installation.

• dealdoh-client

• Facebook Experimental

• Using client from Web Browser
  Mozilla Firefox provides a Trusted Recursive Resolver who can be configured to query DoH servers. This article from Daniel Stenberg provides a lot of details about TRR and how to configure it. Please check also the browser implementations list.

Example

<?php
use GuzzleHttp\Client as GuzzleClient;
use Http\Adapter\Guzzle6\Client as GuzzleClientAdapter;
use NoGlitchYo\Dealdoh\Dns\Client\DnsCryptClient;
use NoGlitchYo\Dealdoh\Dns\Client\DohClient;
use NoGlitchYo\Dealdoh\Dns\Client\PlainDnsClient;
use NoGlitchYo\Dealdoh\Dns\Resolver\DnsUpstreamPoolResolver;
use NoGlitchYo\Dealdoh\Entity\DnsUpstreamPool;
use NoGlitchYo\Dealdoh\Mapper\DnsCrypt\AuthenticatedEncryptionMapper;
use NoGlitchYo\Dealdoh\Mapper\HttpResponseMapper;
use NoGlitchYo\Dealdoh\Mapper\MessageMapper;
use NoGlitchYo\Dealdoh\Middleware\DohResolverMiddleware;
use NoGlitchYo\Dealdoh\Repository\DnsCrypt\CertificateRepository;
use Psr\Http\Message\ResponseInterface;

$messageMapper = new MessageMapper();

// Initialize the DNS clients to use with the resolver
$dnsClients = [
    new DohClient(new GuzzleClientAdapter(new GuzzleClient()), $messageMapper),
    new PlainDnsClient($messageMapper),
    new DnsCryptClient(new AuthenticatedEncryptionMapper(), new CertificateRepository(), $messageMapper)
];

// Initialize the list of DNS upstreams to use to resolve the DNS queries
$dnsUpstreamPool = new DnsUpstreamPool([
    'dns://8.8.8.8:53',
    'https://cloudflare-dns.com/dns-query',
    'sdns://AQcAAAAAAAAAFlsyMDAxOmJjODoxODI0OjczODo6MV0gAyfzz5J-mV9G-yOB4Hwcdk7yX12EQs5Iva7kV3oGtlEgMi5kbnNjcnlwdC1jZXJ0LmFjc2Fjc2FyLWFtcy5jb20',
]);

// Initialize the DNS resolver with the list of upstreams and the list of clients able to exchange with the upstreams
$dnsResolver = new DnsUpstreamPoolResolver($dnsUpstreamPool, $dnsClients);

// Create the ResolverMiddleware with the created DnsResolver
$dohMiddleware = new DohResolverMiddleware($dnsResolver, $messageMapper, new HttpResponseMapper($messageMapper));

/** @var $response ResponseInterface */
$response = $dohMiddleware->forward(/* Expect a \Psr\Http\Message\RequestInterface object */);

More examples

Checkout some really simple integration examples to get a glimpse on how it can be done:

• Slim Framework integration
• DoH + Docker + DNS + Hostname Discovery
• dealdoh-client

Testing

If you wish to run the test, checkout the project and run the test with:

composer test

Contributing

Get started here CONTRIBUTING.md.

License

This project is licensed under the MIT License - see the LICENSE.md file for details

Acknowledgments

• https://github.com/reactphp/dns
• https://github.com/mageddo/dns-proxy-server
• https://github.com/facebookexperimental/doh-proxy
• https://github.com/DNSCrypt/dnscrypt-proxy

References

• RFC-8484
• RFC-1035
• RFC-4501
• RFC-7719
• PSR-7
• PSR-15
• PSR-18
• DNSCrypt
• DNS Stamps
• Wiki page DNS-over-HTTPS from Curl

dealdoh's Issues

composer require noglitchyo/dealdoh not working

root@CubeCloud-2022925552:~/dealdoh# ./composer.phar require noglitchyo/dealdoh
Do not run Composer as root/super user! See https://getcomposer.org/root for details
Continue as root/super user [yes]? 
Info from https://repo.packagist.org: #StandWithUkraine

Installation failed, deleting ./composer.json.

In RequireCommand.php line 225:
                                                                                                                          
  No composer.json present in the current directory (./composer.json), this may be the cause of the following exception.  
                                                                                                                          

In PackageDiscoveryTrait.php line 331:
                                                                                                                                                                        
  Could not find a version of package noglitchyo/dealdoh matching your minimum-stability (stable). Require it with an explicit version constraint allowing its desired  
   stability.                                                                                                                                                           
                                                                                                                                                                        

composer version:

root@CubeCloud-2022925552:~/dealdoh# ./composer.phar -v
Do not run Composer as root/super user! See https://getcomposer.org/root for details
Continue as root/super user [yes]? 
   ______
  / ____/___  ____ ___  ____  ____  ________  _____
 / /   / __ \/ __ `__ \/ __ \/ __ \/ ___/ _ \/ ___/
/ /___/ /_/ / / / / / / /_/ / /_/ (__  )  __/ /
\____/\____/_/ /_/ /_/ .___/\____/____/\___/_/
                    /_/
Composer version 2.5.1 2022-12-22 15:33:54

php version:

root@CubeCloud-2022925552:~/dealdoh# php -v
PHP 7.4.3-4ubuntu2.17 (cli) (built: Jan 10 2023 15:37:44) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with Zend OPcache v7.4.3-4ubuntu2.17, Copyright (c), by Zend Technologies