curl / doh

stand-alone application for DoH (DNS-over-HTTPS) name resolves and lookups

doh

A libcurl-using application that resolves a host name using DNS-over-HTTPS (DoH).

This code uses POST requests unconditionally for this.

Install

make
sudo make install

Usage

doh [options] host [DoH URL]

If DoH URL is left out, the Cloudflare DoH server will be used. See also list of public servers

Examples

$ doh www.example.com
www.example.com from https://dns.cloudflare.com/dns-query
TTL: 2612 seconds
A: 93.184.216.34
AAAA: 2606:2800:0220:0001:0248:1893:25c8:1946

$ doh www.yahoo.com https://dns.google/dns-query
www.yahoo.com from https://dns.google/dns-query
TTL: 36 seconds
A: 87.248.98.8
A: 87.248.98.7
AAAA: 2a00:1288:0110:001c:0000:0000:0000:0004
AAAA: 2a00:1288:0110:001c:0000:0000:0000:0003
CNAME: atsv2-fp.wg1.b.yahoo.com
CNAME: atsv2-fp.wg1.b.yahoo.com

doh's Issues

About problem 7

Hello, everyone

I am trying to build a DoH Server, but I always get some error like problem 7 decoding 80 bytes response to probe for A
Here is a sample of my response, this is binary

I am not sure if there's something wrong with my response packet format.

Thanks very much, if someone can help me.

doh_encode: values returned on error should be zero for consistency with post-invocation test

doh_encode has type size_t, but returns non-zero values from type DOHcode in case of error at each of the lines 259: return DOH_TOO_SMALL_BUFFER; and 287: return DOH_DNS_BAD_LABEL;

This is inconsistent with the post-invocation test at line 686: if(!p->dohlen) { ... } which uses zero as indication of failure.

It appears that lines 259 and 287 should read return 0;

Cake

tests and CI

We should really create a few basic tests to start with and then build and verify the tests for commits and PRs in a CI setup...

malicious server response causes out of bounds read in store_cname function

A specially crafted response from a DoH server can cause store_cname to read data out of bounds:

ASan stack trace:

==3100859==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f08f3f00d68 at pc 0x55b90efcb4e6 bp 0x7ffdd6a6f910 sp 0x7ffdd6a6f908
READ of size 8 at 0x7f08f3f00d68 thread T0
    #0 0x55b90efcb4e5 in store_cname /home/fusl/Projects/curl/doh/doh.c:422:13
    #1 0x55b90efcb4e5 in rdata /home/fusl/Projects/curl/doh/doh.c:495:10
    #2 0x55b90efcb4e5 in doh_decode /home/fusl/Projects/curl/doh/doh.c:588:10
    #3 0x55b90efcb4e5 in main /home/fusl/Projects/curl/doh/doh.c:965:18
    #4 0x7f08f622accf  (/usr/lib/libc.so.6+0x27ccf) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658)
    #5 0x7f08f622ad89 in __libc_start_main (/usr/lib/libc.so.6+0x27d89) (BuildId: 8bfe03f6bf9b6a6e2591babd0bbc266837d8f658)
    #6 0x55b90ee921c4 in _start (/home/fusl/Projects/curl/doh/doh+0x1f1c4) (BuildId: 1dfaebf7d37031b4a7bb6886e4aabdb4dcec14d6)

Address 0x7f08f3f00d68 is located in stack of thread T0 at offset 3432 in frame
    #0 0x55b90efc856f in main /home/fusl/Projects/curl/doh/doh.c:787

  This frame has 8 object(s):
    [32, 832) 'urls' (line 795)
    [960, 964) 'still_running' (line 799)
    [976, 3432) 'd' (line 801) <== Memory access at offset 3432 overflows this variable
    [3568, 3572) 'queued' (line 804)
    [3584, 3588) 'numfds' (line 922)
    [3600, 3616) 'wait' (line 940)
    [3632, 3640) 'probe' (line 950)
    [3664, 3672) 'response_code' (line 962)

Server response that triggers this out of bounds read:

00000000: 0000 8130 0001 0000 0001 3030 0030 3030  ...0......00.000
00000010: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000020: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000040: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000050: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000060: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000070: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000080: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000090: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000a0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000b0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000c0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000d0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000e0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000000f0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000100: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000110: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000120: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000130: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000140: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000150: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000160: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000170: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000180: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000190: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000001a0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000001b0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000001c0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000001d0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000001e0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000001f0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000200: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000210: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000220: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000230: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000240: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000250: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000260: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000270: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000280: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000290: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000002a0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000002b0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000002c0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000002d0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000002e0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000002f0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000300: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000310: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000320: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000330: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000340: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000350: 3030 0030 3030 3030 3030 3000 0000 3030  00.00000000...00
00000360: 3030 3030 3030 0000 0030 3030 3030 3030  000000...0000000
00000370: 3000 0030 3030 3030 3030 3030 3030 3030  0..0000000000000
00000380: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000390: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000003a0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000003b0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000003c0: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
000003d0: 3030 3030 3000 3030 3030 3030 3030 0000  00000.00000000..
000003e0: 0030 3030 3030 3030 3000 0000 3030 3030  .00000000...0000
000003f0: 3030 3030 0000 0030 3030 3030 3030 30    0000...00000000

This bug was discovered with the help of AFL++ in combination with ASan.

Request for record type 'A' always returns 'AAAA'

~$ doh google.com
[google.com]
TTL: 215 seconds
A: 172.217.19.174
AAAA: 2a00:1450:4019:0803:0000:0000:0000:200e
~$ doh -tA google.com
[google.com]
TTL: 298 seconds
AAAA: 2a00:1450:4019:0803:0000:0000:0000:200e
~$ doh -tAAAA google.com
[google.com]
TTL: 284 seconds
AAAA: 2a00:1450:4019:0803:0000:0000:0000:200e

Also:

• A non-zero return code on resolution failure would be helpful.

• Using IP address as URL enables to avoid plain DNS at all like we can do with curl:

    ~$ curl -s -H 'accept: application/dns-json' 'https://1.1.1.1/dns-query?name=google.com&type=A'
    {"Status":0,"TC":false,"RD":true,"RA":true,"AD":false,"CD":false,"Question":[{"name":"google.com","type":1}],"Answer":[{"name":"google.com","type":1,"TTL":274,"data":"172.217.19.174"}]}
  

Anonyme13

Unable to use dns.google

According to the Google Blog the new RFC-compliant DOH server is:
https://dns.google/dns-query

Unfurtunately the doh cli does not work with that server.
christoph@server:~$ ./doh www.google.com https://dns.google/dns.query
problem 7 decoding 787 bytes response to probe for A
problem 7 decoding 787 bytes response to probe for AAAA

It works with the deprecated URL:
https://dns.google.com/experimental

The DNS over HTTPS URL has changed

doh/doh.c

Line 701 in 05b11f3

const char *url = "https://dns.cloudflare.com/.well-known/dns-query";

The above should now just be https://cloudflare-dns.com/dns-query, as per the latest draft.

Geti

Saya tidak tahu cari pdf tolong bantu saya

Curl DoH not working on windows 7

hey!
curl doh works fine on windows 10 after compiling and running on windows 7 or 8 it gives curl error code (6) Couldn't resolve host. if I remove the Doh its work perfectly fine on all windows os.
??

curl = curl_easy_init();
	curl_easy_setopt(curl, CURLOPT_URL, "https://stackoverflow.com");
	curl_easy_setopt(curl, CURLOPT_DOH_URL, "https://dns.google/dns-query")
	res = curl_easy_perform(curl)
	cout << res << endl;
	curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);
	curl_easy_cleanup(curl);

Output the equivalent curl command line

It would be great if doh has a flag to print out the curl command that can send the equivalent HTTP request.

This would be very useful to repeat the test in other HTTP client, e.g. when you need to setup some blackbox monitoring.

I don't know what a DOH request is

I guess this is more of a personal issue but...

Add a -p for proxy flag

Would be great if I could send my requests to my Burp Suite proxy. Possible to add a -p flag for proxy?

Would look like this:

doh -k www.example.com https://10.10.10.10/dns-query -p 127.0.0.1:8080

Support TXT records

This tools has been really handy for debugging DoH servers that don't support JSON requests. However, it seems that TXT records are not supported, only A AAAA NS and CNAME. This seems like it shouldn't be too hard to add, but maybe I am missing something about the decoding process.

Would it be possible to add TXT record support?

Apéritif