https-dns-proxy

https_dns_proxy is a light-weight DNS<-->HTTPS, non-caching proxy for Google's DNS-over-HTTPS service.

Using DNS over HTTPS makes eavesdropping and spoofing of DNS traffic between you and the HTTPS DNS provider (Google) much less likely. This of course only makes sense if you trust Google as they're currently the only provider of such a service.

Features:

• Tiny Size (<30kiB).
• Uses curl for HTTP/2 and pipelining, keeping resolve latencies extremely low.
• Single-threaded, non-blocking select() server for use on resource-starved embedded systems.
• Designed to sit in front of dnsmasq or similar caching resolver for transparent use.

BUILD

Depends on c-ares, libcurl, libev.

$ cmake .
$ make

INSTALL

There is no installer at this stage - just run it.

# ./https_dns_proxy -u nobody -g nogroup -d

OpenWRT package install

I maintain a package in the OpenWRT packages repository as well. You can install as follows:

root@OpenWrt:~# opkg update
root@OpenWrt:~# opkg install https_dns_proxy
root@OpenWrt:~# /etc/init.d/https_dns_proxy enable
root@OpenWrt:~# /etc/init.d/https_dns_proxy start

Replace any 'list server' lines in /etc/config/dhcp with:

list server '127.0.0.1#5053'

You may also want to add the line:

noresolv '1'

This prevents dnsmasq from using /etc/resolv.conf DNS servers, leaving only our proxy server.

Usage

Just run it as a daemon and point traffic at it. Commandline flags are:

Usage: https_dns_proxy [-a <listen_addr>] [-p <listen_port>]
        [-e <subnet>] [-d] [-u <user>] [-g <group>] [-b <dns_servers>]
        [-l <logfile>]

  -a listen_addr    Local address to bind to. (127.0.0.1)
  -p listen_port    Local port to bind to. (5053)
  -e subnet_addr    An edns-client-subnet to use such as "203.31.0.0/16". ()
  -d                Daemonize.
  -u user           User to drop to launched as root. (nobody)
  -g group          Group to drop to launched as root. (nobody)
  -b dns_servers    Comma separated IPv4 address of DNS servers
                    to resolve dns.google.com. (8.8.8.8,8.8.4.4)
  -t proxy_server   Optional HTTP proxy. e.g. socks5://127.0.0.1:1080
                    (Initial DNS resolution can't be done over this.)
  -l logfile        Path to file to log to. (-)
  -v                Increase logging verbosity. (INFO)

TODO

• Test coverage could be better.
• Load tests (that don't tax Google's infrastructure) would be nice.

AUTHORS

• Aaron Drew ([email protected])