From 5381c2bcbc7c00026ad57ea2d8e5f3b5a4b20a5a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=A3=8E=E6=89=87=E6=BB=91=E7=BF=94=E7=BF=BC?= Date: Tue, 17 Sep 2024 11:55:43 +0000 Subject: [PATCH 1/3] Add ECH support --- infra/conf/cfgcommon/tlscfg/tls.go | 5 ++ transport/internet/tls/config.go | 8 ++ transport/internet/tls/config.pb.go | 56 +++++++++----- transport/internet/tls/config.proto | 6 ++ transport/internet/tls/ech.go | 114 ++++++++++++++++++++++++++++ transport/internet/tls/ech_go122.go | 12 +++ 6 files changed, 184 insertions(+), 17 deletions(-) create mode 100644 transport/internet/tls/ech.go create mode 100644 transport/internet/tls/ech_go122.go diff --git a/infra/conf/cfgcommon/tlscfg/tls.go b/infra/conf/cfgcommon/tlscfg/tls.go index 417ca6c1ebc..680c1076cc6 100644 --- a/infra/conf/cfgcommon/tlscfg/tls.go +++ b/infra/conf/cfgcommon/tlscfg/tls.go @@ -22,6 +22,8 @@ type TLSConfig struct { DisableSystemRoot bool `json:"disableSystemRoot"` PinnedPeerCertificateChainSha256 *[]string `json:"pinnedPeerCertificateChainSha256"` VerifyClientCertificate bool `json:"verifyClientCertificate"` + ECHConfig string `json:"echConfig"` + ECHDOHServer string `json:"echDohServer"` } // Build implements Buildable. @@ -58,6 +60,9 @@ func (c *TLSConfig) Build() (proto.Message, error) { } } + config.EchConfig = c.ECHConfig + config.Ech_DOHserver = c.ECHDOHServer + return config, nil } diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go index 8de83b938fb..1d03a850c55 100644 --- a/transport/internet/tls/config.go +++ b/transport/internet/tls/config.go @@ -286,6 +286,14 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config { case Config_TLS1_3: config.MaxVersion = tls.VersionTLS13 } + + if len(c.EchConfig) > 0 || len(c.Ech_DOHserver) > 0 { + err := ApplyECH(c, config) + if err != nil { + newError("unable to set ECH").AtError().Base(err).WriteToLog() + } + } + return config } diff --git a/transport/internet/tls/config.pb.go b/transport/internet/tls/config.pb.go index 6559d82efd6..bc02b88eb5a 100644 --- a/transport/internet/tls/config.pb.go +++ b/transport/internet/tls/config.pb.go @@ -234,6 +234,10 @@ type Config struct { MaxVersion Config_TLSVersion `protobuf:"varint,10,opt,name=max_version,json=maxVersion,proto3,enum=v2ray.core.transport.internet.tls.Config_TLSVersion" json:"max_version,omitempty"` // Whether or not to allow self-signed certificates when pinned_peer_certificate_chain_sha256 is present. AllowInsecureIfPinnedPeerCertificate bool `protobuf:"varint,11,opt,name=allow_insecure_if_pinned_peer_certificate,json=allowInsecureIfPinnedPeerCertificate,proto3" json:"allow_insecure_if_pinned_peer_certificate,omitempty"` + // ECH Config in base64 format + EchConfig string `protobuf:"bytes,16,opt,name=ech_config,json=echConfig,proto3" json:"ech_config,omitempty"` + // DOH server to query HTTPS record for ECH + Ech_DOHserver string `protobuf:"bytes,17,opt,name=ech_DOHserver,json=echDOHserver,proto3" json:"ech_DOHserver,omitempty"` } func (x *Config) Reset() { @@ -345,6 +349,20 @@ func (x *Config) GetAllowInsecureIfPinnedPeerCertificate() bool { return false } +func (x *Config) GetEchConfig() string { + if x != nil { + return x.EchConfig + } + return "" +} + +func (x *Config) GetEch_DOHserver() string { + if x != nil { + return x.Ech_DOHserver + } + return "" +} + var File_transport_internet_tls_config_proto protoreflect.FileDescriptor var file_transport_internet_tls_config_proto_rawDesc = []byte{ @@ -376,7 +394,7 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x49, 0x53, 0x53, 0x55, 0x45, 0x10, 0x02, 0x12, 0x1b, 0x0a, 0x17, 0x41, 0x55, 0x54, 0x48, 0x4f, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x56, 0x45, 0x52, 0x49, 0x46, 0x59, 0x5f, 0x43, 0x4c, 0x49, - 0x45, 0x4e, 0x54, 0x10, 0x03, 0x22, 0xb2, 0x06, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, + 0x45, 0x4e, 0x54, 0x10, 0x03, 0x22, 0xf6, 0x06, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2d, 0x0a, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x42, 0x06, 0x82, 0xb5, 0x18, 0x02, 0x28, 0x01, 0x52, 0x0d, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x12, @@ -421,22 +439,26 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x24, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x49, 0x66, 0x50, 0x69, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, - 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x22, 0x49, 0x0a, 0x0a, 0x54, 0x4c, 0x53, 0x56, 0x65, 0x72, - 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x10, - 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x30, 0x10, 0x01, 0x12, 0x0a, 0x0a, - 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x31, 0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, - 0x31, 0x5f, 0x32, 0x10, 0x03, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x33, 0x10, - 0x04, 0x3a, 0x17, 0x82, 0xb5, 0x18, 0x13, 0x0a, 0x08, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, - 0x79, 0x12, 0x03, 0x74, 0x6c, 0x73, 0x90, 0xff, 0x29, 0x01, 0x42, 0x84, 0x01, 0x0a, 0x25, 0x63, - 0x6f, 0x6d, 0x2e, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x74, 0x72, - 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, - 0x2e, 0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, - 0x6f, 0x6d, 0x2f, 0x76, 0x32, 0x66, 0x6c, 0x79, 0x2f, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2d, 0x63, - 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x35, 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, - 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x74, 0x6c, 0x73, 0xaa, 0x02, 0x21, - 0x56, 0x32, 0x52, 0x61, 0x79, 0x2e, 0x43, 0x6f, 0x72, 0x65, 0x2e, 0x54, 0x72, 0x61, 0x6e, 0x73, - 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x54, 0x6c, - 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x63, 0x68, 0x5f, 0x63, 0x6f, + 0x6e, 0x66, 0x69, 0x67, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x65, 0x63, 0x68, 0x43, + 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x63, 0x68, 0x5f, 0x44, 0x4f, 0x48, + 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x11, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x63, + 0x68, 0x44, 0x4f, 0x48, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x22, 0x49, 0x0a, 0x0a, 0x54, 0x4c, + 0x53, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x65, 0x66, 0x61, + 0x75, 0x6c, 0x74, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x30, 0x10, + 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x31, 0x10, 0x02, 0x12, 0x0a, 0x0a, + 0x06, 0x54, 0x4c, 0x53, 0x31, 0x5f, 0x32, 0x10, 0x03, 0x12, 0x0a, 0x0a, 0x06, 0x54, 0x4c, 0x53, + 0x31, 0x5f, 0x33, 0x10, 0x04, 0x3a, 0x17, 0x82, 0xb5, 0x18, 0x13, 0x0a, 0x08, 0x73, 0x65, 0x63, + 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, 0x03, 0x74, 0x6c, 0x73, 0x90, 0xff, 0x29, 0x01, 0x42, 0x84, + 0x01, 0x0a, 0x25, 0x63, 0x6f, 0x6d, 0x2e, 0x76, 0x32, 0x72, 0x61, 0x79, 0x2e, 0x63, 0x6f, 0x72, + 0x65, 0x2e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x69, 0x6e, 0x74, 0x65, + 0x72, 0x6e, 0x65, 0x74, 0x2e, 0x74, 0x6c, 0x73, 0x50, 0x01, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, + 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x76, 0x32, 0x66, 0x6c, 0x79, 0x2f, 0x76, 0x32, 0x72, + 0x61, 0x79, 0x2d, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x76, 0x35, 0x2f, 0x74, 0x72, 0x61, 0x6e, 0x73, + 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x2f, 0x74, 0x6c, + 0x73, 0xaa, 0x02, 0x21, 0x56, 0x32, 0x52, 0x61, 0x79, 0x2e, 0x43, 0x6f, 0x72, 0x65, 0x2e, 0x54, + 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x65, + 0x74, 0x2e, 0x54, 0x6c, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( diff --git a/transport/internet/tls/config.proto b/transport/internet/tls/config.proto index 8c9f92e55d2..c3d9e61f2da 100644 --- a/transport/internet/tls/config.proto +++ b/transport/internet/tls/config.proto @@ -78,4 +78,10 @@ message Config { // Whether or not to allow self-signed certificates when pinned_peer_certificate_chain_sha256 is present. bool allow_insecure_if_pinned_peer_certificate = 11; + + // ECH Config in base64 format + string ech_config = 16; + + // DOH server to query HTTPS record for ECH + string ech_DOHserver = 17; } diff --git a/transport/internet/tls/ech.go b/transport/internet/tls/ech.go new file mode 100644 index 00000000000..959b2d985b1 --- /dev/null +++ b/transport/internet/tls/ech.go @@ -0,0 +1,114 @@ +//go:build go1.23 +// +build go1.23 + +package tls + +import ( + "bytes" + "crypto/tls" + "encoding/base64" + "io" + "net/http" + "regexp" + "sync" + "time" + + "github.com/miekg/dns" +) + +func ApplyECH(c *Config, config *tls.Config) error { + var ECHConfig []byte + var err error + + if len(c.EchConfig) > 0 { + ECHConfig, err = base64.StdEncoding.DecodeString(c.EchConfig) + if err != nil { + return newError("invalid ECH config") + } + } else { // ECH config > DOH lookup + if c.ServerName == "" { + return newError("Using DOH for ECH needs serverName") + } + ECHRecord, err := QueryRecord(c.ServerName, c.Ech_DOHserver) + if err != nil { + return err + } + ECHConfig, _ = base64.StdEncoding.DecodeString(ECHRecord) + } + + config.EncryptedClientHelloConfigList = ECHConfig + return nil +} + +type record struct { + record string + expire time.Time +} + +var ( + dnsCache = make(map[string]record) + mutex sync.RWMutex +) + +func QueryRecord(domain string, server string) (string, error) { + rec, found := dnsCache[domain] + if found && rec.expire.After(time.Now()) { + return rec.record, nil + } + mutex.Lock() + defer mutex.Unlock() + record, ttl, err := dohQuery(server, domain) + if err != nil { + return "", err + } + // Use TTL for good, but many HTTPS records have TTL 60, too short + if ttl < 600 { + ttl = 600 + } + rec.record = record + rec.expire = time.Now().Add(time.Second * time.Duration(ttl)) + dnsCache[domain] = rec + return record, nil +} + +func dohQuery(server string, domain string) (string, uint32, error) { + m := new(dns.Msg) + m.SetQuestion(dns.Fqdn(domain), dns.TypeHTTPS) + msg, err := m.Pack() + if err != nil { + return "", 0, err + } + client := &http.Client{ + Timeout: 5 * time.Second, + } + req, err := http.NewRequest("POST", server, bytes.NewReader(msg)) + if err != nil { + return "", 0, err + } + req.Header.Set("Content-Type", "application/dns-message") + resp, err := client.Do(req) + if err != nil { + return "", 0, err + } + defer resp.Body.Close() + respBody, err := io.ReadAll(resp.Body) + if err != nil { + return "", 0, err + } + if resp.StatusCode != http.StatusOK { + return "", 0, newError("query failed with response code:", resp.StatusCode) + } + respMsg := new(dns.Msg) + err = respMsg.Unpack(respBody) + if err != nil { + return "", 0, err + } + if len(respMsg.Answer) > 0 { + re := regexp.MustCompile(`ech="([^"]+)"`) + match := re.FindStringSubmatch(respMsg.Answer[0].String()) + if match[1] != "" { + return match[1], respMsg.Answer[0].Header().Ttl, nil + } + } + return "", 0, newError("no ech record found") +} \ No newline at end of file diff --git a/transport/internet/tls/ech_go122.go b/transport/internet/tls/ech_go122.go new file mode 100644 index 00000000000..35ba0fa81f4 --- /dev/null +++ b/transport/internet/tls/ech_go122.go @@ -0,0 +1,12 @@ +//go:build !go1.23 +// +build !go1.23 + +package tls + +import ( + "crypto/tls" +) + +func ApplyECH(c *Config, config *tls.Config) error { + return newError("using ECH require go 1.23 or higher") +} From 21278b5bc40b1172bdbd357b852a54b24c0d9b85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=A3=8E=E6=89=87=E6=BB=91=E7=BF=94=E7=BF=BC?= Date: Wed, 18 Sep 2024 08:12:11 +0000 Subject: [PATCH 2/3] Use internet.DialSystem() Why not --- transport/internet/tls/ech.go | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/transport/internet/tls/ech.go b/transport/internet/tls/ech.go index 959b2d985b1..e77e1fc1777 100644 --- a/transport/internet/tls/ech.go +++ b/transport/internet/tls/ech.go @@ -9,11 +9,14 @@ import ( "encoding/base64" "io" "net/http" + "context" "regexp" "sync" "time" "github.com/miekg/dns" + "github.com/v2fly/v2ray-core/v5/common/net" + "github.com/v2fly/v2ray-core/v5/transport/internet" ) func ApplyECH(c *Config, config *tls.Config) error { @@ -57,6 +60,7 @@ func QueryRecord(domain string, server string) (string, error) { } mutex.Lock() defer mutex.Unlock() + newError("Tring to query ECH config for domain: ", domain, " with DOH server: ", server).AtDebug().WriteToLog() record, ttl, err := dohQuery(server, domain) if err != nil { return "", err @@ -78,8 +82,24 @@ func dohQuery(server string, domain string) (string, uint32, error) { if err != nil { return "", 0, err } + tr := &http.Transport{ + IdleConnTimeout: 90 * time.Second, + ForceAttemptHTTP2: true, + DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) { + dest, err := net.ParseDestination(network + ":" + addr) + if err != nil { + return nil, err + } + conn, err := internet.DialSystem(ctx, dest, nil) + if err != nil { + return nil, err + } + return conn, nil + }, + } client := &http.Client{ - Timeout: 5 * time.Second, + Timeout: 5 * time.Second, + Transport: tr, } req, err := http.NewRequest("POST", server, bytes.NewReader(msg)) if err != nil { @@ -107,6 +127,7 @@ func dohQuery(server string, domain string) (string, uint32, error) { re := regexp.MustCompile(`ech="([^"]+)"`) match := re.FindStringSubmatch(respMsg.Answer[0].String()) if match[1] != "" { + newError("Get ECH config:", match[1], " TTL:", respMsg.Answer[0].Header().Ttl).AtDebug().WriteToLog() return match[1], respMsg.Answer[0].Header().Ttl, nil } } From 34416105b713480ef374c51ca5a732bfc2c8a057 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=A3=8E=E6=89=87=E6=BB=91=E7=BF=94=E7=BF=BC?= Date: Thu, 26 Sep 2024 15:11:51 +0000 Subject: [PATCH 3/3] Many fixes --- infra/conf/cfgcommon/tlscfg/tls.go | 9 +++- transport/internet/tls/config.pb.go | 10 ++--- transport/internet/tls/config.proto | 4 +- transport/internet/tls/ech.go | 66 +++++++++++++++-------------- 4 files changed, 50 insertions(+), 39 deletions(-) diff --git a/infra/conf/cfgcommon/tlscfg/tls.go b/infra/conf/cfgcommon/tlscfg/tls.go index 680c1076cc6..b8671534410 100644 --- a/infra/conf/cfgcommon/tlscfg/tls.go +++ b/infra/conf/cfgcommon/tlscfg/tls.go @@ -60,7 +60,14 @@ func (c *TLSConfig) Build() (proto.Message, error) { } } - config.EchConfig = c.ECHConfig + if c.ECHConfig != "" { + ECHConfig, err := base64.StdEncoding.DecodeString(c.ECHConfig) + if err != nil { + return nil, newError("invalid ECH Config", c.ECHConfig) + } + config.EchConfig = ECHConfig + } + config.Ech_DOHserver = c.ECHDOHServer return config, nil diff --git a/transport/internet/tls/config.pb.go b/transport/internet/tls/config.pb.go index bc02b88eb5a..56269d13857 100644 --- a/transport/internet/tls/config.pb.go +++ b/transport/internet/tls/config.pb.go @@ -234,8 +234,8 @@ type Config struct { MaxVersion Config_TLSVersion `protobuf:"varint,10,opt,name=max_version,json=maxVersion,proto3,enum=v2ray.core.transport.internet.tls.Config_TLSVersion" json:"max_version,omitempty"` // Whether or not to allow self-signed certificates when pinned_peer_certificate_chain_sha256 is present. AllowInsecureIfPinnedPeerCertificate bool `protobuf:"varint,11,opt,name=allow_insecure_if_pinned_peer_certificate,json=allowInsecureIfPinnedPeerCertificate,proto3" json:"allow_insecure_if_pinned_peer_certificate,omitempty"` - // ECH Config in base64 format - EchConfig string `protobuf:"bytes,16,opt,name=ech_config,json=echConfig,proto3" json:"ech_config,omitempty"` + // ECH Config in bytes format + EchConfig []byte `protobuf:"bytes,16,opt,name=ech_config,json=echConfig,proto3" json:"ech_config,omitempty"` // DOH server to query HTTPS record for ECH Ech_DOHserver string `protobuf:"bytes,17,opt,name=ech_DOHserver,json=echDOHserver,proto3" json:"ech_DOHserver,omitempty"` } @@ -349,11 +349,11 @@ func (x *Config) GetAllowInsecureIfPinnedPeerCertificate() bool { return false } -func (x *Config) GetEchConfig() string { +func (x *Config) GetEchConfig() []byte { if x != nil { return x.EchConfig } - return "" + return nil } func (x *Config) GetEch_DOHserver() string { @@ -440,7 +440,7 @@ var file_transport_internet_tls_config_proto_rawDesc = []byte{ 0x52, 0x24, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x49, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x49, 0x66, 0x50, 0x69, 0x6e, 0x6e, 0x65, 0x64, 0x50, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x63, 0x68, 0x5f, 0x63, 0x6f, - 0x6e, 0x66, 0x69, 0x67, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x65, 0x63, 0x68, 0x43, + 0x6e, 0x66, 0x69, 0x67, 0x18, 0x10, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x65, 0x63, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x63, 0x68, 0x5f, 0x44, 0x4f, 0x48, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x11, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x63, 0x68, 0x44, 0x4f, 0x48, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x22, 0x49, 0x0a, 0x0a, 0x54, 0x4c, diff --git a/transport/internet/tls/config.proto b/transport/internet/tls/config.proto index c3d9e61f2da..fc471a65d93 100644 --- a/transport/internet/tls/config.proto +++ b/transport/internet/tls/config.proto @@ -79,8 +79,8 @@ message Config { // Whether or not to allow self-signed certificates when pinned_peer_certificate_chain_sha256 is present. bool allow_insecure_if_pinned_peer_certificate = 11; - // ECH Config in base64 format - string ech_config = 16; + // ECH Config in bytes format + bytes ech_config = 16; // DOH server to query HTTPS record for ECH string ech_DOHserver = 17; diff --git a/transport/internet/tls/ech.go b/transport/internet/tls/ech.go index e77e1fc1777..8b012250e86 100644 --- a/transport/internet/tls/ech.go +++ b/transport/internet/tls/ech.go @@ -5,12 +5,10 @@ package tls import ( "bytes" + "context" "crypto/tls" - "encoding/base64" "io" "net/http" - "context" - "regexp" "sync" "time" @@ -24,19 +22,15 @@ func ApplyECH(c *Config, config *tls.Config) error { var err error if len(c.EchConfig) > 0 { - ECHConfig, err = base64.StdEncoding.DecodeString(c.EchConfig) - if err != nil { - return newError("invalid ECH config") - } + ECHConfig = c.EchConfig } else { // ECH config > DOH lookup - if c.ServerName == "" { + if config.ServerName == "" { return newError("Using DOH for ECH needs serverName") } - ECHRecord, err := QueryRecord(c.ServerName, c.Ech_DOHserver) + ECHConfig, err = QueryRecord(c.ServerName, c.Ech_DOHserver) if err != nil { return err } - ECHConfig, _ = base64.StdEncoding.DecodeString(ECHRecord) } config.EncryptedClientHelloConfigList = ECHConfig @@ -44,7 +38,7 @@ func ApplyECH(c *Config, config *tls.Config) error { } type record struct { - record string + record []byte expire time.Time } @@ -53,34 +47,40 @@ var ( mutex sync.RWMutex ) -func QueryRecord(domain string, server string) (string, error) { +func QueryRecord(domain string, server string) ([]byte, error) { + mutex.Lock() rec, found := dnsCache[domain] if found && rec.expire.After(time.Now()) { + mutex.Unlock() return rec.record, nil } - mutex.Lock() - defer mutex.Unlock() - newError("Tring to query ECH config for domain: ", domain, " with DOH server: ", server).AtDebug().WriteToLog() + mutex.Unlock() + + newError("Trying to query ECH config for domain: ", domain, " with ECH server: ", server).AtDebug().WriteToLog() record, ttl, err := dohQuery(server, domain) if err != nil { - return "", err + return []byte{}, err } - // Use TTL for good, but many HTTPS records have TTL 60, too short + if ttl < 600 { ttl = 600 } + + mutex.Lock() + defer mutex.Unlock() rec.record = record rec.expire = time.Now().Add(time.Second * time.Duration(ttl)) dnsCache[domain] = rec return record, nil } -func dohQuery(server string, domain string) (string, uint32, error) { +func dohQuery(server string, domain string) ([]byte, uint32, error) { m := new(dns.Msg) m.SetQuestion(dns.Fqdn(domain), dns.TypeHTTPS) + m.Id = 0 msg, err := m.Pack() if err != nil { - return "", 0, err + return []byte{}, 0, err } tr := &http.Transport{ IdleConnTimeout: 90 * time.Second, @@ -103,33 +103,37 @@ func dohQuery(server string, domain string) (string, uint32, error) { } req, err := http.NewRequest("POST", server, bytes.NewReader(msg)) if err != nil { - return "", 0, err + return []byte{}, 0, err } req.Header.Set("Content-Type", "application/dns-message") resp, err := client.Do(req) if err != nil { - return "", 0, err + return []byte{}, 0, err } defer resp.Body.Close() respBody, err := io.ReadAll(resp.Body) if err != nil { - return "", 0, err + return []byte{}, 0, err } if resp.StatusCode != http.StatusOK { - return "", 0, newError("query failed with response code:", resp.StatusCode) + return []byte{}, 0, newError("query failed with response code:", resp.StatusCode) } respMsg := new(dns.Msg) err = respMsg.Unpack(respBody) if err != nil { - return "", 0, err + return []byte{}, 0, err } if len(respMsg.Answer) > 0 { - re := regexp.MustCompile(`ech="([^"]+)"`) - match := re.FindStringSubmatch(respMsg.Answer[0].String()) - if match[1] != "" { - newError("Get ECH config:", match[1], " TTL:", respMsg.Answer[0].Header().Ttl).AtDebug().WriteToLog() - return match[1], respMsg.Answer[0].Header().Ttl, nil + for _, answer := range respMsg.Answer { + if https, ok := answer.(*dns.HTTPS); ok && https.Hdr.Name == dns.Fqdn(domain) { + for _, v := range https.Value { + if echConfig, ok := v.(*dns.SVCBECHConfig); ok { + newError(context.Background(), "Get ECH config:", echConfig.String(), " TTL:", respMsg.Answer[0].Header().Ttl).AtDebug().WriteToLog() + return echConfig.ECH, answer.Header().Ttl, nil + } + } + } } } - return "", 0, newError("no ech record found") -} \ No newline at end of file + return []byte{}, 0, newError("no ech record found") +}