Let's start with a 15 minutes ugly PoC hack before going to bed

Who said the DNSCrypt protocol was "complex"?
2025-04-06 22:57:37 +03:00 · 2018-01-09 00:24:51 +01:00 · 2018-01-09 00:24:51 +01:00 · b076e01f7a
commit b076e01f7a
parent 9653ab395c
4 changed files with 346 additions and 0 deletions
--- a/dnscrypt-proxy.go
+++ b/dnscrypt-proxy.go
@ -0,0 +1,143 @@
+package main
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"log"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/jedisct1/xsecretbox"
+	"golang.org/x/crypto/curve25519"
+	"golang.org/x/crypto/ed25519"
+)
+
+type Proxy struct {
+	proxyPublicKey  [32]byte
+	proxySecretKey  [32]byte
+	minQuestionSize uint
+	serversInfo     []ServerInfo
+}
+
+func (proxy *Proxy) fetchServerInfo(serverAddrStr string, serverPkStr string, providerName string) {
+	serverPublicKey, err := hex.DecodeString(strings.Replace(serverPkStr, ":", "", -1))
+	if err != nil || len(serverPublicKey) != ed25519.PublicKeySize {
+		log.Fatal("Invalid public key")
+	}
+	certInfo, err := FetchCurrentCert(proxy, serverPublicKey, serverAddrStr, providerName)
+	if err != nil {
+		log.Fatal(err)
+	}
+	remoteUDPAddr, err := net.ResolveUDPAddr("udp", serverAddrStr)
+	if err != nil {
+		log.Fatal(err)
+	}
+	remoteTCPAddr, err := net.ResolveTCPAddr("tcp", serverAddrStr)
+	if err != nil {
+		log.Fatal(err)
+	}
+	serverInfo := ServerInfo{
+		MagicQuery:         certInfo.MagicQuery,
+		ServerPk:           certInfo.ServerPk,
+		SharedKey:          certInfo.SharedKey,
+		CryptoConstruction: certInfo.CryptoConstruction,
+		Timeout:            TimeoutMin,
+		UDPAddr:            remoteUDPAddr,
+		TCPAddr:            remoteTCPAddr,
+	}
+	proxy.serversInfo = append(proxy.serversInfo, serverInfo)
+}
+
+func NewProxy(listenAddrStr string, serverAddrStr string, serverPkStr string, providerName string) Proxy {
+	proxy := Proxy{minQuestionSize: InitialMinQuestionSize}
+	if _, err := rand.Read(proxy.proxySecretKey[:]); err != nil {
+		log.Fatal(err)
+	}
+	curve25519.ScalarBaseMult(&proxy.proxyPublicKey, &proxy.proxySecretKey)
+	proxy.fetchServerInfo(serverAddrStr, serverPkStr, providerName)
+	clientPc, err := net.ListenPacket("udp", listenAddrStr)
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer clientPc.Close()
+	fmt.Printf("Now listening to %v [UDP]\n", listenAddrStr)
+	for {
+		buffer := make([]byte, MaxDNSPacketSize)
+		length, clientAddr, err := clientPc.ReadFrom(buffer)
+		if err != nil {
+			break
+		}
+		packet := buffer[:length]
+		go func() {
+			proxy.processIncomingQuery(&proxy.serversInfo[0], packet, clientAddr, clientPc)
+		}()
+	}
+	return proxy
+}
+
+type ServerInfo struct {
+	MagicQuery         [8]byte
+	ServerPk           [32]byte
+	SharedKey          [32]byte
+	CryptoConstruction CryptoConstruction
+	Timeout            time.Duration
+	UDPAddr            *net.UDPAddr
+	TCPAddr            *net.TCPAddr
+}
+
+func (proxy *Proxy) processIncomingQuery(serverInfo *ServerInfo, packet []byte, clientAddr net.Addr, clientPc net.PacketConn) {
+	packet = Pad(packet, proxy.minQuestionSize)
+	nonce := make([]byte, xsecretbox.NonceSize)
+	rand.Read(nonce[0 : xsecretbox.NonceSize/2])
+	encrypted := serverInfo.MagicQuery[:]
+	encrypted = append(encrypted, proxy.proxyPublicKey[:]...)
+	encrypted = append(encrypted, nonce[:xsecretbox.NonceSize/2]...)
+	encrypted = xsecretbox.Seal(encrypted, nonce, packet, serverInfo.SharedKey[:])
+	pc, err := net.DialUDP("udp", nil, serverInfo.UDPAddr)
+	defer pc.Close()
+	if err != nil {
+		return
+	}
+	pc.SetDeadline(time.Now().Add(serverInfo.Timeout))
+	pc.Write(encrypted)
+	buffer := make([]byte, MaxDNSPacketSize)
+	length, err := pc.Read(buffer)
+	if err != nil {
+		return
+	}
+	buffer = buffer[:length]
+	serverMagicLen := len(ServerMagic)
+	responseHeaderLen := serverMagicLen + xsecretbox.NonceSize
+	if len(buffer) < responseHeaderLen+xsecretbox.TagSize ||
+		!bytes.Equal(buffer[:serverMagicLen], ServerMagic[:]) {
+		return
+	}
+	serverNonce := buffer[serverMagicLen:responseHeaderLen]
+	if !bytes.Equal(nonce[:xsecretbox.NonceSize/2], serverNonce[:xsecretbox.NonceSize/2]) {
+		return
+	}
+	decrypted, err := xsecretbox.Open(nil, serverNonce, buffer[responseHeaderLen:], serverInfo.SharedKey[:])
+	if err != nil {
+		return
+	}
+	decrypted, err = Unpad(decrypted)
+	if err != nil || uint(len(decrypted)) < MinDNSPacketSize {
+		return
+	}
+	if HasTCFlag(decrypted) {
+		if MaxDNSPacketSize-proxy.minQuestionSize < proxy.minQuestionSize {
+			proxy.minQuestionSize = MaxDNSPacketSize
+		} else {
+			proxy.minQuestionSize *= 2
+		}
+	}
+	clientPc.WriteTo(decrypted, clientAddr)
+}
+
+func main() {
+	log.SetFlags(0)
+	_ = NewProxy("127.0.0.1:5399", "212.47.228.136:443", "E801:B84E:A606:BFB0:BAC0:CE43:445B:B15E:BA64:B02F:A3C4:AA31:AE10:636A:0790:324D", "2.dnscrypt-cert.fr.dnscrypt.org")
+}