Go to file
Travis Burtrum 9ca43664b0
moparisthebest/jDnsProxy/pipeline/head This commit looks good Details
Abandon travis-ci for jenkins
2020-11-26 20:00:27 -05:00
.ci Abandon travis-ci for jenkins 2020-11-26 20:00:27 -05:00
http-doh-listener Update pom.xml files to support both standard and full jars 2019-04-15 00:06:16 -04:00
jDnsProxy Update key pins for test 2020-11-14 00:11:08 -05:00
jDnsProxy-all Update pom.xml files to support both standard and full jars 2019-04-15 00:06:16 -04:00
xmpp-dox Update pom.xml files to support both standard and full jars 2019-04-15 00:06:16 -04:00
.gitignore Re-factor into a multi-module maven project 2019-03-12 22:15:04 -04:00
LICENSE.txt Switch license to MIT 2018-03-22 22:28:34 -04:00
jdnsproxy.properties Update readme 2019-04-15 00:09:58 -04:00
pom.xml Update pom.xml files to support both standard and full jars 2019-04-15 00:06:16 -04:00
readme.md Abandon travis-ci for jenkins 2020-11-26 20:00:27 -05:00

readme.md

jDnsProxy

Build Status

Simple fast and lightweight DNS proxy and cache that listens on TCP or UDP ports and relays the request to various upstream DNS-over-TCP, DNS-over-TLS, or DNS-over-HTTPS servers, optionally over http or socks proxies (like tor), and optionally pinning public keys for complete TLS security. Implements a simple response cache respecting TTLs but also implementing proper Serve-Stale functionality.

This should support any current and future DNS record generically, as well as providing full DNSSEC support if upstream resolvers do.

Sample/default configuration is in jdnsproxy.properties and should be documented clearly there.

Build/run like so:

mvn clean package
java -jar jDnsProxy/target/jDnsProxy.jar ./jdnsproxy.properties

# or with xmpp:// listener+resolver support:
java -jar xmpp-dox/target/xmpp-dox-full.jar ./xmpp-dox/jdnsproxy.xmpp.resolver.properties

# or with http:// listener support:
java -jar http-doh-listener/target/http-doh-listener-full.jar ./jdnsproxy.properties

# or with support for *everything* we support in this repo (other jars we don't know about can also add additional protocol support)
java -jar jDnsProxy-all/target/jDnsProxy-all.jar ./jdnsproxy.properties

Implemented specs:

Use these for quick testing:

dig -p5353 @127.0.0.1 debian.org +tries=1 +retry=0 +tcp
dig -p5353 @127.0.0.1 debian.org +tries=1 +retry=0 +tcp +dnssec

dig -p5353 @127.0.0.1 debian.org +tries=1 +retry=0
dig -p5353 @127.0.0.1 debian.org +tries=1 +retry=0 +dnssec

And use this to extract TLS public keys in pinning format:

openssl s_client -connect 'dns.google.com:443' 2>&1 < /dev/null | sed -n '/-----BEGIN/,/-----END/p' | openssl x509 -noout -pubkey | openssl asn1parse -noout -inform pem -out /dev/stdout | openssl dgst -sha256 -binary | openssl base64

License

MIT License, refer to LICENSE.txt