Support using DOH server for type 65 query

infra/conf/transport_internet.go

@@ -390,6 +390,7 @@ type TLSConfig struct {
 	PinnedPeerCertificatePublicKeySha256 *[]string        `json:"pinnedPeerCertificatePublicKeySha256"`
 	MasterKeyLog                         string           `json:"masterKeyLog"`
 	ECHConfig                            string           `json:"echConfig"`
+	ECHDOHServer                         string           `json:"echDohServer"`
 }
 
 // Build implements Buildable.
@@ -446,6 +447,7 @@ func (c *TLSConfig) Build() (proto.Message, error) {
 
 	config.MasterKeyLog = c.MasterKeyLog
 	config.EchConfig = c.ECHConfig
+	config.Ech_DOHserver = c.ECHDOHServer
 
 	return config, nil
 }
@@ -759,19 +761,19 @@ func (c *SocketConfig) Build() (*internet.SocketConfig, error) {
 }
 
 type StreamConfig struct {
-	Network             *TransportProtocol  `json:"network"`
-	Security            string              `json:"security"`
-	TLSSettings         *TLSConfig          `json:"tlsSettings"`
-	REALITYSettings     *REALITYConfig      `json:"realitySettings"`
-	TCPSettings         *TCPConfig          `json:"tcpSettings"`
-	KCPSettings         *KCPConfig          `json:"kcpSettings"`
-	WSSettings          *WebSocketConfig    `json:"wsSettings"`
-	HTTPSettings        *HTTPConfig         `json:"httpSettings"`
-	SocketSettings      *SocketConfig       `json:"sockopt"`
-	GRPCConfig          *GRPCConfig         `json:"grpcSettings"`
-	GUNConfig           *GRPCConfig         `json:"gunSettings"`
-	HTTPUPGRADESettings *HttpUpgradeConfig  `json:"httpupgradeSettings"`
-	SplitHTTPSettings   *SplitHTTPConfig    `json:"splithttpSettings"`
+	Network             *TransportProtocol `json:"network"`
+	Security            string             `json:"security"`
+	TLSSettings         *TLSConfig         `json:"tlsSettings"`
+	REALITYSettings     *REALITYConfig     `json:"realitySettings"`
+	TCPSettings         *TCPConfig         `json:"tcpSettings"`
+	KCPSettings         *KCPConfig         `json:"kcpSettings"`
+	WSSettings          *WebSocketConfig   `json:"wsSettings"`
+	HTTPSettings        *HTTPConfig        `json:"httpSettings"`
+	SocketSettings      *SocketConfig      `json:"sockopt"`
+	GRPCConfig          *GRPCConfig        `json:"grpcSettings"`
+	GUNConfig           *GRPCConfig        `json:"gunSettings"`
+	HTTPUPGRADESettings *HttpUpgradeConfig `json:"httpupgradeSettings"`
+	SplitHTTPSettings   *SplitHTTPConfig   `json:"splithttpSettings"`
 }
 
 // Build implements Buildable.

transport/internet/tls/config.go

@@ -390,7 +390,7 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
 			config.KeyLogWriter = writer
 		}
 	}
-	if len(c.EchConfig) > 0 {
+	if len(c.EchConfig) > 0 || len(c.Ech_DOHserver) > 0 {
 		err := ApplyECH(c, config)
 		if err != nil {
 			errors.LogError(context.Background(), err)

transport/internet/tls/config.proto

@@ -88,5 +88,6 @@ message Config {
   repeated bytes pinned_peer_certificate_public_key_sha256 = 14;
 
   string master_key_log = 15;
-  string ech_config =16;
+  string ech_config = 16;
+  string ech_DOHserver = 17;
 }

transport/internet/tls/ech.go

@@ -4,18 +4,107 @@
 package tls
 
 import (
-	"context"
+	"bytes"
 	"crypto/tls"
 	"encoding/base64"
+	"io"
+	"net/http"
+	"regexp"
+	"sync"
+	"time"
 
+	"github.com/miekg/dns"
 	"github.com/xtls/xray-core/common/errors"
 )
 
 func ApplyECH(c *Config, config *tls.Config) error {
-	ECHConfig, err := base64.StdEncoding.DecodeString(c.EchConfig)
-	if err != nil {
-		errors.LogError(context.Background(), "invalid ECH config")
+	var ECHConfig []byte
+	var err error
+
+	if len(c.EchConfig) > 0 {
+		ECHConfig, err = base64.StdEncoding.DecodeString(c.EchConfig)
+		if err != nil {
+			return errors.New("invalid ECH config")
+		}
+	} else {
+		if c.ServerName == "" {
+			return errors.New("Using DOH for ECH needs serverName")
+		}
+		ECHRecord, err := QueryRecord(c.ServerName, c.Ech_DOHserver)
+		if err != nil {
+			return err
+		}
+		ECHConfig, _ = base64.StdEncoding.DecodeString(ECHRecord)
 	}
+
 	config.EncryptedClientHelloConfigList = ECHConfig
 	return nil
 }
+
+type record struct {
+	record string
+	expire time.Time
+}
+
+var (
+	dnsCache = make(map[string]record)
+	mutex    sync.RWMutex
+)
+
+func QueryRecord(domain string, server string) (string, error) {
+	mutex.RLock()
+	defer mutex.RUnlock()
+	rec, found := dnsCache[domain]
+	if found && rec.expire.After(time.Now()) {
+		return "", nil
+	}
+	record, err := dohQuery(server, domain)
+	if err != nil {
+		return "", err
+	}
+	rec.record = record
+	rec.expire = time.Now().Add(time.Second * 600)
+	return record, nil
+}
+
+func dohQuery(server string, domain string) (string, error) {
+	m := new(dns.Msg)
+	m.SetQuestion(dns.Fqdn(domain), dns.TypeHTTPS)
+	msg, err := m.Pack()
+	if err != nil {
+		return "", err
+	}
+	client := &http.Client{
+		Timeout: 5 * time.Second,
+	}
+	req, err := http.NewRequest("POST", server, bytes.NewReader(msg))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/dns-message")
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return "", errors.New("query failed with response code:", resp.StatusCode)
+	}
+	respMsg := new(dns.Msg)
+	err = respMsg.Unpack(respBody)
+	if err != nil {
+		return "", err
+	}
+	if len(respMsg.Answer) > 0 {
+		re := regexp.MustCompile(`ech="([^"]+)"`)
+		match := re.FindStringSubmatch(respMsg.Answer[0].String())
+		if match[1] != "" {
+			return match[1], nil
+		}
+	}
+	return "", errors.New("no ech record found")
+}