feature: simple support DOH server

etc/smartdns/smartdns.conf

@@ -30,6 +30,8 @@
 #      tls cert file
 #   bind-cert-key-pass [password]
 #      tls private key password
+# bind-https server
+#   bind-https [IP]:[port][@device] [-group [group]] [-no-rule-addr] [-no-rule-nameserver] [-no-rule-ipset] [-no-speed-check] [-no-cache] [-no-rule-soa] [-no-dualstack-selection]
 # option:
 #   -group: set domain request to use the appropriate server group.
 #   -no-rule-addr: skip address rule.

src/dns_client.c

@@ -3328,7 +3328,7 @@ static int _dns_client_send_https(struct dns_server_info *server_info, void *pac
 						"POST %s HTTP/1.1\r\n"
 						"Host: %s\r\n"
 						"User-Agent: smartdns\r\n"
-						"content-type: application/dns-message\r\n"
+						"Content-Type: application/dns-message\r\n"
 						"Content-Length: %d\r\n"
 						"\r\n",
 						https_flag->path, https_flag->httphost, len);

src/dns_conf.c

@@ -2218,7 +2218,7 @@ static int _config_bind_ip(int argc, char *argv[], DNS_BIND_TYPE type)
 	bind_ip->flags = server_flag;
 	bind_ip->group = group;
 	dns_conf_bind_ip_num++;
-	if (bind_ip->type == DNS_BIND_TYPE_TLS) {
+	if (bind_ip->type == DNS_BIND_TYPE_TLS || bind_ip->type == DNS_BIND_TYPE_HTTPS) {
 		if (bind_ip->ssl_cert_file == NULL || bind_ip->ssl_cert_key_file == NULL) {
 			bind_ip->ssl_cert_file = dns_conf_bind_ca_file;
 			bind_ip->ssl_cert_key_file = dns_conf_bind_ca_key_file;
@@ -2249,6 +2249,11 @@ static int _config_bind_ip_tls(void *data, int argc, char *argv[])
 	return _config_bind_ip(argc, argv, DNS_BIND_TYPE_TLS);
 }
 
+static int _config_bind_ip_https(void *data, int argc, char *argv[])
+{
+	return _config_bind_ip(argc, argv, DNS_BIND_TYPE_HTTPS);
+}
+
 static int _config_option_parser_filepath(void *data, int argc, char *argv[])
 {
 	if (argc <= 1) {
@@ -4098,6 +4103,7 @@ static struct config_item _config_item[] = {
 	CONF_CUSTOM("bind", _config_bind_ip_udp, NULL),
 	CONF_CUSTOM("bind-tcp", _config_bind_ip_tcp, NULL),
 	CONF_CUSTOM("bind-tls", _config_bind_ip_tls, NULL),
+	CONF_CUSTOM("bind-https", _config_bind_ip_https, NULL),
 	CONF_CUSTOM("bind-cert-file", _config_option_parser_filepath, &dns_conf_bind_ca_file),
 	CONF_CUSTOM("bind-cert-key-file", _config_option_parser_filepath, &dns_conf_bind_ca_key_file),
 	CONF_STRING("bind-cert-key-pass", dns_conf_bind_ca_key_pass, DNS_MAX_PATH),

src/dns_server.c

@@ -27,6 +27,7 @@
 #include "dns_conf.h"
 #include "fast_ping.h"
 #include "hashtable.h"
+#include "http_parse.h"
 #include "list.h"
 #include "nftset.h"
 #include "tlog.h"
@@ -1101,7 +1102,7 @@ static void _dns_server_conn_release(struct dns_server_conn_head *conn)
 			tls_client->ssl = NULL;
 		}
 		pthread_mutex_destroy(&tls_client->ssl_lock);
-	} else if (conn->type == DNS_CONN_TYPE_TLS_SERVER) {
+	} else if (conn->type == DNS_CONN_TYPE_TLS_SERVER || conn->type == DNS_CONN_TYPE_HTTPS_SERVER) {
 		struct dns_server_conn_tls_server *tls_server = (struct dns_server_conn_tls_server *)conn;
 		if (tls_server->ssl_ctx != NULL) {
 			SSL_CTX_free(tls_server->ssl_ctx);
@@ -1141,6 +1142,71 @@ static int _dns_server_reply_tcp_to_buffer(struct dns_server_conn_tcp_client *tc
 	return 0;
 }
 
+static int _dns_server_reply_http_error(struct dns_server_conn_tcp_client *tcpclient, int code, const char *code_msg,
+										const char *message)
+{
+	int send_len = 0;
+	int http_len = 0;
+	unsigned char data[DNS_IN_PACKSIZE];
+
+	http_len = snprintf((char *)data, DNS_IN_PACKSIZE,
+						"HTTP/1.1 %d %s\r\n"
+						"\r\n"
+						"%s",
+						code, code_msg, message);
+
+	send_len = _dns_server_tcp_socket_send(tcpclient, data, http_len);
+	if (send_len < 0) {
+		if (errno == EAGAIN) {
+			/* save data to buffer, and retry when EPOLLOUT is available */
+			return _dns_server_reply_tcp_to_buffer(tcpclient, data, http_len);
+		}
+		return -1;
+	} else if (send_len < http_len) {
+		/* save remain data to buffer, and retry when EPOLLOUT is available */
+		return _dns_server_reply_tcp_to_buffer(tcpclient, data + send_len, http_len - send_len);
+	}
+
+	return 0;
+}
+
+static int _dns_server_reply_https(struct dns_request *request, struct dns_server_conn_tcp_client *tcpclient,
+								   void *packet, unsigned short len)
+{
+	int send_len = 0;
+	int http_len = 0;
+	unsigned char inpacket_data[DNS_IN_PACKSIZE];
+	unsigned char *inpacket = inpacket_data;
+
+	if (len > sizeof(inpacket_data)) {
+		tlog(TLOG_ERROR, "packet size is invalid.");
+		return -1;
+	}
+
+	http_len = snprintf((char *)inpacket, DNS_IN_PACKSIZE,
+						"HTTP/1.1 200 OK\r\n"
+						"content-type: application/dns-message\r\n"
+						"Content-Length: %d\r\n"
+						"\r\n",
+						len);
+	memcpy(inpacket + http_len, packet, len);
+	http_len += len;
+
+	send_len = _dns_server_tcp_socket_send(tcpclient, inpacket, http_len);
+	if (send_len < 0) {
+		if (errno == EAGAIN) {
+			/* save data to buffer, and retry when EPOLLOUT is available */
+			return _dns_server_reply_tcp_to_buffer(tcpclient, inpacket, http_len);
+		}
+		return -1;
+	} else if (send_len < http_len) {
+		/* save remain data to buffer, and retry when EPOLLOUT is available */
+		return _dns_server_reply_tcp_to_buffer(tcpclient, inpacket + send_len, http_len - send_len);
+	}
+
+	return 0;
+}
+
 static int _dns_server_reply_tcp(struct dns_request *request, struct dns_server_conn_tcp_client *tcpclient,
 								 void *packet, unsigned short len)
 {
@@ -1255,6 +1321,8 @@ static int _dns_reply_inpacket(struct dns_request *request, unsigned char *inpac
 		ret = _dns_server_reply_tcp(request, (struct dns_server_conn_tcp_client *)conn, inpacket, inpacket_len);
 	} else if (conn->type == DNS_CONN_TYPE_TLS_CLIENT) {
 		ret = _dns_server_reply_tcp(request, (struct dns_server_conn_tcp_client *)conn, inpacket, inpacket_len);
+	} else if (conn->type == DNS_CONN_TYPE_HTTPS_CLIENT) {
+		ret = _dns_server_reply_https(request, (struct dns_server_conn_tcp_client *)conn, inpacket, inpacket_len);
 	} else {
 		ret = -1;
 	}
@@ -6112,47 +6180,104 @@ static int _dns_server_tcp_process_one_request(struct dns_server_conn_tcp_client
 	int total_len = tcpclient->recvbuff.size;
 	int proceed_len = 0;
 	unsigned char *request_data = NULL;
-	int ret = 0;
+	int ret = RECV_ERROR_FAIL;
+	int len = 0;
+	struct http_head *http_head = NULL;
 
 	/* Handling multiple requests */
 	for (;;) {
-		if ((total_len - proceed_len) <= (int)sizeof(unsigned short)) {
-			ret = RECV_ERROR_AGAIN;
-			break;
-		}
+		ret = RECV_ERROR_FAIL;
+		if (tcpclient->head.type == DNS_CONN_TYPE_HTTPS_CLIENT) {
+			if ((total_len - proceed_len) <= 0) {
+				ret = RECV_ERROR_AGAIN;
+				goto out;
+			}
 
-		/* Get record length */
-		request_data = (unsigned char *)(tcpclient->recvbuff.buf + proceed_len);
-		request_len = ntohs(*((unsigned short *)(request_data)));
+			http_head = http_head_init(4096);
+			if (http_head == NULL) {
+				goto out;
+			}
 
-		if (request_len >= sizeof(tcpclient->recvbuff.buf)) {
-			tlog(TLOG_DEBUG, "request length is invalid.");
-			return RECV_ERROR_FAIL;
-		}
+			len = http_head_parse(http_head, (char *)tcpclient->recvbuff.buf, tcpclient->recvbuff.size);
+			if (len < 0) {
+				if (len == -1) {
+					ret = 0;
+					goto out;
+				}
 
-		if (request_len > (total_len - proceed_len - sizeof(unsigned short))) {
-			ret = RECV_ERROR_AGAIN;
-			break;
-		}
+				tlog(TLOG_DEBUG, "remote server not supported.");
+				goto errout;
+			}
+
+			if (http_head_get_method(http_head) != HTTP_METHOD_POST) {
+				tlog(TLOG_DEBUG, "remote server not supported.");
+				goto errout;
+			}
+
+			const char *content_type = http_head_get_fields_value(http_head, "Content-Type");
+			if (content_type == NULL ||
+				strncmp(content_type, "application/dns-message", sizeof("application/dns-message")) != 0) {
+				tlog(TLOG_DEBUG, "content type not supported, %s", content_type);
+				goto errout;
+			}
+
+			request_len = http_head_get_data_len(http_head);
+			if (request_len >= len) {
+				tlog(TLOG_DEBUG, "request length is invalid.");
+
+				goto errout;
+			}
+			request_data = (unsigned char *)http_head_get_data(http_head);
+			proceed_len += len;
+		} else {
+			if ((total_len - proceed_len) <= (int)sizeof(unsigned short)) {
+				ret = RECV_ERROR_AGAIN;
+				break;
+			}
 
-		request_data = (unsigned char *)(tcpclient->recvbuff.buf + proceed_len + sizeof(unsigned short));
+			/* Get record length */
+			request_data = (unsigned char *)(tcpclient->recvbuff.buf + proceed_len);
+			request_len = ntohs(*((unsigned short *)(request_data)));
+
+			if (request_len >= sizeof(tcpclient->recvbuff.buf)) {
+				tlog(TLOG_DEBUG, "request length is invalid.");
+				return RECV_ERROR_FAIL;
+			}
+
+			if (request_len > (total_len - proceed_len - sizeof(unsigned short))) {
+				ret = RECV_ERROR_AGAIN;
+				break;
+			}
+
+			request_data = (unsigned char *)(tcpclient->recvbuff.buf + proceed_len + sizeof(unsigned short));
+			proceed_len += sizeof(unsigned short) + request_len;
+		}
 
 		/* process one record */
 		ret = _dns_server_recv(&tcpclient->head, request_data, request_len, &tcpclient->localaddr,
 							   tcpclient->localaddr_len, &tcpclient->addr, tcpclient->addr_len);
 		if (ret != 0) {
 			return ret;
 		}
-
-		proceed_len += sizeof(unsigned short) + request_len;
 	}
 
+out:
+
 	if (total_len > proceed_len && proceed_len > 0) {
 		memmove(tcpclient->recvbuff.buf, tcpclient->recvbuff.buf + proceed_len, total_len - proceed_len);
 	}
 
 	tcpclient->recvbuff.size -= proceed_len;
 
+errout:
+	if (http_head) {
+		http_head_destroy(http_head);
+	}
+
+	if (ret == RECV_ERROR_FAIL && tcpclient->head.type == DNS_CONN_TYPE_HTTPS_CLIENT) {
+		_dns_server_reply_http_error(tcpclient, 400, "Bad Request", "Bad Request");
+	}
+
 	return ret;
 }
 
@@ -6273,7 +6398,14 @@ static int _dns_server_tls_accept(struct dns_server_conn_tls_server *tls_server,
 	memset(tls_client, 0, sizeof(*tls_client));
 
 	tls_client->head.fd = fd;
-	tls_client->head.type = DNS_CONN_TYPE_TLS_CLIENT;
+	if (tls_server->head.type == DNS_CONN_TYPE_TLS_SERVER) {
+		tls_client->head.type = DNS_CONN_TYPE_TLS_CLIENT;
+	} else if (tls_server->head.type == DNS_CONN_TYPE_HTTPS_SERVER) {
+		tls_client->head.type = DNS_CONN_TYPE_HTTPS_CLIENT;
+	} else {
+		tlog(TLOG_ERROR, "invalid http server type.");
+		goto errout;
+	}
 	tls_client->head.server_flags = tls_server->head.server_flags;
 	tls_client->head.dns_group = tls_server->head.dns_group;
 	tls_client->head.ipset_nftset_rule = tls_server->head.ipset_nftset_rule;
@@ -6402,10 +6534,10 @@ static int _dns_server_process(struct dns_server_conn_head *conn, struct epoll_e
 			tlog(TLOG_DEBUG, "process TCP packet from %s failed.",
 				 get_host_by_addr(name, sizeof(name), (struct sockaddr *)&tcpclient->addr));
 		}
-	} else if (conn->type == DNS_CONN_TYPE_TLS_SERVER) {
+	} else if (conn->type == DNS_CONN_TYPE_TLS_SERVER || conn->type == DNS_CONN_TYPE_HTTPS_SERVER) {
 		struct dns_server_conn_tls_server *tls_server = (struct dns_server_conn_tls_server *)conn;
 		ret = _dns_server_tls_accept(tls_server, event, now);
-	} else if (conn->type == DNS_CONN_TYPE_TLS_CLIENT) {
+	} else if (conn->type == DNS_CONN_TYPE_TLS_CLIENT || conn->type == DNS_CONN_TYPE_HTTPS_CLIENT) {
 		struct dns_server_conn_tls_client *tls_client = (struct dns_server_conn_tls_client *)conn;
 		ret = _dns_server_process_tls(tls_client, event, now);
 		if (ret != 0) {

src/http_parse.c

@@ -111,10 +111,10 @@ const char *http_head_get_fields_value(struct http_head *http_head, const char *
 	uint32_t key;
 	struct http_head_fields *filed;
 
-	key = hash_string(name);
+	key = hash_string_case(name);
 	hash_for_each_possible(http_head->field_map, filed, node, key)
 	{
-		if (strncmp(filed->name, name, 128) == 0) {
+		if (strncasecmp(filed->name, name, 128) == 0) {
 			return filed->value;
 		}
 	}
@@ -205,7 +205,7 @@ static int _http_head_add_fields(struct http_head *http_head, char *name, char *
 	fields->value = value;
 
 	list_add_tail(&fields->list, &http_head->field_head.list);
-	key = hash_string(name);
+	key = hash_string_case(name);
 	hash_add(http_head->field_map, &fields->node, key);
 
 	return 0;

src/include/hash.h

@@ -21,6 +21,7 @@
 
 #include "bitmap.h"
 #include "jhash.h"
+#include <ctype.h>
 
 /* Fast hashing routine for ints,  longs and pointers.
    (C) 2002 Nadia Yvette Chambers, IBM */
@@ -223,11 +224,28 @@ static inline uint32_t hash_string_initval(const char *s, uint32_t initval)
 	return h;
 }
 
+static inline uint32_t hash_string_case_initval(const char *s, uint32_t initval)
+{
+	uint32_t h = initval;
+
+	while (*s) {
+		h = h * 31 + tolower(*s);
+		s++;
+	}
+
+	return h;
+}
+
 static inline uint32_t hash_string(const char *s)
 {
 	return hash_string_initval(s, 0);
 }
 
+static inline uint32_t hash_string_case(const char *s)
+{
+	return hash_string_case_initval(s, 0);
+}
+
 static inline uint32_t hash_string_array(const char **a)
 {
 	uint32_t h = 0;

test/cases/test-bind.cc

@@ -56,6 +56,36 @@ cache-persist no)""");
 	EXPECT_EQ(client.GetAnswer()[0].GetData(), "1.2.3.4");
 }
 
+TEST(Bind, https)
+{
+	Defer
+	{
+		unlink("/tmp/smartdns-cert.pem");
+		unlink("/tmp/smartdns-key.pem");
+	};
+
+	smartdns::Server server_wrap;
+	smartdns::Server server;
+
+	server.Start(R"""(bind [::]:61053
+server https://127.0.0.1:60053 -no-check-certificate
+log-num 0
+log-console yes
+log-level debug
+cache-persist no)""");
+	server_wrap.Start(R"""(bind-https [::]:60053
+address /example.com/1.2.3.4
+log-num 0
+log-console yes
+log-level debug
+cache-persist no)""");
+	smartdns::Client client;
+	ASSERT_TRUE(client.Query("example.com", 61053));
+	ASSERT_EQ(client.GetAnswerNum(), 1);
+	EXPECT_EQ(client.GetStatus(), "NOERROR");
+	EXPECT_EQ(client.GetAnswer()[0].GetData(), "1.2.3.4");
+}
+
 TEST(Bind, udp_tcp)
 {
 	smartdns::MockServer server_upstream;