Add an option to check cert hashes on every client DoH connection

Author: jedisct1

dnscrypt-proxy/cert_hashes.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"net"
+	"slices"
+	"strings"
+
+	"golang.org/x/net/idna"
+)
+
+var errCertHashNotFound = errors.New("Certificate hash not found")
+
+// certHashesMatch reports whether the key of a pinned certificate is in a verified chain.
+func certHashesMatch(cs *tls.ConnectionState, hashes [][]byte) bool {
+	isPinned := func(cert *x509.Certificate) bool {
+		h := sha256.Sum256(cert.RawTBSCertificate)
+		return slices.ContainsFunc(hashes, func(hash []byte) bool { return bytes.Equal(hash, h[:]) })
+	}
+	pinnedKeys := make(map[string]bool)
+	for _, cert := range cs.PeerCertificates {
+		if isPinned(cert) {
+			pinnedKeys[string(cert.RawSubjectPublicKeyInfo)] = true
+		}
+	}
+	for _, chain := range cs.VerifiedChains {
+		for _, cert := range chain {
+			if pinnedKeys[string(cert.RawSubjectPublicKeyInfo)] || isPinned(cert) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func certHashesHostKey(host string) string {
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		host = h
+	}
+	if ip := ParseIP(host); ip != nil {
+		return ip.String()
+	}
+	if ascii, err := idna.Lookup.ToASCII(host); err == nil {
+		host = ascii
+	}
+	return strings.ToLower(strings.TrimSuffix(host, "."))
+}

dnscrypt-proxy/config.go

@@ -95,6 +95,7 @@ type Config struct {
 	TLSCipherSuite           []uint16                    `toml:"tls_cipher_suite"`
 	TLSPreferRSA             bool                        `toml:"tls_prefer_rsa"`
 	TLSKeyLogFile            string                      `toml:"tls_key_log_file"`
+	DoHCertHashesOnConnect   bool                        `toml:"doh_check_cert_hashes_on_connect"`
 	NetprobeAddress          string                      `toml:"netprobe_address"`
 	NetprobeTimeout          int                         `toml:"netprobe_timeout"`
 	OfflineMode              bool                        `toml:"offline_mode"`
@@ -161,6 +162,7 @@ func newConfig() Config {
 		TLSCipherSuite:           nil,
 		TLSPreferRSA:             false,
 		TLSKeyLogFile:            "",
+		DoHCertHashesOnConnect:   false,
 		NetprobeTimeout:          60,
 		OfflineMode:              false,
 		RefusedCodeInResponses:   false,

dnscrypt-proxy/config_loader.go

@@ -75,6 +75,9 @@ func configureLogging(proxy *Proxy, flags *ConfigFlags, config *Config) {
 func configureXTransport(proxy *Proxy, config *Config) error {
 	proxy.xTransport.tlsDisableSessionTickets = config.TLSDisableSessionTickets
 	proxy.xTransport.tlsPreferRSA = config.TLSPreferRSA
+	if config.DoHCertHashesOnConnect {
+		proxy.xTransport.certHashes.Store(&map[string][][]byte{})
+	}
 	proxy.xTransport.http3 = config.HTTP3
 	proxy.xTransport.http3Probe = config.HTTP3Probe
 

dnscrypt-proxy/example-dnscrypt-proxy.toml

@@ -295,6 +295,15 @@ cert_refresh_delay = 240
 # tls_disable_session_tickets = false
 
 
+## DoH: Check the certificate hashes of server stamps on every new connection,
+## not only at startup and when certificates are reloaded.
+##
+## This improves security, but also increases the risks of downtime if you
+## don't use DNSCrypt servers in addition to DoH servers.
+
+# doh_check_cert_hashes_on_connect = false
+
+
 ## Prefer RSA certificates over ECDSA for TLS connections.
 ## When this is enabled, some servers may become impossible to use,
 ## or may stop working later as they upgrade their configuration.

dnscrypt-proxy/proxy.go

@@ -449,6 +449,16 @@ func (proxy *Proxy) updateRegisteredServers() error {
 	for _, registeredRelay := range proxy.registeredRelays {
 		proxy.serversInfo.registerRelay(registeredRelay.name, registeredRelay.stamp)
 	}
+	if proxy.xTransport.certHashes.Load() != nil {
+		certHashes := make(map[string][][]byte)
+		for _, registeredServer := range proxy.registeredServers {
+			if stamp := registeredServer.stamp; stamp.Proto == stamps.StampProtoTypeDoH {
+				key := certHashesHostKey(stamp.ProviderName)
+				certHashes[key] = append(certHashes[key], stamp.Hashes...)
+			}
+		}
+		proxy.xTransport.certHashes.Store(&certHashes)
+	}
 	return nil
 }
 

dnscrypt-proxy/serversInfo.go

@@ -994,6 +994,10 @@ func fetchDoHServerInfo(proxy *Proxy, name string, stamp stamps.ServerStamp, isN
 	body := dohTestPacket(0xcafe).Data
 	useGet := false
 	if _, _, _, _, err := proxy.xTransport.DoHQuery(useGet, url, body, proxy.timeout); err != nil {
+		if errors.Is(err, errCertHashNotFound) {
+			dlog.Criticalf("[%s] Certificate hash %x not found", name, stamp.Hashes)
+			return ServerInfo{}, err
+		}
 		useGet = true
 		if _, _, _, _, err := proxy.xTransport.DoHQuery(useGet, url, body, proxy.timeout); err != nil {
 			return ServerInfo{}, err
@@ -1029,31 +1033,17 @@ func fetchDoHServerInfo(proxy *Proxy, name string, stamp stamps.ServerStamp, isN
 	}
 	dlog.Infof("[%s] TLS version: %x - Protocol: %v - Cipher suite: %v", name, tls.Version, protocol, tls.CipherSuite)
 	showCerts := proxy.showCerts
-	found := false
-	var wantedHash [32]byte
 	for _, cert := range tls.PeerCertificates {
 		h := sha256.Sum256(cert.RawTBSCertificate)
 		if showCerts {
 			dlog.Noticef("Advertised cert: [%s] [%x]", cert.Subject, h)
 		} else {
 			dlog.Debugf("Advertised cert: [%s] [%x]", cert.Subject, h)
 		}
-		for _, hash := range stamp.Hashes {
-			if len(hash) == len(wantedHash) {
-				copy(wantedHash[:], hash)
-				if h == wantedHash {
-					found = true
-					break
-				}
-			}
-		}
-		if found {
-			break
-		}
 	}
-	if !found && len(stamp.Hashes) > 0 {
-		dlog.Criticalf("[%s] Certificate hash [%x] not found", name, wantedHash)
-		return ServerInfo{}, fmt.Errorf("Certificate hash not found")
+	if len(stamp.Hashes) > 0 && !certHashesMatch(tls, stamp.Hashes) {
+		dlog.Criticalf("[%s] Certificate hash %x not found", name, stamp.Hashes)
+		return ServerInfo{}, errCertHashNotFound
 	}
 	if len(serverResponse) < MinDNSPacketSize || len(serverResponse) > MaxDNSPacketSize ||
 		serverResponse[0] != 0xca || serverResponse[1] != 0xfe || serverResponse[4] != 0x00 || serverResponse[5] != 0x01 {

dnscrypt-proxy/xtransport.go

@@ -101,6 +101,7 @@ type XTransport struct {
 	httpProxyFunction        func(*http.Request) (*url.URL, error)
 	tlsClientCreds           DOHClientCreds
 	keyLogWriter             io.Writer
+	certHashes               atomic.Pointer[map[string][][]byte]
 }
 
 func NewXTransport() *XTransport {
@@ -397,6 +398,24 @@ func (xTransport *XTransport) rebuildTransport() {
 	if xTransport.tlsDisableSessionTickets {
 		tlsClientConfig.SessionTicketsDisabled = true
 	}
+	if xTransport.certHashes.Load() != nil {
+		tlsClientConfig.VerifyConnection = func(cs tls.ConnectionState) error {
+			certHashes := xTransport.certHashes.Load()
+			var hashes [][]byte
+			if cs.ServerName != "" {
+				hashes = (*certHashes)[certHashesHostKey(cs.ServerName)]
+			} else if len(cs.PeerCertificates) > 0 {
+				// The stamp host name is an IP address, so there is no SNI: use the certificate addresses.
+				for _, ip := range cs.PeerCertificates[0].IPAddresses {
+					hashes = append(hashes, (*certHashes)[ip.String()]...)
+				}
+			}
+			if len(hashes) > 0 && !certHashesMatch(&cs, hashes) {
+				return errCertHashNotFound
+			}
+			return nil
+		}
+	}
 	if xTransport.tlsPreferRSA {
 		tlsClientConfig.MaxVersion = tls.VersionTLS12
 		if hasAESGCMHardwareSupport {
@@ -730,6 +749,12 @@ func (xTransport *XTransport) Fetch(
 		Transport: xTransport.transport,
 		Timeout:   timeout,
 	}
+	if certHashes := xTransport.certHashes.Load(); certHashes != nil && len((*certHashes)[certHashesHostKey(url.Host)]) > 0 {
+		// The other host's certificate wouldn't be checked against these hashes
+		client.CheckRedirect = func(*http.Request, []*http.Request) error {
+			return errors.New("Redirects are not followed for servers with certificate hashes")
+		}
+	}
 	host, port := ExtractHostAndPort(url.Host, 443)
 	hasAltSupport := false
 	http3Suppressed := false