DoH Android 9 Support

[pratikgajjar]

• Enable private dns with 1-1-1-1 on android 9 pie
• Cloudflare Implementation - wireformat
• Cloudflare Implementation - JSON

Ideal Scenario :

• On android 9 and above self hosted (blocky) DNS should work like 1dot1dot1dot1.cloudflare-dns.com or dns.google

Issue :
Current API is not compatible with cloudflare one or android 9. I have tested via cmd. There must be some global API spec on how to implement DoH.

Note : Current blocky server works with Nebulo (Android App), If we make it compatible then we won't be needing any 3rd party app to use Blocky.

Cloudflare wireformat Request

$ curl -H 'accept: application/dns-message' -v 'https://cloudflare-dns.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    49  100    49    0     0    382      0 --:--:-- --:--:-- --:--:--   382
0000000 cdab 8081 0100 0100 0000 0000 7703 7777
0000010 6507 6178 706d 656c 6303 6d6f 0000 0001
0000020 c001 000c 0001 0001 3701 0061 5d04 d8b8
0000030 0022
0000031

Blocky Request

$ curl -H 'accept: application/dns-message' -v 'https://dns.blocky.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    64  100    64    0     0    800      0 --:--:-- --:--:-- --:--:--   800
0000000 cdab 8081 0100 0100 0000 0000 7703 7777
0000010 6507 6178 706d 656c 6303 6d6f 0000 0001
0000020 0301 7777 0777 7865 6d61 6c70 0365 6f63
0000030 006d 0100 0100 0000 074c 0400 b85d 22d8
0000040

I can contribute via writing code as well, Need guidance from author on current implementation and need to figure out what logic cloudflare has used. Looking at binary It seems this might be minor fix with some formatting changes.

Edit 1

• Reading https://datatracker.ietf.org/doc/html/rfc8484 for DoH implementation

[0xERR0R]

I think, the "problem" is the compression. I enabled the compression (DNS wire format), now I get the same result:

# Cloudflare DoH
curl -H 'accept: application/dns-message' -v 'https://cloudflare-dns.com/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump
...
0000000 0000 8081 0100 0100 0000 0000 7703 7777
0000010 6507 6178 706d 656c 6303 6d6f 0000 0001
0000020 c001 000c 0001 0001 3301 005e 5d04 d8b8
0000030 0022                                   
0000031

# Google DoH
curl -H 'accept: application/dns-message' -v 'https://dns.google/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump
...
0000000 0000 8081 0100 0100 0000 0000 7703 7777
0000010 6507 6178 706d 656c 6303 6d6f 0000 0001
0000020 c001 000c 0001 0001 5000 00c6 5d04 d8b8
0000030 0022                                   
0000031

# Blocky DoH
curl -H 'accept: application/dns-message' -v 'http://localhost:4000/dns-query?dns=AAABAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump
...
0000000 0000 0081 0100 0100 0000 0000 7703 7777
0000010 6507 6178 706d 656c 6303 6d6f 0000 0001
0000020 c001 000c 0001 0001 3301 002a 5d04 d8b8
0000030 0022                                   
0000031

Compression should be optional, but maybe android implementation expects only compressed format

[pratikgajjar]

Hey, Thank you for the revert, but It seems even in your output they are not same. All three are different hexcode in fact.

Check this diff

Left : Cloudflare
Right: blocky

Even google and cloudflare's responses are not same 💀

Left: Cloudflare
Right: Google

Also I tried using blocky v0.15 in Android 11 phone, It says can't connect to dns server.

[0xERR0R]

I tested with example.com and all resolvers returned the same result. If you test with another domain, it is possible that different tesolvers return different result (other TTL, different order etc). Can you compare with plain dns query?
Does Android DoH with blocky work now?

[pratikgajjar]

Not sure what's the issue but Android DoH didn't work. I am reading this rfc later will check android docs on how their client works then I might find something.

You can use dns[dot]pratikgajjar[dot]in to test if you have android device.