use crate::llm::actions::{
client_trait::{Client, ClientActionResult},
protocol_trait::Protocol,
ActionDefinition, Parameter, ParameterDefinition,
};
use crate::protocol::EventType;
use crate::state::app_state::AppState;
use anyhow::{Context, Result};
use serde_json::json;
use std::sync::LazyLock;
pub static DOH_CLIENT_CONNECTED_EVENT: LazyLock<EventType> = LazyLock::new(|| {
EventType::new(
"doh_connected",
"DoH client successfully connected to DNS-over-HTTPS server",
json!({"type": "query_dns", "domain": "example.com", "record_type": "A"}),
)
.with_parameters(vec![Parameter {
name: "server_url".to_string(),
type_hint: "string".to_string(),
description: "DoH server URL (e.g., https://dns.google/dns-query)".to_string(),
required: true,
}])
});
pub static DOH_CLIENT_RESPONSE_RECEIVED_EVENT: LazyLock<EventType> = LazyLock::new(|| {
EventType::new(
"doh_response_received",
"DNS response received from DoH server",
json!({"type": "query_dns", "domain": "mail.example.com", "record_type": "MX"}),
)
.with_parameters(vec![
Parameter {
name: "query_id".to_string(),
type_hint: "number".to_string(),
description: "DNS query ID".to_string(),
required: true,
},
Parameter {
name: "domain".to_string(),
type_hint: "string".to_string(),
description: "Domain name queried".to_string(),
required: true,
},
Parameter {
name: "query_type".to_string(),
type_hint: "string".to_string(),
description: "DNS record type (A, AAAA, MX, etc.)".to_string(),
required: true,
},
Parameter {
name: "answers".to_string(),
type_hint: "array".to_string(),
description: "Array of DNS answers".to_string(),
required: true,
},
Parameter {
name: "status".to_string(),
type_hint: "string".to_string(),
description: "Response status (NoError, NXDomain, etc.)".to_string(),
required: true,
},
])
});
pub struct DohClientProtocol;
impl DohClientProtocol {
pub fn new() -> Self {
Self
}
}
impl Protocol for DohClientProtocol {
fn get_startup_parameters(&self) -> Vec<ParameterDefinition> {
vec![
ParameterDefinition {
name: "ca_cert_pem".to_string(),
description: "PEM-encoded certificate to trust in addition to the system \
roots. Use this to reach a DoH server presenting a private-CA \
or self-signed certificate -- including NetGet's own DoH \
server, which serves a self-signed cert by default."
.to_string(),
type_hint: "string".to_string(),
required: false,
example: json!("-----BEGIN CERTIFICATE-----\n..."),
default: None,
},
ParameterDefinition {
name: "insecure_skip_verify".to_string(),
description: "Disable certificate verification entirely. Off by default, \
and deliberately named for what it does: it accepts ANY \
certificate, so a DoH connection made with it is not \
authenticated and offers no protection against interception. \
Prefer `ca_cert_pem`, which trusts one certificate rather \
than all of them."
.to_string(),
type_hint: "boolean".to_string(),
required: false,
example: json!(false),
default: None,
},
]
}
fn get_async_actions(&self, _state: &AppState) -> Vec<ActionDefinition> {
vec![
ActionDefinition {
name: "query_dns".to_string(),
description: "Make a DNS query over HTTPS".to_string(),
parameters: vec![
Parameter {
name: "domain".to_string(),
type_hint: "string".to_string(),
description: "Domain name to query (e.g., example.com)".to_string(),
required: true,
},
Parameter {
name: "record_type".to_string(),
type_hint: "string".to_string(),
description:
"DNS record type: A, AAAA, MX, TXT, CNAME, NS, SOA, PTR, SRV, etc."
.to_string(),
required: false,
},
Parameter {
name: "use_get".to_string(),
type_hint: "boolean".to_string(),
description: "Use HTTP GET method instead of POST (default: false)"
.to_string(),
required: false,
},
],
example: json!({
"type": "query_dns",
"domain": "example.com",
"record_type": "A",
"use_get": false
}),
log_template: None,
},
ActionDefinition {
name: "disconnect".to_string(),
description: "Disconnect from the DoH server".to_string(),
parameters: vec![],
example: json!({
"type": "disconnect"
}),
log_template: None,
},
]
}
fn get_sync_actions(&self) -> Vec<ActionDefinition> {
vec![
ActionDefinition {
name: "query_dns".to_string(),
description: "Make another DNS query in response to received data".to_string(),
parameters: vec![
Parameter {
name: "domain".to_string(),
type_hint: "string".to_string(),
description: "Domain name to query".to_string(),
required: true,
},
Parameter {
name: "record_type".to_string(),
type_hint: "string".to_string(),
description: "DNS record type (A, AAAA, MX, etc.)".to_string(),
required: false,
},
],
example: json!({
"type": "query_dns",
"domain": "mail.example.com",
"record_type": "A"
}),
log_template: None,
},
ActionDefinition {
name: "wait_for_more".to_string(),
description: "Wait for user to trigger more queries".to_string(),
parameters: vec![],
example: json!({
"type": "wait_for_more"
}),
log_template: None,
},
]
}
fn protocol_name(&self) -> &'static str {
"DNS-over-HTTPS"
}
fn get_event_types(&self) -> Vec<EventType> {
vec![
EventType::new(
"doh_connected",
"Triggered when DoH client connects to server",
json!({"type": "placeholder", "event_id": "doh_connected"}),
),
EventType::new(
"doh_response_received",
"Triggered when DoH client receives a DNS response",
json!({"type": "placeholder", "event_id": "doh_response_received"}),
),
]
}
fn stack_name(&self) -> &'static str {
"ETH>IP>TCP>TLS>HTTP/2>DNS"
}
fn keywords(&self) -> Vec<&'static str> {
vec![
"doh",
"dns-over-https",
"doh client",
"dns client",
"secure dns",
]
}
fn metadata(&self) -> crate::protocol::metadata::ProtocolMetadataV2 {
use crate::protocol::metadata::{DevelopmentState, ProtocolMetadataV2};
ProtocolMetadataV2::builder()
.state(DevelopmentState::Experimental)
.implementation("hickory-client with DNS-over-HTTPS support")
.llm_control("Full control over DNS queries with LLM-driven decision making")
.e2e_testing("Public DoH servers (Google, Cloudflare)")
.build()
}
fn description(&self) -> &'static str {
"DNS-over-HTTPS (DoH) client for secure DNS resolution over HTTPS (RFC 8484)"
}
fn example_prompt(&self) -> &'static str {
"Connect to Google DoH at https://dns.google/dns-query and resolve example.com"
}
fn group_name(&self) -> &'static str {
"DNS"
}
fn get_startup_examples(&self) -> crate::llm::actions::StartupExamples {
use crate::llm::actions::StartupExamples;
use serde_json::json;
StartupExamples::new(
json!({
"type": "open_client",
"remote_addr": "dns.google:443",
"base_stack": "doh",
"instruction": "Query example.com for all record types and summarize the DNS configuration"
}),
json!({
"type": "open_client",
"remote_addr": "dns.google:443",
"base_stack": "doh",
"event_handlers": [{
"event_pattern": "doh_response_received",
"handler": {
"type": "script",
"language": "python",
"code": "<doh_client_handler>"
}
}]
}),
json!({
"type": "open_client",
"remote_addr": "dns.google:443",
"base_stack": "doh",
"event_handlers": [
{
"event_pattern": "doh_connected",
"handler": {
"type": "static",
"actions": [{
"type": "query_dns",
"domain": "example.com",
"record_type": "A"
}]
}
},
{
"event_pattern": "doh_response_received",
"handler": {
"type": "static",
"actions": [{
"type": "disconnect"
}]
}
}
]
}),
)
}
}
impl Client for DohClientProtocol {
fn connect(
&self,
ctx: crate::protocol::ConnectContext,
) -> std::pin::Pin<
Box<dyn std::future::Future<Output = anyhow::Result<std::net::SocketAddr>> + Send>,
> {
Box::pin(async move {
use crate::client::doh::DohClient;
DohClient::connect_with_llm_actions(
ctx.remote_addr,
ctx.llm_client,
ctx.state,
ctx.status_tx,
ctx.client_id,
ctx.startup_params,
)
.await
})
}
fn execute_action(&self, action: serde_json::Value) -> Result<ClientActionResult> {
let action_type = action
.get("type")
.and_then(|v| v.as_str())
.context("Missing 'type' field in action")?;
match action_type {
"query_dns" => {
let domain = action
.get("domain")
.and_then(|v| v.as_str())
.context("Missing 'domain' field")?
.to_string();
let record_type = action
.get("record_type")
.and_then(|v| v.as_str())
.unwrap_or("A")
.to_string();
let use_get = action
.get("use_get")
.and_then(|v| v.as_bool())
.unwrap_or(false);
Ok(ClientActionResult::Custom {
name: "dns_query".to_string(),
data: json!({
"domain": domain,
"record_type": record_type,
"use_get": use_get,
}),
})
}
"disconnect" => Ok(ClientActionResult::Disconnect),
"wait_for_more" => Ok(ClientActionResult::WaitForMore),
_ => Err(anyhow::anyhow!(
"Unknown DoH client action: {}",
action_type
)),
}
}
}