Fix: set DoH req's SNI and HTTP host to avoid certificate verify fail…

… and CF DNS 403

#649 (comment)

control/dns_control.go

@@ -665,7 +665,7 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte
 			client := &http.Client{
 				Transport: roundTripper,
 			}
-			msg, err := httpDNS(client, dialArgument.bestTarget.String(), data)
+			msg, err := httpDNS(client, dialArgument.bestTarget.String(), upstream.Hostname, data)
 			if err != nil {
 				return err
 			}
@@ -742,14 +742,18 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte
 		case dns.UpstreamScheme_HTTPS:
 
 			httpTransport := http.Transport{
+				TLSClientConfig: &tls.Config{
+					ServerName:         upstream.Hostname,
+					InsecureSkipVerify: false,
+				},
 				DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
 					return &netproxy.FakeNetConn{Conn: conn}, nil
 				},
 			}
 			client := http.Client{
 				Transport: &httpTransport,
 			}
-			msg, err := httpDNS(&client, dialArgument.bestTarget.String(), data)
+			msg, err := httpDNS(&client, dialArgument.bestTarget.String(), upstream.Hostname, data)
 			if err != nil {
 				return err
 			}
@@ -846,7 +850,7 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte
 	return nil
 }
 
-func httpDNS(client *http.Client, target string, data []byte) (respMsg *dnsmessage.Msg, err error) {
+func httpDNS(client *http.Client, target string, host string, data []byte) (respMsg *dnsmessage.Msg, err error) {
 	serverURL := url.URL{
 		Scheme: "https",
 		Host:   target,
@@ -859,6 +863,7 @@ func httpDNS(client *http.Client, target string, data []byte) (respMsg *dnsmessa
 	}
 	req.Header.Set("Content-Type", "application/dns-message")
 	req.Header.Set("Accept", "application/dns-message")
+	req.Host = host
 	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err