added support for DoT (DNS over TLS)

Author: ryzeon-dev

README.md

@@ -1,13 +1,22 @@
 <p align="center">
-<img alt="Version Badge" src="https://img.shields.io/badge/dev--version-v5.1.1-16a085">
-<img alt="Version Badge" src="https://img.shields.io/badge/release-v5.1.1-16a085">
+<img alt="Version Badge" src="https://img.shields.io/badge/dev--version-v5.2.0-16a085">
+<img alt="Version Badge" src="https://img.shields.io/badge/release-v5.2.0-16a085">
 <img alt="Docker Image Version" src="https://img.shields.io/docker/v/ryzeondev/bmdns?label=docker-version&color=16a085">
 <img alt="License Badge" src="https://img.shields.io/github/license/ryzeon-dev/bmdns?color=16a085">
 <img alt="Language Badge" src="https://img.shields.io/badge/python3-16a085?logo=python&logoColor=16a085&labelColor=5a5a5a">
 </p>
 
 # Bare-Metal DNS
-Lightweight DNS written in Python. No fancy UI. No extensive analysis. Just a bare metal DNS server
+A lightweight DNS server for homelabs: local records, ad-blocking, VLAN segmentation, and DoT support. No database, no web UI, just DNS.
+
+## Why BMDNS?
+BMDNS is a self-hosted DNS server for homelabs and small networks. It gives you local DNS resolution, ad-blocking via blocklists, and VLAN segmentation—without the overhead of a web UI or database.
+
+- **Simple configuration** — Single YAML file
+- **VLAN-aware** — Serve different records to different networks
+- **Blocklist support** — Block ads and trackers at the DNS level
+- **DoT support** — Encrypted upstream queries to protect your privacy
+- **Cross-platform** — Linux, Windows, Docker
 
 # Index
 - [Supported OS](#supported-os) 
@@ -28,6 +37,7 @@ Lightweight DNS written in Python. No fancy UI. No extensive analysis. Just a ba
   - [Static Remaps](#static-remaps)
   - [VLANs](#vlans)
   - [Root Servers](#root-servers)
+    - [DoT Root Servers](#dot-root-servers)
   - [Blocklists](#blocklists)
 - [Cascading Search](#cascading-search)
 - [Log](#log)
@@ -38,7 +48,7 @@ Lightweight DNS written in Python. No fancy UI. No extensive analysis. Just a ba
 The software officially supports GNU/Linux and Windows. 
 
 It should work on FreeBSD and MacOS systems, but it is untested.  
-The `install`/`update`/`uninstall` scripts are specifically written for GNU/Linux and Windows, any attempt of running them in other OS may lead to errors and unexpected behaviour. 
+The `install`/`update`/`uninstall` scripts are specifically written for GNU/Linux and Windows, any attempt of running them in other OS may lead to errors and unexpected behavior. 
 
 ## OS requirements
 Compilation requires `python3 python3-venv python3-pip` packages to be installed. Install them using your OS's package manager
@@ -170,7 +180,7 @@ static:
 
 Wildcard static resolution is supported, and only requires the user to add a "*" in the position associated with the wildcard.
 
-e.g. you have a server named `my-server` with ip address `192.168.0.2` wich provides multiple web services, \ 
+e.g. you have a server named `my-server` with ip address `192.168.0.2` wich provides multiple web services, \
 each one identified as a subdomain of the server name itself
 ```yaml
 static:
@@ -276,6 +286,17 @@ root-servers:
   - 94.140.15.15    
 ```
 
+#### DoT Root Servers
+
+BMDNS supports wrapping request in DoT, so it is possible to use tls root servers
+
+e.g. AdGuard and Cloudflare tls root servers
+```yaml
+root-servers:
+  - tls://dns.adguard-dns.com
+  - tls://1.1.1.1 
+```
+
 ### Blocklists
 List of text files which contain static mappings for websites you want to block
 

src/Conf.py

@@ -7,7 +7,7 @@
 from StaticRemap import StaticRemap
 from qtype import QTYPE
 from utils import logFatalError
-from validation import validateIPv4
+from validation import validateIPv4, validateTlsIPv4, validateDomainName, validateTlsDomainName
 
 
 class Conf:
@@ -66,9 +66,7 @@ def __parseConf(self):
             logFatalError(f'Fatal: `root-servers` field must contain a list of strings')
             sys.exit(1)
 
-        if any(map(lambda e: not validateIPv4(e), self.rootServers)):
-            logFatalError(f'Fatal: `root-servers` field must contain a list of valid IPv4 addresses')
-            sys.exit(1)
+        self.__validateRootServers()
 
         self.blocklists = yconf.get('blocklists')
         if self.blocklists is None:
@@ -150,6 +148,17 @@ def __parseBlocklistFile(self, filePath: str):
 
             self.blocklist[hostnameRegex] = ip
 
+    def __validateRootServers(self):
+        for server in self.rootServers:
+            ipv4Validation = validateIPv4(server)
+            tlsIpv4Validation = validateTlsIPv4(server)
+            domainNameValidation = validateDomainName(server)
+            tlsDomainNameValidation = validateTlsDomainName(server)
+
+            if not any([ipv4Validation, tlsIpv4Validation, domainNameValidation, tlsDomainNameValidation]):
+                logFatalError(f'Fatal: `{server}` is not a valid root-server')
+                sys.exit(1)
+
     def search(self, target: str, qtype: int) -> str|None:
         remap = self.remaps.get(target)
         if remap is not None:

src/DNS.py

@@ -1,6 +1,7 @@
 import random
 import socket as sk
 from _thread import start_new_thread
+import ssl
 
 from Cache import Cache
 from DnsHeader import DnsHeader
@@ -136,6 +137,7 @@ def assembleResponse(data, type=QTYPE.A):
 
             return
 
+        print(self.caches)
         # searches in cache
         if qtype in self.qtypes:
             if responseBytes := self.caches[qtype].getForId(qname, requestId):
@@ -151,7 +153,12 @@ def assembleResponse(data, type=QTYPE.A):
 
         # asks configured root servers
         for server in self.conf.rootServers:
-            responseBytes = self.askRootServer(server, bytes)
+            if server.startswith('tls://'):
+                print('tls server detected')
+                responseBytes = self.askTlsRootServer(server, bytes)
+
+            else:
+                responseBytes = self.askRootServer(server, bytes)
 
             if responseBytes is None:
                 continue
@@ -165,6 +172,7 @@ def assembleResponse(data, type=QTYPE.A):
             except:
                 self.logger.error(f'{strRequestId} | Error: cannot send response to {fmtClientAddress}')
 
+            print(f'{qtype = } ; {qtype in self.qtypes = }')
             if qtype in self.qtypes:
                 self.caches[qtype].append(responseBytes)
 
@@ -191,4 +199,24 @@ def askRootServer(self, server, questionBytes):
         except:
             return None
 
+        return responseBytes
+
+    def askTlsRootServer(self, server, questionBytes):
+        sslContext = ssl.create_default_context()
+        targetServer = server.removeprefix('tls://')
+        print(f'{targetServer = }')
+
+        try:
+            with sk.create_connection((targetServer, STD_DoT_PORT), timeout=5) as sock:
+                with sslContext.wrap_socket(sock, server_hostname=targetServer) as tlsSocket:
+                    querySize = len(questionBytes).to_bytes(2, 'big')
+                    tlsSocket.sendall(querySize + questionBytes)
+
+                    responseLength = int.from_bytes(tlsSocket.recv(2), 'big')
+                    responseBytes = tlsSocket.recv(responseLength)
+
+        except Exception as e:
+            print(e)
+            return
+
         return responseBytes

src/constants.py

@@ -20,6 +20,7 @@
 RECV_SIZE = 2048
 
 STD_DNS_PORT = 53
+STD_DoT_PORT = 853
 
 QNAME_STD_POINTER = b'\xc0\x0c'
 QNAME_POINTER_FLAG = 0b11000000

src/main.py

@@ -5,7 +5,7 @@
 from DNS import DNS
 from utils import logFatalError
 
-VERSION = 'v5.1.0'
+VERSION = 'v5.2.0'
 
 if __name__ == '__main__':
     if os.sys.platform == 'linux':

src/unit_testing.py

@@ -253,6 +253,8 @@ def test_conf_from_yaml(self):
 root-servers:
   - 1.1.1.1
   - 1.0.0.1
+  - tls://1.1.1.1
+  - tls://dns.cloudflare.com
 
 blocklists:
   -'''
@@ -269,7 +271,7 @@ def test_conf_from_yaml(self):
         self.assertEqual(conf.port, 53)
         self.assertEqual(conf.logging, True)
         self.assertEqual(conf.persistentLog, False)
-        self.assertEqual(conf.rootServers, ['1.1.1.1', '1.0.0.1'])
+        self.assertEqual(conf.rootServers, ['1.1.1.1', '1.0.0.1', 'tls://1.1.1.1', 'tls://dns.cloudflare.com'])
         self.assertEqual(conf.search('me.local', QTYPE.A), '0.0.0.0')
         self.assertEqual(conf.search('qname', QTYPE.TXT), 'txt record')
         self.assertIsNone(conf.search('name', QTYPE.CNAME))
@@ -285,6 +287,12 @@ def test_ipv4_success(self):
     def test_ipv4_fail(self):
         self.assertFalse(validateIPv4('10.2.0.258'))
 
+    def test_tls_ipv4_success(self):
+        self.assertTrue(validateTlsIPv4('tls://1.1.1.1'))
+
+    def test_tls_ipv4_fail(self):
+        self.assertFalse(validateTlsIPv4('tsl://1.1.1.1'))
+
     def test_ipv6_success(self):
         self.assertTrue(validateIPv6('fe80:beef::deeb'))
 
@@ -303,6 +311,12 @@ def test_cname_success(self):
     def test_cname_fail(self):
         self.assertFalse(validateDomainName('wrong_domain.name.a'))
 
+    def test_tls_domain_name_success(self):
+        self.assertTrue(validateTlsDomainName('tls://dns.cloudflare.com'))
+
+    def test_tls_domain_name_fail(self):
+        self.assertFalse(validateTlsDomainName('tsl://dns.cloudflare.com'))
+
     def test_vlanmask_success(self):
         self.assertTrue(validateVlanMask('192.168.0.1/24'))
         self.assertTrue(validateVlanMask('192.168.0.1'))

src/utils.py

@@ -10,7 +10,7 @@ def u16ToBytes(value):
     return struct.pack(U16, value)
 
 def bytesToU32(bytes):
-    return struct.unpack(U16, bytes[0:4])[0]
+    return struct.unpack(U32, bytes[0:4])[0]
 
 def u32ToBytes(value):
     return struct.pack(U32, value)

src/validation.py

@@ -7,6 +7,12 @@ def validateIPv4(ip):
         ip
     ) is not None
 
+def validateTlsIPv4(ip):
+    return re.fullmatch(
+        '^tls\\:\\/\\/((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])\\.){3}(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[0-9])$',
+        ip
+    ) is not None
+
 def validateIPv6(ip):
     return re.fullmatch(
         '^(?:(?:[a-f0-9]*)?:){1,7}[a-f0-9]*$',
@@ -25,6 +31,18 @@ def validateDomainName(name):
 
     return False
 
+def validateTlsDomainName(name):
+    if re.fullmatch(
+        '(?i)^tls\\:\\/\\/[a-z0-9]\\.?([a-z0-9\\-]*\\.)*[a-z0-9\\-]+$',
+        name
+    ) is None:
+        return False
+
+    if 0 < len(name.removesuffix('.')) <= 253:
+        return True
+
+    return False
+
 def validateTxtRecord(record):
     return 0 <= len(record) <= TXT_RECORD_MAX_LENGTH