dpyproxy 2.2.0__py3-none-any.whl

modules/dns/DnsModeDeterminator.py

@@ -0,0 +1,358 @@
+import logging
+import random
+from ipaddress import ip_address, ip_network
+
+import dns.message
+from dns.message import make_query
+
+from enumerators.DnsProxyMode import DnsProxyMode
+from enumerators.DnsResolvers import DnsResolvers
+from modules.dns.DnsResolver import DnsResolver
+from network.DomainResolver import DomainResolver
+from network.NetworkAddress import NetworkAddress
+from util.Util import parse_all_ips
+
+
+class DnsModeDeterminator:
+    """
+    Determines functioning circumvention modes and reachable DoQ/DoH/etc. servers.
+    """
+
+    @staticmethod
+    def parse_custom_resolvers(resolvers: list[tuple[DnsProxyMode, str, str, int, str, str]]) -> list[DnsResolver]:
+        """
+        Parses a list of custom resolvers (tuple of ProxyMode, name, ip, port) into DnsResolver objects.
+        """
+        _ret = []
+        for resolver in resolvers:
+            address = NetworkAddress(resolver[2], resolver[3])
+            _ret += [DnsResolver(resolver[1], address, resolver[0], resolver[4], 0, 0, resolver[5])]
+        return _ret
+
+    @staticmethod
+    def parse_default_resolvers(resolvers: list[DnsResolvers], modes: list[DnsProxyMode]) -> list[DnsResolver]:
+        """
+        Parses a list of default resolvers into DnsResolver objects using their standard ports and names. Does that for
+        all provided proxy modes.
+        """
+        _ret = []
+        for mode in modes:
+            # call custom resolver method with resolvers default values
+            _ret += DnsModeDeterminator.parse_custom_resolvers(
+                list(
+                    map(
+                        lambda resolver: (
+                            mode,
+                            str(resolver.name),
+                            str(resolver.value),
+                            mode.default_port(),
+                            str(resolver.hostname),
+                            str(resolver.path),
+                        ),
+                        resolvers,
+                    )
+                )
+            )
+        return _ret
+
+    @staticmethod
+    def generate_resolvers(restrict_advertised: bool = True) -> list[DnsResolver]:
+        """
+        Generates a list of DnsResolver objects based on the statically defined addresses below.
+        """
+        _res = []
+
+        if restrict_advertised:
+            # append RESOLVERS_SUPPORT_ALL
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_ALL, [mode for mode in DnsProxyMode if mode != DnsProxyMode.AUTO]
+            )
+
+            # append RESOLVERS_SUPPORT_ALL_ENCRYPTED
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_ALL_ENCRYPTED,
+                [DnsProxyMode.DOT, DnsProxyMode.DOH, DnsProxyMode.DOH3, DnsProxyMode.DOQ],
+            )
+
+            # append RESOLVERS_SUPPORT_ALL_EXCEPT_DOQ
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_ALL_EXCEPT_DOQ,
+                [mode for mode in DnsProxyMode if mode != DnsProxyMode.DOQ and mode != DnsProxyMode.AUTO],
+            )
+
+            # append RESOLVERS_SUPPORT_ALL_EXCEPT_DOH3_DOQ
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_ALL_EXCEPT_DOH3_DOQ,
+                [
+                    mode
+                    for mode in DnsProxyMode
+                    if mode != DnsProxyMode.DOQ and mode != DnsProxyMode.AUTO and mode != DnsProxyMode.DOH3
+                ],
+            )
+
+            # append RESOLVERS_SUPPORT_UDP_TCP_DOT
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_UDP_TCP_DOT,
+                [
+                    DnsProxyMode.UDP,
+                    DnsProxyMode.LAST_RESPONSE,
+                    DnsProxyMode.TCP,
+                    DnsProxyMode.TCP_FRAG,
+                    DnsProxyMode.DOT,
+                ],
+            )
+
+            # append RESOLVERS_SUPPORT_UDP_TCP_DOH
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_UDP_TCP_DOH,
+                [
+                    DnsProxyMode.UDP,
+                    DnsProxyMode.LAST_RESPONSE,
+                    DnsProxyMode.TCP,
+                    DnsProxyMode.TCP_FRAG,
+                    DnsProxyMode.DOH,
+                ],
+            )
+
+            # append RESOLVERS_SUPPORT_ENCRYPTED_EXCEPT_DOQ
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_ENCRYPTED_EXCEPT_DOH3_DOQ, [DnsProxyMode.DOT, DnsProxyMode.DOH]
+            )
+
+            # append RESOLVERS_SUPPORT_ONLY_UNENCRYPTED
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                DnsModeDeterminator.RESOLVERS_SUPPORT_ONLY_UNENCRYPTED,
+                [DnsProxyMode.UDP, DnsProxyMode.TCP, DnsProxyMode.TCP_FRAG, DnsProxyMode.LAST_RESPONSE],
+            )
+        else:
+            _res += DnsModeDeterminator.parse_default_resolvers(
+                [x for x in DnsResolvers], [mode for mode in DnsProxyMode if mode != DnsProxyMode.AUTO]
+            )
+        return _res
+
+    # resolvers that support UDP/TPC/DoT/DoH/DoH3/DoQ
+    RESOLVERS_SUPPORT_ALL: list[DnsResolvers] = [
+        DnsResolvers.ADGUARD_1,
+        DnsResolvers.ADGUARD_2,
+        DnsResolvers.ADGUARD_UNFILTERED_1,
+        DnsResolvers.ADGUARD_UNFILTERED_2,
+        DnsResolvers.ADGUARD_FAMILY_1,
+        DnsResolvers.ADGUARD_FAMILY_2,
+    ]
+
+    # resolver that support DoQ/DoH3/DoH/DoT
+    RESOLVERS_SUPPORT_ALL_ENCRYPTED: list[DnsResolvers] = [DnsResolvers.NEXTDNS_1, DnsResolvers.NEXTDNS_2]
+
+    # resolvers that support UDP/TCP/DoT/DoH/DoH3 but no DoQ
+    RESOLVERS_SUPPORT_ALL_EXCEPT_DOQ: list[DnsResolvers] = [
+        DnsResolvers.CLOUDFLARE_1,
+        DnsResolvers.CLOUDFLARE_2,
+        DnsResolvers.CLOUDFLARE_SECURITY_1,
+        DnsResolvers.CLOUDFLARE_SECURITY_2,
+        DnsResolvers.CLOUDFLARE_FAMILY_1,
+        DnsResolvers.CLOUDFLARE_FAMILY_2,
+        DnsResolvers.GOOGLE_1,
+        DnsResolvers.GOOGLE_2,
+    ]
+
+    # resolvers that support UDP/TCP/DoT/DoH but no DOH3 and DoQ
+    RESOLVERS_SUPPORT_ALL_EXCEPT_DOH3_DOQ: list[DnsResolvers] = [
+        DnsResolvers.CLEAN_BROWSING_FAMILY_1,
+        DnsResolvers.CLEAN_BROWSING_FAMILY_2,
+        DnsResolvers.CLEAN_BROWSING_ADULT_1,
+        DnsResolvers.CLEAN_BROWSING_SECURITY_1,
+        DnsResolvers.CLEAN_BROWSING_SECURITY_2,
+        DnsResolvers.CISCO_1,
+        DnsResolvers.CISCO_2,
+        DnsResolvers.CISCO_FAMILY_1,
+        DnsResolvers.CISCO_FAMILY_2,
+        DnsResolvers.CISCO_SANDBOX_1,
+        DnsResolvers.CISCO_SANDBOX_2,
+        DnsResolvers.QUAD_9_1,
+        DnsResolvers.QUAD_9_2,
+        DnsResolvers.QUAD_9_EDNS_1,
+        DnsResolvers.QUAD_9_EDNS_2,
+        DnsResolvers.QUAD_9_UNSECURED_1,
+        DnsResolvers.QUAD_9_UNSECURED_2,
+        DnsResolvers.YANDEX_1,
+        DnsResolvers.YANDEX_2,
+        DnsResolvers.YANDEX_SAFE_1,
+        DnsResolvers.YANDEX_SAFE_2,
+        DnsResolvers.YANDEX_FAMILY_1,
+        DnsResolvers.YANDEX_FAMILY_2,
+    ]
+
+    # resolvers that support UDP/TCP/DoT
+    RESOLVERS_SUPPORT_UDP_TCP_DOT: list[DnsResolvers] = [DnsResolvers.CLEAN_BROWSING_ADULT_2]
+
+    # resolvers that support UDP/TCP/DoH
+    RESOLVERS_SUPPORT_UDP_TCP_DOH: list[DnsResolvers] = [DnsResolvers.CISCO_CHROMIUM]
+
+    # resolvers that support DoT/DoH
+    RESOLVERS_SUPPORT_ENCRYPTED_EXCEPT_DOH3_DOQ: list[DnsResolvers] = [
+        DnsResolvers.WIKIMEDIA,
+        DnsResolvers.MULLVAD,
+        DnsResolvers.MULLVAD_ADBLOCK,
+        DnsResolvers.MULLVAD_BASE,
+        DnsResolvers.MULLVAD_EXTENDED,
+        DnsResolvers.MULLVAD_FAMILY,
+        DnsResolvers.MULLVAD_ALL,
+    ]
+
+    # resolvers that support UDP/TCP
+    RESOLVERS_SUPPORT_ONLY_UNENCRYPTED: list[DnsResolvers] = [DnsResolvers.G_CORE_1, DnsResolvers.G_CORE_2]
+
+    CUSTOM_RESOLVERS: list[DnsResolver] = parse_custom_resolvers(
+        [
+            #########################################################
+            #                                                       #
+            #                                                       #
+            #               Add custom DNS servers here             #
+            #                                                       #
+            #                                                       #
+            #########################################################
+            # each server need the supported proxy mode, a name, the IP address, and a port
+            # e.g. a DoT server under 127.0.0.1:1234
+            # (DnsProxyMode.DOT, "My Server", "127.0.0.1", 1234),
+        ]
+    )
+
+    def __init__(
+        self,
+        timeout: int,
+        censored_domain: str,
+        compare_ip_ranges: list[str],
+        block_page_ips: bool = False,
+        restrict_advertised: bool = True,
+    ):
+        """
+        :param timeout: timeout for DNS requests
+        :param censored_domain: censored domain
+        :param compare_ip_ranges: ip ranges to compare against
+        :param block_page_ips: whether the ip ranges are block pages ips (avoid) or not (match)
+        :param restrict_advertised: whether to restrict resolver to what they actually support
+        in one of these ranges to be deemed correct
+        """
+
+        self.timeout = timeout
+        self.censored_domain = censored_domain
+        self.block_page_ips = block_page_ips
+
+        self.compare_ip_ranges = []
+        for ip_range in compare_ip_ranges:
+            try:
+                self.compare_ip_ranges.append(ip_network(ip_range))
+            except:
+                logging.error(f"Could not parse {ip_range} as a valid ip range!")
+                raise
+        self.censored_request = make_query(censored_domain, "A")
+        self.resolvers: list[DnsResolver] = DnsModeDeterminator.generate_resolvers(restrict_advertised)
+
+    def generate_working_resolver(
+        self, mode: DnsProxyMode = None, min_retries: int = 1, max_retries: int = 1, add_sni: bool = True
+    ):
+        """
+        Generator that yields all working DnsResolvers.
+        :param mode: Restricts resolver generation to the specified mode.
+        :param min_retries: Number of minimum retries to determine success.
+        :param max_retries: Number of maximum retries to determine success.
+        :param add_sni: Whether to include an SNI extension.
+        """
+        all_modes = [
+            DnsProxyMode.DOT,
+            DnsProxyMode.DOH,
+            DnsProxyMode.DOH3,
+            DnsProxyMode.DOQ,
+            DnsProxyMode.UDP,
+            DnsProxyMode.TCP,
+            DnsProxyMode.TCP_FRAG,
+            DnsProxyMode.LAST_RESPONSE,
+        ]
+
+        # Restrict to the given mode or use all
+        modes_to_test = [mode] if mode is not None else all_modes
+
+        # Generate all (mode, resolver) combinations
+        resolver_mode_pairs = [
+            (_mode, resolver) for _mode in modes_to_test for resolver in self.resolvers if resolver.mode == _mode
+        ]
+
+        # Shuffle to ensure full random order across modes and resolvers
+        random.shuffle(resolver_mode_pairs)
+
+        for _mode, resolver in resolver_mode_pairs:
+            validate_ip = (
+                not add_sni
+                if _mode in [DnsProxyMode.DOT, DnsProxyMode.DOH, DnsProxyMode.DOH3, DnsProxyMode.DOQ]
+                else True
+            )
+            yield from self.try_resolver(
+                resolver,
+                mode=_mode,
+                validate_ip=validate_ip,
+                min_retries=min_retries,
+                max_retries=max_retries,
+                add_sni=add_sni,
+            )
+
+    def try_resolver(
+        self, resolver, mode: DnsProxyMode, validate_ip: bool, min_retries: int, max_retries: int, add_sni: bool
+    ):
+        """
+        Generator function that determines all reachable DNS resolvers for the specified mode. If validate_ip is True,
+        the DNS resolver must respond with a pre-defined IP address.
+        """
+        logging.debug(f"Trying to resolve {resolver.name} for mode {mode}")
+        success = False
+
+        for i in range(max_retries):
+            resolver.tries += 1
+            try:
+                answer = DomainResolver.resolve_static(
+                    mode=mode,
+                    message=self.censored_request,
+                    resolver=resolver.address,
+                    timeout=self.timeout,
+                    hostname=resolver.hostname,
+                    add_sni=add_sni,
+                    path=resolver.path,
+                )
+            except Exception as e:
+                logging.debug(f"Could not resolve to {resolver.name} for mode {mode} with exception {e}")
+            else:
+                if validate_ip:
+                    if self.assert_correct_ip(answer):
+                        logging.debug(f"Successfully resolved to {resolver.name} for mode {mode}")
+                        resolver.successes += 1
+                        if i + 1 >= min_retries and resolver.successes / (i + 1) >= 2 / 3:
+                            success = True
+                            break
+                    else:
+                        logging.debug(f"Incorrect IP from {resolver.name} in mode {mode}")
+                else:
+                    logging.debug(f"Successfully resolved to {resolver.name} for mode {mode}")
+                    resolver.successes += 1
+                    if i + 1 >= min_retries and resolver.successes / (i + 1) >= 2 / 3:
+                        success = True
+                        break
+        if success:
+            yield resolver
+
+    def assert_correct_ip(self, answer: dns.message.Message) -> bool:
+        """
+        Determines whether the given DNS response contains the given IP in its answer section.
+        :param answer: The DNS response to check.
+        """
+        # extract requires record type and class
+
+        resolved_ips = parse_all_ips(answer)
+        for ip in resolved_ips:
+            # check if IP lies in range
+            for ip_range in self.compare_ip_ranges:
+                if ip_address(ip) in ip_range:
+                    return not self.block_page_ips
+
+        logging.debug(
+            f"None of the resolved IP addresses {resolved_ips} in specified IP ranges {self.compare_ip_ranges}."
+        )
+        return self.block_page_ips

modules/dns/DnsModule.py

@@ -0,0 +1,113 @@
+from argparse import ArgumentParser, Namespace
+
+from enumerators.DnsProxyMode import DnsProxyMode
+from modules.dns.DnsProxy import DnsProxy
+from modules.Module import Module
+from network.NetworkAddress import NetworkAddress
+
+
+class DnsModule(Module):
+    """
+    Implements circumvention methods for DNS censorship.
+    """
+
+    def __init__(self, parser: ArgumentParser):
+        super().__init__(parser)
+        self.proxy: DnsProxy | None = None
+        self.server_address: NetworkAddress | None = None
+
+    @staticmethod
+    def register_parameters(parser: ArgumentParser):
+        dns_module = parser.add_argument_group("DNS Module")
+
+        dns_module.add_argument(
+            "--dns_mode",
+            type=DnsProxyMode,
+            default=DnsProxyMode.AUTO,
+            help="Mode that the DNS proxy operates in. Default AUTO. If not set to AUTO, still attempts to "
+            "automatically determine a resolver for the configured mode. To pre-define the used DNS mode and server "
+            "set this flag and the dns_resolver_host and optionally the dns_resolver_port flags.",
+        )
+
+        dns_module.add_argument(
+            "--dns_timeout",
+            type=int,
+            default=3,
+            help=f"Connection timeout in seconds. For the {DnsProxyMode.LAST_RESPONSE} mode this timeout will "
+            "always be reached. Set this timeout and the timeout of calling application accordingly.",
+        )
+
+        dns_module.add_argument("--dns_host", type=str, default="127.0.0.1", help="Address the proxy server runs on")
+
+        dns_module.add_argument("--dns_port", type=int, default=5533, help="Port the proxy server runs on")
+
+        dns_module.add_argument(
+            "--dns_resolver_host",
+            type=str,
+            default=None,
+            help="DNS resolver IP. If set, must correspond to the selected dns_mode.",
+        )
+
+        dns_module.add_argument(
+            "--dns_resolver_port",
+            type=str,
+            default=None,
+            help="DNS resolver port. If set, must correspond to the selected dns_mode. If unset, port is chosen "
+            "based on the chosen or determined mode's standard port",
+        )
+
+        dns_module.add_argument(
+            "--dns_censored_domain",
+            type=str,
+            default="www.google.dj",
+            help="A domain name censored in your location. Used to determine working circumventions methods. "
+            "Specify together with --dns_censored_domain_ip",
+        )
+
+        dns_module.add_argument(
+            "--dns_compare_ip_ranges",
+            type=str,
+            default="8.8.4.0/24,8.8.8.0/24,8.34.208.0/20,8.35.192.0/20,23.236.48.0/20,23.251.128.0/19,34.0.0.0/15,34.2.0.0/16,34.3.0.0/23,34.3.3.0/24,34.3.4.0/24,34.3.8.0/21,34.3.16.0/20,34.3.32.0/19,34.3.64.0/18,34.4.0.0/14,34.8.0.0/13,34.16.0.0/12,34.32.0.0/11,34.64.0.0/10,34.128.0.0/10,35.184.0.0/13,35.192.0.0/14,35.196.0.0/15,35.198.0.0/16,35.199.0.0/17,35.199.128.0/18,35.200.0.0/13,35.208.0.0/12,35.224.0.0/12,35.240.0.0/13,57.140.192.0/18,64.15.112.0/20,64.233.160.0/19,66.22.228.0/23,66.102.0.0/20,66.249.64.0/19,70.32.128.0/19,72.14.192.0/18,74.114.24.0/21,74.125.0.0/16,104.154.0.0/15,104.196.0.0/14,104.237.160.0/19,107.167.160.0/19,107.178.192.0/18,108.59.80.0/20,108.170.192.0/18,108.177.0.0/17,130.211.0.0/16,136.22.160.0/20,136.22.176.0/21,136.22.184.0/23,136.22.186.0/24,136.124.0.0/15,142.250.0.0/15,146.148.0.0/17,152.65.208.0/22,152.65.214.0/23,152.65.218.0/23,152.65.222.0/23,152.65.224.0/19,162.120.128.0/17,162.216.148.0/22,162.222.176.0/21,172.110.32.0/21,172.217.0.0/16,172.253.0.0/16,173.194.0.0/16,173.255.112.0/20,192.104.160.0/23,192.158.28.0/22,192.178.0.0/15,193.186.4.0/24,199.36.154.0/23,199.36.156.0/24,199.192.112.0/22,199.223.232.0/21,207.223.160.0/20,208.65.152.0/22,208.68.108.0/22,208.81.188.0/22,208.117.224.0/19,209.85.128.0/17,216.58.192.0/19,216.73.80.0/20,216.239.32.0/19,216.252.220.0/22",
+            help="A list of IP ranges the resolved IP of the censored domain lies in. The censored domain is "
+            "specifiable in --dns_censored_domain.",
+        )
+
+        dns_module.add_argument(
+            "--dns_block_page_ips",
+            default=False,
+            help="Whether the given IP ranges to compare are block page IPs or not. Default is False.",
+        )
+
+        dns_module.add_argument(
+            "--dns_add_sni",
+            default=True,
+            help="Whether or not to include the SNI for encrypted DNS modes. Defaults to True.",
+        )
+
+        dns_module.add_argument(
+            "--dns_skip_working_file",
+            default=False,
+            help="Whether taking the stored working resolver from a file should be skipped. Defaults to False.",
+        )
+
+    def extract_parameters(self, args: Namespace):
+        self.server_address = NetworkAddress(args.dns_host, args.dns_port)
+        resolver_address = NetworkAddress(args.dns_resolver_host, args.dns_port)
+
+        self.proxy = DnsProxy(
+            proxy_mode=args.dns_mode,
+            address=self.server_address,
+            timeout=args.dns_timeout,
+            dns_resolver_address=resolver_address,
+            censored_domain=args.dns_censored_domain,
+            compare_ip_ranges=[x for x in args.dns_compare_ip_ranges.split(",")],
+            block_page_ips=args.dns_block_page_ips,
+            add_sni=args.dns_add_sni,
+            skip_working_file=args.dns_skip_working_file,
+        )
+
+    def start(self):
+        self.proxy.start()
+
+    def stop(self):
+        self.proxy.continue_processing = False