Add sniffer enhancement related to Fake DNS #697

yuhan6665 · 2021-02-21T02:13:35Z

I have been thinking of for the cache/mapping loss when core is rebooted. Also got some idea from the initial user of the current fake DNS.
Basically the idea is to use the existing sniffers (HTTP, TLS) when the domain name cannot be recovered. When it works, logs will be like:

31872-31976/com.v2ray.ang I/GoLog: [Info] v2ray.com/core/app/dns: returning fake IP 240.0.0.2 for domain baidu.com
...reboot...
2020-11-29 22:55:56.300 31872-31976/com.v2ray.ang I/GoLog: [Info] [1895565757] v2ray.com/core/proxy/socks: TCP Connect request to tcp:240.0.0.2:80
2020-11-29 22:55:56.300 31872-31976/com.v2ray.ang I/GoLog: [Info] v2ray.com/core/app/dns/fakedns: A fake ip request to 240.0.0.2, however there is no matching domain name in fake DNS
2020-11-29 22:55:56.300 31872-31976/com.v2ray.ang I/GoLog: [Info] [1895565757] v2ray.com/core/app/dispatcher: Using sniffer http1 since the fake DNS missed
2020-11-29 22:55:56.300 31872-31976/com.v2ray.ang I/GoLog: [Info] [1895565757] v2ray.com/core/app/dispatcher: sniffed domain: baidu.com
2020-11-29 22:55:56.300 31872-31976/com.v2ray.ang I/GoLog: [Info] [1895565757] v2ray.com/core/app/dispatcher: taking detour [direct] for [tcp:baidu.com:80]

Loyalsoldier · 2021-02-23T02:28:57Z

Maybe this behavior should be the default one in FakeDNS instead of adding a new DNS convention fakedns+others?

yuhan6665 · 2021-02-23T03:16:59Z

Maybe be this behavior should be the default one in FakeDNS instead of adding a new DNS convention fakedns+others?

I can make change this way. Commit will be simpler even.
The reason to add a new sniffer "fakedns+others" was to give user a way to opt out. But opt out will fail connection anyway..

rurirei · 2021-02-23T11:17:06Z

but v2ray-sniffing enabled also on my side, as FakeDns not used anywhere.

{ "destOverride": [ "http", "tls", "fakedns" ] },
{ "dns": { "servers": [ "fakedns", "8.8.8.8" ] }

[v2ray] [Debug] v2ray.com/core/app/dns: domain dns.google will use DNS in order: [FakeDNS UDP:8.8.8.8:53]
[v2ray] [Info] [348177452] v2ray.com/core/app/dispatcher: fake dns got domain: dns.google for ip: 198.18.0.3
[v2ray] [Info] [348177452] v2ray.com/core/app/dispatcher: sniffed domain: dns.google

// not FakeDNS!
[v2ray] [Info] [2213317628] v2ray.com/core/app/dispatcher: sniffed domain: api.github.com

Loyalsoldier · 2021-02-23T12:21:04Z

but v2ray-sniffing enabled also on my side, as FakeDns not used anywhere.

{ "destOverride": [ "http", "tls", "fakedns" ] },
{ "dns": { "servers": [ "fakedns", "8.8.8.8" ] }

[v2ray] [Debug] v2ray.com/core/app/dns: domain dns.google will use DNS in order: [FakeDNS UDP:8.8.8.8:53]
[v2ray] [Info] [348177452] v2ray.com/core/app/dispatcher: fake dns got domain: dns.google for ip: 198.18.0.3
[v2ray] [Info] [348177452] v2ray.com/core/app/dispatcher: sniffed domain: dns.google

// not FakeDNS!
[v2ray] [Info] [2213317628] v2ray.com/core/app/dispatcher: sniffed domain: api.github.com

There is an option metadataOnly for FakeDNS. Set it true, then v2ray can't sniff domains. But I don't know what this option for.

yuhan6665 · 2021-02-23T23:15:58Z

@rurirei
without b17dbd5, user need to turn on sniffer "http", "tls" for all IP range. Which might not be desirable in some cases.
c88d124 is just a small enhancement to make new fake IP unique.

Loyalsoldier · 2021-02-24T00:47:43Z

Maybe add a boolean option fallback to SniffingObject. Set it true, then fallback to other sniffers?

(But as you can see for now, if the metadataOnly option in fakeDNS is set to false, other sniffers still work. Is it necessary to keep both fallback and metadataOnly options?)

@xiaokangwang

Fallback means if the request IP is in the range of fakes, when fakeDNS cache missed (most likely due to reboot), "tls" and "http" sniffer will be used to identify domain

With the default ip range, now it is guarentee to return different ip within 4 hours. It helps when core is rebooted, new DNS request still get fresh ip, If there is request to the old fake ips, fake DNS can't find the domain, other sniffers will get a chance to work. Also fix an edge case where element is wrongly brought to top of LRU

rurirei · 2021-02-24T00:58:33Z

@yuhan6665 @Loyalsoldier what about defaults to fallback (if when metadataOnly: false), unless there are no "http and/or tls" sniffers appears in specified configs.

Loyalsoldier · 2021-02-24T01:04:01Z

@yuhan6665 @Loyalsoldier what about defaults to fallback (if when metadataOnly: false), unless there are no "http and/or tls" sniffers appears in specified configs.

IMO, I like the word fallback more. The metadataOnly word to me is hard to understand. 😂

rurirei · 2021-02-24T01:09:50Z

@Loyalsoldier metadataOnly is not option for fallback seems.

v2ray-core/app/proxyman/config.proto

Lines 60 to 63 in 38da831

    
             // Whether should only try to sniff metadata without waiting for client input. 
        
             // Can be used to support SMTP like protocol where server send the first message. 
        
             bool metadata_only = 3; 
        
           }

yuhan6665 · 2021-02-25T01:31:33Z

From what I can tell, metadataOnly = ture will turn off any fallback behavior, so I think we are good. Let's keep the existing configs as is.

klzgrad · 2021-03-06T14:00:45Z

This will stop working with TLS 1.3 ESNI and HTTP/3, no?

rurirei · 2021-03-06T14:06:01Z

@klzgrad FakeDNS will not work with Encrypted DNS query. It may work with ESNI.

kslr

Looks good, but if we plan to add TUN Inbound, "fakedns+other" is better

kslr · 2021-04-03T08:14:33Z

@xiaokangwang Don't forget

xiaokangwang · 2021-04-08T21:35:07Z

The reason I added a metadata only only is that without that, some protocol that require server to initiate the talk will not work(notably SMTP).

I have to say that the change in shouldOverride have break the abstraction of the sniffer. I will look more into how to incorporate this change into V2Ray.
https://github.com/v2fly/v2ray-core/pull/697/files#diff-c3820ebfbe4f1eb7e9d13008e995e0fa8912cad9f058c9f7767aed1df10533d8R181

xiaokangwang · 2021-04-08T22:05:27Z

but v2ray-sniffing enabled also on my side, as FakeDns not used anywhere.

{ "destOverride": [ "http", "tls", "fakedns" ] },
{ "dns": { "servers": [ "fakedns", "8.8.8.8" ] }

[v2ray] [Debug] v2ray.com/core/app/dns: domain dns.google will use DNS in order: [FakeDNS UDP:8.8.8.8:53]
[v2ray] [Info] [348177452] v2ray.com/core/app/dispatcher: fake dns got domain: dns.google for ip: 198.18.0.3
[v2ray] [Info] [348177452] v2ray.com/core/app/dispatcher: sniffed domain: dns.google

// not FakeDNS!
[v2ray] [Info] [2213317628] v2ray.com/core/app/dispatcher: sniffed domain: api.github.com

Sorry my English is very bad and I cannot understand your meaning, but, when FakeDNS is not getting result, and metadataonly is false which allow V2Ray to prevent client from dialing connection before sending content, other sniffer's result will work.

xiaokangwang · 2021-04-08T22:09:31Z

If agreed, I can rework the internal code of this PR so that:
A composite sniffer will sniff the domain name with tls and http if the ip address in the fake dns's ip pool but no result is given from fake dns.

Loyalsoldier · 2021-04-08T22:19:05Z

If agreed, I can rework the internal code of this PR so that:
A composite sniffer will sniff the domain name with tls and http if the ip address in the fake dns's ip pool but no result is given from fake dns.

It's great to also implement this #806

xiaokangwang · 2021-04-08T22:29:13Z

If agreed, I can rework the internal code of this PR so that:
A composite sniffer will sniff the domain name with tls and http if the ip address in the fake dns's ip pool but no result is given from fake dns.

It's great to also implement this #806

There are also domains like .internal that shouldn't be solved with fake dns. I think this should be something we require user to configure to suit their environment instead of hard code such logic. This issue is similar to some app don't respect fake dns's response and refuse to work when fake dns is enabled. We already have setting to solve all these problems, we shouldn't use hard coded logic then.

Loyalsoldier · 2021-04-09T00:42:17Z

If agreed, I can rework the internal code of this PR so that:
A composite sniffer will sniff the domain name with tls and http if the ip address in the fake dns's ip pool but no result is given from fake dns.

It's great to also implement this #806

There are also domains like .internal that shouldn't be solved with fake dns. I think this should be something we require user to configure to suit their environment instead of hard code such logic. This issue is similar to some app don't respect fake dns's response and refuse to work when fake dns is enabled. We already have setting to solve all these problems, we shouldn't use hard coded logic then.

But V2Ray cannot deal with invalid domains with space now.

yuhan6665 · 2021-04-19T00:18:32Z

Close as work is done in #915

yuhan6665 force-pushed the fake+others branch from 8448e00 to c88d124 Compare February 21, 2021 02:25

yuhan6665 force-pushed the fake+others branch from c88d124 to 0052edc Compare February 24, 2021 00:43

yuhan6665 added 2 commits February 23, 2021 19:50

Fallback to other sniffers for fakedns sniffing mode

d7e6800

Fallback means if the request IP is in the range of fakes, when fakeDNS cache missed (most likely due to reboot), "tls" and "http" sniffer will be used to identify domain

yuhan6665 force-pushed the fake+others branch from 0052edc to fff3e1a Compare February 24, 2021 00:51

yuhan6665 mentioned this pull request Feb 26, 2021

Fakedns XTLS/Xray-core#309

Merged

kslr approved these changes Mar 10, 2021

View reviewed changes

kslr requested a review from xiaokangwang March 10, 2021 20:44

This was referenced Mar 30, 2021

feat: shouldSniffDomain for (FakeDNS) Sniffer XTLS/Xray-core#436

Closed

feat: shouldSniffDomain for Sniffer #843

Closed

xiaokangwang mentioned this pull request Apr 9, 2021

Fake DNS improvement: fakedns+others sniffer, muti stack(mutlti pool) fake dns #882

Merged

yuhan6665 closed this Apr 19, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add sniffer enhancement related to Fake DNS #697

Add sniffer enhancement related to Fake DNS #697

yuhan6665 commented Feb 21, 2021

Loyalsoldier commented Feb 23, 2021 •

edited

Loading

yuhan6665 commented Feb 23, 2021

rurirei commented Feb 23, 2021

Loyalsoldier commented Feb 23, 2021

yuhan6665 commented Feb 23, 2021

Loyalsoldier commented Feb 24, 2021 •

edited

Loading

rurirei commented Feb 24, 2021

Loyalsoldier commented Feb 24, 2021

rurirei commented Feb 24, 2021

yuhan6665 commented Feb 25, 2021

klzgrad commented Mar 6, 2021

rurirei commented Mar 6, 2021

kslr left a comment

kslr commented Apr 3, 2021

xiaokangwang commented Apr 8, 2021

xiaokangwang commented Apr 8, 2021

xiaokangwang commented Apr 8, 2021

Loyalsoldier commented Apr 8, 2021

xiaokangwang commented Apr 8, 2021

Loyalsoldier commented Apr 9, 2021

yuhan6665 commented Apr 19, 2021

Add sniffer enhancement related to Fake DNS #697

Add sniffer enhancement related to Fake DNS #697

Conversation

yuhan6665 commented Feb 21, 2021

Loyalsoldier commented Feb 23, 2021 • edited Loading

yuhan6665 commented Feb 23, 2021

rurirei commented Feb 23, 2021

Loyalsoldier commented Feb 23, 2021

yuhan6665 commented Feb 23, 2021

Loyalsoldier commented Feb 24, 2021 • edited Loading

rurirei commented Feb 24, 2021

Loyalsoldier commented Feb 24, 2021

rurirei commented Feb 24, 2021

yuhan6665 commented Feb 25, 2021

klzgrad commented Mar 6, 2021

rurirei commented Mar 6, 2021

kslr left a comment

Choose a reason for hiding this comment

kslr commented Apr 3, 2021

xiaokangwang commented Apr 8, 2021

xiaokangwang commented Apr 8, 2021

xiaokangwang commented Apr 8, 2021

Loyalsoldier commented Apr 8, 2021

xiaokangwang commented Apr 8, 2021

Loyalsoldier commented Apr 9, 2021

yuhan6665 commented Apr 19, 2021

Loyalsoldier commented Feb 23, 2021 •

edited

Loading

Loyalsoldier commented Feb 24, 2021 •

edited

Loading