proxy dns with NOTIMP error

[robberphex]

Chromium will send SVCB/HTTPS type dns query, which cause dns leak.

To prvent dns leak,

• If the dns query type is not implemented, should return NOTIMP error, not just send data to original destination.
• If the dns query has wrong format domain, should return FORMERR error, not send data to original destination.

[AkinoKaede]

Thanks, I think we need to discuss a more reasonable solution.

[robberphex]

Thanks, I think we need to discuss a more reasonable solution.

Yes, but how? This has put the user in danger for years.

[dyhkwong]

To prevent DNS leak, why not override destination address and configure proxySettings for dns outbound to make non-A/AAAA traffic routable?

[robberphex]

To prevent DNS leak, why not override destination address and configure proxySettings for dns outbound to make non-A/AAAA traffic routable?

1. Is there an example for this?
2. non-A/AAAA dns request will always to remote server, which is time-costing. And return NOTIMP error is reasonable.
3. v2ray provide route solution for "customized routing", throw HTTPS dns query will cause client/chromium waiting and use dns response. Returning NOTIMP can make client use dns response from v2ray.

[codecov-commenter]

Codecov Report

Patch and project coverage have no change.

Comparison is base (5c995d9) 38.29% compared to head (1f28093) 38.29%.

❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2595   +/-   ##
=======================================
  Coverage   38.29%   38.29%           
=======================================
  Files         637      637           
  Lines       38122    38147   +25     
=======================================
+ Hits        14599    14610   +11     
- Misses      21911    21929   +18     
+ Partials     1612     1608    -4     

Impacted Files	Coverage Δ
proxy/dns/dns.go	63.75% <0.00%> (-8.31%)	⬇️

... and 8 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

[robberphex]

@AkinoKaede @dyhkwong proxySettings only has tag and transportLayer field, is not captiable to split flow by domains.

For example, Chromium will send SVCB/HTTPS query for every domain, some chinese domain should only query in local network.

And currently, we don't have much resource to implement SVCB/HTTPS query type, and we cannot implement every query on time in futrue. So let's fllow spec, return NOTIMP.

Is there any other way to prevent this kind of dnsleak, and don't put the user in danger?

[AkinoKaede]

@AkinoKaede @dyhkwong proxySettings only has tag and transportLayer field, is not captiable to split flow by domains.

For example, Chromium will send SVCB/HTTPS query for every domain, some chinese domain should only query in local network.

And currently, we don't have much resource to implement SVCB/HTTPS query type, and we cannot implement every query on time in futrue. So let's fllow spec, return NOTIMP.

Is there any other way to prevent this kind of dnsleak, and don't put the user in danger?

Another developer suggested configuring the proxySettings to route requests not supported by dns app to the blackhole.

[rp-hello]

@AkinoKaede @dyhkwong proxySettings only has tag and transportLayer field, is not captiable to split flow by domains.
For example, Chromium will send SVCB/HTTPS query for every domain, some chinese domain should only query in local network.
And currently, we don't have much resource to implement SVCB/HTTPS query type, and we cannot implement every query on time in futrue. So let's fllow spec, return NOTIMP.
Is there any other way to prevent this kind of dnsleak, and don't put the user in danger?

Another developer suggested configuring the proxySettings to route requests not supported by dns app to the blackhole.

I meet same problem, Is there any updates for proxySettings? If not, I think we could merge this to keep user safe.

[dyhkwong]

At least make this optional for those users chaining DNS traffic with `proxySettings`.

…

I meet same problem, Is there any updates for `proxySettings`? If not, I think we could merge this to keep user safe.

[github-actions]

It has been open 120 days with no activity. Remove stale label or comment or this will be closed in 5 days