Revert "Switch to local UDP DNS resolver" #2650

Mygod · 2021-01-04T05:43:13Z

Reverts #2635

I am not sure why you would want to remove uds. Local port is accessible by any process on the device and is potentially a security risk. UDS is protected by the filesystem permissions while local port is not.

This reverts commit 700f4d2.

zonyitoo · 2021-01-04T05:46:09Z

The only reason is that common DNS libraries doesn't support resolving with UDS.

Why is that a security risk?

madeye · 2021-01-04T05:46:30Z

We already opened ports for local shadowsocks socks5 server and DNS resolver...

zonyitoo · 2021-01-04T05:49:19Z

sslocal itself still need to resolve remote servers' domain names.

The DNS relay in sslocal is like a DNS server, which simply redirects DNS queries to both configured local and remote servers.

In sslocal's point of view, it requires 2 set of DNS servers:

for resolving remote servers' domain names
for DNS relay

Mygod · 2021-01-04T05:51:05Z

We already opened ports for local shadowsocks socks5 server and DNS resolver...

This port gives untrusted processes direct access to underlying DNS port and therefore leaks the user's identity information (DNS provider) and possibly more. Technically, socks5 port should not be exposed either, but this is less problematic.

zonyitoo · 2021-01-04T05:59:17Z

How about this:

The UDP DNS resolver should be kept for sslocal to resolve remote servers' domain names
For DNS Relay, the local DNS could be provided by a UDS server.

madeye · 2021-01-04T06:02:05Z

IMO, in any way, we have to expose the local resolver from sslocal, for tun2socks.

leaks the user's identity information (DNS provider)

In fact, with the local DNS resolver enabled, do a DNS query from any app can lead to this kind of leaking...

madeye · 2021-01-04T06:02:27Z

For DNS Relay, the local DNS could be provided by a UDS server.

Yes, I think it's doable.

Mygod · 2021-01-04T06:18:43Z

The UDP DNS resolver should be kept for sslocal to resolve remote servers' domain names

What UDP DNS resolver?

IMO, in any way, we have to expose the local resolver from sslocal, for tun2socks.

leaks the user's identity information (DNS provider)

In fact, with the local DNS resolver enabled, do a DNS query from any app can lead to this kind of leaking...

Not necessarily if ACL is set up properly. Another security risk regarding this is that an app can probe two consecutive ports for DNS to test if the user is running Shadowsocks in this mode.

I don't understand why you decided to take the trouble to remove all the UDS code that is already there. What do you gain from this?

It is ok to expose sslocal acl resolver since it will be accessible via the tun interface anyway.

madeye · 2021-01-04T06:47:42Z

Some background here: current shadowsocks-android resolves the hostname of a shadowsocks server to IPs before generate the JSON config for sslocal.

I don't understand why you decided to take the trouble to remove all the UDS code that is already there. What do you gain from this?

@zonyitoo plans to support resolving hostname for shadowsocks remote server in sslocal. This change will help simplify his implementation in shadowsocks-rust.

The UDP DNS resolver should be kept for sslocal to resolve remote servers' domain names

Can we also use UDS to do the DNS resolving of shadowsocks server's hostname?

zonyitoo · 2021-01-04T06:49:39Z

Can we also use UDS to do the DNS resolving of shadowsocks server's hostname?

It was done in the past. But it will require a RPC call everytime when I want to connect to a remote server.

This was done by a DNS library (trust-dns), which implements lots of things that a DNS resolver should do, for example, caching with TTL, multi nameservers support, recursive resolving, ...

madeye · 2021-01-04T06:57:46Z

It was done in the past. But it will require a RPC call everytime when I want to connect to a remote server.

RPC calls are almost free for us. If I understand correctly, Android system should already cache the DNS queries, the real cost is just a local socket read/write.

I think we can revert back to the previous implementation, given @Mygod raised some security concerns here.

zonyitoo · 2021-01-04T07:13:55Z

Does getaddrinfo works in Android? If it works, then

since Android have already resolved servers' domain to IPs before starting sslocal, actually nothing could be done for sslocal's resolver.
sslocal uses getaddrinfo by default, which is also the default of tokio.

madeye · 2021-01-04T08:01:38Z

getaddrinfo works on Android.

But its queries will be sent to tun and intercepted by tun2socks then sent back to sslocal...

madeye · 2021-01-04T08:13:53Z

since Android have already resolved servers' domain to IPs before starting sslocal, actually nothing could be done for sslocal's resolver.

Yes, if we decide not to resolve server's hostname in sslocal, we can revert to the previous solution without any problem.

But its queries will be sent to tun and intercepted by tun2socks then sent back to sslocal...

Another possible trick is that we always bypass the ss-server's hostname to the local resolver. In that way we have something like this:

sslocal's getaddrinfo --(1)--> tun2socks --> sslocal's DNS relay --(2)--> ss-android's UDS based system resolver

1. resolve server's hostname
2. bypass to local resolver

zonyitoo · 2021-01-04T08:17:08Z

That would become similar to the redir.

Ok, I will add back support UDS of local-dns-addr.

- ref shadowsocks/shadowsocks-android#2650 - Server's builtin DNS will not use local-dns-addr

* Allow user to keep data when uninstalling (shadowsocks#2506) * Update README.md * Update dependencies * Add cargo clean task * Enable LTO * Speed up rebuild * Update issue templates with labels * Update dependencies * Fix output name second attempt * Update NDK * Ensure cargoBuild is ran before mergeJniLibFolders * Bump version * Refine release build process * Refine gradle files * Add RUST_BACKTRACE * Use rethrowAsSocketException * Suppress write errors to protect_path * Update shadowsocks-rust * Bump version * Improve accessibility * Rename cipher plain to none * Revert "Add RUST_BACKTRACE" This reverts commit fdff88e. ndk-stack should be used instead. * Use cp.cloudflare.com for connectivity test Credits: https://www.v2ex.com/t/656983#r_8748918 * Update dependencies * Remote DNS setting is enabled unconditionally * Show more information on conflicting plugins Because one of you feckers just cannot learn to be decent. * Add support for PTR queries * Prevent querying PTR on custom Network * Suppress network unspecified exceptions * Handle IOException while reading * Refine handling duplicate plugins * Use any address as default DNS * Suppress EACCES for ProtectWorker * Clean up unused code * Do not suppress IOException * Disable UDP relay if plugin is enabled and no fallback * Remove unnecessary isExperimental * Update dependencies * Fix unchecked cast * Do not use WorkManager in device storage * Remove unnecessary directBootAware overloading * Suppress BadConfigurationProvider * Disable RemoveWorkManagerInitializer lint for apps * Update to Android 11 beta 1 * Request QUERY_ALL_PACKAGES for mobile * Refine code style * Fix ambiguous coroutineContext * Downgrade coroutines * Update dependencies * Deprecate using Handler * Fix shadowsocks#2546 * Only match exported plugins * Update dependencies * Update dependencies * Migrate to ML kit for scanning QR code Fixes shadowsocks#2548. * Make scanner immersive * Lock orientation to prevent camera recreation * Fix missing Serializable declaration * Add missing serialVersionUID * Update dependencies * Partially migrate to ActivityResultContracts AlertDialogFragment will be migrated after the API goes stable. * Add ActionBar to oss activity * Add ActionBar to details activity * Refine Scanner * Bump version * Update dependencies * Suppress cancellation exceptions * Skip processing if EOS is reached * Refine PTR compat * Fix shadowsocks#2557 * Fix shadowsocks#2562 * Update Android gradle * Set VPN flag properly Refine shadowsocks#2562. * Drop support for Android Lollipop * Update dependencies * Remove UDP upstream DNS support. Fix shadowsocks#2564 shadowsocks#2518 * Update shadowsocks-rust * Update dependencies * Decouple main dependencies from plugin lib * Simplify code * Add missing type * Update dependencies * Deprecate old backup mechanism for Android 5- * Update leanback theme to appcompat * Use singleTask launchMode * Fix build * Bump version * Update dependencies * Update dependencies * Bump plugin lib version to 2.0.0 * Add isV2 to PluginManager.InitResult * Pass a value with the VPN option, if plugin version < 2.0 * Switch to __android_vpn * Remove unnecessary parentheses * Update shadowsocks-rust * Bump version * Clean up and bump version * Revert camera-view back to alpha17 * Bump version * Update dependencies * Migrate away from deprecated APIs with core 1.3.0-alpha05 * Clean up code * Refine code style * Remove old ciphers. Fix shadowsocks#2621 * Enable single-threaded * Update shadowsocks-rust to 1.8.23 * Use Parcelize for TrafficStats * Fix platform insets on API 29- * Fix shadowsocks#2623 * Update barcode-scanning * Fix shadowsocks#2571 * Refine error message * Refine shadowsocks#2571 * Limit open sockets to 256 in UDP association. Fix shadowsocks#2625 * Bump version * Fix little problem of profile switching * Update shadowsocks-rust to 1.9.0 (shadowsocks#2622) * Fix shadowsocks#2638 * Bump version * Switch to local UDP DNS resolver (shadowsocks#2635) * Switch to the local UDP DNS resolver * Update shadowsocks-rust * Revert the rustup commands * Fix shadowsocks#2642 * Fix the ByteBuffer allocation * Update shadowsocks-rust * Revert to local UDS resolver Fix shadowsocks#2650 * Check deprecated ciphers (shadowsocks#2651) * Bump version * Fix shadowsocks#2301 * Bump version * Remove the non-ietf chacha20 and salsa20 ciphers * Fix shadowsocks#2665 * Update dependencies * Fix deprecation of kotlin extensions * Remove unused gcm work library for API 23+ * Use work-multiprocess * Refine code style * Update dependencies (shadowsocks#2672) * Update dependencies * Refine code style * Bump gradle to 6.8.2 * Drop packet if out of buffer * Refine error message * Enlarge the buffer size of a UDP connection * Bump version * Ignore all exceptions whilst updating subscriptions * Refine the JSON config file for ss-rust 1.10 * Refine the code style * Update shadowsocks-rust to v1.10.3 * Fix shadowsocks#2679 * Update dependencies Fixes shadowsocks#2699. * Fix deprecation of adapterPosition * Bump plugin to 2.0.1 * Migrate AlertDialogFragment to fragment result API * Remove useless dependency update * Migrate the rest to fragment result API * Remove unused field * Prevent crashing on shitty ROMs * Add search tool for profiles (shadowsocks#2682) * Suppress logging unsupported query type errors * Ignore if connection was prematurely closed * Use default udp_timeout=300 instead Refine shadowsocks#2625. * Mark underlyingNetwork as volatile Attempts at addressing shadowsocks#2667. * Fixed required targetFragments for preference * Downgrade gradle plugin * Update shadowsocks-rust and add back some ciphers Fix shadowsocks#2705 and shadowsocks#2663. * Update dependencies * Check plugin properly Fix shadowsocks#2667. * Check crypto before init * Make code style more Kotlin * Update core and remove workaround * Refine search to respect locale * Double fixes touch target * Resolve server name dynamically always (shadowsocks#2731) Fixes shadowsocks#2722. * Bump version * Downgrade fragment to 1.3.2 Fixes shadowsocks#2733. * Make plugin library depend on minimum version instead * Enable Parallel GC * Set useLegacyPackaging * Update the maven publish plugin (shadowsocks#2734) 1. Remove the unnecessary custom URL 2. Replace jcenter with mavenCentral * Handle illegal profiles properly * Fix windows build failed shadowsocks#2666 shadowsocks#2711 * Allowed build under msys2 or cygwin * Update dependencies * Bring back semitransparent TV app via build variants (shadowsocks#2741) This creates two variants for tv, freedom containing the original design, and google containing one matching Google's nonsense guideline. The former should be published on GitHub and elsewhere. Revert "Revert "Revert "Revert "Revert "Make app fullscreen to match guidelines""""" This reverts commit 0c67ac6. * Fix typo * Show full proxied apps mode to compensate for missing title * Use MaterialAlertDialogBuilder * Add progress indicator to ServiceButton * Remove elevation from progress * Only show progress for connecting * Only show progress when connecting is taking too long * Bump version * Update dependencies * Update sdk to S * Use registerBestMatchingNetworkCallback * Use OsConstants.ENONET * Deal with new requirements * Use main thread for default network callback on API 26+ * Remove unused code * Fix duplicate authentication * Update dependencies * Bump version * More stupid Android 6 bugs * Update dependencies * Downgrade leanback-preference * Update to API 31 * Remove STORAGE permission on Android 10+ * Update dnsjava * Ensure that redirects are always followed Fixes shadowsocks#2786, shadowsocks#2791. * Update dependencies * Update to AGP 7.0.2 * Fix lint * Update dependencies * Fix shadowsocks#2803 * Remove extra file * v5.2.6 * Revert "Show full proxied apps mode to compensate for missing title" This reverts commit d21cf7b. Fixes shadowsocks#2806. * Add linkedin.com to gfwlist * Fix Codacy badge * Update dependencies * Update .gitignore ignore DS_Store * Just to satisfy the obsessive-compulsive disorder :-) * Update shadowsocks-rust Update rust dependency * add new ciphers feature, and reorder cipher name * Modify acl rules * Update config.yml try to fix up the rust build error * enable armv8, neon feathures for hardware acceleration. * Fix the missing springAnimator * Update shadowsocks-rust to v1.15.0-alpha.5 * Bump version * Update translations Fixes shadowsocks#2867. * Add German and Ukrainian translations * Misc fixes * Fix order * Use system resolver * Update dependencies * Declare POST_NOTIFICATIONS * Protect sensitive profile information when copied * Add support for monochrome icons (not recommended) * Declare supported languages * Require authentication for closing service * Support skipping animation in StatsBar * Downgrade AGP * Misc fixes * Turn on fun switch * Remove useless code * Bump version * Fix the compile error shadowsocks#2930 (shadowsocks#2935) Make checking python version code compatible with windows and *nix Redefine the python version detection code Co-authored-by: Mygod <[email protected]> Co-authored-by: Mygod <[email protected]> Co-authored-by: Max Lv <[email protected]> Co-authored-by: cyber386 <[email protected]> Co-authored-by: Goooler <[email protected]> Co-authored-by: SquallATF <[email protected]> Co-authored-by: dev4u <[email protected]>

Revert "Switch to local UDP DNS resolver (#2635)"

90af581

This reverts commit 700f4d2.

Mygod requested review from madeye and zonyitoo January 4, 2021 05:43

zonyitoo added a commit to shadowsocks/shadowsocks-rust that referenced this pull request Jan 4, 2021

Revert deprecation of UDS local DNS

d41404c

- ref shadowsocks/shadowsocks-android#2650 - Server's builtin DNS will not use local-dns-addr

madeye closed this in e51f177 Jan 5, 2021

Mygod deleted the revert-2635-local-udp-dns branch April 15, 2021 23:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Revert "Switch to local UDP DNS resolver" #2650

Revert "Switch to local UDP DNS resolver" #2650

Mygod commented Jan 4, 2021

zonyitoo commented Jan 4, 2021

madeye commented Jan 4, 2021 •

edited

Loading

zonyitoo commented Jan 4, 2021 •

edited

Loading

Mygod commented Jan 4, 2021

zonyitoo commented Jan 4, 2021

madeye commented Jan 4, 2021

madeye commented Jan 4, 2021

Mygod commented Jan 4, 2021

madeye commented Jan 4, 2021 •

edited

Loading

zonyitoo commented Jan 4, 2021 •

edited

Loading

madeye commented Jan 4, 2021 •

edited

Loading

zonyitoo commented Jan 4, 2021 •

edited

Loading

madeye commented Jan 4, 2021

madeye commented Jan 4, 2021 •

edited

Loading

zonyitoo commented Jan 4, 2021

Revert "Switch to local UDP DNS resolver" #2650

Revert "Switch to local UDP DNS resolver" #2650

Conversation

Mygod commented Jan 4, 2021

zonyitoo commented Jan 4, 2021

madeye commented Jan 4, 2021 • edited Loading

zonyitoo commented Jan 4, 2021 • edited Loading

Mygod commented Jan 4, 2021

zonyitoo commented Jan 4, 2021

madeye commented Jan 4, 2021

madeye commented Jan 4, 2021

Mygod commented Jan 4, 2021

madeye commented Jan 4, 2021 • edited Loading

zonyitoo commented Jan 4, 2021 • edited Loading

madeye commented Jan 4, 2021 • edited Loading

zonyitoo commented Jan 4, 2021 • edited Loading

madeye commented Jan 4, 2021

madeye commented Jan 4, 2021 • edited Loading

zonyitoo commented Jan 4, 2021

madeye commented Jan 4, 2021 •

edited

Loading

zonyitoo commented Jan 4, 2021 •

edited

Loading

madeye commented Jan 4, 2021 •

edited

Loading

zonyitoo commented Jan 4, 2021 •

edited

Loading

madeye commented Jan 4, 2021 •

edited

Loading

zonyitoo commented Jan 4, 2021 •

edited

Loading

madeye commented Jan 4, 2021 •

edited

Loading