求助这样的情况算是有泄露吗？[网关导致的泄露检测异常案例] #59

upbeat-backbone-bose · 2023-10-25T12:04:36Z

upbeat-backbone-bose
Oct 25, 2023

最初列表是没有中国ip的，参数也没调整，近期发现有cn ip了

Answered by kkkgo

Oct 26, 2023

你应该是配置v2的《排除CN》功能泄漏了，这个你检查v2的配置。或者可以考虑使用PaoPaoGateway。

View full answer

kkkgo · 2023-10-26T05:39:51Z

kkkgo
Oct 26, 2023
Maintainer

重启容器等待10分钟，数据检查更新后，再尝试测试一下。
确保mark_data功能已开启，谢谢反馈。

4 replies

upbeat-backbone-bose Oct 26, 2023
Author

重启容器，开启mark_data情况依旧。
启动命令为：
docker run -d --name paopaodns -v /root/paopao-dns-data:/data -e CNAUTO=yes -e UPDATE=weekly -e USE_MARK_DATA=yes -e ADDINFO=yes --restart always -p 5353:53/tcp -p 5353:53/udp dockerproxy.com/sliamb/paopaodns:latest

kkkgo Oct 26, 2023
Maintainer

是重启容器，不是再开一个，用docker start和stop。重启容器能正常查询DNS后等待10分钟数据检查更新后再测试。确保容器日志有出现global_mark.dat Update OK.

upbeat-backbone-bose Oct 26, 2023
Author

确认情况依旧，已经补贴了日志。

upbeat-backbone-bose Oct 26, 2023
Author

使用了有2个月了应该，最初是完全不漏得，最近发现突然漏了，自己排查了很久没找到原因，删除了所有images,volume重新部署还是一样，所以过来反馈求助取取经。

upbeat-backbone-bose · 2023-10-26T06:32:30Z

upbeat-backbone-bose
Oct 26, 2023
Author

Debug.sh执行诊断日志如下。 @kkkgo

`/data # debug.sh
=====PaoPaoDNS docker debug=====
[info] images build time : 2023-10-05 16:09:23 UTC
[info] ========== env info ==========
====ENV TEST====
MEM:220m 450m 500000 750mb
prefPC:68
CORES:-2-
POWCORES:-2-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux e2f3ca60e1ef 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 Linux-
====ENV TEST====
[info] ========== process info ==========
PID USER TIME COMMAND
1 root 0:00 {init.sh} /bin/sh /usr/sbin/init.sh
21 root 0:00 crond
124 root 0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
127 root 0:00 mosdns start -d /tmp -c mosdns.yaml
139 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
140 root 0:00 {data_update.sh} /bin/sh /usr/sbin/data_update.sh
145 root 0:00 sleep 230
152 root 0:00 redis-server unixsocket:/tmp/redis.sock
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
180 root 0:00 inotifywait -e modify,delete /etc/unbound/named.cache /data/Country-only-cn-private.mmdb /data/force_cn_list.txt /data/force_nocn_list.txt /data/global_mark.dat /data/trackerslist.txt
185 root 0:00 sh
191 root 0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
196 root 0:00 ps -ef
[info] ========== cn list info ==========
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
[info] ========== reids info ==========
used_memory_human:1.11M
used_memory_rss_human:7.07M
used_memory_peak_human:1.11M
total_system_memory_human:3.82G
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:750.00M
(integer) 874
[test] IP test, you will see that all the following IPs are your public network exit IP !
[test] ========== IP TEST START ==========
CN IP URL:
117.*
117.*

Non-CN IP URL:
117.*
117.*
117.*
117.*
117.*

IP INFO:
117.*
CN,Zhejiang
ASN56041/China Mobile
HTTP/1.1
curl/8.3.0
Asia/Shanghai Time: 10/26/2023, 2:28:46 PM

----mosdns whoami aka dig:
"ns" "117.."

----local-unbound whoami aka dig:
"ns" "117.."

----mosdns whoami 03k dig:
117..

----local-unbound whoami 03k dig:
117..
[test] ========== IP TEST END ==========

[test] The DNS hijacking test, you will see timed out message !
[test] ========== DNS HIJACK START ==========
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; no servers could be reached

[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
112.48.141.202
112.48.141.203

----local-unbound CN dig:
www.taobao.com.danuoyi.tbcache.com.
112.48.141.203
112.48.141.202
[test] ========== CN DOMAIN TEST END ==========
[test] Non-CN domain test, you will see that the DNS resolution result is correct IP !
[test] ========== Non-CN DOMAIN TEST START ==========
----mosdns Non-CN dig:
youtube-ui.l.google.com.
64.233.176.91
64.233.177.91

----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
216.58.203.78
142.251.220.14

----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
142.250.67.14
172.217.167.110

----dnscrypt-socks5 Non-CN dig:
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
[test] ========== Non-CN DOMAIN TEST END ==========
[test] IPv6 Dual CN test: you will see that IPv6 is OK !
[test] ========== IPV6 CN DOMAIN TEST START ==========
[test] ========== IPV6 CN DOMAIN TEST END ==========
[test] IPv6 Dual Non-CN test: you will see that IPv6 is empty !
[test] ========== IPV6 Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 Non-CN DOMAIN TEST END ==========
[test] IPv6 only Non-CN test: you will see that IPv6 is ok !
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST END ==========

[info] ALL TEST FINISH.
`

2 replies

kkkgo Oct 26, 2023
Maintainer

你这是刚重启容器还没到10分钟吧。进程有sleep 230。

upbeat-backbone-bose Oct 26, 2023
Author

30分钟后我再重新跑一次debug，贴上来。

upbeat-backbone-bose · 2023-10-26T07:18:53Z

upbeat-backbone-bose
Oct 26, 2023
Author

容器运行信息：

Debug.sh执行日志信息：

`/data # debug.sh
=====PaoPaoDNS docker debug=====
[info] images build time : 2023-10-05 16:09:23 UTC
[info] ========== env info ==========
====ENV TEST====
MEM:220m 450m 500000 750mb
prefPC:68
CORES:-2-
POWCORES:-2-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux e2f3ca60e1ef 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 Linux-
====ENV TEST====
[info] ========== process info ==========
PID USER TIME COMMAND
1 root 0:00 {init.sh} /bin/sh /usr/sbin/init.sh
21 root 0:00 crond
124 root 0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
139 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
152 root 0:03 redis-server unixsocket:/tmp/redis.sock
395 root 0:00 unbound -c /tmp/unbound_raw.conf
397 root 0:00 unbound -c /tmp/unbound_forward.conf
771 root 0:01 mosdns start -d /tmp -c mosdns.yaml
807 root 0:00 inotifywait -e modify,delete /etc/unbound/named.cache /data/Country-only-cn-private.mmdb /data/force_cn_list.txt /data/force_nocn_list.txt /data/global_mark.dat /data/trackerslist.txt
814 root 0:00 sh
822 root 0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
827 root 0:00 ps -ef
[info] ========== cn list info ==========
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
[info] ========== reids info ==========
used_memory_human:1.17M
used_memory_rss_human:7.12M
used_memory_peak_human:1.19M
total_system_memory_human:3.82G
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:750.00M
(integer) 881
[test] IP test, you will see that all the following IPs are your public network exit IP !
[test] ========== IP TEST START ==========
CN IP URL:
117.....*
117.....*

Non-CN IP URL:
58.84.52.74
117.....*
117.....*
117.....*
117.....*

IP INFO:
117.....*
CN,Zhejiang
ASN56041/China Mobile
HTTP/1.1
curl/8.4.0
Asia/Shanghai Time: 10/26/2023, 3:16:59 PM

----mosdns whoami aka dig:
"ns" "117.....*"

----local-unbound whoami aka dig:
"ns" "117.....*"

----mosdns whoami 03k dig:
117.....*

----local-unbound whoami 03k dig:
117.....*
[test] ========== IP TEST END ==========

[test] The DNS hijacking test, you will see timed out message !
[test] ========== DNS HIJACK START ==========
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; no servers could be reached

[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
111.1.164.217
111.1.164.218

----local-unbound CN dig:
www.taobao.com.danuoyi.tbcache.com.
111.1.164.217
111.1.164.218
[test] ========== CN DOMAIN TEST END ==========
[test] Non-CN domain test, you will see that the DNS resolution result is correct IP !
[test] ========== Non-CN DOMAIN TEST START ==========
----mosdns Non-CN dig:
youtube-ui.l.google.com.
142.250.199.78
142.250.204.46

----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
172.217.12.142
142.250.72.238

----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
142.250.189.14
142.250.217.142

----dnscrypt-socks5 Non-CN dig:
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
[test] ========== Non-CN DOMAIN TEST END ==========
[test] IPv6 Dual CN test: you will see that IPv6 is OK !
[test] ========== IPV6 CN DOMAIN TEST START ==========
[test] ========== IPV6 CN DOMAIN TEST END ==========
[test] IPv6 Dual Non-CN test: you will see that IPv6 is empty !
[test] ========== IPV6 Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 Non-CN DOMAIN TEST END ==========
[test] IPv6 only Non-CN test: you will see that IPv6 is ok !
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST END ==========

[info] ALL TEST FINISH.
`

0 replies

upbeat-backbone-bose · 2023-10-26T07:20:20Z

upbeat-backbone-bose
Oct 26, 2023
Author

挂载卷文件信息，未作任何变更配置

1 reply

kkkgo Oct 26, 2023
Maintainer

看你容器启动日志。docker logs

upbeat-backbone-bose · 2023-10-26T08:32:12Z

upbeat-backbone-bose
Oct 26, 2023
Author

看你容器启动日志。docker logs

root@debian:~/paopao-dns-data# docker logs paopaodns
=====PaoPaoDNS docker start=====
images build time : 2023-10-05 16:09:23 UTC
New version install ! Try clean...
ulimit adbove 1000000.
total used free shared buff/cache available
Mem: 3915 501 2205 1 1210 3181
Swap: 980 0 980
total used free shared buff/cache available
Mem: 3.8G 500.8M 2.2G 588.0K 1.2G 3.1G
Swap: 980.0M 0 980.0M
MEMSIZE:3181
====ENV TEST====
MEM:220m 450m 500000 750mb
prefPC:68
CORES:-2-
POWCORES:-2-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux e2f3ca60e1ef 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 Linux-
====ENV TEST====
Apply trackerslist...
load_mark_data
dat size pass.
1203940+0 records in
1203940+0 records out
1203940 bytes (1.1MB) copied, 7.828672 seconds, 150.2KB/s
1024+0 records in
1024+0 records out
1024 bytes (1.0KB) copied, 0.006858 seconds, 145.8KB/s
global_mark hash: OK.
/data
2023-10-26T14:27:30.427+0800 INFO working directory changed {"path": "/tmp"}
2023-10-26T14:27:30.430+0800 INFO main config loaded {"file": "mosdns.yaml"}
PID USER TIME COMMAND
1 root 0:00 {init.sh} /bin/sh /usr/sbin/init.sh
21 root 0:00 crond
124 root 0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
126 root 0:00 unbound -c /tmp/unbound_forward.conf -p
127 root 0:00 mosdns start -d /tmp -c mosdns.yaml
138 root 0:00 unbound -c /tmp/unbound_raw.conf -p
139 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
140 root 0:00 {data_update.sh} /bin/sh /usr/sbin/data_update.sh
145 root 0:00 sleep 230
150 root 0:00 ps
151 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
152:C 26 Oct 2023 14:27:30.483 # WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
152:C 26 Oct 2023 14:27:30.484 # systemd supervision requested or auto-detected, but Redis is compiled without libsystemd support!
Setting up watches.
Watches established.
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/main: Permission denied
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/community: could not connect to server (check repositories file)
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/main: could not connect to server (check repositories file)
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/community: could not connect to server (check repositories file)
2023-10-26 14:31:34 CST
/etc/unbound/named.cache diff sha256sum, update...
newsum:fa5ffa04c78f8d3fc170c978e9ff55d4
oldsum:a2e668cca45d931a1cacd8e42cff8a52
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 3313 100 3313 0 0 3132 0 0:00:01 0:00:01 --:--:-- 3134
/tmp/named.cache Download OK.
/etc/unbound/named.cache MODIFY
/etc/unbound/named.cache Update OK.
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
unbound reload...
killall: unbound: no process killed
395 root 0:00 unbound -c /tmp/unbound_raw.conf
397 root 0:00 unbound -c /tmp/unbound_forward.conf
Setting up watches.
Watches established.
used_memory_human:1.17M
2023-10-26 14:31:44 CST
/usr/sbin/Country-only-cn-private.mmdb.xz diff sha256sum, update...
newsum:c01d0a06f11aee3be0adb0f323155515d2c0aac3a92860563a9a7e8a2c7c4cfc
oldsum:c955bd2fe611321ca7b02e28ed72988f056233924b5d73180c0b54c40d9248c2
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 51572 100 51572 0 0 4909 0 0:00:10 0:00:10 --:--:-- 12587
/tmp/Country-only-cn-private.mmdb Download OK.
/usr/sbin/Country-only-cn-private.mmdb.xz Update OK.
/data/Country-only-cn-private.mmdb MODIFY
2023-10-26 14:35:26 CST
127 root 0:00 mosdns start -d /tmp -c mosdns.yaml
127 root 0:00 [mosdns]
killall: mosdns: no process killed
mosdns reload...
killall: mosdns: no process killed
508 root 0:00 mosdns start -d /tmp -c mosdns.yaml
Setting up watches.
Watches established.
Network error: https://raw.githubusercontent.com/kkkgo/all-tracker-list/main/trackerslist.txt.xz.sha256sum
2023-10-26 14:35:36 CST
/usr/sbin/trackerslist.txt.xz diff sha256sum, update...
newsum:8896ce0578419b1e56ddf8a52fb018712050dbc70fc491f480b980073134e448
oldsum:649d8ddd99c770303498c0e475c69d1be378181eef2134db9a5c9a0c446c909d
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:10 --:--:-- 0
curl: (28) SSL connection timeout
sha256sum: can't open '/tmp/trackerslist.txt.xz.download': No such file or directory
/tmp/trackerslist.txt.xz.download Download error.
rm: can't remove '/tmp/trackerslist.txt.xz.download': No such file or directory
Download failed. Attempting to change the download link...
https://cdn.jsdelivr.net/gh/kkkgo/all-tracker-list/trackerslist.txt.xz.sha256sum
2023-10-26 14:35:57 CST
/usr/sbin/trackerslist.txt.xz diff sha256sum, update...
newsum:8896ce0578419b1e56ddf8a52fb018712050dbc70fc491f480b980073134e448
oldsum:649d8ddd99c770303498c0e475c69d1be378181eef2134db9a5c9a0c446c909d
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2348 100 2348 0 0 956 0 0:00:02 0:00:02 --:--:-- 956
/tmp/trackerslist.txt.xz.download Download OK.
/usr/sbin/trackerslist.txt.xz Update OK.
/data/trackerslist.txt MODIFY
2023-10-26 14:36:07 CST
Setting up watches.
Watches established.
/data/global_mark.dat diff sha256sum, update...
newsum:9e14d89403fb21e906b06af4c43f383b3c6f215f4d41cf83d4cacbf6ce683e2f
oldsum:00b3fd44696d11154fbb69d51221b359f9eaa1f92f81da0a4fc87a2969cf6aa7
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:10 --:--:-- 0
curl: (28) SSL connection timeout
sha256sum: can't open '/tmp/global_mark.dat.download': No such file or directory
/tmp/global_mark.dat.download Download error.
rm: can't remove '/tmp/global_mark.dat.download': No such file or directory
2023-10-26 14:40:48 CST
/data/global_mark.dat diff sha256sum, update...
newsum:9e14d89403fb21e906b06af4c43f383b3c6f215f4d41cf83d4cacbf6ce683e2f
oldsum:00b3fd44696d11154fbb69d51221b359f9eaa1f92f81da0a4fc87a2969cf6aa7
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
53 1206k 53 642k 0 0 1053 0 0:19:33 0:10:24 0:09:09 49596
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR (err 1)
/tmp/global_mark.dat.download Download error.
Download failed. Attempting to change the download link...
https://cdn.jsdelivr.net/gh/kkkgo/PaoPao-Pref/global_mark.dat.sha256sum
2023-10-26 14:51:17 CST
/data/global_mark.dat diff sha256sum, update...
newsum:9e14d89403fb21e906b06af4c43f383b3c6f215f4d41cf83d4cacbf6ce683e2f
oldsum:00b3fd44696d11154fbb69d51221b359f9eaa1f92f81da0a4fc87a2969cf6aa7
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1206k 100 1206k 0 0 4822 0 0:04:16 0:04:16 --:--:-- 5437
/tmp/global_mark.dat.download Download OK.
/data/global_mark.dat MODIFY
/data/global_mark.dat Update OK.
load_mark_data
dat size pass.
1234488+0 records in
1234488+0 records out
1234488 bytes (1.2MB) copied, 8.842805 seconds, 136.3KB/s
1024+0 records in
1024+0 records out
1024 bytes (1.0KB) copied, 0.007270 seconds, 137.6KB/s
global_mark hash: OK.
/data
508 root 0:00 mosdns start -d /tmp -c mosdns.yaml
508 root 0:00 [mosdns]
killall: mosdns: no process killed
mosdns reload...
killall: mosdns: no process killed
771 root 0:00 mosdns start -d /tmp -c mosdns.yaml
Setting up watches.
Watches established.

14 replies

upbeat-backbone-bose Oct 26, 2023
Author

你电脑是用的PaoPaoDNS的IP做DNS吗，还是作为其他的DNS上游

paopao监听端口5353，作为adg的上游，adg关闭缓存，不启用备用，不启用edns，只为了看面板和拦截广告。

裸paopaodns直接监听53裸连也是一样的情况，最初部署的时候是完全没问题的

upbeat-backbone-bose Oct 26, 2023
Author

你电脑是用的PaoPaoDNS的IP做DNS吗，还是作为其他的DNS上游

paopao监听端口5353，作为adg的上游，adg关闭缓存，不启用备用，不启用edns，只为了看面板和拦截广告。

裸paopaodns直接监听53裸连也是一样的情况，最初部署的时候是完全没问题的

网关v2rayA，xray内核，tproxy，排除cn

upbeat-backbone-bose Oct 26, 2023
Author

又做了个实验，网关改为主路由默认网关，不走旁路网关v2rayA。
dns依然adghome，配置一致，paopaodns作为上游就不漏了。如果想配合旁路网关使用是还需要增加什么配置参数吗？目前控制变量法是查出这样一个情况。

kkkgo Oct 26, 2023
Maintainer

你应该是配置v2的《排除CN》功能泄漏了，这个你检查v2的配置。或者可以考虑使用PaoPaoGateway。

Answer selected by upbeat-backbone-bose

upbeat-backbone-bose Oct 26, 2023
Author

又做了个实验，网关改为主路由默认网关，不走旁路网关v2rayA。
dns依然adghome，配置一致，paopaodns作为上游就不漏了。如果想配合旁路网关使用是还需要增加什么配置参数吗？目前控制变量法是查出这样一个情况。

重新切换回旁路网关v2rayA，将“透明代理/系统代理实现方式”从tproxy，调整为redirect之后也不泄露了，看起来问题还是在网关上，影响了paopaodns的解析结果。我再翻阅资料研究一下两个实现方式的区别，盲猜是代理模式劫持了？这个现象也提供大佬知晓。

kkkgo Oct 26, 2023
Maintainer

解析结果其实可能没有影响，只是在PaoPaoDNS解析之前v2自己去查了一次DNS而已。

kkkgo Oct 26, 2023
Maintainer

也不存在劫持，DNS泄漏检测原理就是有DNS请求过去

upbeat-backbone-bose Oct 26, 2023
Author

解析结果其实可能没有影响，只是在PaoPaoDNS解析之前v2自己去查了一次DNS而已。

可以断定的是与旁路网关有关，非paopaodns的问题，关联因素是代理模式和网关分流规则。不同代理模式有些是首次有漏，后续n-1都不漏。

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

求助这样的情况算是有泄露吗？[网关导致的泄露检测异常案例] #59

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 5 comments 21 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

求助这样的情况算是有泄露吗？[网关导致的泄露检测异常案例] #59

upbeat-backbone-bose Oct 25, 2023

Replies: 5 comments · 21 replies

kkkgo Oct 26, 2023 Maintainer

upbeat-backbone-bose Oct 26, 2023 Author

kkkgo Oct 26, 2023 Maintainer

upbeat-backbone-bose Oct 26, 2023 Author

upbeat-backbone-bose Oct 26, 2023 Author

upbeat-backbone-bose Oct 26, 2023 Author

Non-CN IP URL: 117.* 117.* 117.* 117.* 117.*

IP INFO: 117.* CN,Zhejiang ASN56041/China Mobile HTTP/1.1 curl/8.3.0 Asia/Shanghai Time: 10/26/2023, 2:28:46 PM

----mosdns whoami aka dig: "ns" "117.."

----local-unbound whoami aka dig: "ns" "117.."

----mosdns whoami 03k dig: 117..

[test] ========== DNS HIJACK END ========== [test] CN domain test, you will see that the DNS resolution result is CN IP ! [test] ========== CN DOMAIN TEST START ========== ----mosdns CN dig: www.taobao.com.danuoyi.tbcache.com. 112.48.141.202 112.48.141.203

----dnscrypt-unbound NOCN dig: youtube-ui.l.google.com. 216.58.203.78 142.251.220.14

----dnscrypt Non-CN dig: youtube-ui.l.google.com. 142.250.67.14 172.217.167.110

kkkgo Oct 26, 2023 Maintainer

upbeat-backbone-bose Oct 26, 2023 Author

upbeat-backbone-bose Oct 26, 2023 Author

Non-CN IP URL: 58.84.52.74 117.....* 117.....* 117.....* 117.....*

IP INFO: 117.....* CN,Zhejiang ASN56041/China Mobile HTTP/1.1 curl/8.4.0 Asia/Shanghai Time: 10/26/2023, 3:16:59 PM

----mosdns whoami aka dig: "ns" "117.....*"

----local-unbound whoami aka dig: "ns" "117.....*"

----mosdns whoami 03k dig: 117.....*

[test] ========== DNS HIJACK END ========== [test] CN domain test, you will see that the DNS resolution result is CN IP ! [test] ========== CN DOMAIN TEST START ========== ----mosdns CN dig: www.taobao.com.danuoyi.tbcache.com. 111.1.164.217 111.1.164.218

----dnscrypt-unbound NOCN dig: youtube-ui.l.google.com. 172.217.12.142 142.250.72.238

----dnscrypt Non-CN dig: youtube-ui.l.google.com. 142.250.189.14 142.250.217.142

upbeat-backbone-bose Oct 26, 2023 Author

kkkgo Oct 26, 2023 Maintainer

upbeat-backbone-bose Oct 26, 2023 Author

upbeat-backbone-bose Oct 26, 2023 Author

upbeat-backbone-bose Oct 26, 2023 Author

upbeat-backbone-bose Oct 26, 2023 Author

kkkgo Oct 26, 2023 Maintainer

upbeat-backbone-bose Oct 26, 2023 Author

kkkgo Oct 26, 2023 Maintainer

kkkgo Oct 26, 2023 Maintainer

upbeat-backbone-bose Oct 26, 2023 Author

upbeat-backbone-bose
Oct 25, 2023

Replies: 5 comments 21 replies

kkkgo
Oct 26, 2023
Maintainer

upbeat-backbone-bose Oct 26, 2023
Author

kkkgo Oct 26, 2023
Maintainer

upbeat-backbone-bose Oct 26, 2023
Author

upbeat-backbone-bose Oct 26, 2023
Author

upbeat-backbone-bose
Oct 26, 2023
Author

Non-CN IP URL:
117.*
117.*
117.*
117.*
117.*

IP INFO:
117.*
CN,Zhejiang
ASN56041/China Mobile
HTTP/1.1
curl/8.3.0
Asia/Shanghai Time: 10/26/2023, 2:28:46 PM

----mosdns whoami aka dig:
"ns" "117.."

----local-unbound whoami aka dig:
"ns" "117.."

----mosdns whoami 03k dig:
117..

[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
112.48.141.202
112.48.141.203

----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
216.58.203.78
142.251.220.14

----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
142.250.67.14
172.217.167.110

kkkgo Oct 26, 2023
Maintainer

upbeat-backbone-bose Oct 26, 2023
Author

upbeat-backbone-bose
Oct 26, 2023
Author

Non-CN IP URL:
58.84.52.74
117.....*
117.....*
117.....*
117.....*

IP INFO:
117.....*
CN,Zhejiang
ASN56041/China Mobile
HTTP/1.1
curl/8.4.0
Asia/Shanghai Time: 10/26/2023, 3:16:59 PM

----mosdns whoami aka dig:
"ns" "117.....*"

----local-unbound whoami aka dig:
"ns" "117.....*"

----mosdns whoami 03k dig:
117.....*

[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
111.1.164.217
111.1.164.218

----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
172.217.12.142
142.250.72.238

----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
142.250.189.14
142.250.217.142

upbeat-backbone-bose
Oct 26, 2023
Author

kkkgo Oct 26, 2023
Maintainer

upbeat-backbone-bose
Oct 26, 2023
Author

upbeat-backbone-bose Oct 26, 2023
Author

upbeat-backbone-bose Oct 26, 2023
Author

upbeat-backbone-bose Oct 26, 2023
Author

kkkgo Oct 26, 2023
Maintainer

upbeat-backbone-bose Oct 26, 2023
Author

kkkgo Oct 26, 2023
Maintainer

kkkgo Oct 26, 2023
Maintainer

upbeat-backbone-bose Oct 26, 2023
Author