Why does a sniffed SNI override an explicit IP?

[r3a1d3a1]

If sniffing is enabled on a Socks inbound, rather than using the SNI just for routing, it seems that the IP the packet is sent to is ignored, and a DNS resolution is used for the sniffed domain. I did not expect this. Is this desired or a bug?!

P.S. I'm not using FakeDNS.

[dyhkwong]

It is legacy code. There was a pull request #1271 for this but did not get merged.

[4-FLOSS-Free-Libre-Open-Source-Software]

Btw, do you know what's the TTL for FakeDNS responses? I can't find where it's set in the code.

600 seconds.

• Decrease FakeDNS TTL #3043

[dyhkwong]

It is not as easy as you think. Existing methods (LookupIPv4 and LookupIPv6) only return IPs (for all types of DNS, includes fake DNS), you need to add some new methods like LookupIPv4WithTTL and LookupIPv6WithTTL to return TTL and then modify the code of all DNS types without breaking current APIs.

What's worse, maintainers even refused to merge a fix for DNS TTL in #1179.

Yet another very dirty method is XTLS/Xray-core@a0f1e1f, but this is just too hacky.

I fixed this for myself a long time ago. I can make a pull request for this by adding new methods like LookupIPv4WithTTL and LookupIPv6WithTTL without breaking current ones, so that TTLs (except localhost DNS) are respected and fake DNS can return a TTL value of 1. However it will not be a minor change. And, at least maintainers need to accept simple fixes like #1179.

[r3a1d3a1]

The current 600 could be made a default for an input arg which FakeDNS overrides with a smaller value. Should be a minor change w/o much controversy -> easy to merge.

[dyhkwong]

The current 600 could be made a default for an input arg which FakeDNS overrides with a smaller value. Should be a minor change w/o much controversy -> easy to merge.

Unless you want dirty code like XTLS/Xray-core@a0f1e1f, this will not be a minor change. Have you ever read the source code?

[r3a1d3a1]

I get a nose bleed when I read Golang :)

[dyhkwong]

Always 600 for all dns. https://github.com/v2fly/v2ray-core/blob/master/app/dns/dnscommon.go#L196 2024年6月9日 23:47:17 r3a1d3a1 ***@***.***>:

…

Btw, do you know what's the TTL for FakeDNS responses? I can't find where it's set in the code[https://github.com/v2fly/v2ray-core/blob/master/app/dns/fakedns/fake.go]. — Reply to this email directly, view it on GitHub[#2994 (reply in thread)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AMCYAJXBK2VZ4GSU7TYBLU3ZGR2ILAVCNFSM6AAAAABHF4PEPSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TOMJZG44TS]. You are receiving this because you commented.

[r3a1d3a1]

Wow! That's 10 minutes! Why doesn't it use something like 5 seconds instead for FakeDNS to minimize poisoning after disconnecting? It'd only slightly increase CPU usage.

[dyhkwong]

#1528 need to add new mothods 2024年6月9日 23:47:17 r3a1d3a1 ***@***.***>:

…

Btw, do you know what's the TTL for FakeDNS responses? I can't find where it's set in the code[https://github.com/v2fly/v2ray-core/blob/master/app/dns/fakedns/fake.go]. — Reply to this email directly, view it on GitHub[#2994 (reply in thread)], or unsubscribe[https://github.com/notifications/unsubscribe-auth/AMCYAJXBK2VZ4GSU7TYBLU3ZGR2ILAVCNFSM6AAAAABHF4PEPSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TOMJZG44TS]. You are receiving this because you commented.

[r3a1d3a1]

Thanks man. I guess I'll create an issue for it since I don't see FakeDNS in particular addressed in that thread.