Adding dns with non-standard port causes the app to close and to never come back

[menkaur]

I'm running my own dns server, and I'm exposing it to yggdrasil on port 55 (tested, working correctly).
I decided to try and use it in the app
I entered my pc's address followed by ::55. After this, I have connected to yggdrasil network. The outcome is that the app stops to function and the only way to revive it is to wipe the data. I'm assuming this is because I'm using non-standard port, but I'm not sure

App version: 0.5.4.1

[vloddos]

TLDR

THERE ARE NO CUSTOM DNS SERVER PORT SUPPORT!

The application crashes forever because adding a server with a port causes a parsing error that is not currently handled.

The fix was proposed here #83.

Why do not implement full support for DNS on custom ports

Support for DNS servers on custom ports via VpnService.Builder.addDnsServer() is not directly possible, since this API is designed to work with the standard DNS port (53). The Android system will try to send DNS requests to the specified IP addresses, but always to port 53 (UDP and TCP).

To implement support for DNS servers on custom ports, you will need to intercept DNS traffic inside the VPN tunnel yourself and redirect it to the specified custom port.

Implementing full support for DNS on custom ports with interception and redirection of traffic is a non-trivial task.

Implementing full support for DNS on custom ports

This is a lot more complex than just passing the address to addDnsServer(). Here's a general concept of how it could be done:

1. Don't use builder.addDnsServer() for servers with custom ports:

• If you want to use the system resolver for standard DNS (port 53), you can continue to use addDnsServer() for them.
• For DNS servers with custom ports, you won't advertise them via addDnsServer().

2. Set up DNS traffic routing to the VPN interface:

• You'll need to route all DNS traffic (or traffic to the IP addresses of your "custom" DNS servers) through the VPN tunnel. This can be done with builder.addRoute().
• Often, the system DNS resolver may try to use DNS servers learned from the underlying network. If you want full control over DNS, you might need to route the standard DNS ports (53) to some dummy address inside the tunnel, and then intercept those packets.

3. Intercept DNS packets in your VPN code (reader() and writer() methods):

• In your reader() method, when you receive IP packets from FileInputStream (from applications), you will need to:
  • Parse the IP packet.
  • If it is a UDP packet (DNS is mostly UDP, but can be TCP) and it is directed to port 53 (or the IP address you defined as your "internal" address for DNS interception), then it is a DNS query.
  • Extract the DNS query data from it.

4. Modify and redirect DNS queries:

• When you intercept a DNS query:
  • Do not modify the source IP (it belongs to the application that made the query).
  • Change the destination IP and port to the IP and custom port of your DNS server.
  • Send this modified packet via yggdrasil.sendBuffer() (or equivalent if the packet should not go through Yggdrasil but directly to the Internet, but in the context of Yggdrasil, probably through it).

5. Handle DNS responses:

• When a response comes from your custom DNS server (you will get it via yggdrasil.recvBuffer()):
  • You will need to identify that this is a DNS response to one of your redirected queries (e.g. by the DNS transaction ID and the source/port address of the response).
  • Modify the source IP and port of the response packet to make it look like the response came from a standard DNS server (e.g. the IP and port where the application originally sent the request).
  • Change the destination IP to the application's original IP.
  • Write this modified packet to a FileOutputStream (in the VPN interface).

Complications and Considerations:

• Packet Parsing: You will need a reliable way to parse IP, UDP/TCP, and DNS headers. You can use existing libraries or implement this manually (which is quite labor-intensive and error-prone).
• Request/Response Mapping (NAT/PAT): To keep track of which response belongs to which request, you will need to implement some kind of NAT (Network Address Translation) or PAT (Port Address Translation) for DNS queries. This is usually done with a state table.
• TCP DNS: While DNS most often uses UDP, it can also operate over TCP for large responses or zone transfers. Your implementation should take this into account if full support is required.
• Performance: Handling every DNS packet in user space can impact performance.
• Configuration: You will need to develop a way for the user to specify DNS servers along with their custom ports in your application settings.
• Yggdrasil: If the DNS server is inside the Yggdrasil network, then communication will occur via yggdrasil.sendBuffer() and yggdrasil.recvBuffer(). If the DNS server is on the "external" internet, then the VPN will need to be able to access that external server.

[HodlOnToYourButts]

Claude helped me build a prototype Alfis android app and modified Yggdrasil to use it for DNS queries:
Alfis-android
Yggdrasil-android