dns leak with socks5->relay
Author: ezbikCreated Jun 26, 2026Updated Jun 30, 2026
Setup:
Socks5 server
gost -L 'socks5://:5999?udp=true&resolver=1.1.1.1' -F relay://127.0.0.1:1111Relay server
gost -L 'relay://:1111?bind=true&resolver=1.1.1.1'
Test:
connect to UDP://dns.google:53 through the socks5://127.0.0.1:5999
Issues:
- DNS leaks in the Socks5 server.
Proof: run it with strace -ff .. 2>&1 | grep 127.0.0.53 -C20 and check the output
[pid 97354] <... getsockname resumed>{sa_family=AF_INET, sin_port=htons(54378), sin_addr=inet_addr("127.0.0.1")}, [112 => 16]) = 0
[pid 97350] <... clock_gettime resumed>{tv_sec=4017355, tv_nsec=3386835}) = 0
[pid 97354] getpeername(10, <unfinished ...>
[pid 97350] clock_gettime(CLOCK_MONOTONIC, <unfinished ...>
[pid 97354] <... getpeername resumed>{sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.53")}, [112 => 16]) = 0
[pid 97350] <... clock_gettime resumed>{tv_sec=4017355, tv_nsec=4001163}) = 0
[pid 97354] clock_gettime(CLOCK_MONOTONIC, <unfinished ...>
[pid 97350] nanosleep({tv_sec=0, tv_nsec=20000}, <unfinished ...>
[pid 97354] <... clock_gettime resumed>{tv_sec=4017355, tv_nsec=4541458}) = 0
[pid 97354] clock_gettime(CLOCK_MONOTONIC, <unfinished ...>
[pid 97350] <... nanosleep resumed>NULL) = 0
[pid 97354] <... clock_gettime resumed>{tv_sec=4017355, tv_nsec=4999061}) = 0
[pid 97350] clock_gettime(CLOCK_MONOTONIC, <unfinished ...>
[pid 97354] write(10, "\30\322\1 \0\1\0\0\0\0\0\1\3dns\6google\0\0\1\0\1\0\0)\4"..., 39 <unfinished ...>So Socks5 server sends dns.google to the system resolver despite resolver=1.1.1.1 in CLI config.
- Hostname of the UDP request is not passed to the relay chain.
When doing TCP requests, their hostnames are passed to the relay:// server. But UDP requests aren't.
Source: go-gost/gost