A method and system for protecting DNS data packets in mobile terminal Wireguard VPN connection

Abstract

The present invention proposes a method and system for protecting DNS packets in a mobile Wireguard VPN connection, including: in response to starting a VPN on a mobile platform, configuring a public DNS server IP address, adding the IP address to routing rules, and obtaining an int-type VPN_fd; using Wireguard-go to read the obtained VPN_fd and resolve the IP packet through an IP capture system; using the Tire algorithm to find the IP data corresponding to the domain name in the cache; if no cached data exists, constructing a UDP socket, sending an original DNS request to a secondary DNS server, and modifying the secondary DNS server's reply packet; if cached data exists, writing the constructed DNS return packet to the VPN_fd, updating the packet's status in a linked list, and inserting a node for the record into the Tire tree. The present invention does not require the establishment of a DNS service or the use of third-party DNS providers. It can flexibly resolve private domain names at any business level and can intercept DNS requests on the terminal side without going through any private DNS service, achieving domain name resolution and verification of the resolution results.

Description

Technical Field

[0001] The present invention belongs to the technical field, and in particular relates to a method and system for protecting DNS data packets in a mobile terminal Wireguard VPN connection. Background Art

[0002] In order to avoid directly exposing the IP address and Nginx site mapping scenarios, we need to use domain name access services. Usually, the following two solutions are used: building a DNS service by ourselves to resolve domain names that do not exist on the public network; choosing the services of a third-party DNS service provider.

[0003] However, setting up your own DNS service introduces two issues: competition between the primary and backup DNS services for resolution, and the resulting pressure on the DNS service, which can lead to DNS contamination or hijacking. To address this issue, the typical approach is to configure only your own DNS service on the terminal side, without configuring a backup public DNS service. However, this can result in significant traffic pressure on your own DNS service and the possibility of DNS hijacking and contamination.

[0004] Using a third-party DNS service

[0005] For businesses, there is still a limit on the number of custom domain names that can be set, which makes it difficult to achieve full flexibility and timeliness.

[0006] In view of this, it is very meaningful to propose a method and system for protecting DNS data packets in mobile Wireguard VPN connections. Summary of the Invention

[0007] In order to solve the existing DNS self-resolution demand scenarios for private domain names, solve the traffic pressure and security maintenance costs of building DNS services by oneself, and solve the problems of limited number and lack of flexibility of private domain names selected by third-party DNS service providers, the present invention provides a method and system for protecting DNS data packets in mobile terminal Wireguard VPN connections, aiming to intercept DNS requests on the terminal side without going through any private DNS service, realize domain name resolution and verification of resolution results, so as to solve the above-mentioned technical defects.

[0008] In a first aspect, the present invention provides a method for protecting DNS data packets in a mobile terminal Wireguard VPN connection, the method comprising the following steps:

[0009] In response to starting the VPN on the mobile platform, configuring the public DNS server IP, adding the IP to the routing rules, and obtaining the int type VPN_fd;

[0010] Use wireguard-go to read the obtained VPN_fd and parse the IP data packet through the IP capture system;

[0011] Use the Tire algorithm to find the IP data corresponding to the domain name in the cache. If there is no cached data, construct a UDP socket, send the original DNS request to the secondary DNS server, and modify the secondary DNS server's reply packet;

[0012] If there is cached data, the constructed DNS return data packet is written into the VPN_fd, and the status of the data packet in the linked list is updated, and a node of the record is inserted into the Tire tree.

[0013] Preferably, the method further includes: finally using the Tire algorithm to cache the result data into a linked list.

[0014] Further preferably, it also includes: in the RoutineReadFromTUN method of wireguard-go, when reading the request from tun, if it is determined that the request target IP is the configured public DNS server IP, the request is filtered out.

[0015] Further preferably, the VPN_fd is read using wireguard-go, and the IP data packet is parsed by an IP capture system, specifically including:

[0016] In the RoutineReadFromTUN method of wireguard-go, each IP data packet is obtained and byte analysis is performed on the IP data packet. Based on the fixed IP protocol header, the UDP data packet is analyzed and the parsed port is 53, which is determined to be a DNS request data packet. At the same time, a linked list is used to store each request data packet.

[0017] Further preferably, modifying the second DNS server reply packet specifically includes: parsing the answer area data in the DNS data structure according to the UDP protocol and the DNS protocol in the reply data packet, and modifying the answer to the service IP corresponding to the private domain name.

[0018] Further preferably, the method further includes: the mobile platform includes Android and iOS, and when starting VPN, Android uses VpnService technology and iOS uses NetworkExtension technology.

[0019] In a second aspect, an embodiment of the present invention further provides a system for protecting DNS data packets in a mobile terminal Wireguard VPN connection, the system comprising:

[0020] The startup module is configured to start the VPN on the mobile platform, configure the public DNS server IP, add the IP to the routing rules, and obtain the int type VPN_fd;

[0021] A reading module configured to read the obtained VPN_fd using wireguard-go and parse the IP data packet through an IP capture system;

[0022] The Tire algorithm module is configured to use the Tire algorithm to find the IP data corresponding to the domain name in the cache and cache the result data into a linked list;

[0023] The judgment module is configured to judge whether there is cache data and whether the request target IP is the configured public DNS server IP.

[0024] Preferably, it also includes:

[0025] The IP capture system module is configured to obtain each IP packet in the RoutineReadFromTUN method of wireguard-go, perform byte analysis on the IP packet, analyze the UDP packet based on the fixed IP protocol header, and parse the port 53 to determine it is a DNS request packet; at the same time, a linked list is used to store each request packet;

[0026] The modification module is configured to parse the answer zone data in the DNS data structure according to the UDP protocol and the DNS protocol in the reply data packet, and modify the answer to the service IP corresponding to the private domain name.

[0027] In a third aspect, an embodiment of the present invention provides an electronic device comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0028] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any implementation manner in the first aspect.

[0029] Compared with the prior art, the present invention has the following advantages:

[0030] The technical solution of the present invention does not require the establishment of a DNS service by itself, nor does it require the use of services from a third-party DNS provider. It can flexibly resolve private domain names at any business level, and can intercept DNS requests on the terminal side without going through any private DNS service to achieve domain name resolution and verification of resolution results. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and, together with the description, serve to explain the principles of the present invention. Other embodiments and many of the expected advantages of the embodiments will be readily apparent as they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with respect to each other. Like reference numerals designate corresponding similar parts.

[0032] Figure 1 is a diagram of an exemplary device architecture in which an embodiment of the present invention may be applied;

[0033] Figure 2 Schematic diagram of a method for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to an embodiment of the present invention;

[0034] Figure 3 A schematic diagram of a specific process of a method for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to an embodiment of the present invention;

[0035] Figure 4 A schematic diagram of constructing a Tire algorithm in a method for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to an embodiment of the present invention;

[0036] Figure 5 Schematic diagram of the architecture of a system for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to an embodiment of the present invention;

[0037] Figure 6 It is a schematic structural diagram of a computer device suitable for implementing an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In the following detailed description, reference is made to the accompanying drawings, which form a part of the detailed description and are illustrated by illustrative specific embodiments in which the present invention may be practiced. To this end, directional terms, such as "top," "bottom," "left," "right," "up," "down," etc., are used with reference to the orientation of the figures being described. Because the components of the embodiments may be positioned in several different orientations, directional terms are used for illustrative purposes and are in no way limiting. It should be understood that other embodiments may be utilized or logical changes may be made without departing from the scope of the present invention. Therefore, the following detailed description should not be adopted in a limiting sense, and the scope of the present invention is defined by the appended claims.

[0039] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0040] Figure 1 An exemplary system architecture 100 is shown to which a method for processing information or an apparatus for processing information according to an embodiment of the present invention can be applied.

[0041] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, 103, a network 104, and a server 105. Network 104 is a medium for providing communication links between terminal devices 101, 102, 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0042] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0043] The terminal devices 101 , 102 , and 103 may be various electronic devices with communication functions, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0044] The server 105 may be a server that provides various services, such as a background information processing server that processes verification request information sent by the terminal devices 101, 102, and 103. The background information processing server may analyze and perform other processing on the received verification request information and obtain a processing result (e.g., verification success information indicating that the verification request is a legitimate request).

[0045] It should be noted that the method for processing information provided in the embodiment of the present invention is generally executed by the server 105, and accordingly, the device for processing information is generally set in the server 105. In addition, the method for sending information provided in the embodiment of the present invention is generally executed by the terminal devices 101, 102, and 103, and accordingly, the device for sending information is generally set in the terminal devices 101, 102, and 103.

[0046] It should be noted that the server can be either hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When the server is software, it can be implemented as multiple software programs or software modules (for example, to provide distributed services), or as a single software program or multiple software modules, without specific limitation herein.

[0047] Figure 2 It is shown that an embodiment of the present invention discloses a method for protecting DNS data packets in a mobile terminal Wireguard VPN connection, such as Figure 2 As shown, the method includes the following steps:

[0048] S1. In response to starting the VPN on the mobile platform, configure the public DNS server IP, add the IP to the routing rules, and obtain the int type VPN_fd;

[0049] S2. Use wireguard-go to read the obtained VPN_fd and parse the IP data packet through the IP capture system;

[0050] S3. Use the Tire algorithm to find the IP data corresponding to the domain name in the cache. If there is no cached data, construct a UDPSocket, send the original DNS request to the second DNS server, and modify the second DNS server's reply packet.

[0051] S4. If there is cached data, the constructed DNS return data packet is written into the VPN_fd, and the status of the data packet in the linked list is updated, and a node of the record is inserted into the Tire tree.

[0052] Specific, combined Figure 3 The method steps of the present invention are described in detail:

[0053] 1. Start VPN (Android uses VpnService technology, iOS uses NetworkExtension technology), configure the public DNS server IP, such as 114.114.114.114, and add it to the routing rules to obtain the VPN fd of type int;

[0054] 2. In the RoutineReadFromTUN method of wireguard-go, obtain each IP packet, perform byte analysis on the IP packet, analyze the fixed IP protocol header, and derive the UDP packet. The parsed port is 53, which is determined to be a DNS request packet. At the same time, a linked list is used to store each request packet.

[0055] 3. Use the Tire algorithm to find the IP data corresponding to the domain name in the cache. If there is cached data, construct a DNS return data packet and jump directly to 5. If there is no cached data, continue to the next step;

[0056] 4. Construct a UDP Socket and send the original DNS request to another public DNS server (such as Baidu DNS: 180.76.76.76). In the reply data packet, the answer zone data in the DNS data structure is parsed according to the UDP protocol and the DNS protocol, and the answer is modified to the service IP corresponding to the private domain name.

[0057] 5. Write the modified DNS data packet back to the VPN fd, update the status of the data packet in the linked list, and insert the node of the record into the Tire tree;

[0058] 6. In the RoutineReadFromTUN method of wireguard-go, when reading the request from tun, if the request target IP is 114.114.114.114, the request is filtered out.

[0059] By using a linked list to efficiently store and update the status of each complete cycle of DNS packet sending and receiving, it is easy to record and track.

[0060] Furthermore, the Tire tree algorithm is used when caching the IP address corresponding to the domain name:

[0061] Trie tree is a tree-based data structure used to store strings. Its characteristic is that it decomposes the string into individual characters and stores them in the form of a tree. Each node represents a character, and the path from the root node to the leaf node represents a complete string. The insertion and search operations of the Trie tree are both character-based. The insertion operation inserts a string into the Trie tree, with each character corresponding to a node. The time complexity of the insertion operation is O(m), where m is the length of the string. The search operation searches for a string in the Trie tree, and its time complexity is also O(m). In DNS, Trie trees are often used to store domain names and corresponding IP addresses. When resolving domain names, the DNS server will input the domain name as a string into the Trie tree for search. If the corresponding leaf node is found, the corresponding IP address is returned; otherwise, an error message is returned that the domain name does not exist.

[0062] Using a Trie tree as the data structure for DNS resolution has the following advantages:

[0063] 1. Since the Trie tree stores all domain name and IP address information, domain name resolution operations can be performed quickly, greatly improving the response speed of DNS domain name resolution;

[0064] 2. Trie tree has good space utilization, because multiple domain names may share the same prefix, and space usage can be reduced by sharing nodes;

[0065] 3. The structure of the Trie tree is highly scalable and can support more domain name and IP address information.

[0066] Specifically, the use of the Tire tree algorithm is as follows:

[0067] Assuming there are 6 words b, adc, abd, bcd, abcd, efg, hii, the tree we build using the Tire algorithm is as follows Figure 4 :

[0068] like Figure 4 As shown in the figure, for each node, the process of traversing from the root to it is a word. If the node is marked in red, it means that the word exists, otherwise it does not exist.

[0069] So, for a word, we simply follow it from the root to the corresponding node and see if the node is marked red to determine whether it has appeared before. Marking the node red is equivalent to inserting the word. This allows us to perform query and insertion simultaneously.

[0070] The technical solution of the present invention does not require the establishment of a DNS service by itself, nor does it require the use of services from a third-party DNS provider. It can flexibly resolve private domain names at any business level, and can intercept DNS requests on the terminal side without going through any private DNS service to achieve domain name resolution and verification of resolution results.

[0071] In a second aspect, an embodiment of the present invention further discloses a system for protecting DNS data packets in a mobile terminal Wireguard VPN connection, such as Figure 5 As shown, the system includes: a starting module 51 , a reading module 52 , a Tire algorithm module 53 , a judgment module 54 , an IP capture system module 55 and a modification module 56 .

[0072] In a specific embodiment, the startup module 51 is configured to start the VPN on the mobile platform, configure the public DNS server IP, and add the IP to the routing rules to obtain the int type VPN_fd; the reading module 52 is configured to use wireguard-go to read the obtained VPN_fd and parse the IP data packet through the IP capture system; the Tire algorithm module 53 is configured to use the Tire algorithm to find the IP data corresponding to the domain name in the cache and cache the result data in a linked list; the judgment module 54 is configured to determine whether there is cached data and whether the requested target IP is the configured public DNS server IP.

[0073] The IP capture system module 55 is configured to obtain each IP data packet in the RoutineReadFromTUN method of wireguard-go, perform byte analysis on the IP data packet, analyze the UDP data packet based on the fixed IP protocol header, and parse the port 53 to determine it as a DNS request data packet; at the same time, a linked list is used to store each request data packet; the modification module 56 is configured to parse the answer area data in the DNS data structure according to the UDP protocol and the DNS protocol in the reply data packet, and modify its answer to the service IP corresponding to the private domain name.

[0074] Reference below Figure 6 , which shows an electronic device (eg Figure 1 A schematic structural diagram of a computer device 600 (a server or terminal device as shown). Figure 6 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0075] like Figure 6 As shown, the computer device 600 includes a central processing unit (CPU) 601 and a graphics processing unit (GPU) 602, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 603 or the program loaded from the storage part 609 to the random access memory (RAM) 606. Various programs and data required for the operation of the device 600 are also stored in the RAM 604. The CPU 601, GPU 602, ROM 603 and RAM 604 are connected to each other via a bus 605. An input / output (I / O) interface 606 is also connected to the bus 605.

[0076] The following components are connected to the I / O interface 606: an input section 607 including a keyboard, a mouse, and the like; an output section 608 including a display such as a liquid crystal display (LCD), a speaker, and the like; a storage section 609 including a hard disk and the like; and a communication section 610 including a network interface card such as a LAN card or a modem. The communication section 610 performs communication processing via a network such as the Internet. A drive 611 may also be connected to the I / O interface 606 as needed. A removable medium 612, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like, is installed in the drive 611 as needed, so that a computer program read therefrom can be installed into the storage section 609 as needed.

[0077] In particular, according to an embodiment disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment disclosed in the present invention includes a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication portion 610, and / or installed from a removable medium 612. When the computer program is executed by a central processing unit (CPU) 601 and a graphics processing unit (GPU) 602, the above-mentioned functions defined in the method of the present invention are performed.

[0078] It should be noted that the computer-readable medium described in the present invention may be a computer-readable signal medium or a computer-readable medium, or any combination thereof. Computer-readable media may be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices, apparatuses, or components, or any combination thereof. More specific examples of computer-readable media may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution device, apparatus, or component. In the present invention, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution apparatus, device, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical cable, RF, or any suitable combination thereof.

[0079] Computer program code for performing the operations of the present invention may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0080] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the devices, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based device that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0081] The modules involved in the embodiments of the present invention may be implemented in software or hardware, and may also be set in a processor.

[0082] As another aspect, the present invention further provides a computer-readable medium, which may be included in the electronic device described in the above embodiment, or may exist independently and not incorporated into the electronic device. The computer-readable medium carries one or more programs. When executed by the electronic device, the electronic device: in response to initiating a VPN on a mobile platform, configures a public DNS server IP address, adds the IP address to the routing rules, and obtains an int-type VPN_fd; uses wireguard-go to read the obtained VPN_fd and parses the IP packet through an IP capture system; uses the Tire algorithm to locate the IP address corresponding to the domain name in the cache; if no cached data exists, constructs a UDP socket, sends the original DNS request to a second DNS server, and modifies the second DNS server's reply packet; if cached data exists, writes the constructed DNS return packet to the VPN_fd, updates the status of the packet in the linked list, and inserts a node for the record into the Tire tree.

[0083] The above description is merely an illustration of the preferred embodiments of the present invention and the technical principles employed. Those skilled in the art should understand that the scope of the invention is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned inventive concept. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in the present invention.

Claims

1. A method for protecting DNS data packets in a mobile terminal Wireguard VPN connection, characterized in that The method comprises the following steps: In response to starting the VPN on the mobile platform, configuring the public DNS server IP, adding the IP to the routing rules, and obtaining the int type VPN_fd; Wireguard-go is used to read the obtained VPN_fd, and the IP data packet is parsed through the IP capture system. In the RoutineReadFromTUN method of wireguard-go, when reading the request from tun, if the request target IP is determined to be the configured public DNS server IP, the request is filtered out; Use the Tire algorithm to find the IP data corresponding to the domain name in the cache. If there is no cached data, construct a UDP socket, send the original DNS request to the secondary DNS server, and modify the secondary DNS server's reply packet; If there is cached data, the constructed DNS return data packet is written into the VPN_fd, the status of the data packet in the linked list is updated, and the node of the record is inserted into the Tire tree. Finally, the Tire algorithm is used to cache the result data into the linked list.

2. The method for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to claim 1, wherein Use wireguard-go to read the obtained VPN_fd and parse the IP data packet through the IP capture system, specifically including: In the RoutineReadFromTUN method of wireguard-go, each IP data packet is obtained and byte analysis is performed on the IP data packet. Based on the fixed IP protocol header, the UDP data packet is analyzed and the parsed port is 53, which is determined to be a DNS request data packet. At the same time, a linked list is used to store each request data packet.

3. The method for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to claim 2, wherein Modify the secondary DNS server reply packet to include: In the reply data packet, the answer zone data in the DNS data structure is parsed according to the UDP protocol and the DNS protocol, and the answer is modified to the service IP corresponding to the private domain name.

4. The method for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to claim 3, wherein Also includes: Mobile platforms include Android and iOS. When starting VPN, Android uses VpnService technology and iOS uses NetworkExtension technology.

5. A system for protecting DNS data packets in a mobile Wireguard VPN connection, characterized in that The system includes: The startup module is configured to start the VPN on the mobile platform, configure the public DNS server IP, add the IP to the routing rules, and obtain the VPN_fd of type int; A reading module configured to read the obtained VPN_fd using wireguard-go and parse the IP data packet through an IP capture system; The Tire algorithm module is configured to use the Tire algorithm to find the IP data corresponding to the domain name in the cache and cache the result data into a linked list; The judgment module is configured to determine whether there is cached data. If there is no cached data, a UDP Socket is constructed, the original DNS request is sent to the second DNS server, and the reply packet of the second DNS server is modified; if there is cached data, the constructed DNS return data packet is written into the VPN_fd, the status of the data packet in the linked list is updated, and the node of the record is inserted into the Tire tree; it is determined whether the request target IP is the configured public network DNS server IP. In the RoutineReadFromTUN method of wireguard-go, when reading the request from tun, if it is determined that the request target IP is the configured public network DNS server IP, the request is filtered out.

6. The system for protecting DNS data packets in a mobile terminal Wireguard VPN connection according to claim 5, characterized in that Also includes: The IP capture system module is configured to obtain each IP packet in the RoutineReadFromTUN method of wireguard-go, perform byte analysis on the IP packet, analyze the UDP packet based on the fixed IP protocol header, and parse the port 53 to determine it is a DNS request packet; at the same time, a linked list is used to store each request packet; The modification module is configured to parse the answer zone data in the DNS data structure according to the UDP protocol and the DNS protocol in the reply data packet, and modify the answer to the service IP corresponding to the private domain name.

7. An electronic device comprising: one or more processors; a storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images