README
¶
🩸 Ladon
Реактивный Anti-DPI движок
Ladon реактивно наблюдает DNS-трафик клиентов шлюза, четырёхстадийной пробой (DNS → TCP:443 → TLS handshake → HTTP read до 32KB) идентифицирует реальные DPI-блокировки и собирает IP в kernel ipset для tunnel-routing. За доли секунды.
Установка
curl -fsSL https://github.com/belotserkovtsev/ladon/releases/latest/download/install.sh \
| sudo bash
Скрипт ставит бинарь, конфиги, ipset'ы и dnsmasq drop-in — нужен Debian/Ubuntu. Полный runbook + manual install + troubleshooting — в docs/install.md.
Как работает
Классификация по сигнатуре отказа в живой сети, а не по готовому списку.
- Реактивная подписка — probe только на домены, которые клиенты сами запросили через DNS.
- Четырёхстадийный probe — DNS → TCP:443 → TLS handshake → HTTP read до 32KB.
- 20+ типизированных failure-кодов —
tls_alert,tls_garbage,tls_reset,tls13_block,mtls_required,tcp_refused,http_cutoff,http_451, ... - Server-active vs path-active — TLS alert / RST /
connection refusedотделены от timeout / cutoff / garbage. - 24h temporal accumulation — порог blocked-вердиктов в окне для постоянного списка.
- Семья как единица — при ≥N подтверждённых поддоменов eTLD+1 семья тянется в туннель целиком: её IP разворачиваются скопом, новые поддомены (
covered) больше не пробятся. - Опциональный exit-compare — второй observer из другой геолокации.
Полная методология — в docs/methodology.md.
Документация
| docs/install.md | install (auto + manual), troubleshooting |
| docs/configuration.md | YAML, CLI, manual lists, exit-compare, prune |
| docs/methodology.md | как Ladon работает |
| docs/extensions.md | bundled allow/deny-пресеты + формат своих списков |
| docs/probe-api.md | HTTP-контракт probe-сервера для exit-compare |
| probe-server/ladon/ | референсная Go-имплементация probe-сервера |
Благодарности
Лицензия
MIT — см. LICENSE.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
ladon
command
ladon CLI.
|
ladon CLI. |
|
internal
|
|
|
config
Package config loads ladon's YAML config file and hands back an engine.Config plus a probe backend chosen by the file.
|
Package config loads ladon's YAML config file and hands back an engine.Config plus a probe backend chosen by the file. |
|
decision
Package decision classifies probe outcomes into a censorship verdict.
|
Package decision classifies probe outcomes into a censorship verdict. |
|
dnsmasq
Package dnsmasq parses dnsmasq log lines emitted with log-queries=extra.
|
Package dnsmasq parses dnsmasq log lines emitted with log-queries=extra. |
|
dnsmasqcfg
Package dnsmasqcfg writes a dnsmasq.d snippet that delegates manual-allow and extension domains to dnsmasq's native ipset= directive.
|
Package dnsmasqcfg writes a dnsmasq.d snippet that delegates manual-allow and extension domains to dnsmasq's native ipset= directive. |
|
doctor
Package doctor implements `ladon doctor`: a one-shot health check that walks ladon's own pipeline (engine → input → decision → accumulation → ipset output) and reports, in plain language, the first place the chain breaks.
|
Package doctor implements `ladon doctor`: a one-shot health check that walks ladon's own pipeline (engine → input → decision → accumulation → ipset output) and reports, in plain language, the first place the chain breaks. |
|
engine
Package engine wires all pipeline stages (tail → ingest → probe → decide) into a single long-running process.
|
Package engine wires all pipeline stages (tail → ingest → probe → decide) into a single long-running process. |
|
etld
Package etld computes the effective-TLD-plus-one (registrable root) for a domain, using the public suffix list.
|
Package etld computes the effective-TLD-plus-one (registrable root) for a domain, using the public suffix list. |
|
ipset
Package ipset wraps the `ipset` CLI for atomic set mutations.
|
Package ipset wraps the `ipset` CLI for atomic set mutations. |
|
manual
Package manual loads allow/deny lists from plain text files.
|
Package manual loads allow/deny lists from plain text files. |
|
migrate
Package migrate is a tiny, dependency-free schema-migration runner for the SQLite database ladon owns.
|
Package migrate is a tiny, dependency-free schema-migration runner for the SQLite database ladon owns. |
|
obs
Package obs centralizes ladon's structured logging.
|
Package obs centralizes ladon's structured logging. |
|
prober
Package prober runs staged network probes (DNS / TCP:443 / TLS-SNI / HTTP) against a domain.
|
Package prober runs staged network probes (DNS / TCP:443 / TLS-SNI / HTTP) against a domain. |
|
scorer
Package scorer promotes hot domains into cache once enough blocked verdicts accumulate.
|
Package scorer promotes hot domains into cache once enough blocked verdicts accumulate. |
|
storage
Package storage is the SQLite access layer for ladon.
|
Package storage is the SQLite access layer for ladon. |
|
tail
Package tail follows a log file like `tail -F`, surviving truncation (in place / logrotate copytruncate), rotation (inode change), and brief disappearance.
|
Package tail follows a log file like `tail -F`, surviving truncation (in place / logrotate copytruncate), rotation (inode change), and brief disappearance. |
|
ui
Package ui renders ladon's human-facing command output in a consistent terminal style: the LADON wordmark, a verdict badge, section headers and aligned status rows.
|
Package ui renders ladon's human-facing command output in a consistent terminal style: the LADON wordmark, a verdict badge, section headers and aligned status rows. |
|
watcher
Package watcher ingests DNS query events and persists them as observations.
|
Package watcher ingests DNS query events and persists them as observations. |
|
probe-server
|
|
|
ladon
command
Package main is the reference probe-server that ladon's RemoteProber speaks.
|
Package main is the reference probe-server that ladon's RemoteProber speaks. |
Click to show internal directories.
Click to hide internal directories.