ladon

module

v1.3.1 Latest Latest Go to latest Published: May 14, 2026 License: MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/belotserkovtsev/ladon

Links

Open Source Insights

README ¶

🩸 Ladon

Реактивный Anti-DPI движок

Ladon реактивно наблюдает DNS-трафик клиентов шлюза, четырёхстадийной пробой (DNS → TCP:443 → TLS handshake → HTTP read до 32KB) идентифицирует реальные DPI-блокировки и собирает IP в kernel ipset для tunnel-routing. За доли секунды.

Установка

curl -fsSL https://github.com/belotserkovtsev/ladon/releases/latest/download/install.sh \
  | sudo bash

Скрипт ставит бинарь, конфиги, ipset'ы и dnsmasq drop-in — нужен Debian/Ubuntu. Полный runbook + manual install + troubleshooting — в docs/install.md.

Как работает

Классификация по сигнатуре отказа в живой сети, а не по готовому списку.

Реактивная подписка — probe только на домены, которые клиенты сами запросили через DNS.
Четырёхстадийный probe — DNS → TCP:443 → TLS handshake → HTTP read до 32KB.
20+ типизированных failure-кодов — tls_alert, tls_garbage, tls_reset, tls13_block, mtls_required, tcp_refused, http_cutoff, http_451, ...
Server-active vs path-active — TLS alert / RST / connection refused отделены от timeout / cutoff / garbage.
24h temporal accumulation — порог подтверждённых failures для постоянного списка.
Опциональный exit-compare — второй observer из другой геолокации.

Полная методология — в docs/methodology.md.

Документация


docs/install.md	install (auto + manual), troubleshooting
docs/configuration.md	YAML, CLI, manual lists, exit-compare, prune
docs/methodology.md	как Ladon работает
docs/extensions.md	bundled allow/deny-пресеты + формат своих списков
docs/probe-api.md	HTTP-контракт probe-сервера для exit-compare
probe-server/ladon/	референсная Go-имплементация probe-сервера

Благодарности

Лицензия

MIT — см. LICENSE.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
ladon command ladon CLI.	ladon CLI.
internal
config Package config loads ladon's YAML config file and hands back an engine.Config plus a probe backend chosen by the file.	Package config loads ladon's YAML config file and hands back an engine.Config plus a probe backend chosen by the file.
decision Package decision classifies probe outcomes into engine states.	Package decision classifies probe outcomes into engine states.
dnsmasq Package dnsmasq parses dnsmasq log lines emitted with log-queries=extra.	Package dnsmasq parses dnsmasq log lines emitted with log-queries=extra.
dnsmasqcfg Package dnsmasqcfg writes a dnsmasq.d snippet that delegates manual-allow and extension domains to dnsmasq's native ipset= directive.	Package dnsmasqcfg writes a dnsmasq.d snippet that delegates manual-allow and extension domains to dnsmasq's native ipset= directive.
engine Package engine wires all pipeline stages (tail → ingest → probe → decide) into a single long-running process.	Package engine wires all pipeline stages (tail → ingest → probe → decide) into a single long-running process.
etld Package etld computes the effective-TLD-plus-one (registrable root) for a domain, using the public suffix list.	Package etld computes the effective-TLD-plus-one (registrable root) for a domain, using the public suffix list.
ipset Package ipset wraps the `ipset` CLI for atomic set mutations.	Package ipset wraps the `ipset` CLI for atomic set mutations.
manual Package manual loads allow/deny lists from plain text files.	Package manual loads allow/deny lists from plain text files.
prober Package prober runs staged network probes (DNS / TCP:443 / TLS-SNI / HTTP) against a domain.	Package prober runs staged network probes (DNS / TCP:443 / TLS-SNI / HTTP) against a domain.
publisher Package publisher renders the live runtime set (cache ∪ hot ∪ manual) into a flat artifact a downstream consumer can ingest.	Package publisher renders the live runtime set (cache ∪ hot ∪ manual) into a flat artifact a downstream consumer can ingest.
scorer Package scorer promotes hot domains into cache once repeated-failure evidence accumulates.	Package scorer promotes hot domains into cache once repeated-failure evidence accumulates.
storage Package storage is the SQLite access layer for ladon.	Package storage is the SQLite access layer for ladon.
tail Package tail follows a log file like `tail -F`, surviving truncation, rotation (inode change), and brief disappearance.	Package tail follows a log file like `tail -F`, surviving truncation, rotation (inode change), and brief disappearance.
watcher Package watcher ingests DNS query events and persists them as observations.	Package watcher ingests DNS query events and persists them as observations.
probe-server
ladon command Package main is the reference probe-server that ladon's RemoteProber speaks.	Package main is the reference probe-server that ladon's RemoteProber speaks.