The real GFW employs a pool of globally routable IP addresses for DNS poisoning. To mimic that, I'd like to add functionality that allows for specifying a list of forged IP addresses in the rule file. The DNS modifier should then either randomly or deterministically (by hashing) select an IP address from this pool when constructing the forged DNS response.
Users could then mimic the authentic behavior of the GFW (in terms of DNS) by downloading the GFWatch open dataset and compiling a rule file which includes all the forged IP addresses and blocked domain names.
I also wonder if it's worthwhile to implement parsing rules (i.e., domain names) from a separate file. There are thousands of domain names and IP addresses in the GFWatch dataset, so the rule file would become gigantic.
Relevant Research
https://www.usenix.org/system/files/sec21-hoang.pdf https://gfwatch.org/overview
Description
The real GFW employs a pool of globally routable IP addresses for DNS poisoning. To mimic that, I'd like to add functionality that allows for specifying a list of forged IP addresses in the rule file. The DNS modifier should then either randomly or deterministically (by hashing) select an IP address from this pool when constructing the forged DNS response.
Users could then mimic the authentic behavior of the GFW (in terms of DNS) by downloading the GFWatch open dataset and compiling a rule file which includes all the forged IP addresses and blocked domain names.
I also wonder if it's worthwhile to implement parsing rules (i.e., domain names) from a separate file. There are thousands of domain names and IP addresses in the GFWatch dataset, so the rule file would become gigantic.