{ "report_info": { "version": "9.0.1", "generated_at": "2026-07-21T01:54:32Z", "binary_name": "dns-leak" }, "binary": { "name": "dns-leak", "path": "/opt/kodachi/dashboard/hooks/dns-leak", "timestamp": "2026-07-21T01:54:32Z", "file_info": { "size": 5653536, "sha256": "82d220f7ef47880a1ba898098733ab2821dd631bbd24cde429a8d32a92fcbb63" }, "flag_n": { "command": "info", "data": { "author": "Warith Al Maawali", "copyright": "© 2026 Kodachi OS", "description": "DNS leak detection and analysis for Kodachi OS", "features": [ "Network interface discovery and validation", "DNS leak detection via challenge-response testing", "Geolocation-based leak analysis", "Multi-interface simultaneous testing", "Detailed test reporting with JSON export", "System resolver configuration analysis" ], "license": "Proprietary", "name": "dns-leak", "securityFeatures": { "authentication": "Secure authentication for sensitive operations", "encryption": "HTTPS for all external API communications", "inputValidation": "All interface names and IDs are sanitized and validated", "rateLimiting": "Built-in retry limits and timeouts for DNS queries" }, "systemRequirements": { "dependencies": [ "Network interfaces", "DNS resolver access", "Internet connectivity for leak testing" ], "os": "Linux (Debian-based, specifically Kodachi OS)", "privileges": "root/sudo for network interface access" }, "version": "9.8.4 (build 320)", "website": "https://digi77.com" }, "errors": [], "metadata": { "executionTime": 1, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-21T01:54:32.773175849Z", "version": "9.8.4 (build 320)", "warnings": [] }, "flag_v": { "command": "version", "data": { "buildDate": "REDACTED-BUILD-TIME", "gitCommit": "005897c3f3d5956a3211bf723def023febf10b13", "name": "dns-leak", "rustVersion": "1.97.0", "version": "9.8.4 (build 320)" }, "errors": [], "metadata": { "executionTime": 3, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-21T01:54:32.932545723Z", "version": "9.8.4 (build 320)", "warnings": [] }, "flag_h": { "command": "help", "data": { "commandCategories": [ { "category": "Network Discovery", "commands": [ { "description": "Discover network interfaces available for testing (no root, no authentication needed)", "examples": [ "dns-leak discover", "dns-leak discover --json", "dns-leak discover -V" ], "name": "discover", "options": [ { "default": "off", "description": "Verbose interface details, repeat (-VV) for more. The global --verbose flag does NOT affect this command", "flag": "-V, --discover-verbose", "required": false } ], "requires_sudo": false, "usage": "dns-leak discover [OPTIONS]" } ] }, { "category": "DNS Leak Testing", "commands": [ { "description": "Run DNS leak test on specified interface or all interfaces (requires prior online-auth authentication; this is also what a bare `dns-leak` runs)", "examples": [ "dns-leak test", "dns-leak test --interface tun0", "dns-leak test --json", "dns-leak test --keep-all" ], "name": "test", "options": [ { "default": "all active non-loopback interfaces", "description": "Specify a network interface to test", "flag": "-i, --interface ", "required": false }, { "default": "5", "description": "DNS query timeout, 1-60 seconds", "flag": "--dns-timeout ", "required": false }, { "default": "off (IP masked)", "description": "Print and save the unmasked public IP (masked by default)", "flag": "--show-public-ip", "required": false }, { "default": "off (older results pruned)", "description": "Keep every result file (by default older result files are pruned)", "flag": "--keep-all", "required": false } ], "requires_sudo": false, "usage": "dns-leak test [OPTIONS]" } ] }, { "category": "Reporting", "commands": [ { "description": "Generate a detailed report of a previous test (run the test with --keep-all if you want old result files to survive)", "examples": [ "dns-leak report --id dns_leak_results_", "dns-leak report --id dns_leak_results_ --json" ], "name": "report", "options": [ { "description": "Test ID to generate report for", "flag": "-r, --id ", "required": true } ], "requires_sudo": false, "usage": "dns-leak report -r " }, { "description": "Display results from a previous DNS leak test (run the test with --keep-all if you want old result files to survive)", "examples": [ "dns-leak results --file test_results.json", "dns-leak results --file test_results.json --json" ], "name": "results", "options": [ { "description": "Path to the results JSON file", "flag": "-f, --file ", "required": true } ], "requires_sudo": false, "usage": "dns-leak results --file " } ] } ], "description": "DNS leak detection and analysis for Kodachi OS", "dnsLeakDetectionMethods": [ "Real DNS resolution (system resolver, unique challenge subdomains per test run)", "External API verification (challenge-response correlation)", "Direct DNS server comparison and geolocation analysis", "Country-based DNS server leak detection", "System resolver configuration analysis" ], "environmentVariables": [ { "default": "info", "description": "Set logging level", "name": "RUST_LOG", "values": "error|warn|info|debug|trace" }, { "default": "unset", "description": "Disable all colored output when set", "name": "NO_COLOR", "values": "1|true|yes (any value disables color)" } ], "exitCodes": { "0": "Success", "1": "General error", "2": "Invalid arguments", "3": "Permission denied", "4": "Network error", "5": "File not found", "6": "Authentication required", "7": "DNS leak detected" }, "globalOptions": [ { "description": "Print help information", "flag": "-h, --help" }, { "description": "Print version information", "flag": "-v, --version" }, { "description": "Display detailed information", "flag": "-n, --info" }, { "description": "Show usage examples", "flag": "-e, --examples" }, { "description": "Output in JSON format", "flag": "--json" }, { "description": "Force output format (text|json)", "flag": "-o, --output-format " }, { "description": "Pretty-print JSON output", "flag": "--json-pretty" }, { "description": "Verbose interface details (discover only, repeat -VV for more)", "flag": "-V, --discover-verbose" }, { "description": "Suppress non-essential output", "flag": "--quiet" }, { "description": "Disable colored output", "flag": "--no-color" }, { "description": "Set timeout (default: 30)", "flag": "--timeout " }, { "description": "Retry attempts (default: 3)", "flag": "--retry " }, { "description": "DNS query timeout (default: 5)", "flag": "--dns-timeout " }, { "description": "Specify network interface to test", "flag": "-i, --interface " }, { "description": "Show unmasked public IP in output and saved files (default: masked)", "flag": "--show-public-ip" }, { "description": "Keep all result files (default: older files pruned for privacy)", "flag": "--keep-all" } ], "interfaceSpecifications": { "commonInterfaces": "eth0, ens33, enp2s0, enp2s1, eno1, wlan0, wlx18a6f71995d8, tun0, tailscale0, br0", "notes": [ "If no interface specified, all active interfaces will be tested", "Loopback interface (lo) is automatically excluded from testing", "Supports Predictable Network Interface Names (enp*, ens*, eno*, enx*)", "Includes USB wireless adapters (wlx*) and VPN tunnels (tun*, tailscale*)" ] }, "name": "dns-leak", "outputFormats": { "json": "Machine-readable output suitable for automation (use --json flag)", "standard": "Human-readable text output with colored status indicators" }, "usage": "dns-leak [OPTIONS] [COMMAND] [ARGS]" }, "errors": [], "metadata": { "executionTime": 7, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-21T01:54:33.164799055Z", "version": "9.8.4 (build 320)", "warnings": [] }, "flag_e": { "command": "examples", "data": { "categories": [ { "description": "List the interfaces you can test, then test them for DNS leaks. No root is needed for any dns-leak command, but the leak test itself needs an active online-auth session.", "examples": [ { "command": "dns-leak discover", "description": "See which network interfaces can be tested", "expectedOutput": "One block per interface with its name, type, IP addresses, DNS resolution state and configured DNS servers (loopback is excluded)" }, { "command": "dns-leak", "description": "Run the default DNS leak test on every active interface (identical to `dns-leak test`)", "expectedOutput": "Per-interface DNS servers with their country, plus a leak verdict for each interface", "notes": "Needs an authenticated session and internet access. Without a session it exits with 'Authentication required for command: test'; run `online-auth authenticate` first." }, { "command": "dns-leak test --interface tun0", "description": "Check that a VPN tunnel is not leaking DNS to the ISP resolver", "expectedOutput": "DNS servers observed through tun0 and a leak verdict for that interface" }, { "command": "dns-leak test --json", "description": "Run the leak test and emit machine-readable JSON", "expectedOutput": "A result envelope whose data carries the per-interface findings and the potential_leak_detected flag" } ], "id": "0_quick_start", "title": "Quick Start" }, { "description": "Find out which interfaces exist before you test one. Loopback (lo) is always excluded. Discovery needs no authentication.", "examples": [ { "command": "dns-leak discover", "description": "List all interfaces available for DNS leak testing", "expectedOutput": "Interface names with type, IP addresses, DNS resolution state and DNS servers, for example eth0, wlan0 and tun0" }, { "command": "dns-leak discover -V", "description": "Same list with the extra per-interface detail", "expectedOutput": "Interface list plus is-up, loopback, interface-type and address-count fields", "notes": "-V is short for --discover-verbose and can be repeated (-VV) for more detail. The global --verbose flag does NOT change discovery output." }, { "command": "dns-leak discover --json", "description": "List interfaces as JSON for automation", "expectedOutput": "JSON envelope with data.interfaces[] and data.total_count" }, { "command": "dns-leak discover --json | jq '.data.interfaces[].name'", "description": "Extract only interface names, ready to loop over in a script", "expectedOutput": "One quoted interface name per line" } ], "id": "1_interface_discovery", "title": "Interface Discovery" }, { "description": "Test every active interface, or one interface by name. Interface names follow the usual Linux schemes: eth0, ens33, enp2s0 and eno1 (wired), wlan0 and wlx (wireless), tun0 and tailscale0 (VPN), br0 (bridge). Take the exact name from `dns-leak discover`. Every test needs an authenticated session and internet access.", "examples": [ { "command": "dns-leak test", "description": "Test all active non-loopback interfaces for DNS leaks", "expectedOutput": "A block per interface listing the DNS servers that answered, their country, and a leak verdict", "notes": "Needs an active online-auth session and internet access. Exit code 7 signals that a DNS leak was detected." }, { "command": "dns-leak test --interface eth0", "description": "Test a single named interface instead of all of them", "expectedOutput": "DNS leak test result for eth0 only", "notes": "Replace eth0 with any name reported by `dns-leak discover` (wlan0, tun0, enp2s0, tailscale0, br0, ...). Unknown or malformed names are rejected before the test runs." }, { "command": "dns-leak test --interface tun0", "description": "Verify a VPN tunnel: confirm DNS queries leave through the tunnel and not through the ISP resolver", "expectedOutput": "DNS servers seen through tun0 with their country, compared against your visible exit location", "notes": "This is the check worth running right after connecting a VPN or Tor." }, { "command": "dns-leak test --json | jq '.data.potential_leak_detected'", "description": "Reduce a full test to a single true/false for scripting", "expectedOutput": "true or false" } ], "id": "2_leak_testing", "title": "DNS Leak Testing" }, { "description": "By default dns-leak masks your public IP and prunes older result files. Both flags below opt out of that, so reach for them deliberately.", "examples": [ { "command": "dns-leak test --show-public-ip", "description": "Show the real public IP instead of the masked one", "expectedOutput": "The usual leak report, but the public IP is printed in full rather than partially masked", "notes": "PRIVACY: the unmasked IP is also written into the saved JSON result file, which stays on disk. Use it only when you need the exact address, for example when filing a bug, and delete the result file afterwards." }, { "command": "dns-leak test --keep-all", "description": "Keep every result file instead of pruning the older ones", "expectedOutput": "The test runs normally and no previous dns_leak_results_*.json file is removed", "notes": "Without this flag a text-mode test prunes older result files, so the files that `results --file` and `report --id` need can vanish. Kept files record DNS servers and timestamps, so clean them up yourself." }, { "command": "dns-leak test --interface tun0 --keep-all --json", "description": "Keep the result file of a tunnel test so you can report on it later", "expectedOutput": "JSON envelope for tun0, with its dns_leak_results_.json file left in the results directory" } ], "id": "3_privacy_and_result_files", "title": "Privacy and Result Files" }, { "description": "Re-open a test you already ran. Both commands read the dns_leak_results_*.json files in the results directory, so the test that produced them must have been run with --keep-all if it is not the most recent one.", "examples": [ { "command": "dns-leak results --file dns_leak_results_.json", "description": "Print a saved test result again, without re-running the test", "expectedOutput": "The same per-interface DNS servers and leak verdict as the original run", "notes": "Replace with a real filename from a prior run. The file is looked up in the current directory first, then in the results directory, so a bare filename is enough." }, { "command": "dns-leak results --file dns_leak_results_.json --json", "description": "Re-emit a saved result as JSON", "expectedOutput": "JSON envelope holding the stored test result" }, { "command": "dns-leak report --id dns_leak_results_", "description": "Build a shareable HTML report from a saved test", "expectedOutput": "Report generated successfully: /dns_leak_report_.html", "notes": "The ID is the result filename without the .json extension. A partial ID also works: the first result file whose name contains it is used." }, { "command": "dns-leak report --id dns_leak_results --json", "description": "Report on the first matching saved test and print the status as JSON", "expectedOutput": "JSON envelope with status success once the HTML report is written", "notes": "This is the partial-ID form: it matches the first dns_leak_results_*.json file in the results directory, so pass a full ID when it matters which." } ], "id": "4_reports_and_saved_results", "title": "Reports and Saved Results" }, { "description": "Slow links, captive portals and Tor exits can need longer waits than the defaults.", "examples": [ { "command": "dns-leak test --timeout=30 --retry=3", "description": "Give the external leak-check calls more time and more attempts", "expectedOutput": "The usual leak report, just slower to give up", "notes": "Timeout range: 1-300 seconds. Retry count: 1-20. This bounds the HTTP calls, not the DNS queries." }, { "command": "dns-leak test --dns-timeout=10", "description": "Wait longer for each individual DNS query to answer", "expectedOutput": "The usual leak report, with slow resolvers given 10 seconds instead of the default", "notes": "DNS timeout range: 1-60 seconds. Separate from --timeout, which bounds the HTTP verification calls." }, { "command": "dns-leak test --interface wlan0 --dns-timeout=15 --timeout=60", "description": "Test one slow wireless link with both waits raised", "expectedOutput": "DNS leak test result for wlan0" } ], "id": "5_timeouts_and_retries", "title": "Timeouts and Retries" }, { "description": "Version, capabilities, help and examples, in text or JSON.", "examples": [ { "command": "dns-leak --version", "description": "Show the version number", "expectedOutput": "dns-leak version " }, { "command": "dns-leak --version --json", "description": "Version with build date, commit and Rust version, as JSON", "expectedOutput": "JSON envelope with name, version, buildDate, gitCommit" }, { "command": "dns-leak --info", "description": "Show what this tool does, its features and its requirements", "expectedOutput": "Program description, feature list, security features and system requirements" }, { "command": "dns-leak --info --json", "description": "The same capability record, machine-readable", "expectedOutput": "JSON envelope with the program info structure" }, { "command": "dns-leak --help", "description": "Show every command, option and exit code", "expectedOutput": "Grouped command list with options and global flags" }, { "command": "dns-leak test --help", "description": "Show the help for a single subcommand", "expectedOutput": "clap help for `test` with its own flags" }, { "command": "dns-leak test --examples", "description": "Show only the examples that apply to one subcommand", "expectedOutput": "The test examples, without the discover/report/results ones" }, { "command": "dns-leak --examples --json", "description": "All examples as JSON, for docs and tooling", "expectedOutput": "JSON envelope with categories[] and quickReference[]" } ], "id": "6_program_information", "title": "Program Information" } ], "description": "Usage examples for dns-leak", "name": "dns-leak", "quickReference": [ "dns-leak discover", "dns-leak test", "dns-leak test --interface tun0", "dns-leak test --json", "dns-leak results --file dns_leak_results_.json", "dns-leak report --id dns_leak_results_", "dns-leak --help", "dns-leak --version", "dns-leak --info --json", "dns-leak --examples --json" ] }, "errors": [], "metadata": { "executionTime": 11, "hostname": "REDACTED-BUILD-HOST", "user": "REDACTED-BUILD-USER" }, "status": "success", "timestamp": "2026-07-21T01:54:33.575027082Z", "version": "9.8.4 (build 320)", "warnings": [] } } }