Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] 下游收到的ECS scope一直为0,初步判断原因为上游响应被截断 #871

Open
4 tasks done
jqyisbest opened this issue Jan 27, 2025 · 2 comments
Open
4 tasks done

Comments

@jqyisbest
Copy link

在提交之前,请确认

  • 我已经尝试搜索过 Issue ,但没有找到相关问题。
  • 我正在使用最新的 mosdns 版本(或者最新的 commit),问题依旧存在。
  • 我仔细看过 wiki 后仍然无法自行解决该问题。
  • 我非常确定这是 mosdns 核心的问题。(如果是通过第三方衍生软件使用 mosdns 核心,不确定问题源头时,请先向衍生软件开发者提交问题。)

mosdns 版本

v5.3.3

操作系统

debian12

Bug 描述和复现步骤

5.3版本中,mosdns似乎会截断上游返回的内容,进而导致下游认为ecs scope为0,如下图所示(1.12.12.12为mosdns上游,mosdns监听5353端口):

Image
Image

使用的配置文件

# 日志设置
log:
  level: "debug"   # 日志级别。可选 "debug" "info" "warn" "error"。默认 "info"。
  file: "/var/log/mosdns/mosdns.log"
  production: false            # 纯 json 输出。


# []string, 从其他配置文件载入 plugins 插件设置。
# include 的插件会比本配置文件中的插件先初始化。
include: ["/etc/mosdns/config/mosdns_upstream.yml","/etc/mosdns/config/mosdns_rules.yml"]

# 插件设置
plugins:

  # ################ ECS序列 #################
  # 参见:https://irine-sistiana.gitbook.io/mosdns-wiki/mosdns-v5/ru-he-pei-zhi-mosdns/ke-zhi-xing-cha-jian#ecs_handler
  - tag: ecs_on
    type: "ecs_handler"
    args:
      forward: true # 是否转发来自下游的 ecs
      preset: "" # 发送预设 ecs
      send: false # 是否发送 ecs(发送客户端地址)
      mask4: 24 # ipv4 掩码。默认 24 | 12
      mask6: 48 # ipv6 掩码。默认 48 | 32

  - tag: ecs_local
    type: "ecs_handler"
    args:
      forward: false # 是否转发来自下游的 ecs
      preset: "154.26.190.88" # 发送本机公网IP
      send: false # 是否发送 ecs
      mask4: 24
      mask6: 48 

  - tag: ecs_off
    type: "ecs_handler"
    args:
      forward: false # 是否转发来自下游的 ecs
      preset: "" # 发送预设 ecs
      send: false # 是否发送 ecs
      mask4: 24
      mask6: 48 

  ################ 解析操作序列 #################

  # 响应操作
  - tag: has_resp_sequence
    type: sequence
    args:
      - matches: has_resp
        exec: accept

  # 国外解析
  - tag: resolve_global
    type: sequence
    args:
      - exec: query_summary resolve_global
      - exec: $ecs_local
      - exec: $forward_global

  # 国内解析
  # 返回非国内IP则 drop_resp
  - tag: resolve_cn
    type: sequence
    args:
      - exec: query_summary resolve_cn
      - exec: $ecs_on
      - exec: prefer_ipv4
      - exec: $forward_cn_tx
      # - matches: "!resp_ip $geoip_cn"
      #   exec: drop_resp
  
  # 兜底解析
  - tag: resolve_fallback
    type: sequence
    args:
      - exec: query_summary resolve_fallback
      - exec: $ecs_local
      - exec: prefer_ipv4
      - exec: $forward_global

  # ################ 分流判断序列 #################
  
  # 匹配本地域名
  - tag: query_for_cn_domain
    type: sequence
    args:
      - matches: qname $geosite_cn
        exec: $resolve_cn

 # 匹配国外域名
  - tag: query_for_global_domain
    type: sequence
    args:
      - matches: qname $geosite_global
        exec: $resolve_global

 # 匹配阻断域名
  - tag: query_for_reject_domain
    type: sequence
    args:
      # 屏蔽DNSSEC,解决ios系统的一些问题 ptr 12
      - matches: qtype 65
        exec: reject 0
      
      # 屏蔽广告
      - matches: qname $geosite_ad
        exec: black_hole 10.10.10.10 ::1

  # ################ 主序列 #################
  - tag: main_sequence
    type: sequence
    args:
      # 尝试命中自定义解析
      - exec: $hosts
      - exec: jump has_resp_sequence
      # 尝试命中阻断解析
      - exec: $query_for_reject_domain
      - exec: jump has_resp_sequence
      # 尝试命中国内解析
      - exec: $query_for_cn_domain
      - exec: jump has_resp_sequence
      # 尝试命中国外解析
      - exec: $query_for_global_domain
      - exec: jump has_resp_sequence
      # 命中兜底解析
      - exec: $resolve_fallback

  # mosdns监听localhost:5353
  # 此插件应位于最低部
  - tag: "udp_server"
    type: "udp_server"
    args:
      entry: main_sequence  # 可执行插件的 tag。
      listen: localhost:5353 # 监听地址。

mosdns 的 log 记录

@jqyisbest
Copy link
Author

补充下游unbound从mosdns收到的应答

Jan 26 13:27:18 unbound[223567:0] info: response for www.iqiyi.com. A IN
Jan 26 13:27:18 unbound[223567:0] info: reply from <.> 127.0.0.1#5353
Jan 26 13:27:18 unbound[223567:0] info: incoming scrubbed packet: ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
;; flags: qr rd ra ; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
ipv6-static.dns.iqiyi.com.	IN	A

;; ANSWER SECTION:
ipv6-static.dns.iqiyi.com.	3600	IN	A	123.129.218.118
ipv6-static.dns.iqiyi.com.	3600	IN	A	123.129.218.119
ipv6-static.dns.iqiyi.com.	3600	IN	A	123.129.218.120
ipv6-static.dns.iqiyi.com.	3600	IN	A	123.129.246.6
ipv6-static.dns.iqiyi.com.	3600	IN	A	123.129.246.7
ipv6-static.dns.iqiyi.com.	3600	IN	A	123.129.246.8

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:
;; MSG SIZE  rcvd: 139

Jan 26 13:27:18 unbound[223567:0] debug: iter_handle processing q with state QUERY RESPONSE STATE
Jan 26 13:27:18 unbound[223567:0] info: query response was ANSWER
Jan 26 13:27:18 unbound[223567:0] debug: iter_handle processing q with state FINISHED RESPONSE STATE
Jan 26 13:27:18 unbound[223567:0] info: finishing processing for www.iqiyi.com. A IN
Jan 26 13:27:18 unbound[223567:0] debug: prepending 1 rrsets
Jan 26 13:27:18 unbound[223567:0] debug: mesh_run: iterator module exit state is module_finished
Jan 26 13:27:18 unbound[223567:0] debug: subnetcache[module 0] operate: extstate:module_wait_module event:module_event_moddone
Jan 26 13:27:18 unbound[223567:0] info: subnetcache operate: query www.iqiyi.com. A IN
Jan 26 13:27:18 unbound[223567:0] debug: subnetcache: Authority indicates no support
Jan 26 13:27:18 unbound[223567:0] debug: reply has edns subnet 139.226.196.0/24 scope /0
Jan 26 13:27:18 unbound[223567:0] debug: mesh_run: subnetcache module exit state is module_finished
Jan 26 13:27:18 unbound[223567:0] debug: query took 0.832963 sec

@jqyisbest
Copy link
Author

补一张黑盒测试结果图
逐行命令解释:
1、以子网A测试腾讯DNS返回结果,能正确返回ecs scope
2、以子网A测试unbound返回结果,unbound以mosdns为上游,mosdns以腾讯DNS为上游,ecs scope为0
3/4、重启unbound,清空缓存并应用新配置:unbound以腾讯DNS为上游
5、以子网A测试unbound返回结果,unbound以腾讯DNS为上游,能正确返回ecs scope并缓存
6、以子网B测试unbound返回结果,unbound以腾讯DNS为上游,能正确返回ecs scope并缓存
7、以子网A测试unbound返回结果,unbound以腾讯DNS为上游,返回和第5步一样的结果,能根据host和ecs正确命中缓存
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant