一个关于 CNAME 记录和分流相关的问题 #112

sixg0000d · 2021-03-31T16:28:45Z

sixg0000d
Mar 31, 2021

请问一下，当一个域名匹配并通过本地的 forward 插件转发查询获取到一条 CNAME 记录时，该 CNAME 记录的域名还会从同一个 forward 插件转发请求吗？

我将 mosdns 当作远程 / 本地域名分流器使用，最近发现 fonts.gstatic.com 这个域名会被最终解析到国外，而该域名在 geosite:cn 列表中，其实是可以通过国内 DNS 解析出国内域名的。但是使用 dig 查询该域名的第一条记录是一条 CNAME 记录：

;; ANSWER SECTION:
fonts.gstatic.com.      149     IN      CNAME   gstaticadssl.l.google.com.

gstaticadssl.l.google.com 这个貌似域名不在 geosite:cn 列表当中。而对该域名进行查询，本地和远程 DNS 会获得不同的结果。（我是不是该给 https://github.com/v2fly/domain-list-community 提个 issue / pr ？）

mosdns 配置如下

log:
  level: warn
  file: ""

plugin:
  - tag: main_server
    type: server
    args:
      entry: main_sequence
      server:
        - protocol: udp
          addr: 127.0.0.1:1053
        - protocol: tcp
          addr: 127.0.0.1:1053

  - tag: main_sequence
    type: sequence
    args:
      exec:
        - _default_cache
        - if:
            - direct_domain
            - "!_query_is_common"
          exec:
            - forward_local
            - _end
        - forward_remote

  - tag: forward_local
    type: forward
    args:
      upstream:
        - addr: 119.29.29.29:53

  - tag: forward_remote
    type: forward
    args:
      upstream:
        - addr: 8.8.8.8:53
        - addr: 8.8.4.4:53
        - addr: 1.1.1.1:53

  - tag: direct_domain
    type: query_matcher
    args:
      domain:
        - ext:/usr/share/v2ray/geosite.dat:cn
        - ext:./direct.list

Answered by sixg0000d

Apr 1, 2021

确认是 systemd-resolved 搞事了，在 NetworkManager.conf 中添加

[main]
dns=dnsmasq

把 systemd-resolved 换成 dnsmasq 就不再有这个现象

~ $ systemctl restart systemd-resolved.service 
~ $ resolvectl query fonts.gstatic.com
fonts.gstatic.com: 203.208.40.66               -- link: enp2s0
                   (gstaticadssl.l.google.com)

-- Information acquired via protocol DNS in 92.2ms.
-- Data is authenticated: no
~ $ systemctl restart systemd-resolved.service
~ $ resolvectl query fonts.gstatic.com
fonts.gstatic.com: 2607:f8b0:4007:804::2003    -- link: enp2s0
                   172.217.11.163              -- link: enp2s0
                   (gstaticadssl.l.google.com)

-- Information acquired via protocol DNS in 825.…

View full answer

rampageX · 2021-03-31T17:16:49Z

rampageX
Mar 31, 2021

你需要解析后做 IP 分流：（两种任选一种）

  ## 两种分流逻辑
  - tag: sequence_bypass_local        # 顺序执行的分流逻辑
    type: sequence
    args:
      exec:
        - forward_local               # 先请求转发至本地服务器
        - if:
            - match_local_ip          # 如果应答包含本地 IP
          goto: _end                  # 就直接采用结果
        - forward_remote              # 否则用远程服务器的结果

  - tag: parallel_bypass_local        # 并发执行的分流的逻辑
    type: parallel
    args:
      parallel:
        - - fast_forward_local             # 并发请求本地和远程服务器
          - if:
              - "!match_local_ip"       # 本地服务器返回的非本地 IP 的应答会被丢弃
            exec:
              - _drop_response
        - - fast_forward_remote

匹配：

  - tag: match_local_ip # 匹配应答的 IP 是否是本地 IP
    type: response_matcher
    args:
      ip:
        - "ext:/root/cfg/geoip.dat:cn"

1 reply

sixg0000d Mar 31, 2021
Author

你需要解析后做 IP 分流：（两种任选一种）

  ## 两种分流逻辑
  - tag: sequence_bypass_local        # 顺序执行的分流逻辑
    type: sequence
    args:
      exec:
        - forward_local               # 先请求转发至本地服务器
        - if:
            - match_local_ip          # 如果应答包含本地 IP
          goto: _end                  # 就直接采用结果
        - forward_remote              # 否则用远程服务器的结果

  - tag: parallel_bypass_local        # 并发执行的分流的逻辑
    type: parallel
    args:
      parallel:
        - - fast_forward_local             # 并发请求本地和远程服务器
          - if:
              - "!match_local_ip"       # 本地服务器返回的非本地 IP 的应答会被丢弃
            exec:
              - _drop_response
        - - fast_forward_remote

匹配：

  - tag: match_local_ip # 匹配应答的 IP 是否是本地 IP
    type: response_matcher
    args:
      ip:
        - "ext:/root/cfg/geoip.dat:cn"

感谢你的解答
但是我不太想把非本地域名的请求发送给本地服务器，所以我只好先对该域名做额外处理

也就是说域名的 CNAME 记录中域名的查询不会直接走第一个域名的 forward 插件而是会重新匹配对吗？

IrineSistiana · 2021-04-01T02:35:33Z

IrineSistiana
Apr 1, 2021
Maintainer

我这里测试了一下 fonts.gstatic.com。没发现问题。

2021-04-01T10:30:17.327+0800	debug	handler/plugin_wrapper.go:75	exec plugin	{"query": "fonts.gstatic.com. IN A 5669 1", "exec": "_default_cache"}
2021-04-01T10:30:17.327+0800	debug	handler/plugin_wrapper.go:75	exec plugin	{"query": "fonts.gstatic.com. IN A 5669 1", "exec": "main_sequence"}
2021-04-01T10:30:17.327+0800	debug	handler/plugin_wrapper.go:108	exec matcher	{"query": "fonts.gstatic.com. IN A 5669 1", "exec": "query_is_ad_domain", "res": false}
2021-04-01T10:30:17.327+0800	debug	handler/plugin_wrapper.go:108	exec matcher	{"query": "fonts.gstatic.com. IN A 5669 1", "exec": "query_is_local_domain", "res": true}
2021-04-01T10:30:17.327+0800	debug	handler/plugin_wrapper.go:75	exec plugin	{"query": "fonts.gstatic.com. IN A 5669 1", "exec": "forward_local"}
2021-04-01T10:30:17.432+0800	debug	forward_local	utils/utils.go:294	response received	{"query": "fonts.gstatic.com. IN A 5669 1", "from": "https://223.5.5.5:443/dns-query"}
2021-04-01T10:30:17.432+0800	debug	handler/plugin_wrapper.go:75	exec plugin	{"query": "fonts.gstatic.com. IN A 5669 1", "exec": "_end"}
2021-04-01T10:30:17.432+0800	debug	main_server	server/server_handler.go:90	entry returned	{"query": "fonts.gstatic.com. IN A 5669 1", "status": "responded"}

成功匹配本地域名，然后由本地服务器解析。

你开 debug log 就能看到处理流程了。

也就是说域名的 CNAME 记录中域名的查询不会直接走第一个域名的 forward 插件而是会重新匹配对吗？

不是很明白你的意思。你可能了理解错了 CNAME 的作用?。🤔

5 replies

sixg0000d Apr 1, 2021
Author

比如说客户端对 fonts.gstatic.com 进行查询，匹配到本地域名列表由 forward_local 进行查询，查询到一条 CNAME 记录 gstaticadssl.l.google.com ，需要对 gstaticadssl.l.google.com 重新查询，不匹配本地域名列表，所以应该不再由 forward_local 进行查询？

sixg0000d Apr 1, 2021
Author

curl fonts.gstatic.com 后

debug 信息如下

2021-04-01T16:42:25.965+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 1 1 37575 14", "exec": "main_sequence"}
2021-04-01T16:42:25.965+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 1 1 37575 14", "exec": "_default_cache"}
2021-04-01T16:42:25.965+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 28 1 435 15", "exec": "main_sequence"}
2021-04-01T16:42:25.965+0800    debug   _default_cache  cache/cache.go:112      cache hit       {"query": "fonts.gstatic.com. 1 1 37575 14"}
2021-04-01T16:42:25.965+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 28 1 435 15", "exec": "_default_cache"}
2021-04-01T16:42:25.965+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "fonts.gstatic.com. 1 1 37575 14", "status": "responded"}
2021-04-01T16:42:25.965+0800    debug   _default_cache  cache/cache.go:112      cache hit       {"query": "fonts.gstatic.com. 28 1 435 15"}
2021-04-01T16:42:25.966+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "fonts.gstatic.com. 28 1 435 15", "status": "responded"}
2021-04-01T16:42:25.967+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 28 1 46405 16", "exec": "main_sequence"}
2021-04-01T16:42:25.967+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 1 1 1948 17", "exec": "main_sequence"}
2021-04-01T16:42:25.967+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 1 1 1948 17", "exec": "_default_cache"}
2021-04-01T16:42:25.967+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 28 1 46405 16", "exec": "_default_cache"}
2021-04-01T16:42:25.967+0800    debug   _default_cache  cache/cache.go:112      cache hit       {"query": "gstaticadssl.l.google.com. 1 1 1948 17"}
2021-04-01T16:42:25.967+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "gstaticadssl.l.google.com. 1 1 1948 17", "status": "responded"}
2021-04-01T16:42:25.967+0800    debug   _default_cache  cache/cache.go:112      cache hit       {"query": "gstaticadssl.l.google.com. 28 1 46405 16"}
2021-04-01T16:42:25.967+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "gstaticadssl.l.google.com. 28 1 46405 16", "status": "responded"}

看上去是分开查询的

IrineSistiana Apr 1, 2021
Maintainer

.是 curl 分开查了两次. mosdns 不会分开查的.

sixg0000d Apr 1, 2021
Author

.是 curl 分开查了两次. mosdns 不会分开查的.

用 chromium 打开网页也是如此

~ $ open https://fonts.gstatic.com
or
~ $ chromium https://fonts.gstatic.com

log

2021-04-01T17:05:53.143+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 28 1 30600 1", "exec": "main_sequence"}
2021-04-01T17:05:53.143+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 28 1 30600 1", "exec": "_default_cache"}
2021-04-01T17:05:53.143+0800    debug   handler/plugin_wrapper.go:108   exec matcher    {"query": "fonts.gstatic.com. 28 1 30600 1", "exec": "direct_domain", "res": true}
2021-04-01T17:05:53.143+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 28 1 30600 1", "exec": "forward_local"}
2021-04-01T17:05:53.144+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 1 1 33921 2", "exec": "main_sequence"}
2021-04-01T17:05:53.144+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 1 1 33921 2", "exec": "_default_cache"}
2021-04-01T17:05:53.144+0800    debug   handler/plugin_wrapper.go:108   exec matcher    {"query": "fonts.gstatic.com. 1 1 33921 2", "exec": "direct_domain", "res": true}
2021-04-01T17:05:53.144+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 1 1 33921 2", "exec": "forward_local"}
2021-04-01T17:05:53.168+0800    debug   forward_local   utils/utils.go:294      response received       {"query": "fonts.gstatic.com. 1 1 33921 2", "from": "192.168.2.1:53"}
2021-04-01T17:05:53.168+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 1 1 33921 2", "exec": "_end"}
2021-04-01T17:05:53.168+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "fonts.gstatic.com. 1 1 33921 2", "status": "responded"}
2021-04-01T17:05:53.174+0800    debug   forward_local   utils/utils.go:294      response received       {"query": "fonts.gstatic.com. 28 1 30600 1", "from": "192.168.2.1:53"}
2021-04-01T17:05:53.174+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "fonts.gstatic.com. 28 1 30600 1", "exec": "_end"}
2021-04-01T17:05:53.174+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "fonts.gstatic.com. 28 1 30600 1", "status": "responded"}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 1 1 39415 3", "exec": "main_sequence"}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 1 1 39415 3", "exec": "_default_cache"}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:108   exec matcher    {"query": "gstaticadssl.l.google.com. 1 1 39415 3", "exec": "direct_domain", "res": false}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:108   exec matcher    {"query": "gstaticadssl.l.google.com. 1 1 39415 3", "exec": "_query_is_common", "res": true}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 1 1 39415 3", "exec": "forward_remote"}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 28 1 35098 4", "exec": "main_sequence"}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 28 1 35098 4", "exec": "_default_cache"}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:108   exec matcher    {"query": "gstaticadssl.l.google.com. 28 1 35098 4", "exec": "direct_domain", "res": false}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:108   exec matcher    {"query": "gstaticadssl.l.google.com. 28 1 35098 4", "exec": "_query_is_common", "res": true}
2021-04-01T17:05:53.175+0800    debug   handler/plugin_wrapper.go:75    exec plugin     {"query": "gstaticadssl.l.google.com. 28 1 35098 4", "exec": "forward_remote"}
2021-04-01T17:05:53.901+0800    debug   forward_remote  utils/utils.go:325      response received       {"query": "gstaticadssl.l.google.com. 28 1 35098 4", "from": "8.8.8.8:53"}
2021-04-01T17:05:53.901+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "gstaticadssl.l.google.com. 28 1 35098 4", "status": "responded"}
2021-04-01T17:05:53.933+0800    debug   forward_remote  utils/utils.go:325      response received       {"query": "gstaticadssl.l.google.com. 1 1 39415 3", "from": "8.8.4.4:53"}
2021-04-01T17:05:53.933+0800    debug   main_server     server/server_handler.go:90     entry returned  {"query": "gstaticadssl.l.google.com. 1 1 39415 3", "status": "responded"}

sixg0000d Apr 1, 2021
Author

我好像找到问题所在了
之前的配置是：我的 mosdns 监听 127.0.0.1:1053，dnsmasq （可以看作是）监听 0.0.0.0:53 ，并将查询转发至 mosdns。
当我把 dnsmasq 关掉再由 mosdns 监听 127.0.0.1:53 后，不再分开查询——查询 fonts.gstatic.com 将获得国内地址结果。

~~所以可能是 dnsmasq 向 mosdns 分别查询了两次，而不是 mosdns 分开查询了。~~

不，我可能还是弄错了，问题不在 dnsmasq ，而好像是在中间的 systemd-resolved。

sixg0000d · 2021-04-01T10:13:46Z

sixg0000d
Apr 1, 2021
Author

确认是 systemd-resolved 搞事了，在 NetworkManager.conf 中添加

[main]
dns=dnsmasq

把 systemd-resolved 换成 dnsmasq 就不再有这个现象

~ $ systemctl restart systemd-resolved.service 
~ $ resolvectl query fonts.gstatic.com
fonts.gstatic.com: 203.208.40.66               -- link: enp2s0
                   (gstaticadssl.l.google.com)

-- Information acquired via protocol DNS in 92.2ms.
-- Data is authenticated: no
~ $ systemctl restart systemd-resolved.service
~ $ resolvectl query fonts.gstatic.com
fonts.gstatic.com: 2607:f8b0:4007:804::2003    -- link: enp2s0
                   172.217.11.163              -- link: enp2s0
                   (gstaticadssl.l.google.com)

-- Information acquired via protocol DNS in 825.7ms.
-- Data is authenticated: no
~ $ systemctl restart systemd-resolved.service
~ $ resolvectl query fonts.gstatic.com
fonts.gstatic.com: 2607:f8b0:4007:80d::2003
                   172.217.5.195
                   (gstaticadssl.l.google.com)

-- Information acquired via protocol DNS in 776.0ms.
-- Data is authenticated: no

以上分别为 /etc/systemd/resolved.conf 中设置 DNS= 为 119.29.29.29、8.8.8.8 和 mosdns 监听的本地地址的结果

已知当 mosdns 作为 systemd-resolved 上游时，systemd-resolved 向 mosdns 查询到 CNAME 记录会重新发起新的查询，无法直接从 mosdns 处获得最终的 A / AAAA 记录。不知道为何如此与如何避免。

1 reply

sixg0000d Apr 1, 2021
Author

翻遍了 systemd-resolved 的文档和配置文件文档也没找到相关信息，只好放弃 systemd-resolved ，转而使用 dnsmasq 作为 NetworkManager 的 dns 后端。

ihipop · 2023-04-22T12:54:16Z

ihipop
Apr 22, 2023

我刚好需要这样的行为：某个域名使用某些cdn的cname的时候使用这个cname的解析结果。

其起因是一些国内网站会使用阿里云的全球加速，但是这些网站可能不在geosite:cn里面，这样的话默认如果给这些域名使用国外dns解析，吐出来的必然的国外IP

而这些网站的cname都是使用的阿里云的昆仑系列的cname,我尝试给这些cname指定使用国内的dns解析，无效。mosdns会使用主域名而非cname的解析规则并且直接返回结果。。。

我也不想使用解析后分流，因为这样会向国内dns泄漏我的解析内容。。

4 replies

ihipop Apr 24, 2023

没有改一行mosdns的代码，使用配置实现了。
分享一下解决方案：

A域名不是 site-cn 或者等其他的规则定义的本地域名
如果A域名响应的域名是cname应答，
这cname，属于 site-cn或者等其他的规则定义的本地域名。比如 geosite:aliyun
丢弃A域名的cname解析结果
使用本地dns重新解析这个cname,并作为A域名的结果返回

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

一个关于 CNAME 记录和分流相关的问题 #112

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 11 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

一个关于 CNAME 记录和分流相关的问题 #112

sixg0000d Mar 31, 2021

Replies: 4 comments · 11 replies

rampageX Mar 31, 2021

sixg0000d Mar 31, 2021 Author

IrineSistiana Apr 1, 2021 Maintainer

sixg0000d Apr 1, 2021 Author

sixg0000d Apr 1, 2021 Author

IrineSistiana Apr 1, 2021 Maintainer

sixg0000d Apr 1, 2021 Author

sixg0000d Apr 1, 2021 Author

sixg0000d Apr 1, 2021 Author

sixg0000d Apr 1, 2021 Author

ihipop Apr 22, 2023

ihipop Apr 24, 2023

cnclg Apr 29, 2023

ihipop Apr 29, 2023

yyysuo May 15, 2024

sixg0000d
Mar 31, 2021

Replies: 4 comments 11 replies

rampageX
Mar 31, 2021

sixg0000d Mar 31, 2021
Author

IrineSistiana
Apr 1, 2021
Maintainer

sixg0000d Apr 1, 2021
Author

sixg0000d Apr 1, 2021
Author

IrineSistiana Apr 1, 2021
Maintainer

sixg0000d Apr 1, 2021
Author

sixg0000d Apr 1, 2021
Author

sixg0000d
Apr 1, 2021
Author

sixg0000d Apr 1, 2021
Author

ihipop
Apr 22, 2023