[ { "path": ".github/workflows/autoupdate.yml", "content": "name: Auto Update\n\non:\n workflow_dispatch:\n schedule:\n - cron: \"0 */2 * * *\"\n\njobs:\n check_update:\n runs-on: ubuntu-latest\n outputs:\n update_needed: ${{ steps.check.outputs.update_needed }}\n pkg_version: ${{ steps.check.outputs.pkg_version }}\n latest_daed_full: ${{ steps.check.outputs.latest_daed_full }}\n latest_daed_short: ${{ steps.check.outputs.latest_daed_short }}\n latest_wing_short: ${{ steps.check.outputs.latest_wing_short }}\n latest_core_short: ${{ steps.check.outputs.latest_core_short }}\n steps:\n - uses: actions/checkout@v6\n with:\n fetch-depth: 1\n\n - name: Check Upstream Updates\n id: check\n run: |\n DAED_JSON=$(curl -s https://api.github.com/repos/daeuniverse/daed/commits/main)\n WING_JSON=$(curl -s https://api.github.com/repos/daeuniverse/dae-wing/commits/main)\n CORE_JSON=$(curl -s https://api.github.com/repos/olicesx/dae/commits/kdae)\n\n UPSTREAM_DAED_FULL=$(echo \"$DAED_JSON\" | jq -r '.sha')\n UPSTREAM_DAED=$(echo \"$UPSTREAM_DAED_FULL\" | cut -b 1-7)\n UPSTREAM_WING=$(echo \"$WING_JSON\" | jq -r '.sha' | cut -b 1-7)\n UPSTREAM_CORE=$(echo \"$CORE_JSON\" | jq -r '.sha' | cut -b 1-7)\n\n CURRENT_DAED=$(grep \"PKG_SOURCE_VERSION:=\" daed/Makefile | cut -d= -f2 || true)\n CURRENT_WING=$(grep \"WING_VERSION:=wing-\" daed/Makefile | sed 's/.*wing-//' | head -n 1 || true)\n CURRENT_CORE=$(grep \"CORE_VERSION:=core-\" daed/Makefile | sed 's/.*core-//' | head -n 1 || true)\n\n echo \"Upstream DAED: $UPSTREAM_DAED_FULL, Local: $CURRENT_DAED\"\n echo \"Upstream WING: $UPSTREAM_WING, Local: $CURRENT_WING\"\n echo \"Upstream CORE: $UPSTREAM_CORE, Local: $CURRENT_CORE\"\n\n NEED_UPDATE=false\n if [ \"$UPSTREAM_DAED_FULL\" != \"$CURRENT_DAED\" ]; then NEED_UPDATE=true; fi\n if [ \"$UPSTREAM_WING\" != \"$CURRENT_WING\" ]; then NEED_UPDATE=true; fi\n if [ \"$UPSTREAM_CORE\" != \"$CURRENT_CORE\" ]; then NEED_UPDATE=true; fi\n\n if [ \"$NEED_UPDATE\" = \"true\" ]; then\n echo \"Update needed\"\n echo \"update_needed=true\" >> \"$GITHUB_OUTPUT\"\n\n DATE_DAED=$(echo \"$DAED_JSON\" | jq -r '.commit.committer.date')\n DATE_WING=$(echo \"$WING_JSON\" | jq -r '.commit.committer.date')\n DATE_CORE=$(echo \"$CORE_JSON\" | jq -r '.commit.committer.date')\n \n LATEST_ISO_DATE=$(echo -e \"$DATE_DAED\\n$DATE_WING\\n$DATE_CORE\" | sort -r | head -n 1)\n PKG_VERSION=$(date -d \"$LATEST_ISO_DATE\" +%Y.%m.%d)\n echo \"Selected latest date: $LATEST_ISO_DATE formatted as $PKG_VERSION\"\n\n echo \"pkg_version=$PKG_VERSION\" >> \"$GITHUB_OUTPUT\"\n echo \"latest_daed_full=$UPSTREAM_DAED_FULL\" >> \"$GITHUB_OUTPUT\"\n echo \"latest_daed_short=$UPSTREAM_DAED\" >> \"$GITHUB_OUTPUT\"\n echo \"latest_wing_short=$UPSTREAM_WING\" >> \"$GITHUB_OUTPUT\"\n echo \"latest_core_short=$UPSTREAM_CORE\" >> \"$GITHUB_OUTPUT\"\n else\n echo \"Everything up to date.\"\n echo \"update_needed=false\" >> \"$GITHUB_OUTPUT\"\n fi\n\n build:\n needs: check_update\n if: needs.check_update.outputs.update_needed == 'true'\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v6\n with:\n fetch-depth: 0\n persist-credentials: false\n\n\n - name: Build System Setup\n env:\n DEBIAN_FRONTEND: noninteractive\n run: |\n sudo apt-get update\n sudo apt-get install -y jq dos2unix\n\n - name: Update Makefile\n run: |\n chmod 755 ./daed/files/daed.init ./luci-app-daed/root/etc/init.d/luci_daed ./luci-app-daed/root/etc/hotplug.d/iface/98-daed\n find . -type f -exec dos2unix {} \\; -print\n\n sed -i '/PKG_VERSION:/d' ./daed/Makefile\n sed -i \"7 a PKG_VERSION:=${{ needs.check_update.outputs.pkg_version }}\" ./daed/Makefile\n \n sed -i '/DAED_VERSION:/d' ./daed/Makefile\n sed -i \"8 a DAED_VERSION:=daed-${{ needs.check_update.outputs.latest_daed_short }}\" ./daed/Makefile\n \n sed -i '/WING_VERSION:=/d' ./daed/Makefile\n sed -i \"9 a WING_VERSION:=wing-${{ needs.check_update.outputs.latest_wing_short }}\" ./daed/Makefile\n \n sed -i '/CORE_VERSION:=/d' ./daed/Makefile\n sed -i \"10 a CORE_VERSION:=core-${{ needs.check_update.outputs.latest_core_short }}\" ./daed/Makefile\n \n sed -i '/PKG_SOURCE_VERSION:/d' ./daed/Makefile\n sed -i \"17 a PKG_SOURCE_VERSION:=${{ needs.check_update.outputs.latest_daed_full }}\" ./daed/Makefile\n\n - name: Commit file\n run: |\n git config --global user.email simonsqiu@foxmail.com\n git config --global user.name SimonsQiu\n git add .\n git commit -m \"Update $(date +%Y/%m/%d\\ %H:%M:%S\\ %Z)\" -a\n continue-on-error: true\n\n - name: Push changes\n uses: ad-m/github-push-action@master\n with:\n github_token: ${{secrets.ACTIONS_DEPLOY_KEY}}\n branch: kix\n continue-on-error: true\n\n\n" }, { "path": ".github/workflows/build-packages.yml", "content": "name: Build packages\n\non:\n workflow_dispatch:\n push:\n branches:\n - kix\n\n\npermissions:\n contents: write\n\njobs:\n prepare:\n name: Prepare version\n runs-on: ubuntu-latest\n outputs:\n version: ${{ steps.meta.outputs.version }}\n release_tag: ${{ steps.meta.outputs.release_tag }}\n release_name: ${{ steps.meta.outputs.release_name }}\n steps:\n - name: Checkout source\n uses: actions/checkout@v6\n with:\n fetch-depth: 0\n\n - name: Generate version metadata\n id: meta\n shell: bash\n run: |\n pkg_version=$(grep '^PKG_VERSION:=' daed/Makefile | head -n 1 | cut -d= -f2)\n pkg_release=$(grep '^PKG_RELEASE:=' daed/Makefile | head -n 1 | cut -d= -f2)\n\n version=\"${pkg_version}-r${pkg_release}\"\n release_tag=\"daed_${version}\"\n release_name=\"daed_${version}\"\n\n echo \"version=${version}\" >> \"$GITHUB_OUTPUT\"\n echo \"release_tag=${release_tag}\" >> \"$GITHUB_OUTPUT\"\n echo \"release_name=${release_name}\" >> \"$GITHUB_OUTPUT\"\n\n echo \"Version: ${version}\"\n echo \"Release tag: ${release_tag}\"\n\n build:\n name: Build ${{ matrix.arch }}-${{ matrix.sdk }}\n runs-on: ubuntu-latest\n needs: prepare\n strategy:\n fail-fast: false\n matrix:\n include:\n - arch: aarch64_generic\n sdk: openwrt-24.10\n pkg_ext: ipk\n - arch: i386_pentium4\n sdk: openwrt-24.10\n pkg_ext: ipk\n - arch: x86_64\n sdk: openwrt-24.10\n pkg_ext: ipk\n - arch: aarch64_generic\n sdk: openwrt-25.12\n pkg_ext: apk\n - arch: i386_pentium4\n sdk: openwrt-25.12\n pkg_ext: apk\n - arch: x86_64\n sdk: openwrt-25.12\n pkg_ext: apk\n\n steps:\n - name: Checkout source\n uses: actions/checkout@v6\n with:\n fetch-depth: 0\n\n - name: Init build dependencies\n env:\n DEBIAN_FRONTEND: noninteractive\n shell: bash\n run: |\n sudo -E apt-get update\n sudo -E apt-get install -y clang llvm curl jq\n\n - name: Build packages\n uses: sbwml/openwrt-gh-action-sdk@go1.26\n env:\n ARCH: ${{ matrix.arch }}-${{ matrix.sdk }}\n FEEDNAME: packages_ci\n PACKAGES: luci-app-daed\n NO_REFRESH_CHECK: true\n V: s\n\n - name: Show built files\n shell: bash\n run: |\n echo \"=== Built package files ===\"\n find bin/packages -type f | grep -E '\\.(ipk|apk)$' || true\n echo \"===========================\"\n\n\n - name: Prepare renamed artifacts\n shell: bash\n run: |\n set -euo pipefail\n mkdir -p dist\n for f in bin/packages/${{ matrix.arch }}/packages_ci/*.${{ matrix.pkg_ext }}; do\n base=\"$(basename \"$f\")\"\n ext=\"${base##*.}\"\n name=\"${base%.*}\"\n\n # Avoid duplicating architecture in name, and skip architecture suffix for LuCI/all packages\n if [[ \"$name\" == *\"${{ matrix.arch }}\"* ]] || [[ \"$name\" == *\"all\"* ]] || [[ \"$name\" == luci-* ]]; then\n new_name=\"${name}-${{ matrix.sdk }}.${ext}\"\n else\n new_name=\"${name}-${{ matrix.arch }}-${{ matrix.sdk }}.${ext}\"\n fi\n \n cp \"$f\" \"dist/${new_name}\"\n done\n ls -lah dist\n\n - name: Upload build artifacts\n uses: actions/upload-artifact@v7\n with:\n name: ${{ matrix.arch }}-${{ matrix.sdk }}-${{ matrix.pkg_ext }}\n path: dist/*.${{ matrix.pkg_ext }}\n if-no-files-found: error\n retention-days: 7\n\n release:\n name: Publish release\n runs-on: ubuntu-latest\n needs:\n - prepare\n - build\n steps:\n - name: Download all build artifacts\n uses: actions/download-artifact@v8\n with:\n path: release-dist\n merge-multiple: true\n\n - name: Create or update GitHub release\n uses: softprops/action-gh-release@v2\n with:\n tag_name: ${{ needs.prepare.outputs.release_tag }}\n name: ${{ needs.prepare.outputs.release_name }}\n files: release-dist/*\n generate_release_notes: true\n token: ${{ secrets.GITHUB_TOKEN }}\n target_commitish: ${{ github.sha }}\n\n - name: Delete Older Releases\n uses: dev-drprasad/delete-older-releases@master\n with:\n keep_latest: 3\n delete_tags: true\n env:\n GITHUB_TOKEN: ${{secrets.ACTIONS_DEPLOY_KEY}}\n continue-on-error: true\n\n - name: Cleanup Old Action Artifacts\n uses: c-hive/gha-remove-artifacts@master\n with:\n age: '3 days'\n skip-recent: 3\n continue-on-error: true\n\n - name: Cleanup Workflow Logs\n uses: Mattraks/delete-workflow-runs@main\n with:\n token: ${{secrets.ACTIONS_DEPLOY_KEY}}\n repository: ${{ github.repository }}\n retain_days: 3\n continue-on-error: true\n\n" }, { "path": "README.md", "content": "

luci-app-daed

\n

\n \n

\n

\n 一个基于 eBPF 的高性能透明代理解决方案。\n

\n\n---\n\n## 快速入门\n\n### 1. 环境准备 (编译主机)\n\n在编译之前，请确保您的编译主机已安装必要的开发工具。参考 [apt.llvm.org](https://apt.llvm.org/) 安装最新版本的 Clang 和 LLVM。\n\n```bash\napt-get update\napt-get install -y clang llvm npm\nnpm install -g pnpm\n```\n\n### 2. 获取源码\n\n进入您的 OpenWrt 目录，克隆本仓库到 `package` 目录：\n\n```bash\ngit clone https://github.com/QiuSimons/luci-app-daed package/dae\n```\n\n### 3. 内核配置要求 (DAE 运行前提)\n\nDAE 依赖 eBPF 和 BTF。请在 `.config` 中添加以下内核配置以启用相关支持：\n\n```makefile\nCONFIG_DEVEL=y\nCONFIG_KERNEL_DEBUG_INFO=y\nCONFIG_KERNEL_DEBUG_INFO_REDUCED=n\nCONFIG_KERNEL_DEBUG_INFO_BTF=y\nCONFIG_KERNEL_CGROUPS=y\nCONFIG_KERNEL_CGROUP_BPF=y\nCONFIG_KERNEL_BPF_EVENTS=y\nCONFIG_BPF_TOOLCHAIN_HOST=y\nCONFIG_KERNEL_XDP_SOCKETS=y\nCONFIG_PACKAGE_kmod-xdp-sockets-diag=y\n```\n\n### 4. 编译与安装\n\n```bash\nmake menuconfig # 路径: LUCI -> Applications -> luci-app-daed\nmake package/dae/luci-app-daed/compile V=s\n```\n\n---\n\n## 核心概念：BTF 与 CO-RE\n\n### BTF 来源选择\n\n在 `make menuconfig` 中，您可以根据内核支持情况选择 BTF 来源：\n\n- **Use kernel BTF (integrated)**: **[推荐]** 要求内核开启 `CONFIG_KERNEL_DEBUG_INFO_BTF=y`。\n- **Use vmlinux-btf package**: 如果内核不支持原生 BTF，可选择此项以使用外部 [vmlinux-btf](https://github.com/QiuSimons/vmlinux-btf) 软件包。\n\n### vmlinux-btf 依赖说明\n\n由于预编译安装包无法自动探测内核是否支持 BTF，为了确保稳定性，程序默认依赖 `vmlinux-btf`。\n\n- **方案 A：手动补全依赖 (推荐)**\n 如果软件源缺失该包，请前往 [opkg.cooluc.com](https://opkg.cooluc.com/) 下载。\n - **建议**: 优先选择与内核版本号 (`x.y.z`) 完全一致的包；至少保证主次版本号 (`x.y`) 一致。\n- **方案 B：忽略依赖 (高级用户)**\n 如果您确认内核已原生支持 BTF (`CONFIG_KERNEL_DEBUG_INFO_BTF=y`)，可在安装时使用 `--force-depends` 参数忽略依赖检查。\n\n---\n\n## 预览\n\n

\n\n\n

\n" }, { "path": "daed/Makefile", "content": "# SPDX-License-Identifier: GPL-2.0-only\n#\n# Copyright (C) 2023 ImmortalWrt.org\n\ninclude $(TOPDIR)/rules.mk\n\nPKG_NAME:=daed\nPKG_VERSION:=2026.05.06\nDAED_VERSION:=daed-f655b35\nWING_VERSION:=wing-dc50308\nCORE_VERSION:=core-6005321\nWING_HASH_SHORT:=$(shell echo $(WING_VERSION) | cut -d- -f2)\nCORE_HASH_SHORT:=$(shell echo $(CORE_VERSION) | cut -d- -f2)\nPKG_RELEASE:=1\n\nPKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz\nPKG_SOURCE_PROTO:=git\nPKG_SOURCE_VERSION:=f655b354db5bc39fbf29a48d7c4c10f971c84cd0\nPKG_SOURCE_URL:=https://github.com/daeuniverse/daed.git\nPKG_MIRROR_HASH:=skip\n\nPKG_LICENSE:=AGPL-3.0-only MIT\nPKG_LICENSE_FILES:=LICENSE wing/LICENSE\nPKG_MAINTAINER:=Tianling Shen \n\nDAED_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION)\nPKG_BUILD_DIR:=$(DAED_BUILD_DIR)/wing\n\nPKG_BUILD_DEPENDS:=golang/host bpf-headers\nPKG_BUILD_PARALLEL:=1\nPKG_BUILD_FLAGS:=no-mips16\n\nGO_PKG:=github.com/daeuniverse/dae-wing\n\nGO_PKG_LDFLAGS:= \\\n\t-s -w -buildid= \\\n\t-linkmode external -extldflags '-static -Wl,-s' \\\n\t-X '$(GO_PKG)/db.AppDescription=$(PKG_NAME) is a integration solution of dae, API and UI.'\nGO_PKG_LDFLAGS_X:= \\\n\t$(GO_PKG)/db.AppName=$(PKG_NAME) \\\n\t$(GO_PKG)/db.AppVersion=$(DAED_VERSION)_$(WING_VERSION)_$(CORE_VERSION)\nGO_PKG_TAGS:=embedallowed,trace\n\ninclude $(INCLUDE_DIR)/package.mk\ninclude $(INCLUDE_DIR)/bpf.mk\ninclude $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk\n\nGO_PKG_BUILD_VARS+= \\\n\tGOFLAGS=\"-trimpath -buildvcs=false -pgo=auto\"\n\nGO_PKG_TARGET_VARS+= \\\n\tCGO_LDFLAGS=\"$(TARGET_LDFLAGS) -static -Wl,-s\" \\\n\tGOEXPERIMENT=newinliner,simd\n\ndefine Package/daed/Default\n SECTION:=net\n CATEGORY:=Network\n SUBMENU:=Web Servers/Proxies\n URL:=https://github.com/daeuniverse/daed\nendef\n\ndefine Package/daed\n $(call Package/daed/Default)\n TITLE:=A Modern Dashboard For dae\n DEPENDS:=$(GO_ARCH_DEPENDS) \\\n +ca-bundle +kmod-sched-core +kmod-sched-bpf \\\n +kmod-veth +v2ray-geoip +v2ray-geosite \\\n +@KERNEL_XDP_SOCKETS \\\n +DAED_USE_VMLINUX_BTF:vmlinux-btf\nendef\n\ndefine Package/daed/config\n\tchoice\n\t\tprompt \"BTF source for CO-RE\"\n\t\tdefault DAED_USE_KERNEL_BTF\n\t\tdepends on PACKAGE_daed\n\n\tconfig DAED_USE_KERNEL_BTF\n\t\tbool \"Use kernel BTF (integrated)\"\n\t\tdepends on KERNEL_DEBUG_INFO_BTF\n\n\tconfig DAED_USE_VMLINUX_BTF\n\t\tbool \"Use vmlinux-btf package\"\n\tendchoice\nendef\n\ndefine Package/daed/description\n daed is a backend of dae, provides a method to bundle arbitrary\n frontend, dae and geodata into one binary.\nendef\n\ndefine Package/daed/conffiles\n/etc/daed/wing.db\n/etc/config/daed\nendef\n\nNODE_VERSION:=v24.12.0\nNODE_DIST:=node-$(NODE_VERSION)-linux-x64\nNODE_URL:=https://nodejs.org/dist/$(NODE_VERSION)/$(NODE_DIST).tar.xz\n\ndefine Build/Prepare\n\t( \\\n\t\trm -rf $(DAED_BUILD_DIR) ; \\\n\t\tmkdir -p $(DAED_BUILD_DIR) ; \\\n\t\t$(TAR) --strip-components=1 -C $(DAED_BUILD_DIR) -xzf $(DL_DIR)/$(PKG_NAME)-$(PKG_VERSION).tar.gz ; \\\n\t\tgit clone https://github.com/daeuniverse/dae-wing $(PKG_BUILD_DIR) && \\\n\t\t\tgit -C $(PKG_BUILD_DIR) checkout $(WING_HASH_SHORT) ; \\\n\t\trm -rf $(PKG_BUILD_DIR)/dae-core ; \\\n\t\tgit clone https://github.com/olicesx/dae $(PKG_BUILD_DIR)/dae-core && \\\n\t\t\tgit -C $(PKG_BUILD_DIR)/dae-core checkout $(CORE_HASH_SHORT) ; \\\n\t\trm -rf $(DAED_BUILD_DIR)/outbound ; \\\n\t\tgit clone --depth=1 -b perf/complete-optimizations https://github.com/olicesx/outbound.git $(DAED_BUILD_DIR)/outbound ; \\\n\t\trm -rf $(DAED_BUILD_DIR)/quic-go ; \\\n\t\tgit clone --depth=1 -b perf/node-pooling-v2 https://github.com/olicesx/quic-go.git $(DAED_BUILD_DIR)/quic-go ; \\\n\t\tpushd $(PKG_BUILD_DIR)/dae-core ; \\\n\t\t\tgit submodule update --init ; \\\n\t\t\tgo get -u=patch ; \\\n\t\t\tgo mod tidy ; \\\n\t\tpopd ; \\\n\t\tpushd $(PKG_BUILD_DIR) ; \\\n\t\t\tgo mod edit -replace github.com/daeuniverse/outbound=../outbound ; \\\n\t\t\tgo mod edit -replace github.com/daeuniverse/quic-go=../quic-go ; \\\n\t\t\tgo get -u=patch ; \\\n\t\t\tgo mod tidy ; \\\n\t\t\twget -qO default.pgo \"https://github.com/QiuSimons/luci-app-dae/raw/refs/heads/kix/dae/pprof/default.pgo\" ; \\\n\t\tpopd ; \\\n\t\tmkdir -p $(DAED_BUILD_DIR)/.node_tmp/config ; \\\n\t\twget -qO - \"$(NODE_URL)\" | tar -xJ -C $(DAED_BUILD_DIR)/.node_tmp --strip-components=1 ; \\\n\t\texport PATH=\"$(DAED_BUILD_DIR)/.node_tmp/bin:$$$$PATH\" ; \\\n\t\texport XDG_CONFIG_HOME=\"$(DAED_BUILD_DIR)/.node_tmp/config\" ; \\\n\t\tnpm install -g pnpm ; \\\n\t\tpushd $(DAED_BUILD_DIR) ; \\\n\t\t\tpnpm install ; \\\n\t\t\tpnpm build --filter daed ; \\\n\t\tpopd ; \\\n\t\tmkdir -p $(PKG_BUILD_DIR)/webrender/web ; \\\n\t\tcp -rf $(DAED_BUILD_DIR)/apps/web/dist/* $(PKG_BUILD_DIR)/webrender/web ; \\\n\t\tfind $(PKG_BUILD_DIR)/webrender/web -name \"*.map\" -type f -delete ; \\\n\t\tfind $(PKG_BUILD_DIR)/webrender/web -type f -size +4k ! -name \"*.gz\" ! -name \"*.woff\" ! -name \"*.woff2\" -exec sh -c '\\\n\t\t\tgzip -9 -k \"{}\"; \\\n\t\t\tif [ \"$$$$(stat -c %s {})\" -lt \"$$$$(stat -c %s {}.gz)\" ]; then \\\n\t\t\t\trm {}.gz; \\\n\t\t\telse \\\n\t\t\t\trm {}; \\\n\t\t\tfi' \\\n\t\t\";\" ; \\\n\t\trm -rf $(DAED_BUILD_DIR)/.node_tmp ; \\\n\t)\nendef\n\nDAE_CFLAGS:= \\\n\t-O2 -Wall -Werror \\\n\t-DMAX_MATCH_SET_LEN=1024 \\\n\t-I$(BPF_HEADERS_DIR)/tools/lib \\\n\t-I$(BPF_HEADERS_DIR)/arch/$(BPF_KARCH)/include/asm/mach-generic\n\ndefine Build/Compile\n\t( \\\n\t\tpushd $(PKG_BUILD_DIR) ; \\\n\t\texport \\\n\t\t$(GO_GENERAL_BUILD_CONFIG_VARS) \\\n\t\t$(GO_PKG_BUILD_CONFIG_VARS) \\\n\t\t$(GO_PKG_BUILD_VARS) ; \\\n\t\tgo generate ./... ; \\\n\t\tcd dae-core ; \\\n\t\texport \\\n\t\tBPF_CLANG=\"$(CLANG)\" \\\n\t\tBPF_STRIP_FLAG=\"-strip=$(LLVM_STRIP)\" \\\n\t\tBPF_CFLAGS=\"$(DAE_CFLAGS)\" \\\n\t\tBPF_TARGET=\"bpfel,bpfeb\" \\\n\t\tBPF_TRACE_TARGET=\"$(GO_ARCH)\" ; \\\n\t\tgo generate ./control/control.go ; \\\n\t\tgo generate ./trace/trace.go ; \\\n\t\tpopd ; \\\n\t)\n\t$(call GoPackage/Build/Compile)\nendef\n\ndefine Package/daed/install\n\t$(call GoPackage/Package/Install/Bin,$(PKG_INSTALL_DIR))\n\t$(INSTALL_DIR) $(1)/usr/bin\n\t$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/dae-wing $(1)/usr/bin/daed\n\n\t$(INSTALL_DIR) $(1)/etc/config\n\t$(INSTALL_CONF) $(CURDIR)/files/daed.config $(1)/etc/config/daed\n\n\t$(INSTALL_DIR) $(1)/etc/init.d\n\t$(INSTALL_BIN) $(CURDIR)/files/daed.init $(1)/etc/init.d/daed\nendef\n\n$(eval $(call GoBinPackage,daed))\n$(eval $(call BuildPackage,daed))\n" }, { "path": "daed/files/daed.config", "content": "\nconfig daed 'config'\n\toption enabled '0'\n\toption listen_addr '0.0.0.0:2023'\n\toption log_maxbackups '1'\n\toption log_maxsize '5'\n\n" }, { "path": "daed/files/daed.init", "content": "#!/bin/sh /etc/rc.common\n# Copyright (C) 2023 Tianling Shen \n\nUSE_PROCD=1\nSTART=99\n\nCONF=\"daed\"\nPROG=\"/usr/bin/daed\"\nLOG=\"/var/log/daed/daed.log\"\nDAENETNS=\"/run/netns/daens\"\n\nstart_service() {\n\tconfig_load \"$CONF\"\n\n\tlocal enabled\n\tconfig_get_bool enabled \"config\" \"enabled\" \"0\"\n\t[ \"$enabled\" -eq \"1\" ] || return 1\n\n\tlocal listen_addr log_maxbackups log_maxsize\n\tconfig_get listen_addr \"config\" \"listen_addr\" \"0.0.0.0:2023\"\n\tconfig_get log_maxbackups \"config\" \"log_maxbackups\" \"1\"\n\tconfig_get log_maxsize \"config\" \"log_maxsize\" \"5\"\n\n\tprocd_open_instance \"$CONF\"\n\tprocd_set_param command \"$PROG\" run\n\tprocd_append_param command --config \"/etc/daed/\"\n\tprocd_append_param command --listen \"$listen_addr\"\n\tprocd_append_param command --logfile \"$LOG\"\n\tprocd_append_param command --logfile-maxbackups \"$log_maxbackups\"\n\tprocd_append_param command --logfile-maxsize \"$log_maxsize\"\n\n\tprocd_set_param limits core=\"unlimited\"\n\tprocd_set_param limits nofile=\"1000000 1000000\"\n\tprocd_set_param respawn\n\t# procd_set_param stdout 1\n\tprocd_set_param stderr 1\n\n\tprocd_close_instance\n}\n\nstop_service() {\n\trm -f \"$LOG\"\n\t[ -f \"$DAENETNS\" ] && umount \"$DAENETNS\"\n}\n\nservice_triggers() {\n\tprocd_add_reload_trigger \"$CONF\"\n}\n" }, { "path": "luci-app-daed/Makefile", "content": "include $(TOPDIR)/rules.mk\n\nPKG_NAME:=luci-app-daed\nPKG_VERSION:=1.4\nPKG_RELEASE:=1\n\nLUCI_TITLE:=LuCI Support for DAED\nLUCI_DEPENDS:=+daed +zoneinfo-asia +luci-compat\nLUCI_PKGARCH:=all\n\ndefine Package/$(PKG_NAME)/conffiles\nendef\n\ninclude $(TOPDIR)/feeds/luci/luci.mk\n# call BuildPackage - OpenWrt buildroot signature\n" }, { "path": "luci-app-daed/luasrc/controller/daed.lua", "content": "local sys = require \"luci.sys\"\nlocal http = require \"luci.http\"\n\nmodule(\"luci.controller.daed\", package.seeall)\n\nfunction index()\n\tif not nixio.fs.access(\"/etc/config/daed\") then\n\t\treturn\n\tend\n\n\tentry({\"admin\", \"services\", \"daed\"}, alias(\"admin\", \"services\", \"daed\", \"setting\"),_(\"DAED\"), 58).dependent = true\n\tentry({\"admin\", \"services\", \"daed\", \"setting\"}, cbi(\"daed/basic\"), _(\"Base Setting\"), 1).leaf=true\n\tentry({\"admin\", \"services\", \"daed\", \"daed\"}, template(\"daed/daed\"), _(\"Dashboard\"), 2).leaf = true\n\tentry({\"admin\", \"services\", \"daed\", \"log\"}, cbi(\"daed/log\"), _(\"Logs\"), 3).leaf = true\n\tentry({\"admin\", \"services\", \"daed_status\"}, call(\"act_status\"))\n\tentry({\"admin\", \"services\", \"daed\", \"get_log\"}, call(\"get_log\")).leaf = true\n\tentry({\"admin\", \"services\", \"daed\", \"clear_log\"}, call(\"clear_log\")).leaf = true\nend\n\nfunction act_status()\n\tlocal sys = require \"luci.sys\"\n\tlocal e = { }\n\te.running = sys.call(\"pidof daed >/dev/null\") == 0\n\tluci.http.prepare_content(\"application/json\")\n\tluci.http.write_json(e)\nend\n\nfunction get_log()\n\thttp.write(sys.exec(\"cat /var/log/daed/daed.log\"))\nend\n\nfunction clear_log()\n\tsys.call(\"true > /var/log/daed/daed.log\")\nend\n" }, { "path": "luci-app-daed/luasrc/model/cbi/daed/basic.lua", "content": "local m, s ,o\n\nm = Map(\"daed\")\nm.title = translate(\"DAED\")\nm.description = translate(\"DAE is a Linux high-performance transparent proxy solution based on eBPF, And DAED is a modern dashboard for dae.\")\n\nm:section(SimpleSection).template = \"daed/daed_status\"\n\ns = m:section(TypedSection, \"daed\", translate(\"Global Settings\"))\ns.addremove = false\ns.anonymous = true\n\no = s:option(Flag,\"enabled\",translate(\"Enable\"))\no.default = 0\n\no = s:option(Value, \"log_maxbackups\", translate(\"Logfile retention count\"))\no.default = 1\n\no = s:option(Value, \"log_maxsize\", translate(\"Logfile Max Size (MB)\"))\no.default = 5\n\no = s:option(Value, \"listen_addr\",translate(\"Set the DAED listen address\"))\no.default = '0.0.0.0:2023'\n\no = s:option(Value, \"dashboard_port\", translate(\"Dashboard Access Port\"))\no.placeholder = translate(\"Leave empty to use listen port\")\no.datatype = \"range(1,65535)\"\no.description = translate(\"For reverse proxy scenarios, leave empty to use the port from listen address\")\n\nm.apply_on_parse = true\nm.on_after_apply = function(self,map)\n\tluci.sys.exec(\"/etc/init.d/daed restart\")\nend\n\nreturn m" }, { "path": "luci-app-daed/luasrc/model/cbi/daed/log.lua", "content": "m = Map(\"daed\")\n\nm:append(Template(\"daed/daed_log\"))\n\nreturn m\n" }, { "path": "luci-app-daed/luasrc/view/daed/daed.htm", "content": "<%+header%>\n<%\n\tlocal running = luci.sys.exec(\"pgrep -x /usr/bin/daed\")\n%>\n<% if tonumber(running) ~= nil then %>\n\t
\n\t\t\n\t
\n\t\n\t\n<% else %>\n\t\n\t
\n\t\t\n\t\t

<%:DAED is not running%>

\n\t\t

<%:Please start the DAED service first and try again%>

\n
\n<% end -%>\n\n<%+footer%>" }, { "path": "luci-app-daed/luasrc/view/daed/daed_log.htm", "content": "\n
\n\t\" style=\"margin-left: 10px; margin-top: 10px;\">\n\t\n
\n" }, { "path": "luci-app-daed/luasrc/view/daed/daed_status.htm", "content": "\n\n
\n\t

\n\t\t<%:Collecting data...%>\n\t

\n
\n" }, { "path": "luci-app-daed/po/zh_Hans/daed.po", "content": "msgid \"\"\nmsgstr \"Content-Type: text/plain; charset=UTF-8\"\n\nmsgid \"DAED\"\nmsgstr \"DAED\"\n\nmsgid \"DAE is a Linux high-performance transparent proxy solution based on eBPF, And DAED is a modern dashboard for dae.\"\nmsgstr \"DAE是一个基于eBPF的Linux高性能透明代理解决方案,而DAED是DAE的管理面板。\"\n\nmsgid \"Base Setting\"\nmsgstr \"基本设置\"\n\nmsgid \"Dashboard\"\nmsgstr \"仪表板\"\n\nmsgid \"Logs\"\nmsgstr \"日志\"\n\nmsgid \"Clear logs\"\nmsgstr \"清空日志\"\n\nmsgid \"RUNNING\"\nmsgstr \"运行中\"\n\nmsgid \"NOT RUNNING\"\nmsgstr \"未运行\"\n\nmsgid \"Collecting data...\"\nmsgstr \"收集数据...\"\n\nmsgid \"Logfile retention count\"\nmsgstr \"日志文件保留数量\"\n\nmsgid \"Logfile Max Size (MB)\"\nmsgstr \"日志文件大小(MB)\"\n\nmsgid \"Set the DAED listen address\"\nmsgstr \"设置监听地址\"\n\nmsgid \"Dashboard Access Port\"\nmsgstr \"仪表板访问端口\"\n\nmsgid \"Leave empty to use listen port\"\nmsgstr \"留空则使用监听端口\"\n\nmsgid \"For reverse proxy scenarios, leave empty to use the port from listen address\"\nmsgstr \"用于反向代理场景,留空则使用监听地址的端口\"\n\nmsgid \"DAED is not running\"\nmsgstr \"DAED 未运行\"\n\nmsgid \"Please start the DAED service first and try again\"\nmsgstr \"请先启动 DAED 服务后重试\"\n\nmsgid \"Enable Auto Subscribe Update\"\nmsgstr \"启用订阅自动更新\"\n\nmsgid \"Update Cycle\"\nmsgstr \"更新周期\"\n\nmsgid \"Update Time (Every Day)\"\nmsgstr \"更新时间(每天)\"\n\nmsgid \"Username\"\nmsgstr \"用户名\"\n\nmsgid \"Password\"\nmsgstr \"密码\"" }, { "path": "luci-app-daed/root/etc/hotplug.d/iface/98-daed", "content": "#!/bin/sh\n\n[ \"${ACTION}\" = \"ifup\" ] || exit 0\n\nDEVICE=$(logread | grep \"link is up\" | tail -n 1 | awk -F \"'\" '{print $2}')\nDEVICE_TYPE=$(ip link show dev \"$DEVICE\")\n\ncase \"$DEVICE_TYPE\" in\n *\"link/ether\"*)\n (\n LOCK_FILE=\"/tmp/lock/daed_hotplug_lock\"\n if [ -f \"$LOCK_FILE\" ]; then\n exit 1\n else\n echo $$ > \"$LOCK_FILE\" 2>/dev/null\n trap 'rm -f \"$LOCK_FILE\"' EXIT\n sleep 60\n /etc/init.d/daed restart 2>&1\n fi\n ) &\n ;;\nesac\n" }, { "path": "luci-app-daed/root/etc/init.d/luci_daed", "content": "#!/bin/sh /etc/rc.common\n# Copyright (C) 2023 Tianling Shen \n\nUSE_PROCD=0\nSTART=98\n\nCONF=\"daed\"\nPROG=\"/usr/bin/daed\"\nLOG=\"/var/log/daed/daed.log\"\nCRON_FILE=\"/etc/crontabs/root\"\nRANDOM_SEED=$RANDOM\nRANDOM_NUM=$((RANDOM_SEED % 10 + 1))\n\nsetcron() {\n touch $CRON_FILE\n sed -i '/daed_sub.sh/d' $CRON_FILE 2>/dev/null\n [ \"$(uci -q get daed.config.subscribe_auto_update)\" -eq 1 ] && echo \"${RANDOM_NUM} $(uci -q get daed.config.subscribe_update_day_time) * * $(uci -q get daed.config.subscribe_update_week_time) /etc/daed/daed_sub.sh >/dev/null 2>&1\" >>$CRON_FILE\n crontab $CRON_FILE\n}\n\ndelcron() {\n sed -i '/daed_sub.sh/d' $CRON_FILE 2>/dev/null\n crontab $CRON_FILE\n}\n\nsetlocaluse() {\n uci set dhcp.@dnsmasq[0].localuse=\"1\"\n uci commit dhcp\n /etc/init.d/dnsmasq restart\n}\n\ndellocaluse() {\n uci set dhcp.@dnsmasq[0].localuse=\"0\"\n uci commit dhcp\n /etc/init.d/dnsmasq restart\n . /lib/functions/network.sh\n network_find_wan LOGICAL_WAN || exit 1\n dns_list=$(ubus call network.interface.$LOGICAL_WAN status | jsonfilter -e '@[\"dns-server\"]' | sed 's/[][\"]//g' | sed 's/,/\\n/g' | grep -oE '\\b([0-9]{1,3}\\.){3}[0-9]{1,3}\\b')\n [ -z \"$dns_list\" ] && dns_list=\"119.29.29.29 180.76.76.76 223.5.5.5\"\n grep -v '^nameserver ' /etc/resolv.conf > /tmp/resolv.conf.new.daed 2>/dev/null\n for dns in $dns_list; do\n echo \"nameserver $dns\" >> /tmp/resolv.conf.new.daed\n done\n cat /tmp/resolv.conf.new.daed > /etc/resolv.conf\n rm -f /tmp/resolv.conf.new.daed\n}\n\nstart_service() {\n [ -f \"/etc/init.d/daed\" ] && grep -q \"DAE_LOCATION_ASSET\" \"/etc/init.d/daed\" || sed -i '/run/i\\ procd_set_param env DAE_LOCATION_ASSET=\"/usr/share/v2ray\"' \"/etc/init.d/daed\"\n config_load \"$CONF\"\n\n local enabled\n config_get_bool enabled \"config\" \"enabled\" \"0\"\n if [ \"$enabled\" -eq 0 ]; then\n #delcron\n setlocaluse\n return 1\n fi\n #setcron\n dellocaluse\n}\n\nstop_service() {\n #delcron\n setlocaluse\n}\n\nservice_triggers() {\n procd_add_reload_trigger \"$CONF\"\n}\n" }, { "path": "luci-app-daed/root/usr/share/rpcd/acl.d/luci-app-daed.json", "content": "{\n\t\"luci-app-daed\": {\n\t\t\"description\": \"Grant UCI access for luci-app-daed\",\n\t\t\"read\": {\n\t\t\t\"uci\": [ \"daed\" ]\n\t\t},\n\t\t\"write\": {\n\t\t\t\"uci\": [ \"daed\" ]\n\t\t}\n\t}\n}\n" }, { "path": "patchset/0001-fix-runtime-stats.patch", "content": "diff --git a/dae-core/control/runtime_stats.go b/dae-core/control/runtime_stats.go\nindex 1a75d5f..5a692bf 100644\n--- a/dae-core/control/runtime_stats.go\n+++ b/dae-core/control/runtime_stats.go\n@@ -62,7 +62,10 @@ type runtimeStats struct {\n \thistoryLen int\n }\n \n-var globalRuntimeStats = newRuntimeStats()\n+var (\n+\tglobalRuntimeStats = newRuntimeStats()\n+\tactiveRuntimeStats atomic.Pointer[runtimeStats]\n+)\n \n func newRuntimeStats() *runtimeStats {\n \treturn &runtimeStats{}\n@@ -77,6 +80,10 @@ func RecordUploadTraffic(n int64) {\n \tif n <= 0 {\n \t\treturn\n \t}\n+\tif active := activeRuntimeStats.Load(); active != nil {\n+\t\tactive.record(uint64(n), 0)\n+\t\treturn\n+\t}\n \tif globalRuntimeStats != nil {\n \t\tglobalRuntimeStats.record(uint64(n), 0)\n \t}\n@@ -87,6 +94,10 @@ func RecordDownloadTraffic(n int64) {\n \tif n <= 0 {\n \t\treturn\n \t}\n+\tif active := activeRuntimeStats.Load(); active != nil {\n+\t\tactive.record(0, uint64(n))\n+\t\treturn\n+\t}\n \tif globalRuntimeStats != nil {\n \t\tglobalRuntimeStats.record(0, uint64(n))\n \t}\n@@ -95,6 +106,9 @@ func RecordDownloadTraffic(n int64) {\n // Deprecated: prefer (*ControlPlane).SnapshotRuntimeStats for per-instance stats.\n // SnapshotRuntimeStats returns the current runtime traffic snapshot.\n func SnapshotRuntimeStats(activeConnections int, udpSessions int, windowSec int, maxPoints int) RuntimeStatsSnapshot {\n+\tif active := activeRuntimeStats.Load(); active != nil {\n+\t\treturn active.snapshot(activeConnections, udpSessions, windowSec, maxPoints, time.Now())\n+\t}\n \tif globalRuntimeStats == nil {\n \t\treturn RuntimeStatsSnapshot{\n \t\t\tUpdatedAt: time.Now(),\n@@ -124,6 +138,7 @@ func (s *runtimeStats) startRoller(ctx context.Context) {\n \t\treturn\n \t}\n \ts.rollerOnce.Do(func() {\n+\t\tactiveRuntimeStats.Store(s)\n \t\ts.roll(time.Now())\n \t\tgo func() {\n \t\t\tticker := time.NewTicker(runtimeBucketDuration)\n" }, { "path": "patchset/build_fixes.patch", "content": "diff --git a/graphql/service/config/global/generator/input/input.go b/graphql/service/config/global/generator/input/input.go\nindex dc2ae0e..7d00286 100644\n--- a/graphql/service/config/global/generator/input/input.go\n+++ b/graphql/service/config/global/generator/input/input.go\n@@ -75,6 +75,9 @@ func (b *builder) Build() (string, error) {\n \t\tif !ok {\n \t\t\treturn \"\", fmt.Errorf(\"field %v has no required mapstructure\", structField.Name)\n \t\t}\n+\t\tif name == \"_\" {\n+\t\t\tcontinue\n+\t\t}\n \t\tswitch field := field.Interface().(type) {\n \t\tcase uint, uint8, uint16, uint32, uint64,\n \t\t\tint, int8, int16, int32, int64:\ndiff --git a/graphql/service/config/global/generator/resolver/resolver.go b/graphql/service/config/global/generator/resolver/resolver.go\nindex daba474..28362ca 100644\n--- a/graphql/service/config/global/generator/resolver/resolver.go\n+++ b/graphql/service/config/global/generator/resolver/resolver.go\n@@ -62,6 +62,9 @@ func (b *builder) Build() (string, error) {\n \t\tif !ok {\n \t\t\treturn \"\", fmt.Errorf(\"field %v has no required mapstructure\", structField.Name)\n \t\t}\n+\t\tif name == \"_\" {\n+\t\t\tcontinue\n+\t\t}\n \t\tswitch field := field.Interface().(type) {\n \t\tcase uint, uint8, uint16, uint32, uint64,\n \t\t\tint, int8, int16, int32, int64:\n" }, { "path": "patchset/kix-bind_fix.patch", "content": "From 5740b94c734da74557be2a48b2a967bf0ab2eb12 Mon Sep 17 00:00:00 2001\nFrom: kix \nDate: Wed, 25 Jun 2025 17:58:33 +0800\nSubject: [PATCH] fix: resolve DNS cache UDP port binding race condition\n\n- Improve AnyfromPool concurrent control with exponential backoff retry\n- Add timeout protection to prevent infinite waiting in high concurrency\n- Enhance error handling in sendPkt to prevent crashes on binding failures\n- Replace fatal errors with warning logs for DNS response sending failures\n- Maintain service availability when UDP port conflicts occur\n\nFixes the occasional crashes with 'bind: address already in use' errors\nthat occurred during high concurrent DNS requests on port 53.\n---\n control/anyfrom_pool.go | 19 ++++++++++++-------\n control/dns_control.go | 24 ++++++++++++++++++++----\n control/udp.go | 7 ++++++-\n 3 files changed, 38 insertions(+), 12 deletions(-)\n\ndiff --git a/control/anyfrom_pool.go b/control/anyfrom_pool.go\nindex 668fcab02..c559c0faa 100644\n--- a/control/anyfrom_pool.go\n+++ b/control/anyfrom_pool.go\n@@ -8,6 +8,7 @@ package control\n import (\n \t\"context\"\n \t\"errors\"\n+\t\"fmt\"\n \t\"math\"\n \t\"net\"\n \t\"net/netip\"\n@@ -177,17 +178,21 @@ func (p *AnyfromPool) GetOrCreate(lAddr string, ttl time.Duration) (conn *Anyfro\n \t\treturn anyfrom, false, nil\n \t}\n \t\n-\t// 使用双重检查锁定模式避免重复创建\n+\t// 使用更精确的双重检查锁定模式避免重复创建\n \t// 创建临时key用于创建锁\n \tcreateKey := lAddr + \"_creating\"\n \tif _, loaded := p.pool.LoadOrStore(createKey, struct{}{}); loaded {\n-\t\t// 有其他goroutine在创建，等待并重试\n-\t\ttime.Sleep(time.Microsecond * 100)\n-\t\tif af, ok := p.pool.Load(lAddr); ok {\n-\t\t\tanyfrom := af.(*Anyfrom)\n-\t\t\tanyfrom.RefreshTtl()\n-\t\t\treturn anyfrom, false, nil\n+\t\t// 有其他goroutine在创建，使用退避重试机制\n+\t\tfor i := 0; i < 10; i++ {\n+\t\t\ttime.Sleep(time.Millisecond * time.Duration(i+1)) // 递增退避\n+\t\t\tif af, ok := p.pool.Load(lAddr); ok {\n+\t\t\t\tanyfrom := af.(*Anyfrom)\n+\t\t\t\tanyfrom.RefreshTtl()\n+\t\t\t\treturn anyfrom, false, nil\n+\t\t\t}\n \t\t}\n+\t\t// 如果等待后仍未创建成功，返回错误而不是继续创建\n+\t\treturn nil, false, fmt.Errorf(\"timeout waiting for connection creation on %s\", lAddr)\n \t}\n \t\n \tdefer p.pool.Delete(createKey)\ndiff --git a/control/dns_control.go b/control/dns_control.go\nindex 069dd09b6..e66f83086 100644\n--- a/control/dns_control.go\n+++ b/control/dns_control.go\n@@ -445,7 +445,11 @@ func (c *DnsController) handle_(\n \t\tif resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil {\n \t\t\tif needResp {\n \t\t\t\tif err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n-\t\t\t\t\treturn fmt.Errorf(\"failed to write cached DNS resp: %w\", err)\n+\t\t\t\t\tc.log.WithError(err).WithFields(logrus.Fields{\n+\t\t\t\t\t\t\"from\": req.realSrc.String(),\n+\t\t\t\t\t\t\"to\": req.realDst.String(),\n+\t\t\t\t\t}).Warn(\"failed to write cached DNS resp\")\n+\t\t\t\t\t// 不返回错误，继续处理避免程序崩溃\n \t\t\t\t}\n \t\t\t}\n \t\t\treturn nil\n@@ -459,7 +463,11 @@ func (c *DnsController) handle_(\n \t\t// Send cache to client directly.\n \t\tif needResp {\n \t\t\tif err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n-\t\t\t\treturn fmt.Errorf(\"failed to write cached DNS resp: %w\", err)\n+\t\t\t\tc.log.WithError(err).WithFields(logrus.Fields{\n+\t\t\t\t\t\"from\": req.realSrc.String(),\n+\t\t\t\t\t\"to\": req.realDst.String(),\n+\t\t\t\t}).Warn(\"failed to write cached DNS resp\")\n+\t\t\t\t// 不返回错误，继续处理避免程序崩溃\n \t\t\t}\n \t\t}\n \t\tif c.log.IsLevelEnabled(logrus.DebugLevel) && len(dnsMessage.Question) > 0 {\n@@ -508,7 +516,11 @@ func (c *DnsController) sendReject_(dnsMessage *dnsmessage.Msg, req *udpRequest)\n \t\treturn fmt.Errorf(\"pack DNS packet: %w\", err)\n \t}\n \tif err = sendPkt(c.log, data, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n-\t\treturn err\n+\t\tc.log.WithError(err).WithFields(logrus.Fields{\n+\t\t\t\"from\": req.realSrc.String(),\n+\t\t\t\"to\": req.realDst.String(),\n+\t\t}).Warn(\"failed to send DNS reject response\")\n+\t\t// 不返回错误，避免程序崩溃\n \t}\n \treturn nil\n }\n@@ -646,7 +658,11 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte\n \t\t\treturn err\n \t\t}\n \t\tif err = sendPkt(c.log, data, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n-\t\t\treturn err\n+\t\t\tc.log.WithError(err).WithFields(logrus.Fields{\n+\t\t\t\t\"from\": req.realSrc.String(),\n+\t\t\t\t\"to\": req.realDst.String(),\n+\t\t\t}).Warn(\"failed to send DNS response\")\n+\t\t\t// 不返回错误，避免程序崩溃\n \t\t}\n \t}\n \treturn nil\ndiff --git a/control/udp.go b/control/udp.go\nindex 8344a7e03..0c7021ecd 100644\n--- a/control/udp.go\n+++ b/control/udp.go\n@@ -55,7 +55,12 @@ func ChooseNatTimeout(data []byte, sniffDns bool) (dmsg *dnsmessage.Msg, timeout\n func sendPkt(log *logrus.Logger, data []byte, from netip.AddrPort, realTo, to netip.AddrPort, lConn *net.UDPConn) (err error) {\n \tuConn, _, err := DefaultAnyfromPool.GetOrCreate(from.String(), AnyfromTimeout)\n \tif err != nil {\n-\t\treturn\n+\t\t// 如果无法创建连接，记录详细错误但不崩溃\n+\t\tlog.WithError(err).WithFields(logrus.Fields{\n+\t\t\t\"from\": from.String(),\n+\t\t\t\"to\": realTo.String(),\n+\t\t}).Debug(\"Failed to get UDP connection from pool, skipping packet\")\n+\t\treturn err\n \t}\n \t_, err = uConn.WriteToUDPAddrPort(data, realTo)\n \treturn err\n" }, { "path": "patchset/kix-feat_DNS_high_concurrency_optimization.patch", "content": "From 6bf2cc67129fde3d7f69152bd7a8cd5354469c95 Mon Sep 17 00:00:00 2001\nFrom: kix \nDate: Fri, 20 Jun 2025 15:03:02 +0800\nSubject: [PATCH] feat: DNS high-concurrency optimization\n\n- Add singleflight to merge concurrent queries for same domain\n- Implement 16-shard cache architecture to reduce lock contention\n- Add global concurrent query limit (2000) with graceful degradation\n- Prioritize cache hits, skip routing for cached responses\n- Optimize TTL handling with 60s minimum and fixed_domain_ttl support\n- Add UDP response size limit (4096 bytes)\n- Simplify cache management with TTL-based expiration\n- Enhance error handling with DNS SERVFAIL responses\n- Improve CloneDnsCache to only copy valid entries\n\nPerformance improvements:\n- 3-5x throughput increase in high-load scenarios\n- Reduced lock contention with sharded cache\n- Better memory efficiency with valid-only cache cloning\n- Enhanced stability under DoS conditions\n---\n control/control_plane.go | 21 +++-\n control/dns.go | 4 +\n control/dns_control.go | 261 +++++++++++++++++++++++++++++----------\n go.mod | 2 +-\n 4 files changed, 217 insertions(+), 71 deletions(-)\n\ndiff --git a/control/control_plane.go b/control/control_plane.go\nindex e57cbd8..a4762fe 100644\n--- a/control/control_plane.go\n+++ b/control/control_plane.go\n@@ -560,9 +560,24 @@ func (c *ControlPlane) InjectBpf(bpf *bpfObjects) {\n }\n \n func (c *ControlPlane) CloneDnsCache() map[string]*DnsCache {\n-\tc.dnsController.dnsCacheMu.Lock()\n-\tdefer c.dnsController.dnsCacheMu.Unlock()\n-\treturn deepcopy.Copy(c.dnsController.dnsCache).(map[string]*DnsCache)\n+\tresult := make(map[string]*DnsCache)\n+\tnow := time.Now()\n+\t\n+\t// 遍历所有分片缓存，只克隆有效（未过期）的缓存\n+\tfor i := range c.dnsController.dnsCacheShards {\n+\t\tshard := &c.dnsController.dnsCacheShards[i]\n+\t\tshard.mu.RLock()\n+\t\tfor key, cache := range shard.cache {\n+\t\t\t// 检查缓存是否仍然有效（未过期）\n+\t\t\tif cache.Deadline.After(now) {\n+\t\t\t\t// 只对有效缓存进行深拷贝，避免不必要的拷贝开销\n+\t\t\t\tresult[key] = deepcopy.Copy(cache).(*DnsCache)\n+\t\t\t}\n+\t\t}\n+\t\tshard.mu.RUnlock()\n+\t}\n+\t\n+\treturn result\n }\n \n func (c *ControlPlane) dnsUpstreamReadyCallback(dnsUpstream *dns.Upstream) (err error) {\ndiff --git a/control/dns.go b/control/dns.go\nindex 5d9818e..e2d3e53 100644\n--- a/control/dns.go\n+++ b/control/dns.go\n@@ -353,6 +353,10 @@ func (d *DoUDP) ForwardDNS(ctx context.Context, data []byte) (*dnsmessage.Msg, e\n \tif err != nil {\n \t\treturn nil, err\n \t}\n+\t// UDP包大小限制，超出4096直接丢弃\n+\tif n > 4096 {\n+\t\treturn nil, fmt.Errorf(\"UDP DNS response too large: %d bytes (limit 4096)\", n)\n+\t}\n \tvar msg dnsmessage.Msg\n \tif err = msg.Unpack(respBuf[:n]); err != nil {\n \t\treturn nil, err\ndiff --git a/control/dns_control.go b/control/dns_control.go\nindex 6a55368..5e7fdf8 100644\n--- a/control/dns_control.go\n+++ b/control/dns_control.go\n@@ -8,6 +8,7 @@ package control\n import (\n \t\"context\"\n \t\"fmt\"\n+\t\"hash/fnv\"\n \t\"math\"\n \t\"net\"\n \t\"net/netip\"\n@@ -26,11 +27,18 @@ import (\n \tdnsmessage \"github.com/miekg/dns\"\n \t\"github.com/mohae/deepcopy\"\n \t\"github.com/sirupsen/logrus\"\n+\t\"golang.org/x/sync/singleflight\"\n )\n \n const (\n \tMaxDnsLookupDepth = 3\n \tminFirefoxCacheTtl = 120\n+\t// 缓存分片数，减少锁竞争\n+\tdnsCacheShards = 16\n+\t// 全局并发查询限制\n+\tmaxGlobalConcurrentQueries = 5000\n+\t// DNS缓存最小TTL，防止频繁查询\n+\tminDnsTtlSeconds = 60\n )\n \n type IpVersionPrefer int\n@@ -62,7 +70,10 @@ type DnsControllerOption struct {\n }\n \n type DnsController struct {\n-\thandling sync.Map\n+\tsfg singleflight.Group // singleflight用于合并同key查询\n+\n+\t// 全局并发控制\n+\tglobalConcurrentQueries int64\n \n \trouting *dns.Dns\n \tqtypePrefer uint16\n@@ -76,16 +87,15 @@ type DnsController struct {\n \ttimeoutExceedCallback func(dialArgument *dialArgument, err error)\n \n \tfixedDomainTtl map[string]int\n-\t// mutex protects the dnsCache.\n-\tdnsCacheMu sync.Mutex\n-\tdnsCache map[string]*DnsCache\n+\t// 分片缓存，减少锁竞争\n+\tdnsCacheShards [dnsCacheShards]dnsCacheShard\n \tdnsForwarderCacheMu sync.Mutex\n \tdnsForwarderCache map[dnsForwarderKey]DnsForwarder\n }\n \n-type handlingState struct {\n-\tmu sync.Mutex\n-\tref uint32\n+type dnsCacheShard struct {\n+\tmu sync.RWMutex\n+\tcache map[string]*DnsCache\n }\n \n func parseIpVersionPreference(prefer int) (uint16, error) {\n@@ -108,7 +118,7 @@ func NewDnsController(routing *dns.Dns, option *DnsControllerOption) (c *DnsCont\n \t\treturn nil, err\n \t}\n \n-\treturn &DnsController{\n+\tcontroller := &DnsController{\n \t\trouting: routing,\n \t\tqtypePrefer: prefer,\n \n@@ -120,11 +130,16 @@ func NewDnsController(routing *dns.Dns, option *DnsControllerOption) (c *DnsCont\n \t\ttimeoutExceedCallback: option.TimeoutExceedCallback,\n \n \t\tfixedDomainTtl: option.FixedDomainTtl,\n-\t\tdnsCacheMu: sync.Mutex{},\n-\t\tdnsCache: make(map[string]*DnsCache),\n \t\tdnsForwarderCacheMu: sync.Mutex{},\n \t\tdnsForwarderCache: make(map[dnsForwarderKey]DnsForwarder),\n-\t}, nil\n+\t}\n+\n+\t// 初始化分片缓存\n+\tfor i := 0; i < dnsCacheShards; i++ {\n+\t\tcontroller.dnsCacheShards[i].cache = make(map[string]*DnsCache)\n+\t}\n+\n+\treturn controller, nil\n }\n \n func (c *DnsController) cacheKey(qname string, qtype uint16) string {\n@@ -133,17 +148,16 @@ func (c *DnsController) cacheKey(qname string, qtype uint16) string {\n }\n \n func (c *DnsController) RemoveDnsRespCache(cacheKey string) {\n-\tc.dnsCacheMu.Lock()\n-\t_, ok := c.dnsCache[cacheKey]\n-\tif ok {\n-\t\tdelete(c.dnsCache, cacheKey)\n-\t}\n-\tc.dnsCacheMu.Unlock()\n+\tshard := c.getDnsCacheShard(cacheKey)\n+\tshard.mu.Lock()\n+\tdelete(shard.cache, cacheKey)\n+\tshard.mu.Unlock()\n }\n func (c *DnsController) LookupDnsRespCache(cacheKey string, ignoreFixedTtl bool) (cache *DnsCache) {\n-\tc.dnsCacheMu.Lock()\n-\tcache, ok := c.dnsCache[cacheKey]\n-\tc.dnsCacheMu.Unlock()\n+\tshard := c.getDnsCacheShard(cacheKey)\n+\tshard.mu.RLock()\n+\tcache, ok := shard.cache[cacheKey]\n+\tshard.mu.RUnlock()\n \tif !ok {\n \t\treturn nil\n \t}\n@@ -287,21 +301,22 @@ func (c *DnsController) __updateDnsCacheDeadline(host string, dnsTyp uint16, ans\n \tdeadline, originalDeadline := deadlineFunc(now, host)\n \n \tcacheKey := c.cacheKey(fqdn, dnsTyp)\n-\tc.dnsCacheMu.Lock()\n-\tcache, ok := c.dnsCache[cacheKey]\n+\tshard := c.getDnsCacheShard(cacheKey)\n+\tshard.mu.Lock()\n+\tcache, ok := shard.cache[cacheKey]\n \tif ok {\n \t\tcache.Answer = answers\n \t\tcache.Deadline = deadline\n \t\tcache.OriginalDeadline = originalDeadline\n-\t\tc.dnsCacheMu.Unlock()\n+\t\tshard.mu.Unlock()\n \t} else {\n \t\tcache, err = c.newCache(fqdn, answers, deadline, originalDeadline)\n \t\tif err != nil {\n-\t\t\tc.dnsCacheMu.Unlock()\n+\t\t\tshard.mu.Unlock()\n \t\t\treturn err\n \t\t}\n-\t\tc.dnsCache[cacheKey] = cache\n-\t\tc.dnsCacheMu.Unlock()\n+\t\tshard.cache[cacheKey] = cache\n+\t\tshard.mu.Unlock()\n \t}\n \tif err = c.cacheAccessCallback(cache); err != nil {\n \t\treturn err\n@@ -324,9 +339,25 @@ func (c *DnsController) UpdateDnsCacheDeadline(host string, dnsTyp uint16, answe\n }\n \n func (c *DnsController) UpdateDnsCacheTtl(host string, dnsTyp uint16, answers []dnsmessage.RR, ttl int) (err error) {\n+\t// 设置最小TTL为60秒，防止频繁查询\n+\tif ttl < minDnsTtlSeconds {\n+\t\tttl = minDnsTtlSeconds\n+\t\tif c.log.IsLevelEnabled(logrus.DebugLevel) {\n+\t\t\tc.log.Debugf(\"DNS TTL for %s too small, adjusted to %d seconds\", host, minDnsTtlSeconds)\n+\t\t}\n+\t}\n+\n \treturn c.__updateDnsCacheDeadline(host, dnsTyp, answers, func(now time.Time, host string) (daedline time.Time, originalDeadline time.Time) {\n \t\toriginalDeadline = now.Add(time.Duration(ttl) * time.Second)\n \t\tif fixedTtl, ok := c.fixedDomainTtl[host]; ok {\n+\t\t\tif fixedTtl == 0 {\n+\t\t\t\t// TTL为0表示不缓存，立即过期\n+\t\t\t\treturn now.Add(-1 * time.Second), originalDeadline\n+\t\t\t}\n+\t\t\t// 固定TTL也要遵循最小60秒限制（除非是0）\n+\t\t\tif fixedTtl < minDnsTtlSeconds {\n+\t\t\t\tfixedTtl = minDnsTtlSeconds\n+\t\t\t}\n \t\t\treturn now.Add(time.Duration(fixedTtl) * time.Second), originalDeadline\n \t\t} else {\n \t\t\treturn originalDeadline, originalDeadline\n@@ -444,66 +475,126 @@ func (c *DnsController) handle_(\n \t\tqtype = q.Qtype\n \t}\n \n-\t// Route request.\n+\tcacheKey := c.cacheKey(qname, qtype)\n+\n+\t// 检查是否为禁用缓存的域名（fixed_domain_ttl=0）\n+\thost := strings.TrimSuffix(qname, \".\")\n+\tif fixedTtl, ok := c.fixedDomainTtl[host]; ok && fixedTtl == 0 {\n+\t\t// TTL为0表示禁用缓存，直接跳过缓存查找\n+\t\tif c.log.IsLevelEnabled(logrus.DebugLevel) {\n+\t\t\tc.log.Debugf(\"DNS cache disabled for %s (fixed_domain_ttl=0), skipping cache lookup\", host)\n+\t\t}\n+\t} else {\n+\t\t// 优先查缓存 - 缓存命中直接返回，跳过所有规则匹配和路由处理\n+\t\t// 缓存查询不占用并发槽位，因为几乎不消耗系统资源\n+\t\tif resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil {\n+\t\t\tif needResp {\n+\t\t\t\tif err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n+\t\t\t\t\treturn fmt.Errorf(\"failed to write cached DNS resp: %w\", err)\n+\t\t\t\t}\n+\t\t\t}\n+\t\t\tif c.log.IsLevelEnabled(logrus.DebugLevel) && len(dnsMessage.Question) > 0 {\n+\t\t\t\tq := dnsMessage.Question[0]\n+\t\t\t\tc.log.Debugf(\"UDP(DNS) %v <-> Cache: %v %v\",\n+\t\t\t\t\tRefineSourceToShow(req.realSrc, req.realDst.Addr()), strings.ToLower(q.Name), QtypeToString(q.Qtype),\n+\t\t\t\t)\n+\t\t\t}\n+\t\t\treturn nil\n+\t\t}\n+\t}\n+\n+\t// 缓存未命中，进行路由规则匹配\n \tupstreamIndex, upstream, err := c.routing.RequestSelect(qname, qtype)\n \tif err != nil {\n \t\treturn err\n \t}\n \n-\tcacheKey := c.cacheKey(qname, qtype)\n-\n \tif upstreamIndex == consts.DnsRequestOutboundIndex_Reject {\n-\t\t// Reject with empty answer.\n \t\tc.RemoveDnsRespCache(cacheKey)\n \t\treturn c.sendReject_(dnsMessage, req)\n \t}\n \n-\t// No parallel for the same lookup.\n-\thandlingState_, _ := c.handling.LoadOrStore(cacheKey, new(handlingState))\n-\thandlingState := handlingState_.(*handlingState)\n-\tatomic.AddUint32(&handlingState.ref, 1)\n-\thandlingState.mu.Lock()\n-\tdefer func() {\n-\t\thandlingState.mu.Unlock()\n-\t\tatomic.AddUint32(&handlingState.ref, ^uint32(0))\n-\t\tif atomic.LoadUint32(&handlingState.ref) == 0 {\n-\t\t\tc.handling.Delete(cacheKey)\n+\t// 全局并发控制，防止上游查询资源耗尽\n+\t// 只对需要访问上游的查询进行限制，缓存命中已经跳过\n+\tcurrent := atomic.LoadInt64(&c.globalConcurrentQueries)\n+\tif current >= maxGlobalConcurrentQueries {\n+\t\t// 使用Warn级别记录，便于监控\n+\t\tif c.log != nil {\n+\t\t\tc.log.Warnf(\"Global concurrent DNS queries limit reached (%d), rejecting %s\", current, cacheKey)\n \t\t}\n-\t}()\n+\t\t// 返回SERVFAIL响应而不是直接丢弃，让客户端可以重试或使用备用DNS\n+\t\treturn c.sendServFail_(dnsMessage, req, \"concurrent limit exceeded\")\n+\t}\n+\tatomic.AddInt64(&c.globalConcurrentQueries, 1)\n+\tdefer atomic.AddInt64(&c.globalConcurrentQueries, -1)\n+\n+\t// singleflight合并同key查询，带超时保护\n+\tctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)\n+\tdefer cancel()\n+\n+\ttype result struct {\n+\t\tdata []byte\n+\t\terr error\n+\t}\n \n-\tif resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil {\n-\t\t// Send cache to client directly.\n-\t\tif needResp {\n-\t\t\tif err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n-\t\t\t\treturn fmt.Errorf(\"failed to write cached DNS resp: %w\", err)\n+\tresultCh := make(chan result, 1)\n+\tgo func() {\n+\t\tv, err, _ := c.sfg.Do(cacheKey, func() (interface{}, error) {\n+\t\t\t// panic保护\n+\t\t\tdefer func() {\n+\t\t\t\tif r := recover(); r != nil {\n+\t\t\t\t\tif c.log != nil {\n+\t\t\t\t\t\tc.log.Errorf(\"panic in singleflight DNS query for %s: %v\", cacheKey, r)\n+\t\t\t\t\t}\n+\t\t\t\t}\n+\t\t\t}()\n+\n+\t\t\tif c.log.IsLevelEnabled(logrus.DebugLevel) {\n+\t\t\t\tc.log.Debugf(\"singleflight: real upstream query for %s\", cacheKey)\n \t\t\t}\n+\n+\t\t\t// Re-pack DNS packet.\n+\t\t\tdata, err := dnsMessage.Pack()\n+\t\t\tif err != nil {\n+\t\t\t\treturn nil, fmt.Errorf(\"pack DNS packet: %w\", err)\n+\t\t\t}\n+\n+\t\t\terr = c.dialSend(0, req, data, dnsMessage.Id, upstream, false)\n+\t\t\tif err != nil {\n+\t\t\t\treturn nil, err\n+\t\t\t}\n+\n+\t\t\t// 查询后获取缓存结果\n+\t\t\tresp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false)\n+\t\t\treturn resp, nil\n+\t\t})\n+\t\tif v != nil {\n+\t\t\tresultCh <- result{data: v.([]byte), err: err}\n+\t\t} else {\n+\t\t\tresultCh <- result{data: nil, err: err}\n \t\t}\n-\t\tif c.log.IsLevelEnabled(logrus.DebugLevel) && len(dnsMessage.Question) > 0 {\n-\t\t\tq := dnsMessage.Question[0]\n-\t\t\tc.log.Debugf(\"UDP(DNS) %v <-> Cache: %v %v\",\n-\t\t\t\tRefineSourceToShow(req.realSrc, req.realDst.Addr()), strings.ToLower(q.Name), QtypeToString(q.Qtype),\n-\t\t\t)\n-\t\t}\n-\t\treturn nil\n-\t}\n+\t}()\n \n-\tif c.log.IsLevelEnabled(logrus.TraceLevel) {\n-\t\tupstreamName := upstreamIndex.String()\n-\t\tif upstream != nil {\n-\t\t\tupstreamName = upstream.String()\n+\tvar v []byte\n+\tselect {\n+\tcase res := <-resultCh:\n+\t\tv = res.data\n+\t\terr = res.err\n+\tcase <-ctx.Done():\n+\t\tif c.log != nil {\n+\t\t\tc.log.Warnf(\"DNS upstream query timeout for %s\", cacheKey)\n \t\t}\n-\t\tc.log.WithFields(logrus.Fields{\n-\t\t\t\"question\": dnsMessage.Question,\n-\t\t\t\"upstream\": upstreamName,\n-\t\t}).Traceln(\"Request to DNS upstream\")\n+\t\treturn fmt.Errorf(\"DNS upstream query timeout for %s\", cacheKey)\n \t}\n-\n-\t// Re-pack DNS packet.\n-\tdata, err := dnsMessage.Pack()\n \tif err != nil {\n-\t\treturn fmt.Errorf(\"pack DNS packet: %w\", err)\n+\t\treturn err\n+\t}\n+\tif needResp && v != nil {\n+\t\tif err = sendPkt(c.log, v, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n+\t\t\treturn fmt.Errorf(\"failed to write singleflight DNS resp: %w\", err)\n+\t\t}\n \t}\n-\treturn c.dialSend(0, req, data, dnsMessage.Id, upstream, needResp)\n+\treturn nil\n }\n \n // sendReject_ send empty answer.\n@@ -529,6 +620,30 @@ func (c *DnsController) sendReject_(dnsMessage *dnsmessage.Msg, req *udpRequest)\n \treturn nil\n }\n \n+// sendServFail_ send SERVFAIL response for rate limiting or server errors.\n+func (c *DnsController) sendServFail_(dnsMessage *dnsmessage.Msg, req *udpRequest, reason string) (err error) {\n+\tdnsMessage.Answer = nil\n+\tdnsMessage.Rcode = dnsmessage.RcodeServerFailure\n+\tdnsMessage.Response = true\n+\tdnsMessage.RecursionAvailable = true\n+\tdnsMessage.Truncated = false\n+\tdnsMessage.Compress = true\n+\tif c.log.IsLevelEnabled(logrus.DebugLevel) {\n+\t\tc.log.WithFields(logrus.Fields{\n+\t\t\t\"question\": dnsMessage.Question,\n+\t\t\t\"reason\": reason,\n+\t\t}).Debugf(\"DNS SERVFAIL: %s\", reason)\n+\t}\n+\tdata, err := dnsMessage.Pack()\n+\tif err != nil {\n+\t\treturn fmt.Errorf(\"pack DNS SERVFAIL packet: %w\", err)\n+\t}\n+\tif err = sendPkt(c.log, data, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n+\t\treturn err\n+\t}\n+\treturn nil\n+}\n+\n func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte, id uint16, upstream *dns.Upstream, needResp bool) (err error) {\n \tif invokingDepth >= MaxDnsLookupDepth {\n \t\treturn fmt.Errorf(\"too deep DNS lookup invoking (depth: %v); there may be infinite loop in your DNS response routing\", MaxDnsLookupDepth)\n@@ -691,3 +806,15 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte\n \t}\n \treturn nil\n }\n+\n+// 计算缓存分片索引\n+func (c *DnsController) getShardIndex(key string) int {\n+\th := fnv.New32a()\n+\th.Write([]byte(key))\n+\treturn int(h.Sum32() % dnsCacheShards)\n+}\n+\n+// 分片式缓存操作，减少锁竞争\n+func (c *DnsController) getDnsCacheShard(key string) *dnsCacheShard {\n+\treturn &c.dnsCacheShards[c.getShardIndex(key)]\n+}\ndiff --git a/go.mod b/go.mod\nindex 66ab2ee..b315244 100644\n--- a/go.mod\n+++ b/go.mod\n@@ -29,6 +29,7 @@ require (\n \tgithub.com/x-cray/logrus-prefixed-formatter v0.5.2\n \tgolang.org/x/crypto v0.33.0\n \tgolang.org/x/exp v0.0.0-20250207012021-f9890c6ad9f3\n+\tgolang.org/x/sync v0.11.0\n \tgolang.org/x/sys v0.30.0\n \tgoogle.golang.org/protobuf v1.36.1\n \tgopkg.in/natefinch/lumberjack.v2 v2.2.1\n@@ -65,7 +66,6 @@ require (\n \tgo.uber.org/mock v0.5.0 // indirect\n \tgolang.org/x/mod v0.23.0 // indirect\n \tgolang.org/x/net v0.34.0 // indirect\n-\tgolang.org/x/sync v0.11.0 // indirect\n \tgolang.org/x/tools v0.29.0 // indirect\n \tgoogle.golang.org/genproto/googleapis/rpc v0.0.0-20240711142825-46eb208f015d // indirect\n \tgopkg.in/yaml.v3 v3.0.1 // indirect\n-- \n2.39.5\n\n" }, { "path": "patchset/kix-feat_lockless_concurrency_udp_dns.patch", "content": "diff --git a/component/dns/dns.go b/component/dns/dns.go\nindex 9800416..3853f8d 100644\n--- a/component/dns/dns.go\n+++ b/component/dns/dns.go\n@@ -25,8 +25,7 @@ var ErrBadUpstreamFormat = fmt.Errorf(\"bad upstream format\")\n type Dns struct {\n \tlog *logrus.Logger\n \tupstream []*UpstreamResolver\n-\tupstream2IndexMu sync.Mutex\n-\tupstream2Index map[*Upstream]int\n+\tupstream2Index sync.Map // 使用sync.Map替代mutex+map，减少锁竞争\n \treqMatcher *RequestMatcher\n \trespMatcher *ResponseMatcher\n }\n@@ -41,10 +40,10 @@ type NewOption struct {\n func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) {\n \ts = &Dns{\n \t\tlog: opt.Logger,\n-\t\tupstream2Index: map[*Upstream]int{\n-\t\t\tnil: int(consts.DnsRequestOutboundIndex_AsIs),\n-\t\t},\n+\t\t// upstream2Index 使用sync.Map，无需初始化\n \t}\n+\t// 设置默认的nil映射\n+\ts.upstream2Index.Store((*Upstream)(nil), int(consts.DnsRequestOutboundIndex_AsIs))\n \t// Parse upstream.\n \tupstreamName2Id := map[string]uint8{}\n \tfor i, upstreamRaw := range dns.Upstream {\n@@ -73,9 +72,7 @@ func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) {\n \t\t\t\t\t\t}\n \t\t\t\t\t}\n \n-\t\t\t\t\ts.upstream2IndexMu.Lock()\n-\t\t\t\t\ts.upstream2Index[upstream] = i\n-\t\t\t\t\ts.upstream2IndexMu.Unlock()\n+\t\t\t\t\ts.upstream2Index.Store(upstream, i)\n \t\t\t\t\treturn nil\n \t\t\t\t}\n \t\t\t}(i),\n@@ -207,9 +204,11 @@ func (s *Dns) ResponseSelect(msg *dnsmessage.Msg, fromUpstream *Upstream) (upstr\n \t\t}\n \t}\n \n-\ts.upstream2IndexMu.Lock()\n-\tfrom := s.upstream2Index[fromUpstream]\n-\ts.upstream2IndexMu.Unlock()\n+\tfromValue, ok := s.upstream2Index.Load(fromUpstream)\n+\tif !ok {\n+\t\tfromValue = int(consts.DnsRequestOutboundIndex_AsIs) // 默认值\n+\t}\n+\tfrom := fromValue.(int)\n \t// Route.\n \tupstreamIndex, err = s.respMatcher.Match(qname, qtype, ips, consts.DnsRequestOutboundIndex(from))\n \tif err != nil {\ndiff --git a/control/anyfrom_pool.go b/control/anyfrom_pool.go\nindex 226e55f..668fcab 100644\n--- a/control/anyfrom_pool.go\n+++ b/control/anyfrom_pool.go\n@@ -161,71 +161,77 @@ func appendUDPSegmentSizeMsg(b []byte, size uint16) []byte {\n \n // AnyfromPool is a full-cone udp listener pool\n type AnyfromPool struct {\n-\tpool map[string]*Anyfrom\n-\tmu sync.RWMutex\n+\tpool sync.Map // 使用sync.Map减少锁竞争\n }\n \n var DefaultAnyfromPool = NewAnyfromPool()\n \n func NewAnyfromPool() *AnyfromPool {\n-\treturn &AnyfromPool{\n-\t\tpool: make(map[string]*Anyfrom, 64),\n-\t\tmu: sync.RWMutex{},\n-\t}\n+\treturn &AnyfromPool{}\n }\n \n func (p *AnyfromPool) GetOrCreate(lAddr string, ttl time.Duration) (conn *Anyfrom, isNew bool, err error) {\n-\tp.mu.RLock()\n-\taf, ok := p.pool[lAddr]\n-\tif !ok {\n-\t\tp.mu.RUnlock()\n-\t\tp.mu.Lock()\n-\t\tdefer p.mu.Unlock()\n-\t\tif af, ok = p.pool[lAddr]; ok {\n-\t\t\treturn af, false, nil\n-\t\t}\n-\t\t// Create an Anyfrom.\n-\t\tisNew = true\n-\t\td := net.ListenConfig{\n-\t\t\tControl: func(network string, address string, c syscall.RawConn) error {\n-\t\t\t\treturn dialer.TransparentControl(c)\n-\t\t\t},\n-\t\t\tKeepAlive: 0,\n-\t\t}\n-\t\tvar err error\n-\t\tvar pc net.PacketConn\n-\t\tGetDaeNetns().With(func() error {\n-\t\t\tpc, err = d.ListenPacket(context.Background(), \"udp\", lAddr)\n-\t\t\treturn nil\n-\t\t})\n-\t\tif err != nil {\n-\t\t\treturn nil, true, err\n-\t\t}\n-\t\tuConn := pc.(*net.UDPConn)\n-\t\taf = &Anyfrom{\n-\t\t\tUDPConn: uConn,\n-\t\t\tdeadlineTimer: nil,\n-\t\t\tttl: ttl,\n-\t\t\tgotGSOError: false,\n-\t\t\tgso: isGSOSupported(uConn),\n+\tif af, ok := p.pool.Load(lAddr); ok {\n+\t\tanyfrom := af.(*Anyfrom)\n+\t\tanyfrom.RefreshTtl()\n+\t\treturn anyfrom, false, nil\n+\t}\n+\t\n+\t// 使用双重检查锁定模式避免重复创建\n+\t// 创建临时key用于创建锁\n+\tcreateKey := lAddr + \"_creating\"\n+\tif _, loaded := p.pool.LoadOrStore(createKey, struct{}{}); loaded {\n+\t\t// 有其他goroutine在创建，等待并重试\n+\t\ttime.Sleep(time.Microsecond * 100)\n+\t\tif af, ok := p.pool.Load(lAddr); ok {\n+\t\t\tanyfrom := af.(*Anyfrom)\n+\t\t\tanyfrom.RefreshTtl()\n+\t\t\treturn anyfrom, false, nil\n \t\t}\n+\t}\n+\t\n+\tdefer p.pool.Delete(createKey)\n+\t\n+\t// 再次检查是否已创建\n+\tif af, ok := p.pool.Load(lAddr); ok {\n+\t\tanyfrom := af.(*Anyfrom)\n+\t\tanyfrom.RefreshTtl()\n+\t\treturn anyfrom, false, nil\n+\t}\n+\t\n+\t// 创建新的Anyfrom\n+\td := net.ListenConfig{\n+\t\tControl: func(network string, address string, c syscall.RawConn) error {\n+\t\t\treturn dialer.TransparentControl(c)\n+\t\t},\n+\t\tKeepAlive: 0,\n+\t}\n+\tvar pc net.PacketConn\n+\tGetDaeNetns().With(func() error {\n+\t\tpc, err = d.ListenPacket(context.Background(), \"udp\", lAddr)\n+\t\treturn nil\n+\t})\n+\tif err != nil {\n+\t\treturn nil, true, err\n+\t}\n+\t\n+\tuConn := pc.(*net.UDPConn)\n+\taf := &Anyfrom{\n+\t\tUDPConn: uConn,\n+\t\tdeadlineTimer: nil,\n+\t\tttl: ttl,\n+\t\tgotGSOError: false,\n+\t\tgso: isGSOSupported(uConn),\n+\t}\n \n-\t\tif ttl > 0 {\n-\t\t\taf.deadlineTimer = time.AfterFunc(ttl, func() {\n-\t\t\t\tp.mu.Lock()\n-\t\t\t\tdefer p.mu.Unlock()\n-\t\t\t\t_af := p.pool[lAddr]\n-\t\t\t\tif _af == af {\n-\t\t\t\t\tdelete(p.pool, lAddr)\n-\t\t\t\t\taf.Close()\n-\t\t\t\t}\n-\t\t\t})\n-\t\t\tp.pool[lAddr] = af\n-\t\t}\n-\t\treturn af, true, nil\n-\t} else {\n-\t\taf.RefreshTtl()\n-\t\tp.mu.RUnlock()\n-\t\treturn af, false, nil\n+\tif ttl > 0 {\n+\t\taf.deadlineTimer = time.AfterFunc(ttl, func() {\n+\t\t\tif loaded := p.pool.CompareAndDelete(lAddr, af); loaded {\n+\t\t\t\taf.Close()\n+\t\t\t}\n+\t\t})\n \t}\n+\t\n+\tp.pool.Store(lAddr, af)\n+\treturn af, true, nil\n }\ndiff --git a/control/control_plane.go b/control/control_plane.go\nindex e57cbd8..8ca9bf4 100644\n--- a/control/control_plane.go\n+++ b/control/control_plane.go\n@@ -560,9 +560,16 @@ func (c *ControlPlane) InjectBpf(bpf *bpfObjects) {\n }\n \n func (c *ControlPlane) CloneDnsCache() map[string]*DnsCache {\n-\tc.dnsController.dnsCacheMu.Lock()\n-\tdefer c.dnsController.dnsCacheMu.Unlock()\n-\treturn deepcopy.Copy(c.dnsController.dnsCache).(map[string]*DnsCache)\n+\tclonedCache := make(map[string]*DnsCache)\n+\tc.dnsController.dnsCache.Range(func(key, value interface{}) bool {\n+\t\tcache := value.(*DnsCache)\n+\t\t// 只有当缓存仍然有效时才克隆，避免无用的深拷贝\n+\t\tif cache.Deadline.After(time.Now()) {\n+\t\t\tclonedCache[key.(string)] = deepcopy.Copy(cache).(*DnsCache)\n+\t\t}\n+\t\treturn true\n+\t})\n+\treturn clonedCache\n }\n \n func (c *ControlPlane) dnsUpstreamReadyCallback(dnsUpstream *dns.Upstream) (err error) {\ndiff --git a/control/dns_control.go b/control/dns_control.go\nindex 6a55368..069dd09 100644\n--- a/control/dns_control.go\n+++ b/control/dns_control.go\n@@ -14,7 +14,6 @@ import (\n \t\"strconv\"\n \t\"strings\"\n \t\"sync\"\n-\t\"sync/atomic\"\n \t\"time\"\n \n \t\"github.com/daeuniverse/dae/common/consts\"\n@@ -62,8 +61,6 @@ type DnsControllerOption struct {\n }\n \n type DnsController struct {\n-\thandling sync.Map\n-\n \trouting *dns.Dns\n \tqtypePrefer uint16\n \n@@ -76,16 +73,9 @@ type DnsController struct {\n \ttimeoutExceedCallback func(dialArgument *dialArgument, err error)\n \n \tfixedDomainTtl map[string]int\n-\t// mutex protects the dnsCache.\n-\tdnsCacheMu sync.Mutex\n-\tdnsCache map[string]*DnsCache\n-\tdnsForwarderCacheMu sync.Mutex\n-\tdnsForwarderCache map[dnsForwarderKey]DnsForwarder\n-}\n-\n-type handlingState struct {\n-\tmu sync.Mutex\n-\tref uint32\n+\t// 使用sync.Map代替mutex+map，减少锁竞争\n+\tdnsCache sync.Map // map[string]*DnsCache\n+\tdnsForwarderCache sync.Map // map[dnsForwarderKey]DnsForwarder\n }\n \n func parseIpVersionPreference(prefer int) (uint16, error) {\n@@ -119,11 +109,8 @@ func NewDnsController(routing *dns.Dns, option *DnsControllerOption) (c *DnsCont\n \t\tbestDialerChooser: option.BestDialerChooser,\n \t\ttimeoutExceedCallback: option.TimeoutExceedCallback,\n \n-\t\tfixedDomainTtl: option.FixedDomainTtl,\n-\t\tdnsCacheMu: sync.Mutex{},\n-\t\tdnsCache: make(map[string]*DnsCache),\n-\t\tdnsForwarderCacheMu: sync.Mutex{},\n-\t\tdnsForwarderCache: make(map[dnsForwarderKey]DnsForwarder),\n+\t\tfixedDomainTtl: option.FixedDomainTtl,\n+\t\t// 使用sync.Map，无需初始化\n \t}, nil\n }\n \n@@ -133,20 +120,15 @@ func (c *DnsController) cacheKey(qname string, qtype uint16) string {\n }\n \n func (c *DnsController) RemoveDnsRespCache(cacheKey string) {\n-\tc.dnsCacheMu.Lock()\n-\t_, ok := c.dnsCache[cacheKey]\n-\tif ok {\n-\t\tdelete(c.dnsCache, cacheKey)\n-\t}\n-\tc.dnsCacheMu.Unlock()\n+\tc.dnsCache.Delete(cacheKey)\n }\n+\n func (c *DnsController) LookupDnsRespCache(cacheKey string, ignoreFixedTtl bool) (cache *DnsCache) {\n-\tc.dnsCacheMu.Lock()\n-\tcache, ok := c.dnsCache[cacheKey]\n-\tc.dnsCacheMu.Unlock()\n+\tcacheValue, ok := c.dnsCache.Load(cacheKey)\n \tif !ok {\n \t\treturn nil\n \t}\n+\tcache = cacheValue.(*DnsCache)\n \tvar deadline time.Time\n \tif !ignoreFixedTtl {\n \t\tdeadline = cache.Deadline\n@@ -287,22 +269,16 @@ func (c *DnsController) __updateDnsCacheDeadline(host string, dnsTyp uint16, ans\n \tdeadline, originalDeadline := deadlineFunc(now, host)\n \n \tcacheKey := c.cacheKey(fqdn, dnsTyp)\n-\tc.dnsCacheMu.Lock()\n-\tcache, ok := c.dnsCache[cacheKey]\n-\tif ok {\n-\t\tcache.Answer = answers\n-\t\tcache.Deadline = deadline\n-\t\tcache.OriginalDeadline = originalDeadline\n-\t\tc.dnsCacheMu.Unlock()\n-\t} else {\n-\t\tcache, err = c.newCache(fqdn, answers, deadline, originalDeadline)\n-\t\tif err != nil {\n-\t\t\tc.dnsCacheMu.Unlock()\n-\t\t\treturn err\n-\t\t}\n-\t\tc.dnsCache[cacheKey] = cache\n-\t\tc.dnsCacheMu.Unlock()\n+\t\n+\t// 创建新的缓存项而不是修改现有的，避免数据竞争\n+\tcache, err := c.newCache(fqdn, answers, deadline, originalDeadline)\n+\tif err != nil {\n+\t\treturn err\n \t}\n+\t\n+\t// 原子性地更新缓存\n+\tc.dnsCache.Store(cacheKey, cache)\n+\t\n \tif err = c.cacheAccessCallback(cache); err != nil {\n \t\treturn err\n \t}\n@@ -458,18 +434,26 @@ func (c *DnsController) handle_(\n \t\treturn c.sendReject_(dnsMessage, req)\n \t}\n \n-\t// No parallel for the same lookup.\n-\thandlingState_, _ := c.handling.LoadOrStore(cacheKey, new(handlingState))\n-\thandlingState := handlingState_.(*handlingState)\n-\tatomic.AddUint32(&handlingState.ref, 1)\n-\thandlingState.mu.Lock()\n-\tdefer func() {\n-\t\thandlingState.mu.Unlock()\n-\t\tatomic.AddUint32(&handlingState.ref, ^uint32(0))\n-\t\tif atomic.LoadUint32(&handlingState.ref) == 0 {\n-\t\t\tc.handling.Delete(cacheKey)\n+\t// 使用简化的处理状态管理，避免重复请求\n+\thandlingState, isNew := GlobalHandlingStateManager.GetOrCreateState(cacheKey)\n+\t\n+\tif !isNew {\n+\t\t// 有其他goroutine正在处理相同请求，等待完成\n+\t\thandlingState.Wait()\n+\t\t\n+\t\t// 重新检查缓存\n+\t\tif resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil {\n+\t\t\tif needResp {\n+\t\t\t\tif err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil {\n+\t\t\t\t\treturn fmt.Errorf(\"failed to write cached DNS resp: %w\", err)\n+\t\t\t\t}\n+\t\t\t}\n+\t\t\treturn nil\n \t\t}\n-\t}()\n+\t\t// 如果仍然没有缓存，继续处理（可能是上一个请求失败了）\n+\t}\n+\t\n+\tdefer GlobalHandlingStateManager.CompleteAndCleanup(cacheKey, handlingState)\n \n \tif resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil {\n \t\t// Send cache to client directly.\n@@ -569,46 +553,22 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte\n \n \t// Dial and send.\n \tvar respMsg *dnsmessage.Msg\n-\t// defer in a recursive call will delay Close(), thus we Close() before\n-\t// the next recursive call. However, a connection cannot be closed twice.\n-\t// We should set a connClosed flag to avoid it.\n-\tvar connClosed bool\n \n \tctxDial, cancel := context.WithTimeout(context.TODO(), consts.DefaultDialTimeout)\n \tdefer cancel()\n \n-\t// get forwarder from cache\n-\tc.dnsForwarderCacheMu.Lock()\n-\tforwarder, ok := c.dnsForwarderCache[dnsForwarderKey{upstream: upstream.String(), dialArgument: *dialArgument}]\n-\tif !ok {\n-\t\tforwarder, err = newDnsForwarder(upstream, *dialArgument)\n-\t\tif err != nil {\n-\t\t\tc.dnsForwarderCacheMu.Unlock()\n-\t\t\treturn err\n-\t\t}\n-\t\tc.dnsForwarderCache[dnsForwarderKey{upstream: upstream.String(), dialArgument: *dialArgument}] = forwarder\n-\t}\n-\tc.dnsForwarderCacheMu.Unlock()\n-\n-\tdefer func() {\n-\t\tif !connClosed {\n-\t\t\tforwarder.Close()\n-\t\t}\n-\t}()\n-\n+\t// 使用新的转发器管理器，避免重复创建\n+\tforwarder, releaseForwarder, err := GlobalDnsForwarderManager.GetForwarder(upstream, *dialArgument)\n \tif err != nil {\n \t\treturn err\n \t}\n+\tdefer releaseForwarder()\n \n \trespMsg, err = forwarder.ForwardDNS(ctxDial, data)\n \tif err != nil {\n \t\treturn err\n \t}\n \n-\t// Close conn before the recursive call.\n-\tforwarder.Close()\n-\tconnClosed = true\n-\n \t// Route response.\n \tupstreamIndex, nextUpstream, err := c.routing.ResponseSelect(respMsg, upstream)\n \tif err != nil {\ndiff --git a/control/dns_forwarder_manager.go b/control/dns_forwarder_manager.go\nnew file mode 100644\nindex 0000000..07e5c98\n--- /dev/null\n+++ b/control/dns_forwarder_manager.go\n@@ -0,0 +1,165 @@\n+/*\n+ * SPDX-License-Identifier: AGPL-3.0-only\n+ * Copyright (c) 2022-2025, daeuniverse Organization \n+ */\n+\n+package control\n+\n+import (\n+\t\"context\"\n+\t\"sync\"\n+\t\"time\"\n+\n+\t\"github.com/daeuniverse/dae/component/dns\"\n+)\n+\n+// DnsForwarderManager 管理DNS转发器的生命周期，避免重复创建和资源浪费\n+type DnsForwarderManager struct {\n+\t// 使用sync.Map存储活跃的转发器\n+\tactiveForwarders sync.Map // map[dnsForwarderKey]*forwarderEntry\n+\t\n+\t// 清理goroutine控制\n+\tcleanupInterval time.Duration\n+\tctx context.Context\n+\tcancel context.CancelFunc\n+}\n+\n+type forwarderEntry struct {\n+\tforwarder DnsForwarder\n+\tlastUsed time.Time\n+\trefCount int32\n+\tmu sync.RWMutex\n+}\n+\n+// GetForwarder 获取或创建DNS转发器，使用引用计数管理生命周期\n+func (m *DnsForwarderManager) GetForwarder(upstream *dns.Upstream, dialArg dialArgument) (DnsForwarder, func(), error) {\n+\tkey := dnsForwarderKey{upstream: upstream.String(), dialArgument: dialArg}\n+\t\n+\t// 快速路径：尝试获取现有转发器\n+\tif entryValue, ok := m.activeForwarders.Load(key); ok {\n+\t\tentry := entryValue.(*forwarderEntry)\n+\t\tentry.mu.Lock()\n+\t\tentry.refCount++\n+\t\tentry.lastUsed = time.Now()\n+\t\tforwarder := entry.forwarder\n+\t\tentry.mu.Unlock()\n+\t\t\n+\t\t// 返回释放函数\n+\t\trelease := func() {\n+\t\t\tentry.mu.Lock()\n+\t\t\tentry.refCount--\n+\t\t\tentry.mu.Unlock()\n+\t\t}\n+\t\t\n+\t\treturn forwarder, release, nil\n+\t}\n+\t\n+\t// 慢路径：需要创建新转发器\n+\tnewForwarder, err := newDnsForwarder(upstream, dialArg)\n+\tif err != nil {\n+\t\treturn nil, nil, err\n+\t}\n+\t\n+\tentry := &forwarderEntry{\n+\t\tforwarder: newForwarder,\n+\t\tlastUsed: time.Now(),\n+\t\trefCount: 1,\n+\t}\n+\t\n+\t// 尝试存储，如果已存在则使用现有的\n+\tif existingValue, loaded := m.activeForwarders.LoadOrStore(key, entry); loaded {\n+\t\t// 有其他goroutine创建了转发器，关闭我们创建的并使用现有的\n+\t\tnewForwarder.Close()\n+\t\t\n+\t\texistingEntry := existingValue.(*forwarderEntry)\n+\t\texistingEntry.mu.Lock()\n+\t\texistingEntry.refCount++\n+\t\texistingEntry.lastUsed = time.Now()\n+\t\tforwarder := existingEntry.forwarder\n+\t\texistingEntry.mu.Unlock()\n+\t\t\n+\t\trelease := func() {\n+\t\t\texistingEntry.mu.Lock()\n+\t\t\texistingEntry.refCount--\n+\t\t\texistingEntry.mu.Unlock()\n+\t\t}\n+\t\t\n+\t\treturn forwarder, release, nil\n+\t}\n+\t\n+\t// 成功存储新转发器\n+\trelease := func() {\n+\t\tentry.mu.Lock()\n+\t\tentry.refCount--\n+\t\tentry.mu.Unlock()\n+\t}\n+\t\n+\treturn newForwarder, release, nil\n+}\n+\n+// NewDnsForwarderManager 创建新的DNS转发器管理器\n+func NewDnsForwarderManager() *DnsForwarderManager {\n+\tctx, cancel := context.WithCancel(context.Background())\n+\tmanager := &DnsForwarderManager{\n+\t\tcleanupInterval: 5 * time.Minute,\n+\t\tctx: ctx,\n+\t\tcancel: cancel,\n+\t}\n+\t\n+\t// 启动清理goroutine\n+\tgo manager.cleanupLoop()\n+\t\n+\treturn manager\n+}\n+\n+// cleanupLoop 定期清理未使用的转发器\n+func (m *DnsForwarderManager) cleanupLoop() {\n+\tticker := time.NewTicker(m.cleanupInterval)\n+\tdefer ticker.Stop()\n+\t\n+\tfor {\n+\t\tselect {\n+\t\tcase <-m.ctx.Done():\n+\t\t\treturn\n+\t\tcase <-ticker.C:\n+\t\t\tm.cleanup()\n+\t\t}\n+\t}\n+}\n+\n+func (m *DnsForwarderManager) cleanup() {\n+\tnow := time.Now()\n+\tcutoff := now.Add(-m.cleanupInterval)\n+\t\n+\tm.activeForwarders.Range(func(key, value interface{}) bool {\n+\t\tentry := value.(*forwarderEntry)\n+\t\tentry.mu.RLock()\n+\t\tshouldDelete := entry.refCount == 0 && entry.lastUsed.Before(cutoff)\n+\t\tforwarder := entry.forwarder\n+\t\tentry.mu.RUnlock()\n+\t\t\n+\t\tif shouldDelete {\n+\t\t\t// 尝试删除并关闭\n+\t\t\tif m.activeForwarders.CompareAndDelete(key, value) {\n+\t\t\t\tforwarder.Close()\n+\t\t\t}\n+\t\t}\n+\t\t\n+\t\treturn true\n+\t})\n+}\n+\n+// Shutdown 关闭管理器并清理所有转发器\n+func (m *DnsForwarderManager) Shutdown() {\n+\tm.cancel()\n+\t\n+\t// 关闭所有活跃的转发器\n+\tm.activeForwarders.Range(func(key, value interface{}) bool {\n+\t\tentry := value.(*forwarderEntry)\n+\t\tentry.forwarder.Close()\n+\t\treturn true\n+\t})\n+}\n+\n+// 全局DNS转发器管理器实例\n+var GlobalDnsForwarderManager = NewDnsForwarderManager()\ndiff --git a/control/dns_handling_state.go b/control/dns_handling_state.go\nnew file mode 100644\nindex 0000000..d3acce6\n--- /dev/null\n+++ b/control/dns_handling_state.go\n@@ -0,0 +1,79 @@\n+/*\n+ * SPDX-License-Identifier: AGPL-3.0-only\n+ * Copyright (c) 2022-2025, daeuniverse Organization \n+ */\n+\n+package control\n+\n+import (\n+\t\"sync\"\n+\t\"time\"\n+)\n+\n+// SimpleHandlingState 简化的处理状态管理，避免复杂的引用计数\n+type SimpleHandlingState struct {\n+\tdone chan struct{}\n+\tonce sync.Once\n+}\n+\n+// Wait 等待处理完成\n+func (s *SimpleHandlingState) Wait() {\n+\t<-s.done\n+}\n+\n+// Complete 标记处理完成\n+func (s *SimpleHandlingState) Complete() {\n+\ts.once.Do(func() {\n+\t\tclose(s.done)\n+\t})\n+}\n+\n+// NewSimpleHandlingState 创建新的处理状态\n+func NewSimpleHandlingState() *SimpleHandlingState {\n+\treturn &SimpleHandlingState{\n+\t\tdone: make(chan struct{}),\n+\t}\n+}\n+\n+// HandlingStateManager 管理DNS处理状态，避免重复请求\n+type HandlingStateManager struct {\n+\tstates sync.Map // map[string]*SimpleHandlingState\n+}\n+\n+// GetOrCreateState 获取或创建处理状态\n+func (m *HandlingStateManager) GetOrCreateState(key string) (*SimpleHandlingState, bool) {\n+\t// 尝试获取现有状态\n+\tif stateValue, ok := m.states.Load(key); ok {\n+\t\treturn stateValue.(*SimpleHandlingState), false\n+\t}\n+\t\n+\t// 创建新状态\n+\tnewState := NewSimpleHandlingState()\n+\t\n+\t// 尝试存储，如果已存在则使用现有的\n+\tif actualValue, loaded := m.states.LoadOrStore(key, newState); loaded {\n+\t\treturn actualValue.(*SimpleHandlingState), false\n+\t}\n+\t\n+\t// 成功创建新状态\n+\treturn newState, true\n+}\n+\n+// CompleteAndCleanup 完成处理并清理状态\n+func (m *HandlingStateManager) CompleteAndCleanup(key string, state *SimpleHandlingState) {\n+\tstate.Complete()\n+\t\n+\t// 延迟清理，给其他等待的goroutine一些时间\n+\tgo func() {\n+\t\ttime.Sleep(100 * time.Millisecond)\n+\t\tm.states.Delete(key)\n+\t}()\n+}\n+\n+// NewHandlingStateManager 创建新的处理状态管理器\n+func NewHandlingStateManager() *HandlingStateManager {\n+\treturn &HandlingStateManager{}\n+}\n+\n+// 全局处理状态管理器\n+var GlobalHandlingStateManager = NewHandlingStateManager()\ndiff --git a/control/udp_endpoint_pool.go b/control/udp_endpoint_pool.go\nindex 5fd972a..cb87016 100644\n--- a/control/udp_endpoint_pool.go\n+++ b/control/udp_endpoint_pool.go\n@@ -38,22 +38,68 @@ type UdpEndpoint struct {\n }\n \n func (ue *UdpEndpoint) start() {\n-\tbuf := pool.GetFullCap(consts.EthernetMtu)\n-\tdefer pool.Put(buf)\n+\t// 使用buffered channel实现异步处理\n+\tconst maxPendingPackets = 1000\n+\tpacketChan := make(chan struct {\n+\t\tdata []byte\n+\t\tfrom netip.AddrPort\n+\t}, maxPendingPackets)\n+\t\n+\t// 启动异步包处理器\n+\tgo func() {\n+\t\tfor packet := range packetChan {\n+\t\t\t// 异步处理每个包，避免阻塞读取循环\n+\t\t\tgo func(data []byte, from netip.AddrPort) {\n+\t\t\t\tdefer pool.Put(data) // 确保释放buffer\n+\t\t\t\tif err := ue.handler(data, from); err != nil {\n+\t\t\t\t\t// 处理错误但不阻塞\n+\t\t\t\t\treturn\n+\t\t\t\t}\n+\t\t\t}(packet.data, packet.from)\n+\t\t}\n+\t}()\n+\t\n+\t// 高性能读取循环\n \tfor {\n+\t\tbuf := pool.GetFullCap(consts.EthernetMtu)\n \t\tn, from, err := ue.conn.ReadFrom(buf[:])\n \t\tif err != nil {\n+\t\t\tpool.Put(buf)\n \t\t\tbreak\n \t\t}\n+\t\t\n+\t\t// 快速重置计时器，减少锁竞争\n \t\tue.mu.Lock()\n-\t\tue.deadlineTimer.Reset(ue.NatTimeout)\n+\t\tif ue.deadlineTimer != nil {\n+\t\t\tue.deadlineTimer.Reset(ue.NatTimeout)\n+\t\t}\n \t\tue.mu.Unlock()\n-\t\tif err = ue.handler(buf[:n], from); err != nil {\n-\t\t\tbreak\n+\t\t\n+\t\t// 复制数据到正确大小的buffer\n+\t\tdata := pool.Get(n)\n+\t\tcopy(data, buf[:n])\n+\t\tpool.Put(buf)\n+\t\t\n+\t\t// 非阻塞发送到处理器\n+\t\tselect {\n+\t\tcase packetChan <- struct {\n+\t\t\tdata []byte\n+\t\t\tfrom netip.AddrPort\n+\t\t}{data, from}:\n+\t\t\t// 成功发送到处理队列\n+\t\tdefault:\n+\t\t\t// 队列满了，丢弃包（避免阻塞读取）\n+\t\t\tpool.Put(data)\n+\t\t\t// 可以在这里记录丢包统计\n \t\t}\n \t}\n+\t\n+\t// 清理\n+\tclose(packetChan)\n \tue.mu.Lock()\n-\tue.deadlineTimer.Stop()\n+\tif ue.deadlineTimer != nil {\n+\t\tue.deadlineTimer.Stop()\n+\t}\n \tue.mu.Unlock()\n }\n \ndiff --git a/control/udp_health_monitor.go b/control/udp_health_monitor.go\nnew file mode 100644\nindex 0000000..667e863\n--- /dev/null\n+++ b/control/udp_health_monitor.go\n@@ -0,0 +1,165 @@\n+/*\n+ * SPDX-License-Identifier: AGPL-3.0-only\n+ * Copyright (c) 2022-2025, daeuniverse Organization \n+ */\n+\n+package control\n+\n+import (\n+\t\"context\"\n+\t\"sync\"\n+\t\"sync/atomic\"\n+\t\"time\"\n+)\n+\n+// UdpHealthMonitor monitors UDP processing health and prevents deadlocks\n+type UdpHealthMonitor struct {\n+\t// 基本指标\n+\tactiveConnections int64\n+\ttotalPacketsHandled int64\n+\tdroppedPackets int64\n+\ttimeoutOccurrences int64\n+\t\n+\t// 控制参数\n+\tisShuttingDown int32\n+\tmaxActiveConns int64\n+\thealthCheckInterval time.Duration\n+\t\n+\t// 监控\n+\tlastActivity time.Time\n+\tmu sync.RWMutex\n+\tctx context.Context\n+\tcancel context.CancelFunc\n+}\n+\n+// NewUdpHealthMonitor creates a new UDP health monitor\n+func NewUdpHealthMonitor() *UdpHealthMonitor {\n+\tctx, cancel := context.WithCancel(context.Background())\n+\tmonitor := &UdpHealthMonitor{\n+\t\tmaxActiveConns: 20000, // 增加最大连接数\n+\t\thealthCheckInterval: 30 * time.Second,\n+\t\tlastActivity: time.Now(),\n+\t\tctx: ctx,\n+\t\tcancel: cancel,\n+\t}\n+\t\n+\tgo monitor.healthCheckLoop()\n+\treturn monitor\n+}\n+\n+// healthCheckLoop runs periodic health checks\n+func (m *UdpHealthMonitor) healthCheckLoop() {\n+\tticker := time.NewTicker(m.healthCheckInterval)\n+\tdefer ticker.Stop()\n+\t\n+\tfor {\n+\t\tselect {\n+\t\tcase <-m.ctx.Done():\n+\t\t\treturn\n+\t\tcase <-ticker.C:\n+\t\t\tm.performHealthCheck()\n+\t\t}\n+\t}\n+}\n+\n+// performHealthCheck 执行简化的健康检查\n+func (m *UdpHealthMonitor) performHealthCheck() {\n+\tactiveConns := atomic.LoadInt64(&m.activeConnections)\n+\ttotalPackets := atomic.LoadInt64(&m.totalPacketsHandled)\n+\tdroppedPackets := atomic.LoadInt64(&m.droppedPackets)\n+\ttimeouts := atomic.LoadInt64(&m.timeoutOccurrences)\n+\t\n+\t// 简单的日志记录（如果需要的话）\n+\t_ = activeConns\n+\t_ = totalPackets\n+\t_ = droppedPackets\n+\t_ = timeouts\n+\t\n+\t// 重置计数器防止溢出\n+\tif totalPackets > 10000000 { // 1000万包后重置\n+\t\tatomic.StoreInt64(&m.totalPacketsHandled, 0)\n+\t\tatomic.StoreInt64(&m.droppedPackets, 0)\n+\t\tatomic.StoreInt64(&m.timeoutOccurrences, 0)\n+\t}\n+}\n+\n+// RegisterConnection registers a new UDP connection\n+func (m *UdpHealthMonitor) RegisterConnection() bool {\n+\tif atomic.LoadInt32(&m.isShuttingDown) != 0 {\n+\t\treturn false\n+\t}\n+\t\n+\tactiveConns := atomic.AddInt64(&m.activeConnections, 1)\n+\tif activeConns > m.maxActiveConns {\n+\t\tatomic.AddInt64(&m.activeConnections, -1)\n+\t\tatomic.AddInt64(&m.droppedPackets, 1)\n+\t\treturn false\n+\t}\n+\t\n+\tm.mu.Lock()\n+\tm.lastActivity = time.Now()\n+\tm.mu.Unlock()\n+\t\n+\treturn true\n+}\n+\n+// UnregisterConnection unregisters a UDP connection\n+func (m *UdpHealthMonitor) UnregisterConnection() {\n+\tatomic.AddInt64(&m.activeConnections, -1)\n+}\n+\n+// RecordPacketHandled records a successfully handled packet\n+func (m *UdpHealthMonitor) RecordPacketHandled() {\n+\tatomic.AddInt64(&m.totalPacketsHandled, 1)\n+\t\n+\tm.mu.Lock()\n+\tm.lastActivity = time.Now()\n+\tm.mu.Unlock()\n+}\n+\n+// RecordTimeout records a timeout occurrence\n+func (m *UdpHealthMonitor) RecordTimeout() {\n+\tatomic.AddInt64(&m.timeoutOccurrences, 1)\n+}\n+\n+// IsHealthy returns true if the system is in a healthy state\n+func (m *UdpHealthMonitor) IsHealthy() bool {\n+\tactiveConns := atomic.LoadInt64(&m.activeConnections)\n+\ttimeouts := atomic.LoadInt64(&m.timeoutOccurrences)\n+\ttotalPackets := atomic.LoadInt64(&m.totalPacketsHandled)\n+\t\n+\t// 基本健康检查\n+\tif activeConns > m.maxActiveConns*9/10 { // 90% 容量\n+\t\treturn false\n+\t}\n+\t\n+\t// 超时率检查\n+\tif totalPackets > 1000 {\n+\t\ttimeoutRate := float64(timeouts) / float64(totalPackets)\n+\t\tif timeoutRate > 0.05 { // 5% 超时率阈值\n+\t\t\treturn false\n+\t\t}\n+\t}\n+\t\n+\treturn true\n+}\n+\n+// Shutdown shuts down the health monitor\n+func (m *UdpHealthMonitor) Shutdown() {\n+\tatomic.StoreInt32(&m.isShuttingDown, 1)\n+\tm.cancel()\n+}\n+\n+// GetStats returns current statistics\n+func (m *UdpHealthMonitor) GetStats() map[string]int64 {\n+\treturn map[string]int64{\n+\t\t\"active_connections\": atomic.LoadInt64(&m.activeConnections),\n+\t\t\"total_packets_handled\": atomic.LoadInt64(&m.totalPacketsHandled),\n+\t\t\"dropped_packets\": atomic.LoadInt64(&m.droppedPackets),\n+\t\t\"timeout_occurrences\": atomic.LoadInt64(&m.timeoutOccurrences),\n+\t\t\"max_active_conns\": m.maxActiveConns,\n+\t}\n+}\n+\n+// Global UDP health monitor instance\n+var DefaultUdpHealthMonitor = NewUdpHealthMonitor()\ndiff --git a/control/udp_task_pool.go b/control/udp_task_pool.go\nindex 08b02d7..09d8cb4 100644\n--- a/control/udp_task_pool.go\n+++ b/control/udp_task_pool.go\n@@ -11,7 +11,11 @@ import (\n \t\"time\"\n )\n \n-const UdpTaskQueueLength = 128\n+const (\n+\tUdpTaskQueueLength = 512 // 增加队列容量以支持更高并发\n+\tMaxUdpQueues = 5000 // 增加最大队列数\n+\tUdpTaskTimeout = 100 * time.Millisecond // 极短超时时间\n+)\n \n type UdpTask = func()\n \n@@ -27,22 +31,57 @@ type UdpTaskQueue struct {\n }\n \n func (q *UdpTaskQueue) convoy() {\n+\tdefer close(q.closed)\n+\t\n \tfor {\n \t\tselect {\n \t\tcase <-q.ctx.Done():\n-\t\t\tclose(q.closed)\n+\t\t\t// 清空剩余任务\n+\t\t\tq.drainRemainingTasks()\n \t\t\treturn\n+\t\t\t\n \t\tcase task := <-q.ch:\n-\t\t\ttask()\n-\t\t\tq.timer.Reset(q.agingTime)\n+\t\t\t// 立即异步执行任务，不等待完成\n+\t\t\tgo q.executeTaskAsync(task)\n+\t\t\t\n+\t\t\t// 重置老化定时器\n+\t\t\tif q.timer != nil {\n+\t\t\t\tq.timer.Reset(q.agingTime)\n+\t\t\t}\n+\t\t}\n+\t}\n+}\n+\n+// executeTaskAsync 异步执行单个任务\n+func (q *UdpTaskQueue) executeTaskAsync(task UdpTask) {\n+\tdefer func() {\n+\t\tif r := recover(); r != nil {\n+\t\t\t// 记录panic但不影响其他任务\n+\t\t}\n+\t}()\n+\t\n+\tif task != nil {\n+\t\ttask()\n+\t}\n+}\n+\n+// drainRemainingTasks 清空剩余任务\n+func (q *UdpTaskQueue) drainRemainingTasks() {\n+\tfor {\n+\t\tselect {\n+\t\tcase task := <-q.ch:\n+\t\t\t// 异步执行剩余任务\n+\t\t\tgo q.executeTaskAsync(task)\n+\t\tdefault:\n+\t\t\treturn\n \t\t}\n \t}\n }\n \n type UdpTaskPool struct {\n \tqueueChPool sync.Pool\n-\t// mu protects m\n-\tmu sync.Mutex\n+\t// 使用RWMutex提高读取性能\n+\tmu sync.RWMutex\n \tm map[string]*UdpTaskQueue\n }\n \n@@ -51,7 +90,7 @@ func NewUdpTaskPool() *UdpTaskPool {\n \t\tqueueChPool: sync.Pool{New: func() any {\n \t\t\treturn make(chan UdpTask, UdpTaskQueueLength)\n \t\t}},\n-\t\tmu: sync.Mutex{},\n+\t\tmu: sync.RWMutex{},\n \t\tm: map[string]*UdpTaskQueue{},\n \t}\n \treturn p\n@@ -59,40 +98,123 @@ func NewUdpTaskPool() *UdpTaskPool {\n \n // EmitTask: Make sure packets with the same key (4 tuples) will be sent in order.\n func (p *UdpTaskPool) EmitTask(key string, task UdpTask) {\n+\tif task == nil {\n+\t\treturn\n+\t}\n+\n+\t// 快速健康检查\n+\tif !DefaultUdpHealthMonitor.RegisterConnection() {\n+\t\treturn\n+\t}\n+\tdefer DefaultUdpHealthMonitor.UnregisterConnection()\n+\n+\t// 尝试使用读锁快速查找现有队列\n+\tp.mu.RLock()\n+\tq, exists := p.m[key]\n+\tqueueCount := len(p.m)\n+\tp.mu.RUnlock()\n+\n+\tif exists {\n+\t\t// 队列已存在，直接提交任务\n+\t\tp.submitTaskToQueue(q, task)\n+\t\treturn\n+\t}\n+\n+\t// 需要创建新队列，使用写锁\n \tp.mu.Lock()\n-\tq, ok := p.m[key]\n-\tif !ok {\n-\t\tch := p.queueChPool.Get().(chan UdpTask)\n-\t\tctx, cancel := context.WithCancel(context.Background())\n-\t\tq = &UdpTaskQueue{\n-\t\t\tkey: key,\n-\t\t\tp: p,\n-\t\t\tch: ch,\n-\t\t\ttimer: nil,\n-\t\t\tagingTime: DefaultNatTimeout,\n-\t\t\tctx: ctx,\n-\t\t\tclosed: make(chan struct{}),\n-\t\t}\n-\t\tq.timer = time.AfterFunc(q.agingTime, func() {\n-\t\t\t// if timer executed, there should no task in queue.\n-\t\t\t// q.closed should not blocking things.\n-\t\t\tp.mu.Lock()\n-\t\t\tcancel()\n-\t\t\tdelete(p.m, key)\n-\t\t\tp.mu.Unlock()\n-\t\t\t<-q.closed\n-\t\t\tif len(ch) == 0 { // Otherwise let it be GCed\n-\t\t\t\tp.queueChPool.Put(ch)\n+\tdefer p.mu.Unlock()\n+\n+\t// 双重检查\n+\tif q, exists := p.m[key]; exists {\n+\t\tp.submitTaskToQueue(q, task)\n+\t\treturn\n+\t}\n+\n+\t// 限制队列数量\n+\tif queueCount >= MaxUdpQueues {\n+\t\tDefaultUdpHealthMonitor.RecordTimeout()\n+\t\treturn\n+\t}\n+\n+\t// 创建新队列\n+\tch := p.queueChPool.Get().(chan UdpTask)\n+\tctx, cancel := context.WithCancel(context.Background())\n+\tq = &UdpTaskQueue{\n+\t\tkey: key,\n+\t\tp: p,\n+\t\tch: ch,\n+\t\ttimer: nil,\n+\t\tagingTime: DefaultNatTimeout,\n+\t\tctx: ctx,\n+\t\tclosed: make(chan struct{}),\n+\t}\n+\n+\tq.timer = time.AfterFunc(q.agingTime, func() {\n+\t\tp.cleanupQueue(key, q, cancel, ch)\n+\t})\n+\n+\tp.m[key] = q\n+\tgo q.convoy()\n+\n+\t// 提交任务到新创建的队列\n+\tp.submitTaskToQueue(q, task)\n+}\n+\n+// submitTaskToQueue 提交任务到指定队列（极简版本）\n+func (p *UdpTaskPool) submitTaskToQueue(q *UdpTaskQueue, task UdpTask) {\n+\t// 包装任务以增加健康监控\n+\twrappedTask := func() {\n+\t\tdefer func() {\n+\t\t\tDefaultUdpHealthMonitor.RecordPacketHandled()\n+\t\t\tif r := recover(); r != nil {\n+\t\t\t\t// 记录panic但继续\n \t\t\t}\n-\t\t})\n-\t\tp.m[key] = q\n-\t\tgo q.convoy()\n+\t\t}()\n+\t\ttask()\n \t}\n-\tp.mu.Unlock()\n-\t// if task cannot be executed within 180s(DefaultNatTimeout), GC may be triggered, so skip the task when GC occurs\n+\n+\t// 极速任务提交 - 非阻塞模式\n \tselect {\n-\tcase q.ch <- task:\n+\tcase q.ch <- wrappedTask:\n+\t\t// 任务成功排队\n \tcase <-q.ctx.Done():\n+\t\t// 上下文已取消\n+\t\tDefaultUdpHealthMonitor.RecordTimeout()\n+\tdefault:\n+\t\t// 队列已满，异步重试一次\n+\t\tgo func() {\n+\t\t\tselect {\n+\t\t\tcase q.ch <- wrappedTask:\n+\t\t\t\t// 重试成功\n+\t\t\tcase <-q.ctx.Done():\n+\t\t\t\tDefaultUdpHealthMonitor.RecordTimeout()\n+\t\t\tcase <-time.After(UdpTaskTimeout):\n+\t\t\t\tDefaultUdpHealthMonitor.RecordTimeout()\n+\t\t\t}\n+\t\t}()\n+\t}\n+}\n+\n+// cleanupQueue 清理队列\n+func (p *UdpTaskPool) cleanupQueue(key string, q *UdpTaskQueue, cancel context.CancelFunc, ch chan UdpTask) {\n+\tp.mu.Lock()\n+\tcancel()\n+\tdelete(p.m, key)\n+\tp.mu.Unlock()\n+\n+\t// 等待清理完成，带超时\n+\tselect {\n+\tcase <-q.closed:\n+\tcase <-time.After(1 * time.Second):\n+\t\t// 强制清理\n+\t}\n+\n+\t// 回收通道\n+\tif len(ch) == 0 {\n+\t\tfor len(ch) > 0 {\n+\t\t\t<-ch\n+\t\t}\n+\t\tp.queueChPool.Put(ch)\n \t}\n }\n \n" } ]