Repository: QiuSimons/luci-app-daed Branch: kix Commit: 1e37979340ec Files: 22 Total size: 154.9 KB Directory structure: gitextract_ggpxd9e4/ ├── .github/ │ └── workflows/ │ ├── autoupdate.yml │ └── build-packages.yml ├── README.md ├── daed/ │ ├── Makefile │ └── files/ │ ├── daed.config │ └── daed.init ├── luci-app-daed/ │ ├── Makefile │ ├── luasrc/ │ │ ├── controller/ │ │ │ └── daed.lua │ │ ├── model/ │ │ │ └── cbi/ │ │ │ └── daed/ │ │ │ ├── basic.lua │ │ │ └── log.lua │ │ └── view/ │ │ └── daed/ │ │ ├── daed.htm │ │ ├── daed_log.htm │ │ └── daed_status.htm │ ├── po/ │ │ └── zh_Hans/ │ │ └── daed.po │ └── root/ │ ├── etc/ │ │ ├── hotplug.d/ │ │ │ └── iface/ │ │ │ └── 98-daed │ │ └── init.d/ │ │ └── luci_daed │ └── usr/ │ └── share/ │ └── rpcd/ │ └── acl.d/ │ └── luci-app-daed.json └── patchset/ ├── 0001-fix-runtime-stats.patch ├── build_fixes.patch ├── kix-bind_fix.patch ├── kix-feat_DNS_high_concurrency_optimization.patch └── kix-feat_lockless_concurrency_udp_dns.patch ================================================ FILE CONTENTS ================================================ ================================================ FILE: .github/workflows/autoupdate.yml ================================================ name: Auto Update on: workflow_dispatch: schedule: - cron: "0 */2 * * *" jobs: check_update: runs-on: ubuntu-latest outputs: update_needed: ${{ steps.check.outputs.update_needed }} pkg_version: ${{ steps.check.outputs.pkg_version }} latest_daed_full: ${{ steps.check.outputs.latest_daed_full }} latest_daed_short: ${{ steps.check.outputs.latest_daed_short }} latest_wing_short: ${{ steps.check.outputs.latest_wing_short }} latest_core_short: ${{ steps.check.outputs.latest_core_short }} steps: - uses: actions/checkout@v6 with: fetch-depth: 1 - name: Check Upstream Updates id: check run: | DAED_JSON=$(curl -s https://api.github.com/repos/daeuniverse/daed/commits/main) WING_JSON=$(curl -s https://api.github.com/repos/daeuniverse/dae-wing/commits/main) CORE_JSON=$(curl -s https://api.github.com/repos/olicesx/dae/commits/kdae) UPSTREAM_DAED_FULL=$(echo "$DAED_JSON" | jq -r '.sha') UPSTREAM_DAED=$(echo "$UPSTREAM_DAED_FULL" | cut -b 1-7) UPSTREAM_WING=$(echo "$WING_JSON" | jq -r '.sha' | cut -b 1-7) UPSTREAM_CORE=$(echo "$CORE_JSON" | jq -r '.sha' | cut -b 1-7) CURRENT_DAED=$(grep "PKG_SOURCE_VERSION:=" daed/Makefile | cut -d= -f2 || true) CURRENT_WING=$(grep "WING_VERSION:=wing-" daed/Makefile | sed 's/.*wing-//' | head -n 1 || true) CURRENT_CORE=$(grep "CORE_VERSION:=core-" daed/Makefile | sed 's/.*core-//' | head -n 1 || true) echo "Upstream DAED: $UPSTREAM_DAED_FULL, Local: $CURRENT_DAED" echo "Upstream WING: $UPSTREAM_WING, Local: $CURRENT_WING" echo "Upstream CORE: $UPSTREAM_CORE, Local: $CURRENT_CORE" NEED_UPDATE=false if [ "$UPSTREAM_DAED_FULL" != "$CURRENT_DAED" ]; then NEED_UPDATE=true; fi if [ "$UPSTREAM_WING" != "$CURRENT_WING" ]; then NEED_UPDATE=true; fi if [ "$UPSTREAM_CORE" != "$CURRENT_CORE" ]; then NEED_UPDATE=true; fi if [ "$NEED_UPDATE" = "true" ]; then echo "Update needed" echo "update_needed=true" >> "$GITHUB_OUTPUT" DATE_DAED=$(echo "$DAED_JSON" | jq -r '.commit.committer.date') DATE_WING=$(echo "$WING_JSON" | jq -r '.commit.committer.date') DATE_CORE=$(echo "$CORE_JSON" | jq -r '.commit.committer.date') LATEST_ISO_DATE=$(echo -e "$DATE_DAED\n$DATE_WING\n$DATE_CORE" | sort -r | head -n 1) PKG_VERSION=$(date -d "$LATEST_ISO_DATE" +%Y.%m.%d) echo "Selected latest date: $LATEST_ISO_DATE formatted as $PKG_VERSION" echo "pkg_version=$PKG_VERSION" >> "$GITHUB_OUTPUT" echo "latest_daed_full=$UPSTREAM_DAED_FULL" >> "$GITHUB_OUTPUT" echo "latest_daed_short=$UPSTREAM_DAED" >> "$GITHUB_OUTPUT" echo "latest_wing_short=$UPSTREAM_WING" >> "$GITHUB_OUTPUT" echo "latest_core_short=$UPSTREAM_CORE" >> "$GITHUB_OUTPUT" else echo "Everything up to date." echo "update_needed=false" >> "$GITHUB_OUTPUT" fi build: needs: check_update if: needs.check_update.outputs.update_needed == 'true' runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 with: fetch-depth: 0 persist-credentials: false - name: Build System Setup env: DEBIAN_FRONTEND: noninteractive run: | sudo apt-get update sudo apt-get install -y jq dos2unix - name: Update Makefile run: | chmod 755 ./daed/files/daed.init ./luci-app-daed/root/etc/init.d/luci_daed ./luci-app-daed/root/etc/hotplug.d/iface/98-daed find . -type f -exec dos2unix {} \; -print sed -i '/PKG_VERSION:/d' ./daed/Makefile sed -i "7 a PKG_VERSION:=${{ needs.check_update.outputs.pkg_version }}" ./daed/Makefile sed -i '/DAED_VERSION:/d' ./daed/Makefile sed -i "8 a DAED_VERSION:=daed-${{ needs.check_update.outputs.latest_daed_short }}" ./daed/Makefile sed -i '/WING_VERSION:=/d' ./daed/Makefile sed -i "9 a WING_VERSION:=wing-${{ needs.check_update.outputs.latest_wing_short }}" ./daed/Makefile sed -i '/CORE_VERSION:=/d' ./daed/Makefile sed -i "10 a CORE_VERSION:=core-${{ needs.check_update.outputs.latest_core_short }}" ./daed/Makefile sed -i '/PKG_SOURCE_VERSION:/d' ./daed/Makefile sed -i "17 a PKG_SOURCE_VERSION:=${{ needs.check_update.outputs.latest_daed_full }}" ./daed/Makefile - name: Commit file run: | git config --global user.email simonsqiu@foxmail.com git config --global user.name SimonsQiu git add . git commit -m "Update $(date +%Y/%m/%d\ %H:%M:%S\ %Z)" -a continue-on-error: true - name: Push changes uses: ad-m/github-push-action@master with: github_token: ${{secrets.ACTIONS_DEPLOY_KEY}} branch: kix continue-on-error: true ================================================ FILE: .github/workflows/build-packages.yml ================================================ name: Build packages on: workflow_dispatch: push: branches: - kix permissions: contents: write jobs: prepare: name: Prepare version runs-on: ubuntu-latest outputs: version: ${{ steps.meta.outputs.version }} release_tag: ${{ steps.meta.outputs.release_tag }} release_name: ${{ steps.meta.outputs.release_name }} steps: - name: Checkout source uses: actions/checkout@v6 with: fetch-depth: 0 - name: Generate version metadata id: meta shell: bash run: | pkg_version=$(grep '^PKG_VERSION:=' daed/Makefile | head -n 1 | cut -d= -f2) pkg_release=$(grep '^PKG_RELEASE:=' daed/Makefile | head -n 1 | cut -d= -f2) version="${pkg_version}-r${pkg_release}" release_tag="daed_${version}" release_name="daed_${version}" echo "version=${version}" >> "$GITHUB_OUTPUT" echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT" echo "release_name=${release_name}" >> "$GITHUB_OUTPUT" echo "Version: ${version}" echo "Release tag: ${release_tag}" build: name: Build ${{ matrix.arch }}-${{ matrix.sdk }} runs-on: ubuntu-latest needs: prepare strategy: fail-fast: false matrix: include: - arch: aarch64_generic sdk: openwrt-24.10 pkg_ext: ipk - arch: i386_pentium4 sdk: openwrt-24.10 pkg_ext: ipk - arch: x86_64 sdk: openwrt-24.10 pkg_ext: ipk - arch: aarch64_generic sdk: openwrt-25.12 pkg_ext: apk - arch: i386_pentium4 sdk: openwrt-25.12 pkg_ext: apk - arch: x86_64 sdk: openwrt-25.12 pkg_ext: apk steps: - name: Checkout source uses: actions/checkout@v6 with: fetch-depth: 0 - name: Init build dependencies env: DEBIAN_FRONTEND: noninteractive shell: bash run: | sudo -E apt-get update sudo -E apt-get install -y clang llvm curl jq - name: Build packages uses: sbwml/openwrt-gh-action-sdk@go1.26 env: ARCH: ${{ matrix.arch }}-${{ matrix.sdk }} FEEDNAME: packages_ci PACKAGES: luci-app-daed NO_REFRESH_CHECK: true V: s - name: Show built files shell: bash run: | echo "=== Built package files ===" find bin/packages -type f | grep -E '\.(ipk|apk)$' || true echo "===========================" - name: Prepare renamed artifacts shell: bash run: | set -euo pipefail mkdir -p dist for f in bin/packages/${{ matrix.arch }}/packages_ci/*.${{ matrix.pkg_ext }}; do base="$(basename "$f")" ext="${base##*.}" name="${base%.*}" # Avoid duplicating architecture in name, and skip architecture suffix for LuCI/all packages if [[ "$name" == *"${{ matrix.arch }}"* ]] || [[ "$name" == *"all"* ]] || [[ "$name" == luci-* ]]; then new_name="${name}-${{ matrix.sdk }}.${ext}" else new_name="${name}-${{ matrix.arch }}-${{ matrix.sdk }}.${ext}" fi cp "$f" "dist/${new_name}" done ls -lah dist - name: Upload build artifacts uses: actions/upload-artifact@v7 with: name: ${{ matrix.arch }}-${{ matrix.sdk }}-${{ matrix.pkg_ext }} path: dist/*.${{ matrix.pkg_ext }} if-no-files-found: error retention-days: 7 release: name: Publish release runs-on: ubuntu-latest needs: - prepare - build steps: - name: Download all build artifacts uses: actions/download-artifact@v8 with: path: release-dist merge-multiple: true - name: Create or update GitHub release uses: softprops/action-gh-release@v2 with: tag_name: ${{ needs.prepare.outputs.release_tag }} name: ${{ needs.prepare.outputs.release_name }} files: release-dist/* generate_release_notes: true token: ${{ secrets.GITHUB_TOKEN }} target_commitish: ${{ github.sha }} - name: Delete Older Releases uses: dev-drprasad/delete-older-releases@master with: keep_latest: 3 delete_tags: true env: GITHUB_TOKEN: ${{secrets.ACTIONS_DEPLOY_KEY}} continue-on-error: true - name: Cleanup Old Action Artifacts uses: c-hive/gha-remove-artifacts@master with: age: '3 days' skip-recent: 3 continue-on-error: true - name: Cleanup Workflow Logs uses: Mattraks/delete-workflow-runs@main with: token: ${{secrets.ACTIONS_DEPLOY_KEY}} repository: ${{ github.repository }} retain_days: 3 continue-on-error: true ================================================ FILE: README.md ================================================

luci-app-daed

一个基于 eBPF 的高性能透明代理解决方案。

--- ## 快速入门 ### 1. 环境准备 (编译主机) 在编译之前，请确保您的编译主机已安装必要的开发工具。参考 [apt.llvm.org](https://apt.llvm.org/) 安装最新版本的 Clang 和 LLVM。 ```bash apt-get update apt-get install -y clang llvm npm npm install -g pnpm ``` ### 2. 获取源码 进入您的 OpenWrt 目录，克隆本仓库到 `package` 目录： ```bash git clone https://github.com/QiuSimons/luci-app-daed package/dae ``` ### 3. 内核配置要求 (DAE 运行前提) DAE 依赖 eBPF 和 BTF。请在 `.config` 中添加以下内核配置以启用相关支持： ```makefile CONFIG_DEVEL=y CONFIG_KERNEL_DEBUG_INFO=y CONFIG_KERNEL_DEBUG_INFO_REDUCED=n CONFIG_KERNEL_DEBUG_INFO_BTF=y CONFIG_KERNEL_CGROUPS=y CONFIG_KERNEL_CGROUP_BPF=y CONFIG_KERNEL_BPF_EVENTS=y CONFIG_BPF_TOOLCHAIN_HOST=y CONFIG_KERNEL_XDP_SOCKETS=y CONFIG_PACKAGE_kmod-xdp-sockets-diag=y ``` ### 4. 编译与安装 ```bash make menuconfig # 路径: LUCI -> Applications -> luci-app-daed make package/dae/luci-app-daed/compile V=s ``` --- ## 核心概念：BTF 与 CO-RE ### BTF 来源选择 在 `make menuconfig` 中，您可以根据内核支持情况选择 BTF 来源： - **Use kernel BTF (integrated)**: **[推荐]** 要求内核开启 `CONFIG_KERNEL_DEBUG_INFO_BTF=y`。 - **Use vmlinux-btf package**: 如果内核不支持原生 BTF，可选择此项以使用外部 [vmlinux-btf](https://github.com/QiuSimons/vmlinux-btf) 软件包。 ### vmlinux-btf 依赖说明 由于预编译安装包无法自动探测内核是否支持 BTF，为了确保稳定性，程序默认依赖 `vmlinux-btf`。 - **方案 A：手动补全依赖 (推荐)** 如果软件源缺失该包，请前往 [opkg.cooluc.com](https://opkg.cooluc.com/) 下载。 - **建议**: 优先选择与内核版本号 (`x.y.z`) 完全一致的包；至少保证主次版本号 (`x.y`) 一致。 - **方案 B：忽略依赖 (高级用户)** 如果您确认内核已原生支持 BTF (`CONFIG_KERNEL_DEBUG_INFO_BTF=y`)，可在安装时使用 `--force-depends` 参数忽略依赖检查。 --- ## 预览

================================================ FILE: daed/Makefile ================================================ # SPDX-License-Identifier: GPL-2.0-only # # Copyright (C) 2023 ImmortalWrt.org include $(TOPDIR)/rules.mk PKG_NAME:=daed PKG_VERSION:=2026.05.06 DAED_VERSION:=daed-f655b35 WING_VERSION:=wing-dc50308 CORE_VERSION:=core-6005321 WING_HASH_SHORT:=$(shell echo $(WING_VERSION) | cut -d- -f2) CORE_HASH_SHORT:=$(shell echo $(CORE_VERSION) | cut -d- -f2) PKG_RELEASE:=1 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_PROTO:=git PKG_SOURCE_VERSION:=f655b354db5bc39fbf29a48d7c4c10f971c84cd0 PKG_SOURCE_URL:=https://github.com/daeuniverse/daed.git PKG_MIRROR_HASH:=skip PKG_LICENSE:=AGPL-3.0-only MIT PKG_LICENSE_FILES:=LICENSE wing/LICENSE PKG_MAINTAINER:=Tianling Shen DAED_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(PKG_VERSION) PKG_BUILD_DIR:=$(DAED_BUILD_DIR)/wing PKG_BUILD_DEPENDS:=golang/host bpf-headers PKG_BUILD_PARALLEL:=1 PKG_BUILD_FLAGS:=no-mips16 GO_PKG:=github.com/daeuniverse/dae-wing GO_PKG_LDFLAGS:= \ -s -w -buildid= \ -linkmode external -extldflags '-static -Wl,-s' \ -X '$(GO_PKG)/db.AppDescription=$(PKG_NAME) is a integration solution of dae, API and UI.' GO_PKG_LDFLAGS_X:= \ $(GO_PKG)/db.AppName=$(PKG_NAME) \ $(GO_PKG)/db.AppVersion=$(DAED_VERSION)_$(WING_VERSION)_$(CORE_VERSION) GO_PKG_TAGS:=embedallowed,trace include $(INCLUDE_DIR)/package.mk include $(INCLUDE_DIR)/bpf.mk include $(TOPDIR)/feeds/packages/lang/golang/golang-package.mk GO_PKG_BUILD_VARS+= \ GOFLAGS="-trimpath -buildvcs=false -pgo=auto" GO_PKG_TARGET_VARS+= \ CGO_LDFLAGS="$(TARGET_LDFLAGS) -static -Wl,-s" \ GOEXPERIMENT=newinliner,simd define Package/daed/Default SECTION:=net CATEGORY:=Network SUBMENU:=Web Servers/Proxies URL:=https://github.com/daeuniverse/daed endef define Package/daed $(call Package/daed/Default) TITLE:=A Modern Dashboard For dae DEPENDS:=$(GO_ARCH_DEPENDS) \ +ca-bundle +kmod-sched-core +kmod-sched-bpf \ +kmod-veth +v2ray-geoip +v2ray-geosite \ +@KERNEL_XDP_SOCKETS \ +DAED_USE_VMLINUX_BTF:vmlinux-btf endef define Package/daed/config choice prompt "BTF source for CO-RE" default DAED_USE_KERNEL_BTF depends on PACKAGE_daed config DAED_USE_KERNEL_BTF bool "Use kernel BTF (integrated)" depends on KERNEL_DEBUG_INFO_BTF config DAED_USE_VMLINUX_BTF bool "Use vmlinux-btf package" endchoice endef define Package/daed/description daed is a backend of dae, provides a method to bundle arbitrary frontend, dae and geodata into one binary. endef define Package/daed/conffiles /etc/daed/wing.db /etc/config/daed endef NODE_VERSION:=v24.12.0 NODE_DIST:=node-$(NODE_VERSION)-linux-x64 NODE_URL:=https://nodejs.org/dist/$(NODE_VERSION)/$(NODE_DIST).tar.xz define Build/Prepare ( \ rm -rf $(DAED_BUILD_DIR) ; \ mkdir -p $(DAED_BUILD_DIR) ; \ $(TAR) --strip-components=1 -C $(DAED_BUILD_DIR) -xzf $(DL_DIR)/$(PKG_NAME)-$(PKG_VERSION).tar.gz ; \ git clone https://github.com/daeuniverse/dae-wing $(PKG_BUILD_DIR) && \ git -C $(PKG_BUILD_DIR) checkout $(WING_HASH_SHORT) ; \ rm -rf $(PKG_BUILD_DIR)/dae-core ; \ git clone https://github.com/olicesx/dae $(PKG_BUILD_DIR)/dae-core && \ git -C $(PKG_BUILD_DIR)/dae-core checkout $(CORE_HASH_SHORT) ; \ rm -rf $(DAED_BUILD_DIR)/outbound ; \ git clone --depth=1 -b perf/complete-optimizations https://github.com/olicesx/outbound.git $(DAED_BUILD_DIR)/outbound ; \ rm -rf $(DAED_BUILD_DIR)/quic-go ; \ git clone --depth=1 -b perf/node-pooling-v2 https://github.com/olicesx/quic-go.git $(DAED_BUILD_DIR)/quic-go ; \ pushd $(PKG_BUILD_DIR)/dae-core ; \ git submodule update --init ; \ go get -u=patch ; \ go mod tidy ; \ popd ; \ pushd $(PKG_BUILD_DIR) ; \ go mod edit -replace github.com/daeuniverse/outbound=../outbound ; \ go mod edit -replace github.com/daeuniverse/quic-go=../quic-go ; \ go get -u=patch ; \ go mod tidy ; \ wget -qO default.pgo "https://github.com/QiuSimons/luci-app-dae/raw/refs/heads/kix/dae/pprof/default.pgo" ; \ popd ; \ mkdir -p $(DAED_BUILD_DIR)/.node_tmp/config ; \ wget -qO - "$(NODE_URL)" | tar -xJ -C $(DAED_BUILD_DIR)/.node_tmp --strip-components=1 ; \ export PATH="$(DAED_BUILD_DIR)/.node_tmp/bin:$$$$PATH" ; \ export XDG_CONFIG_HOME="$(DAED_BUILD_DIR)/.node_tmp/config" ; \ npm install -g pnpm ; \ pushd $(DAED_BUILD_DIR) ; \ pnpm install ; \ pnpm build --filter daed ; \ popd ; \ mkdir -p $(PKG_BUILD_DIR)/webrender/web ; \ cp -rf $(DAED_BUILD_DIR)/apps/web/dist/* $(PKG_BUILD_DIR)/webrender/web ; \ find $(PKG_BUILD_DIR)/webrender/web -name "*.map" -type f -delete ; \ find $(PKG_BUILD_DIR)/webrender/web -type f -size +4k ! -name "*.gz" ! -name "*.woff" ! -name "*.woff2" -exec sh -c '\ gzip -9 -k "{}"; \ if [ "$$$$(stat -c %s {})" -lt "$$$$(stat -c %s {}.gz)" ]; then \ rm {}.gz; \ else \ rm {}; \ fi' \ ";" ; \ rm -rf $(DAED_BUILD_DIR)/.node_tmp ; \ ) endef DAE_CFLAGS:= \ -O2 -Wall -Werror \ -DMAX_MATCH_SET_LEN=1024 \ -I$(BPF_HEADERS_DIR)/tools/lib \ -I$(BPF_HEADERS_DIR)/arch/$(BPF_KARCH)/include/asm/mach-generic define Build/Compile ( \ pushd $(PKG_BUILD_DIR) ; \ export \ $(GO_GENERAL_BUILD_CONFIG_VARS) \ $(GO_PKG_BUILD_CONFIG_VARS) \ $(GO_PKG_BUILD_VARS) ; \ go generate ./... ; \ cd dae-core ; \ export \ BPF_CLANG="$(CLANG)" \ BPF_STRIP_FLAG="-strip=$(LLVM_STRIP)" \ BPF_CFLAGS="$(DAE_CFLAGS)" \ BPF_TARGET="bpfel,bpfeb" \ BPF_TRACE_TARGET="$(GO_ARCH)" ; \ go generate ./control/control.go ; \ go generate ./trace/trace.go ; \ popd ; \ ) $(call GoPackage/Build/Compile) endef define Package/daed/install $(call GoPackage/Package/Install/Bin,$(PKG_INSTALL_DIR)) $(INSTALL_DIR) $(1)/usr/bin $(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/bin/dae-wing $(1)/usr/bin/daed $(INSTALL_DIR) $(1)/etc/config $(INSTALL_CONF) $(CURDIR)/files/daed.config $(1)/etc/config/daed $(INSTALL_DIR) $(1)/etc/init.d $(INSTALL_BIN) $(CURDIR)/files/daed.init $(1)/etc/init.d/daed endef $(eval $(call GoBinPackage,daed)) $(eval $(call BuildPackage,daed)) ================================================ FILE: daed/files/daed.config ================================================ config daed 'config' option enabled '0' option listen_addr '0.0.0.0:2023' option log_maxbackups '1' option log_maxsize '5' ================================================ FILE: daed/files/daed.init ================================================ #!/bin/sh /etc/rc.common # Copyright (C) 2023 Tianling Shen USE_PROCD=1 START=99 CONF="daed" PROG="/usr/bin/daed" LOG="/var/log/daed/daed.log" DAENETNS="/run/netns/daens" start_service() { config_load "$CONF" local enabled config_get_bool enabled "config" "enabled" "0" [ "$enabled" -eq "1" ] || return 1 local listen_addr log_maxbackups log_maxsize config_get listen_addr "config" "listen_addr" "0.0.0.0:2023" config_get log_maxbackups "config" "log_maxbackups" "1" config_get log_maxsize "config" "log_maxsize" "5" procd_open_instance "$CONF" procd_set_param command "$PROG" run procd_append_param command --config "/etc/daed/" procd_append_param command --listen "$listen_addr" procd_append_param command --logfile "$LOG" procd_append_param command --logfile-maxbackups "$log_maxbackups" procd_append_param command --logfile-maxsize "$log_maxsize" procd_set_param limits core="unlimited" procd_set_param limits nofile="1000000 1000000" procd_set_param respawn # procd_set_param stdout 1 procd_set_param stderr 1 procd_close_instance } stop_service() { rm -f "$LOG" [ -f "$DAENETNS" ] && umount "$DAENETNS" } service_triggers() { procd_add_reload_trigger "$CONF" } ================================================ FILE: luci-app-daed/Makefile ================================================ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-daed PKG_VERSION:=1.4 PKG_RELEASE:=1 LUCI_TITLE:=LuCI Support for DAED LUCI_DEPENDS:=+daed +zoneinfo-asia +luci-compat LUCI_PKGARCH:=all define Package/$(PKG_NAME)/conffiles endef include $(TOPDIR)/feeds/luci/luci.mk # call BuildPackage - OpenWrt buildroot signature ================================================ FILE: luci-app-daed/luasrc/controller/daed.lua ================================================ local sys = require "luci.sys" local http = require "luci.http" module("luci.controller.daed", package.seeall) function index() if not nixio.fs.access("/etc/config/daed") then return end entry({"admin", "services", "daed"}, alias("admin", "services", "daed", "setting"),_("DAED"), 58).dependent = true entry({"admin", "services", "daed", "setting"}, cbi("daed/basic"), _("Base Setting"), 1).leaf=true entry({"admin", "services", "daed", "daed"}, template("daed/daed"), _("Dashboard"), 2).leaf = true entry({"admin", "services", "daed", "log"}, cbi("daed/log"), _("Logs"), 3).leaf = true entry({"admin", "services", "daed_status"}, call("act_status")) entry({"admin", "services", "daed", "get_log"}, call("get_log")).leaf = true entry({"admin", "services", "daed", "clear_log"}, call("clear_log")).leaf = true end function act_status() local sys = require "luci.sys" local e = { } e.running = sys.call("pidof daed >/dev/null") == 0 luci.http.prepare_content("application/json") luci.http.write_json(e) end function get_log() http.write(sys.exec("cat /var/log/daed/daed.log")) end function clear_log() sys.call("true > /var/log/daed/daed.log") end ================================================ FILE: luci-app-daed/luasrc/model/cbi/daed/basic.lua ================================================ local m, s ,o m = Map("daed") m.title = translate("DAED") m.description = translate("DAE is a Linux high-performance transparent proxy solution based on eBPF, And DAED is a modern dashboard for dae.") m:section(SimpleSection).template = "daed/daed_status" s = m:section(TypedSection, "daed", translate("Global Settings")) s.addremove = false s.anonymous = true o = s:option(Flag,"enabled",translate("Enable")) o.default = 0 o = s:option(Value, "log_maxbackups", translate("Logfile retention count")) o.default = 1 o = s:option(Value, "log_maxsize", translate("Logfile Max Size (MB)")) o.default = 5 o = s:option(Value, "listen_addr",translate("Set the DAED listen address")) o.default = '0.0.0.0:2023' o = s:option(Value, "dashboard_port", translate("Dashboard Access Port")) o.placeholder = translate("Leave empty to use listen port") o.datatype = "range(1,65535)" o.description = translate("For reverse proxy scenarios, leave empty to use the port from listen address") m.apply_on_parse = true m.on_after_apply = function(self,map) luci.sys.exec("/etc/init.d/daed restart") end return m ================================================ FILE: luci-app-daed/luasrc/model/cbi/daed/log.lua ================================================ m = Map("daed") m:append(Template("daed/daed_log")) return m ================================================ FILE: luci-app-daed/luasrc/view/daed/daed.htm ================================================ <%+header%> <% local running = luci.sys.exec("pgrep -x /usr/bin/daed") %> <% if tonumber(running) ~= nil then %>
<% else %>

<%:DAED is not running%>

<%:Please start the DAED service first and try again%>

<% end -%> <%+footer%> ================================================ FILE: luci-app-daed/luasrc/view/daed/daed_log.htm ================================================
================================================ FILE: luci-app-daed/luasrc/view/daed/daed_status.htm ================================================

<%:Collecting data...%>

================================================ FILE: luci-app-daed/po/zh_Hans/daed.po ================================================ msgid "" msgstr "Content-Type: text/plain; charset=UTF-8" msgid "DAED" msgstr "DAED" msgid "DAE is a Linux high-performance transparent proxy solution based on eBPF, And DAED is a modern dashboard for dae." msgstr "DAE是一个基于eBPF的Linux高性能透明代理解决方案,而DAED是DAE的管理面板。" msgid "Base Setting" msgstr "基本设置" msgid "Dashboard" msgstr "仪表板" msgid "Logs" msgstr "日志" msgid "Clear logs" msgstr "清空日志" msgid "RUNNING" msgstr "运行中" msgid "NOT RUNNING" msgstr "未运行" msgid "Collecting data..." msgstr "收集数据..." msgid "Logfile retention count" msgstr "日志文件保留数量" msgid "Logfile Max Size (MB)" msgstr "日志文件大小(MB)" msgid "Set the DAED listen address" msgstr "设置监听地址" msgid "Dashboard Access Port" msgstr "仪表板访问端口" msgid "Leave empty to use listen port" msgstr "留空则使用监听端口" msgid "For reverse proxy scenarios, leave empty to use the port from listen address" msgstr "用于反向代理场景,留空则使用监听地址的端口" msgid "DAED is not running" msgstr "DAED 未运行" msgid "Please start the DAED service first and try again" msgstr "请先启动 DAED 服务后重试" msgid "Enable Auto Subscribe Update" msgstr "启用订阅自动更新" msgid "Update Cycle" msgstr "更新周期" msgid "Update Time (Every Day)" msgstr "更新时间(每天)" msgid "Username" msgstr "用户名" msgid "Password" msgstr "密码" ================================================ FILE: luci-app-daed/root/etc/hotplug.d/iface/98-daed ================================================ #!/bin/sh [ "${ACTION}" = "ifup" ] || exit 0 DEVICE=$(logread | grep "link is up" | tail -n 1 | awk -F "'" '{print $2}') DEVICE_TYPE=$(ip link show dev "$DEVICE") case "$DEVICE_TYPE" in *"link/ether"*) ( LOCK_FILE="/tmp/lock/daed_hotplug_lock" if [ -f "$LOCK_FILE" ]; then exit 1 else echo $$ > "$LOCK_FILE" 2>/dev/null trap 'rm -f "$LOCK_FILE"' EXIT sleep 60 /etc/init.d/daed restart 2>&1 fi ) & ;; esac ================================================ FILE: luci-app-daed/root/etc/init.d/luci_daed ================================================ #!/bin/sh /etc/rc.common # Copyright (C) 2023 Tianling Shen USE_PROCD=0 START=98 CONF="daed" PROG="/usr/bin/daed" LOG="/var/log/daed/daed.log" CRON_FILE="/etc/crontabs/root" RANDOM_SEED=$RANDOM RANDOM_NUM=$((RANDOM_SEED % 10 + 1)) setcron() { touch $CRON_FILE sed -i '/daed_sub.sh/d' $CRON_FILE 2>/dev/null [ "$(uci -q get daed.config.subscribe_auto_update)" -eq 1 ] && echo "${RANDOM_NUM} $(uci -q get daed.config.subscribe_update_day_time) * * $(uci -q get daed.config.subscribe_update_week_time) /etc/daed/daed_sub.sh >/dev/null 2>&1" >>$CRON_FILE crontab $CRON_FILE } delcron() { sed -i '/daed_sub.sh/d' $CRON_FILE 2>/dev/null crontab $CRON_FILE } setlocaluse() { uci set dhcp.@dnsmasq[0].localuse="1" uci commit dhcp /etc/init.d/dnsmasq restart } dellocaluse() { uci set dhcp.@dnsmasq[0].localuse="0" uci commit dhcp /etc/init.d/dnsmasq restart . /lib/functions/network.sh network_find_wan LOGICAL_WAN || exit 1 dns_list=$(ubus call network.interface.$LOGICAL_WAN status | jsonfilter -e '@["dns-server"]' | sed 's/[]["]//g' | sed 's/,/\n/g' | grep -oE '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b') [ -z "$dns_list" ] && dns_list="119.29.29.29 180.76.76.76 223.5.5.5" grep -v '^nameserver ' /etc/resolv.conf > /tmp/resolv.conf.new.daed 2>/dev/null for dns in $dns_list; do echo "nameserver $dns" >> /tmp/resolv.conf.new.daed done cat /tmp/resolv.conf.new.daed > /etc/resolv.conf rm -f /tmp/resolv.conf.new.daed } start_service() { [ -f "/etc/init.d/daed" ] && grep -q "DAE_LOCATION_ASSET" "/etc/init.d/daed" || sed -i '/run/i\ procd_set_param env DAE_LOCATION_ASSET="/usr/share/v2ray"' "/etc/init.d/daed" config_load "$CONF" local enabled config_get_bool enabled "config" "enabled" "0" if [ "$enabled" -eq 0 ]; then #delcron setlocaluse return 1 fi #setcron dellocaluse } stop_service() { #delcron setlocaluse } service_triggers() { procd_add_reload_trigger "$CONF" } ================================================ FILE: luci-app-daed/root/usr/share/rpcd/acl.d/luci-app-daed.json ================================================ { "luci-app-daed": { "description": "Grant UCI access for luci-app-daed", "read": { "uci": [ "daed" ] }, "write": { "uci": [ "daed" ] } } } ================================================ FILE: patchset/0001-fix-runtime-stats.patch ================================================ diff --git a/dae-core/control/runtime_stats.go b/dae-core/control/runtime_stats.go index 1a75d5f..5a692bf 100644 --- a/dae-core/control/runtime_stats.go +++ b/dae-core/control/runtime_stats.go @@ -62,7 +62,10 @@ type runtimeStats struct { historyLen int } -var globalRuntimeStats = newRuntimeStats() +var ( + globalRuntimeStats = newRuntimeStats() + activeRuntimeStats atomic.Pointer[runtimeStats] +) func newRuntimeStats() *runtimeStats { return &runtimeStats{} @@ -77,6 +80,10 @@ func RecordUploadTraffic(n int64) { if n <= 0 { return } + if active := activeRuntimeStats.Load(); active != nil { + active.record(uint64(n), 0) + return + } if globalRuntimeStats != nil { globalRuntimeStats.record(uint64(n), 0) } @@ -87,6 +94,10 @@ func RecordDownloadTraffic(n int64) { if n <= 0 { return } + if active := activeRuntimeStats.Load(); active != nil { + active.record(0, uint64(n)) + return + } if globalRuntimeStats != nil { globalRuntimeStats.record(0, uint64(n)) } @@ -95,6 +106,9 @@ func RecordDownloadTraffic(n int64) { // Deprecated: prefer (*ControlPlane).SnapshotRuntimeStats for per-instance stats. // SnapshotRuntimeStats returns the current runtime traffic snapshot. func SnapshotRuntimeStats(activeConnections int, udpSessions int, windowSec int, maxPoints int) RuntimeStatsSnapshot { + if active := activeRuntimeStats.Load(); active != nil { + return active.snapshot(activeConnections, udpSessions, windowSec, maxPoints, time.Now()) + } if globalRuntimeStats == nil { return RuntimeStatsSnapshot{ UpdatedAt: time.Now(), @@ -124,6 +138,7 @@ func (s *runtimeStats) startRoller(ctx context.Context) { return } s.rollerOnce.Do(func() { + activeRuntimeStats.Store(s) s.roll(time.Now()) go func() { ticker := time.NewTicker(runtimeBucketDuration) ================================================ FILE: patchset/build_fixes.patch ================================================ diff --git a/graphql/service/config/global/generator/input/input.go b/graphql/service/config/global/generator/input/input.go index dc2ae0e..7d00286 100644 --- a/graphql/service/config/global/generator/input/input.go +++ b/graphql/service/config/global/generator/input/input.go @@ -75,6 +75,9 @@ func (b *builder) Build() (string, error) { if !ok { return "", fmt.Errorf("field %v has no required mapstructure", structField.Name) } + if name == "_" { + continue + } switch field := field.Interface().(type) { case uint, uint8, uint16, uint32, uint64, int, int8, int16, int32, int64: diff --git a/graphql/service/config/global/generator/resolver/resolver.go b/graphql/service/config/global/generator/resolver/resolver.go index daba474..28362ca 100644 --- a/graphql/service/config/global/generator/resolver/resolver.go +++ b/graphql/service/config/global/generator/resolver/resolver.go @@ -62,6 +62,9 @@ func (b *builder) Build() (string, error) { if !ok { return "", fmt.Errorf("field %v has no required mapstructure", structField.Name) } + if name == "_" { + continue + } switch field := field.Interface().(type) { case uint, uint8, uint16, uint32, uint64, int, int8, int16, int32, int64: ================================================ FILE: patchset/kix-bind_fix.patch ================================================ From 5740b94c734da74557be2a48b2a967bf0ab2eb12 Mon Sep 17 00:00:00 2001 From: kix Date: Wed, 25 Jun 2025 17:58:33 +0800 Subject: [PATCH] fix: resolve DNS cache UDP port binding race condition - Improve AnyfromPool concurrent control with exponential backoff retry - Add timeout protection to prevent infinite waiting in high concurrency - Enhance error handling in sendPkt to prevent crashes on binding failures - Replace fatal errors with warning logs for DNS response sending failures - Maintain service availability when UDP port conflicts occur Fixes the occasional crashes with 'bind: address already in use' errors that occurred during high concurrent DNS requests on port 53. --- control/anyfrom_pool.go | 19 ++++++++++++------- control/dns_control.go | 24 ++++++++++++++++++++---- control/udp.go | 7 ++++++- 3 files changed, 38 insertions(+), 12 deletions(-) diff --git a/control/anyfrom_pool.go b/control/anyfrom_pool.go index 668fcab02..c559c0faa 100644 --- a/control/anyfrom_pool.go +++ b/control/anyfrom_pool.go @@ -8,6 +8,7 @@ package control import ( "context" "errors" + "fmt" "math" "net" "net/netip" @@ -177,17 +178,21 @@ func (p *AnyfromPool) GetOrCreate(lAddr string, ttl time.Duration) (conn *Anyfro return anyfrom, false, nil } - // 使用双重检查锁定模式避免重复创建 + // 使用更精确的双重检查锁定模式避免重复创建 // 创建临时key用于创建锁 createKey := lAddr + "_creating" if _, loaded := p.pool.LoadOrStore(createKey, struct{}{}); loaded { - // 有其他goroutine在创建，等待并重试 - time.Sleep(time.Microsecond * 100) - if af, ok := p.pool.Load(lAddr); ok { - anyfrom := af.(*Anyfrom) - anyfrom.RefreshTtl() - return anyfrom, false, nil + // 有其他goroutine在创建，使用退避重试机制 + for i := 0; i < 10; i++ { + time.Sleep(time.Millisecond * time.Duration(i+1)) // 递增退避 + if af, ok := p.pool.Load(lAddr); ok { + anyfrom := af.(*Anyfrom) + anyfrom.RefreshTtl() + return anyfrom, false, nil + } } + // 如果等待后仍未创建成功，返回错误而不是继续创建 + return nil, false, fmt.Errorf("timeout waiting for connection creation on %s", lAddr) } defer p.pool.Delete(createKey) diff --git a/control/dns_control.go b/control/dns_control.go index 069dd09b6..e66f83086 100644 --- a/control/dns_control.go +++ b/control/dns_control.go @@ -445,7 +445,11 @@ func (c *DnsController) handle_( if resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil { if needResp { if err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil { - return fmt.Errorf("failed to write cached DNS resp: %w", err) + c.log.WithError(err).WithFields(logrus.Fields{ + "from": req.realSrc.String(), + "to": req.realDst.String(), + }).Warn("failed to write cached DNS resp") + // 不返回错误，继续处理避免程序崩溃 } } return nil @@ -459,7 +463,11 @@ func (c *DnsController) handle_( // Send cache to client directly. if needResp { if err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil { - return fmt.Errorf("failed to write cached DNS resp: %w", err) + c.log.WithError(err).WithFields(logrus.Fields{ + "from": req.realSrc.String(), + "to": req.realDst.String(), + }).Warn("failed to write cached DNS resp") + // 不返回错误，继续处理避免程序崩溃 } } if c.log.IsLevelEnabled(logrus.DebugLevel) && len(dnsMessage.Question) > 0 { @@ -508,7 +516,11 @@ func (c *DnsController) sendReject_(dnsMessage *dnsmessage.Msg, req *udpRequest) return fmt.Errorf("pack DNS packet: %w", err) } if err = sendPkt(c.log, data, req.realDst, req.realSrc, req.src, req.lConn); err != nil { - return err + c.log.WithError(err).WithFields(logrus.Fields{ + "from": req.realSrc.String(), + "to": req.realDst.String(), + }).Warn("failed to send DNS reject response") + // 不返回错误，避免程序崩溃 } return nil } @@ -646,7 +658,11 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte return err } if err = sendPkt(c.log, data, req.realDst, req.realSrc, req.src, req.lConn); err != nil { - return err + c.log.WithError(err).WithFields(logrus.Fields{ + "from": req.realSrc.String(), + "to": req.realDst.String(), + }).Warn("failed to send DNS response") + // 不返回错误，避免程序崩溃 } } return nil diff --git a/control/udp.go b/control/udp.go index 8344a7e03..0c7021ecd 100644 --- a/control/udp.go +++ b/control/udp.go @@ -55,7 +55,12 @@ func ChooseNatTimeout(data []byte, sniffDns bool) (dmsg *dnsmessage.Msg, timeout func sendPkt(log *logrus.Logger, data []byte, from netip.AddrPort, realTo, to netip.AddrPort, lConn *net.UDPConn) (err error) { uConn, _, err := DefaultAnyfromPool.GetOrCreate(from.String(), AnyfromTimeout) if err != nil { - return + // 如果无法创建连接，记录详细错误但不崩溃 + log.WithError(err).WithFields(logrus.Fields{ + "from": from.String(), + "to": realTo.String(), + }).Debug("Failed to get UDP connection from pool, skipping packet") + return err } _, err = uConn.WriteToUDPAddrPort(data, realTo) return err ================================================ FILE: patchset/kix-feat_DNS_high_concurrency_optimization.patch ================================================ From 6bf2cc67129fde3d7f69152bd7a8cd5354469c95 Mon Sep 17 00:00:00 2001 From: kix Date: Fri, 20 Jun 2025 15:03:02 +0800 Subject: [PATCH] feat: DNS high-concurrency optimization - Add singleflight to merge concurrent queries for same domain - Implement 16-shard cache architecture to reduce lock contention - Add global concurrent query limit (2000) with graceful degradation - Prioritize cache hits, skip routing for cached responses - Optimize TTL handling with 60s minimum and fixed_domain_ttl support - Add UDP response size limit (4096 bytes) - Simplify cache management with TTL-based expiration - Enhance error handling with DNS SERVFAIL responses - Improve CloneDnsCache to only copy valid entries Performance improvements: - 3-5x throughput increase in high-load scenarios - Reduced lock contention with sharded cache - Better memory efficiency with valid-only cache cloning - Enhanced stability under DoS conditions --- control/control_plane.go | 21 +++- control/dns.go | 4 + control/dns_control.go | 261 +++++++++++++++++++++++++++++---------- go.mod | 2 +- 4 files changed, 217 insertions(+), 71 deletions(-) diff --git a/control/control_plane.go b/control/control_plane.go index e57cbd8..a4762fe 100644 --- a/control/control_plane.go +++ b/control/control_plane.go @@ -560,9 +560,24 @@ func (c *ControlPlane) InjectBpf(bpf *bpfObjects) { } func (c *ControlPlane) CloneDnsCache() map[string]*DnsCache { - c.dnsController.dnsCacheMu.Lock() - defer c.dnsController.dnsCacheMu.Unlock() - return deepcopy.Copy(c.dnsController.dnsCache).(map[string]*DnsCache) + result := make(map[string]*DnsCache) + now := time.Now() + + // 遍历所有分片缓存，只克隆有效（未过期）的缓存 + for i := range c.dnsController.dnsCacheShards { + shard := &c.dnsController.dnsCacheShards[i] + shard.mu.RLock() + for key, cache := range shard.cache { + // 检查缓存是否仍然有效（未过期） + if cache.Deadline.After(now) { + // 只对有效缓存进行深拷贝，避免不必要的拷贝开销 + result[key] = deepcopy.Copy(cache).(*DnsCache) + } + } + shard.mu.RUnlock() + } + + return result } func (c *ControlPlane) dnsUpstreamReadyCallback(dnsUpstream *dns.Upstream) (err error) { diff --git a/control/dns.go b/control/dns.go index 5d9818e..e2d3e53 100644 --- a/control/dns.go +++ b/control/dns.go @@ -353,6 +353,10 @@ func (d *DoUDP) ForwardDNS(ctx context.Context, data []byte) (*dnsmessage.Msg, e if err != nil { return nil, err } + // UDP包大小限制，超出4096直接丢弃 + if n > 4096 { + return nil, fmt.Errorf("UDP DNS response too large: %d bytes (limit 4096)", n) + } var msg dnsmessage.Msg if err = msg.Unpack(respBuf[:n]); err != nil { return nil, err diff --git a/control/dns_control.go b/control/dns_control.go index 6a55368..5e7fdf8 100644 --- a/control/dns_control.go +++ b/control/dns_control.go @@ -8,6 +8,7 @@ package control import ( "context" "fmt" + "hash/fnv" "math" "net" "net/netip" @@ -26,11 +27,18 @@ import ( dnsmessage "github.com/miekg/dns" "github.com/mohae/deepcopy" "github.com/sirupsen/logrus" + "golang.org/x/sync/singleflight" ) const ( MaxDnsLookupDepth = 3 minFirefoxCacheTtl = 120 + // 缓存分片数，减少锁竞争 + dnsCacheShards = 16 + // 全局并发查询限制 + maxGlobalConcurrentQueries = 5000 + // DNS缓存最小TTL，防止频繁查询 + minDnsTtlSeconds = 60 ) type IpVersionPrefer int @@ -62,7 +70,10 @@ type DnsControllerOption struct { } type DnsController struct { - handling sync.Map + sfg singleflight.Group // singleflight用于合并同key查询 + + // 全局并发控制 + globalConcurrentQueries int64 routing *dns.Dns qtypePrefer uint16 @@ -76,16 +87,15 @@ type DnsController struct { timeoutExceedCallback func(dialArgument *dialArgument, err error) fixedDomainTtl map[string]int - // mutex protects the dnsCache. - dnsCacheMu sync.Mutex - dnsCache map[string]*DnsCache + // 分片缓存，减少锁竞争 + dnsCacheShards [dnsCacheShards]dnsCacheShard dnsForwarderCacheMu sync.Mutex dnsForwarderCache map[dnsForwarderKey]DnsForwarder } -type handlingState struct { - mu sync.Mutex - ref uint32 +type dnsCacheShard struct { + mu sync.RWMutex + cache map[string]*DnsCache } func parseIpVersionPreference(prefer int) (uint16, error) { @@ -108,7 +118,7 @@ func NewDnsController(routing *dns.Dns, option *DnsControllerOption) (c *DnsCont return nil, err } - return &DnsController{ + controller := &DnsController{ routing: routing, qtypePrefer: prefer, @@ -120,11 +130,16 @@ func NewDnsController(routing *dns.Dns, option *DnsControllerOption) (c *DnsCont timeoutExceedCallback: option.TimeoutExceedCallback, fixedDomainTtl: option.FixedDomainTtl, - dnsCacheMu: sync.Mutex{}, - dnsCache: make(map[string]*DnsCache), dnsForwarderCacheMu: sync.Mutex{}, dnsForwarderCache: make(map[dnsForwarderKey]DnsForwarder), - }, nil + } + + // 初始化分片缓存 + for i := 0; i < dnsCacheShards; i++ { + controller.dnsCacheShards[i].cache = make(map[string]*DnsCache) + } + + return controller, nil } func (c *DnsController) cacheKey(qname string, qtype uint16) string { @@ -133,17 +148,16 @@ func (c *DnsController) cacheKey(qname string, qtype uint16) string { } func (c *DnsController) RemoveDnsRespCache(cacheKey string) { - c.dnsCacheMu.Lock() - _, ok := c.dnsCache[cacheKey] - if ok { - delete(c.dnsCache, cacheKey) - } - c.dnsCacheMu.Unlock() + shard := c.getDnsCacheShard(cacheKey) + shard.mu.Lock() + delete(shard.cache, cacheKey) + shard.mu.Unlock() } func (c *DnsController) LookupDnsRespCache(cacheKey string, ignoreFixedTtl bool) (cache *DnsCache) { - c.dnsCacheMu.Lock() - cache, ok := c.dnsCache[cacheKey] - c.dnsCacheMu.Unlock() + shard := c.getDnsCacheShard(cacheKey) + shard.mu.RLock() + cache, ok := shard.cache[cacheKey] + shard.mu.RUnlock() if !ok { return nil } @@ -287,21 +301,22 @@ func (c *DnsController) __updateDnsCacheDeadline(host string, dnsTyp uint16, ans deadline, originalDeadline := deadlineFunc(now, host) cacheKey := c.cacheKey(fqdn, dnsTyp) - c.dnsCacheMu.Lock() - cache, ok := c.dnsCache[cacheKey] + shard := c.getDnsCacheShard(cacheKey) + shard.mu.Lock() + cache, ok := shard.cache[cacheKey] if ok { cache.Answer = answers cache.Deadline = deadline cache.OriginalDeadline = originalDeadline - c.dnsCacheMu.Unlock() + shard.mu.Unlock() } else { cache, err = c.newCache(fqdn, answers, deadline, originalDeadline) if err != nil { - c.dnsCacheMu.Unlock() + shard.mu.Unlock() return err } - c.dnsCache[cacheKey] = cache - c.dnsCacheMu.Unlock() + shard.cache[cacheKey] = cache + shard.mu.Unlock() } if err = c.cacheAccessCallback(cache); err != nil { return err @@ -324,9 +339,25 @@ func (c *DnsController) UpdateDnsCacheDeadline(host string, dnsTyp uint16, answe } func (c *DnsController) UpdateDnsCacheTtl(host string, dnsTyp uint16, answers []dnsmessage.RR, ttl int) (err error) { + // 设置最小TTL为60秒，防止频繁查询 + if ttl < minDnsTtlSeconds { + ttl = minDnsTtlSeconds + if c.log.IsLevelEnabled(logrus.DebugLevel) { + c.log.Debugf("DNS TTL for %s too small, adjusted to %d seconds", host, minDnsTtlSeconds) + } + } + return c.__updateDnsCacheDeadline(host, dnsTyp, answers, func(now time.Time, host string) (daedline time.Time, originalDeadline time.Time) { originalDeadline = now.Add(time.Duration(ttl) * time.Second) if fixedTtl, ok := c.fixedDomainTtl[host]; ok { + if fixedTtl == 0 { + // TTL为0表示不缓存，立即过期 + return now.Add(-1 * time.Second), originalDeadline + } + // 固定TTL也要遵循最小60秒限制（除非是0） + if fixedTtl < minDnsTtlSeconds { + fixedTtl = minDnsTtlSeconds + } return now.Add(time.Duration(fixedTtl) * time.Second), originalDeadline } else { return originalDeadline, originalDeadline @@ -444,66 +475,126 @@ func (c *DnsController) handle_( qtype = q.Qtype } - // Route request. + cacheKey := c.cacheKey(qname, qtype) + + // 检查是否为禁用缓存的域名（fixed_domain_ttl=0） + host := strings.TrimSuffix(qname, ".") + if fixedTtl, ok := c.fixedDomainTtl[host]; ok && fixedTtl == 0 { + // TTL为0表示禁用缓存，直接跳过缓存查找 + if c.log.IsLevelEnabled(logrus.DebugLevel) { + c.log.Debugf("DNS cache disabled for %s (fixed_domain_ttl=0), skipping cache lookup", host) + } + } else { + // 优先查缓存 - 缓存命中直接返回，跳过所有规则匹配和路由处理 + // 缓存查询不占用并发槽位，因为几乎不消耗系统资源 + if resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil { + if needResp { + if err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil { + return fmt.Errorf("failed to write cached DNS resp: %w", err) + } + } + if c.log.IsLevelEnabled(logrus.DebugLevel) && len(dnsMessage.Question) > 0 { + q := dnsMessage.Question[0] + c.log.Debugf("UDP(DNS) %v <-> Cache: %v %v", + RefineSourceToShow(req.realSrc, req.realDst.Addr()), strings.ToLower(q.Name), QtypeToString(q.Qtype), + ) + } + return nil + } + } + + // 缓存未命中，进行路由规则匹配 upstreamIndex, upstream, err := c.routing.RequestSelect(qname, qtype) if err != nil { return err } - cacheKey := c.cacheKey(qname, qtype) - if upstreamIndex == consts.DnsRequestOutboundIndex_Reject { - // Reject with empty answer. c.RemoveDnsRespCache(cacheKey) return c.sendReject_(dnsMessage, req) } - // No parallel for the same lookup. - handlingState_, _ := c.handling.LoadOrStore(cacheKey, new(handlingState)) - handlingState := handlingState_.(*handlingState) - atomic.AddUint32(&handlingState.ref, 1) - handlingState.mu.Lock() - defer func() { - handlingState.mu.Unlock() - atomic.AddUint32(&handlingState.ref, ^uint32(0)) - if atomic.LoadUint32(&handlingState.ref) == 0 { - c.handling.Delete(cacheKey) + // 全局并发控制，防止上游查询资源耗尽 + // 只对需要访问上游的查询进行限制，缓存命中已经跳过 + current := atomic.LoadInt64(&c.globalConcurrentQueries) + if current >= maxGlobalConcurrentQueries { + // 使用Warn级别记录，便于监控 + if c.log != nil { + c.log.Warnf("Global concurrent DNS queries limit reached (%d), rejecting %s", current, cacheKey) } - }() + // 返回SERVFAIL响应而不是直接丢弃，让客户端可以重试或使用备用DNS + return c.sendServFail_(dnsMessage, req, "concurrent limit exceeded") + } + atomic.AddInt64(&c.globalConcurrentQueries, 1) + defer atomic.AddInt64(&c.globalConcurrentQueries, -1) + + // singleflight合并同key查询，带超时保护 + ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second) + defer cancel() + + type result struct { + data []byte + err error + } - if resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil { - // Send cache to client directly. - if needResp { - if err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil { - return fmt.Errorf("failed to write cached DNS resp: %w", err) + resultCh := make(chan result, 1) + go func() { + v, err, _ := c.sfg.Do(cacheKey, func() (interface{}, error) { + // panic保护 + defer func() { + if r := recover(); r != nil { + if c.log != nil { + c.log.Errorf("panic in singleflight DNS query for %s: %v", cacheKey, r) + } + } + }() + + if c.log.IsLevelEnabled(logrus.DebugLevel) { + c.log.Debugf("singleflight: real upstream query for %s", cacheKey) } + + // Re-pack DNS packet. + data, err := dnsMessage.Pack() + if err != nil { + return nil, fmt.Errorf("pack DNS packet: %w", err) + } + + err = c.dialSend(0, req, data, dnsMessage.Id, upstream, false) + if err != nil { + return nil, err + } + + // 查询后获取缓存结果 + resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false) + return resp, nil + }) + if v != nil { + resultCh <- result{data: v.([]byte), err: err} + } else { + resultCh <- result{data: nil, err: err} } - if c.log.IsLevelEnabled(logrus.DebugLevel) && len(dnsMessage.Question) > 0 { - q := dnsMessage.Question[0] - c.log.Debugf("UDP(DNS) %v <-> Cache: %v %v", - RefineSourceToShow(req.realSrc, req.realDst.Addr()), strings.ToLower(q.Name), QtypeToString(q.Qtype), - ) - } - return nil - } + }() - if c.log.IsLevelEnabled(logrus.TraceLevel) { - upstreamName := upstreamIndex.String() - if upstream != nil { - upstreamName = upstream.String() + var v []byte + select { + case res := <-resultCh: + v = res.data + err = res.err + case <-ctx.Done(): + if c.log != nil { + c.log.Warnf("DNS upstream query timeout for %s", cacheKey) } - c.log.WithFields(logrus.Fields{ - "question": dnsMessage.Question, - "upstream": upstreamName, - }).Traceln("Request to DNS upstream") + return fmt.Errorf("DNS upstream query timeout for %s", cacheKey) } - - // Re-pack DNS packet. - data, err := dnsMessage.Pack() if err != nil { - return fmt.Errorf("pack DNS packet: %w", err) + return err + } + if needResp && v != nil { + if err = sendPkt(c.log, v, req.realDst, req.realSrc, req.src, req.lConn); err != nil { + return fmt.Errorf("failed to write singleflight DNS resp: %w", err) + } } - return c.dialSend(0, req, data, dnsMessage.Id, upstream, needResp) + return nil } // sendReject_ send empty answer. @@ -529,6 +620,30 @@ func (c *DnsController) sendReject_(dnsMessage *dnsmessage.Msg, req *udpRequest) return nil } +// sendServFail_ send SERVFAIL response for rate limiting or server errors. +func (c *DnsController) sendServFail_(dnsMessage *dnsmessage.Msg, req *udpRequest, reason string) (err error) { + dnsMessage.Answer = nil + dnsMessage.Rcode = dnsmessage.RcodeServerFailure + dnsMessage.Response = true + dnsMessage.RecursionAvailable = true + dnsMessage.Truncated = false + dnsMessage.Compress = true + if c.log.IsLevelEnabled(logrus.DebugLevel) { + c.log.WithFields(logrus.Fields{ + "question": dnsMessage.Question, + "reason": reason, + }).Debugf("DNS SERVFAIL: %s", reason) + } + data, err := dnsMessage.Pack() + if err != nil { + return fmt.Errorf("pack DNS SERVFAIL packet: %w", err) + } + if err = sendPkt(c.log, data, req.realDst, req.realSrc, req.src, req.lConn); err != nil { + return err + } + return nil +} + func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte, id uint16, upstream *dns.Upstream, needResp bool) (err error) { if invokingDepth >= MaxDnsLookupDepth { return fmt.Errorf("too deep DNS lookup invoking (depth: %v); there may be infinite loop in your DNS response routing", MaxDnsLookupDepth) @@ -691,3 +806,15 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte } return nil } + +// 计算缓存分片索引 +func (c *DnsController) getShardIndex(key string) int { + h := fnv.New32a() + h.Write([]byte(key)) + return int(h.Sum32() % dnsCacheShards) +} + +// 分片式缓存操作，减少锁竞争 +func (c *DnsController) getDnsCacheShard(key string) *dnsCacheShard { + return &c.dnsCacheShards[c.getShardIndex(key)] +} diff --git a/go.mod b/go.mod index 66ab2ee..b315244 100644 --- a/go.mod +++ b/go.mod @@ -29,6 +29,7 @@ require ( github.com/x-cray/logrus-prefixed-formatter v0.5.2 golang.org/x/crypto v0.33.0 golang.org/x/exp v0.0.0-20250207012021-f9890c6ad9f3 + golang.org/x/sync v0.11.0 golang.org/x/sys v0.30.0 google.golang.org/protobuf v1.36.1 gopkg.in/natefinch/lumberjack.v2 v2.2.1 @@ -65,7 +66,6 @@ require ( go.uber.org/mock v0.5.0 // indirect golang.org/x/mod v0.23.0 // indirect golang.org/x/net v0.34.0 // indirect - golang.org/x/sync v0.11.0 // indirect golang.org/x/tools v0.29.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20240711142825-46eb208f015d // indirect gopkg.in/yaml.v3 v3.0.1 // indirect -- 2.39.5 ================================================ FILE: patchset/kix-feat_lockless_concurrency_udp_dns.patch ================================================ diff --git a/component/dns/dns.go b/component/dns/dns.go index 9800416..3853f8d 100644 --- a/component/dns/dns.go +++ b/component/dns/dns.go @@ -25,8 +25,7 @@ var ErrBadUpstreamFormat = fmt.Errorf("bad upstream format") type Dns struct { log *logrus.Logger upstream []*UpstreamResolver - upstream2IndexMu sync.Mutex - upstream2Index map[*Upstream]int + upstream2Index sync.Map // 使用sync.Map替代mutex+map，减少锁竞争 reqMatcher *RequestMatcher respMatcher *ResponseMatcher } @@ -41,10 +40,10 @@ type NewOption struct { func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) { s = &Dns{ log: opt.Logger, - upstream2Index: map[*Upstream]int{ - nil: int(consts.DnsRequestOutboundIndex_AsIs), - }, + // upstream2Index 使用sync.Map，无需初始化 } + // 设置默认的nil映射 + s.upstream2Index.Store((*Upstream)(nil), int(consts.DnsRequestOutboundIndex_AsIs)) // Parse upstream. upstreamName2Id := map[string]uint8{} for i, upstreamRaw := range dns.Upstream { @@ -73,9 +72,7 @@ func New(dns *config.Dns, opt *NewOption) (s *Dns, err error) { } } - s.upstream2IndexMu.Lock() - s.upstream2Index[upstream] = i - s.upstream2IndexMu.Unlock() + s.upstream2Index.Store(upstream, i) return nil } }(i), @@ -207,9 +204,11 @@ func (s *Dns) ResponseSelect(msg *dnsmessage.Msg, fromUpstream *Upstream) (upstr } } - s.upstream2IndexMu.Lock() - from := s.upstream2Index[fromUpstream] - s.upstream2IndexMu.Unlock() + fromValue, ok := s.upstream2Index.Load(fromUpstream) + if !ok { + fromValue = int(consts.DnsRequestOutboundIndex_AsIs) // 默认值 + } + from := fromValue.(int) // Route. upstreamIndex, err = s.respMatcher.Match(qname, qtype, ips, consts.DnsRequestOutboundIndex(from)) if err != nil { diff --git a/control/anyfrom_pool.go b/control/anyfrom_pool.go index 226e55f..668fcab 100644 --- a/control/anyfrom_pool.go +++ b/control/anyfrom_pool.go @@ -161,71 +161,77 @@ func appendUDPSegmentSizeMsg(b []byte, size uint16) []byte { // AnyfromPool is a full-cone udp listener pool type AnyfromPool struct { - pool map[string]*Anyfrom - mu sync.RWMutex + pool sync.Map // 使用sync.Map减少锁竞争 } var DefaultAnyfromPool = NewAnyfromPool() func NewAnyfromPool() *AnyfromPool { - return &AnyfromPool{ - pool: make(map[string]*Anyfrom, 64), - mu: sync.RWMutex{}, - } + return &AnyfromPool{} } func (p *AnyfromPool) GetOrCreate(lAddr string, ttl time.Duration) (conn *Anyfrom, isNew bool, err error) { - p.mu.RLock() - af, ok := p.pool[lAddr] - if !ok { - p.mu.RUnlock() - p.mu.Lock() - defer p.mu.Unlock() - if af, ok = p.pool[lAddr]; ok { - return af, false, nil - } - // Create an Anyfrom. - isNew = true - d := net.ListenConfig{ - Control: func(network string, address string, c syscall.RawConn) error { - return dialer.TransparentControl(c) - }, - KeepAlive: 0, - } - var err error - var pc net.PacketConn - GetDaeNetns().With(func() error { - pc, err = d.ListenPacket(context.Background(), "udp", lAddr) - return nil - }) - if err != nil { - return nil, true, err - } - uConn := pc.(*net.UDPConn) - af = &Anyfrom{ - UDPConn: uConn, - deadlineTimer: nil, - ttl: ttl, - gotGSOError: false, - gso: isGSOSupported(uConn), + if af, ok := p.pool.Load(lAddr); ok { + anyfrom := af.(*Anyfrom) + anyfrom.RefreshTtl() + return anyfrom, false, nil + } + + // 使用双重检查锁定模式避免重复创建 + // 创建临时key用于创建锁 + createKey := lAddr + "_creating" + if _, loaded := p.pool.LoadOrStore(createKey, struct{}{}); loaded { + // 有其他goroutine在创建，等待并重试 + time.Sleep(time.Microsecond * 100) + if af, ok := p.pool.Load(lAddr); ok { + anyfrom := af.(*Anyfrom) + anyfrom.RefreshTtl() + return anyfrom, false, nil } + } + + defer p.pool.Delete(createKey) + + // 再次检查是否已创建 + if af, ok := p.pool.Load(lAddr); ok { + anyfrom := af.(*Anyfrom) + anyfrom.RefreshTtl() + return anyfrom, false, nil + } + + // 创建新的Anyfrom + d := net.ListenConfig{ + Control: func(network string, address string, c syscall.RawConn) error { + return dialer.TransparentControl(c) + }, + KeepAlive: 0, + } + var pc net.PacketConn + GetDaeNetns().With(func() error { + pc, err = d.ListenPacket(context.Background(), "udp", lAddr) + return nil + }) + if err != nil { + return nil, true, err + } + + uConn := pc.(*net.UDPConn) + af := &Anyfrom{ + UDPConn: uConn, + deadlineTimer: nil, + ttl: ttl, + gotGSOError: false, + gso: isGSOSupported(uConn), + } - if ttl > 0 { - af.deadlineTimer = time.AfterFunc(ttl, func() { - p.mu.Lock() - defer p.mu.Unlock() - _af := p.pool[lAddr] - if _af == af { - delete(p.pool, lAddr) - af.Close() - } - }) - p.pool[lAddr] = af - } - return af, true, nil - } else { - af.RefreshTtl() - p.mu.RUnlock() - return af, false, nil + if ttl > 0 { + af.deadlineTimer = time.AfterFunc(ttl, func() { + if loaded := p.pool.CompareAndDelete(lAddr, af); loaded { + af.Close() + } + }) } + + p.pool.Store(lAddr, af) + return af, true, nil } diff --git a/control/control_plane.go b/control/control_plane.go index e57cbd8..8ca9bf4 100644 --- a/control/control_plane.go +++ b/control/control_plane.go @@ -560,9 +560,16 @@ func (c *ControlPlane) InjectBpf(bpf *bpfObjects) { } func (c *ControlPlane) CloneDnsCache() map[string]*DnsCache { - c.dnsController.dnsCacheMu.Lock() - defer c.dnsController.dnsCacheMu.Unlock() - return deepcopy.Copy(c.dnsController.dnsCache).(map[string]*DnsCache) + clonedCache := make(map[string]*DnsCache) + c.dnsController.dnsCache.Range(func(key, value interface{}) bool { + cache := value.(*DnsCache) + // 只有当缓存仍然有效时才克隆，避免无用的深拷贝 + if cache.Deadline.After(time.Now()) { + clonedCache[key.(string)] = deepcopy.Copy(cache).(*DnsCache) + } + return true + }) + return clonedCache } func (c *ControlPlane) dnsUpstreamReadyCallback(dnsUpstream *dns.Upstream) (err error) { diff --git a/control/dns_control.go b/control/dns_control.go index 6a55368..069dd09 100644 --- a/control/dns_control.go +++ b/control/dns_control.go @@ -14,7 +14,6 @@ import ( "strconv" "strings" "sync" - "sync/atomic" "time" "github.com/daeuniverse/dae/common/consts" @@ -62,8 +61,6 @@ type DnsControllerOption struct { } type DnsController struct { - handling sync.Map - routing *dns.Dns qtypePrefer uint16 @@ -76,16 +73,9 @@ type DnsController struct { timeoutExceedCallback func(dialArgument *dialArgument, err error) fixedDomainTtl map[string]int - // mutex protects the dnsCache. - dnsCacheMu sync.Mutex - dnsCache map[string]*DnsCache - dnsForwarderCacheMu sync.Mutex - dnsForwarderCache map[dnsForwarderKey]DnsForwarder -} - -type handlingState struct { - mu sync.Mutex - ref uint32 + // 使用sync.Map代替mutex+map，减少锁竞争 + dnsCache sync.Map // map[string]*DnsCache + dnsForwarderCache sync.Map // map[dnsForwarderKey]DnsForwarder } func parseIpVersionPreference(prefer int) (uint16, error) { @@ -119,11 +109,8 @@ func NewDnsController(routing *dns.Dns, option *DnsControllerOption) (c *DnsCont bestDialerChooser: option.BestDialerChooser, timeoutExceedCallback: option.TimeoutExceedCallback, - fixedDomainTtl: option.FixedDomainTtl, - dnsCacheMu: sync.Mutex{}, - dnsCache: make(map[string]*DnsCache), - dnsForwarderCacheMu: sync.Mutex{}, - dnsForwarderCache: make(map[dnsForwarderKey]DnsForwarder), + fixedDomainTtl: option.FixedDomainTtl, + // 使用sync.Map，无需初始化 }, nil } @@ -133,20 +120,15 @@ func (c *DnsController) cacheKey(qname string, qtype uint16) string { } func (c *DnsController) RemoveDnsRespCache(cacheKey string) { - c.dnsCacheMu.Lock() - _, ok := c.dnsCache[cacheKey] - if ok { - delete(c.dnsCache, cacheKey) - } - c.dnsCacheMu.Unlock() + c.dnsCache.Delete(cacheKey) } + func (c *DnsController) LookupDnsRespCache(cacheKey string, ignoreFixedTtl bool) (cache *DnsCache) { - c.dnsCacheMu.Lock() - cache, ok := c.dnsCache[cacheKey] - c.dnsCacheMu.Unlock() + cacheValue, ok := c.dnsCache.Load(cacheKey) if !ok { return nil } + cache = cacheValue.(*DnsCache) var deadline time.Time if !ignoreFixedTtl { deadline = cache.Deadline @@ -287,22 +269,16 @@ func (c *DnsController) __updateDnsCacheDeadline(host string, dnsTyp uint16, ans deadline, originalDeadline := deadlineFunc(now, host) cacheKey := c.cacheKey(fqdn, dnsTyp) - c.dnsCacheMu.Lock() - cache, ok := c.dnsCache[cacheKey] - if ok { - cache.Answer = answers - cache.Deadline = deadline - cache.OriginalDeadline = originalDeadline - c.dnsCacheMu.Unlock() - } else { - cache, err = c.newCache(fqdn, answers, deadline, originalDeadline) - if err != nil { - c.dnsCacheMu.Unlock() - return err - } - c.dnsCache[cacheKey] = cache - c.dnsCacheMu.Unlock() + + // 创建新的缓存项而不是修改现有的，避免数据竞争 + cache, err := c.newCache(fqdn, answers, deadline, originalDeadline) + if err != nil { + return err } + + // 原子性地更新缓存 + c.dnsCache.Store(cacheKey, cache) + if err = c.cacheAccessCallback(cache); err != nil { return err } @@ -458,18 +434,26 @@ func (c *DnsController) handle_( return c.sendReject_(dnsMessage, req) } - // No parallel for the same lookup. - handlingState_, _ := c.handling.LoadOrStore(cacheKey, new(handlingState)) - handlingState := handlingState_.(*handlingState) - atomic.AddUint32(&handlingState.ref, 1) - handlingState.mu.Lock() - defer func() { - handlingState.mu.Unlock() - atomic.AddUint32(&handlingState.ref, ^uint32(0)) - if atomic.LoadUint32(&handlingState.ref) == 0 { - c.handling.Delete(cacheKey) + // 使用简化的处理状态管理，避免重复请求 + handlingState, isNew := GlobalHandlingStateManager.GetOrCreateState(cacheKey) + + if !isNew { + // 有其他goroutine正在处理相同请求，等待完成 + handlingState.Wait() + + // 重新检查缓存 + if resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil { + if needResp { + if err = sendPkt(c.log, resp, req.realDst, req.realSrc, req.src, req.lConn); err != nil { + return fmt.Errorf("failed to write cached DNS resp: %w", err) + } + } + return nil } - }() + // 如果仍然没有缓存，继续处理（可能是上一个请求失败了） + } + + defer GlobalHandlingStateManager.CompleteAndCleanup(cacheKey, handlingState) if resp := c.LookupDnsRespCache_(dnsMessage, cacheKey, false); resp != nil { // Send cache to client directly. @@ -569,46 +553,22 @@ func (c *DnsController) dialSend(invokingDepth int, req *udpRequest, data []byte // Dial and send. var respMsg *dnsmessage.Msg - // defer in a recursive call will delay Close(), thus we Close() before - // the next recursive call. However, a connection cannot be closed twice. - // We should set a connClosed flag to avoid it. - var connClosed bool ctxDial, cancel := context.WithTimeout(context.TODO(), consts.DefaultDialTimeout) defer cancel() - // get forwarder from cache - c.dnsForwarderCacheMu.Lock() - forwarder, ok := c.dnsForwarderCache[dnsForwarderKey{upstream: upstream.String(), dialArgument: *dialArgument}] - if !ok { - forwarder, err = newDnsForwarder(upstream, *dialArgument) - if err != nil { - c.dnsForwarderCacheMu.Unlock() - return err - } - c.dnsForwarderCache[dnsForwarderKey{upstream: upstream.String(), dialArgument: *dialArgument}] = forwarder - } - c.dnsForwarderCacheMu.Unlock() - - defer func() { - if !connClosed { - forwarder.Close() - } - }() - + // 使用新的转发器管理器，避免重复创建 + forwarder, releaseForwarder, err := GlobalDnsForwarderManager.GetForwarder(upstream, *dialArgument) if err != nil { return err } + defer releaseForwarder() respMsg, err = forwarder.ForwardDNS(ctxDial, data) if err != nil { return err } - // Close conn before the recursive call. - forwarder.Close() - connClosed = true - // Route response. upstreamIndex, nextUpstream, err := c.routing.ResponseSelect(respMsg, upstream) if err != nil { diff --git a/control/dns_forwarder_manager.go b/control/dns_forwarder_manager.go new file mode 100644 index 0000000..07e5c98 --- /dev/null +++ b/control/dns_forwarder_manager.go @@ -0,0 +1,165 @@ +/* + * SPDX-License-Identifier: AGPL-3.0-only + * Copyright (c) 2022-2025, daeuniverse Organization + */ + +package control + +import ( + "context" + "sync" + "time" + + "github.com/daeuniverse/dae/component/dns" +) + +// DnsForwarderManager 管理DNS转发器的生命周期，避免重复创建和资源浪费 +type DnsForwarderManager struct { + // 使用sync.Map存储活跃的转发器 + activeForwarders sync.Map // map[dnsForwarderKey]*forwarderEntry + + // 清理goroutine控制 + cleanupInterval time.Duration + ctx context.Context + cancel context.CancelFunc +} + +type forwarderEntry struct { + forwarder DnsForwarder + lastUsed time.Time + refCount int32 + mu sync.RWMutex +} + +// GetForwarder 获取或创建DNS转发器，使用引用计数管理生命周期 +func (m *DnsForwarderManager) GetForwarder(upstream *dns.Upstream, dialArg dialArgument) (DnsForwarder, func(), error) { + key := dnsForwarderKey{upstream: upstream.String(), dialArgument: dialArg} + + // 快速路径：尝试获取现有转发器 + if entryValue, ok := m.activeForwarders.Load(key); ok { + entry := entryValue.(*forwarderEntry) + entry.mu.Lock() + entry.refCount++ + entry.lastUsed = time.Now() + forwarder := entry.forwarder + entry.mu.Unlock() + + // 返回释放函数 + release := func() { + entry.mu.Lock() + entry.refCount-- + entry.mu.Unlock() + } + + return forwarder, release, nil + } + + // 慢路径：需要创建新转发器 + newForwarder, err := newDnsForwarder(upstream, dialArg) + if err != nil { + return nil, nil, err + } + + entry := &forwarderEntry{ + forwarder: newForwarder, + lastUsed: time.Now(), + refCount: 1, + } + + // 尝试存储，如果已存在则使用现有的 + if existingValue, loaded := m.activeForwarders.LoadOrStore(key, entry); loaded { + // 有其他goroutine创建了转发器，关闭我们创建的并使用现有的 + newForwarder.Close() + + existingEntry := existingValue.(*forwarderEntry) + existingEntry.mu.Lock() + existingEntry.refCount++ + existingEntry.lastUsed = time.Now() + forwarder := existingEntry.forwarder + existingEntry.mu.Unlock() + + release := func() { + existingEntry.mu.Lock() + existingEntry.refCount-- + existingEntry.mu.Unlock() + } + + return forwarder, release, nil + } + + // 成功存储新转发器 + release := func() { + entry.mu.Lock() + entry.refCount-- + entry.mu.Unlock() + } + + return newForwarder, release, nil +} + +// NewDnsForwarderManager 创建新的DNS转发器管理器 +func NewDnsForwarderManager() *DnsForwarderManager { + ctx, cancel := context.WithCancel(context.Background()) + manager := &DnsForwarderManager{ + cleanupInterval: 5 * time.Minute, + ctx: ctx, + cancel: cancel, + } + + // 启动清理goroutine + go manager.cleanupLoop() + + return manager +} + +// cleanupLoop 定期清理未使用的转发器 +func (m *DnsForwarderManager) cleanupLoop() { + ticker := time.NewTicker(m.cleanupInterval) + defer ticker.Stop() + + for { + select { + case <-m.ctx.Done(): + return + case <-ticker.C: + m.cleanup() + } + } +} + +func (m *DnsForwarderManager) cleanup() { + now := time.Now() + cutoff := now.Add(-m.cleanupInterval) + + m.activeForwarders.Range(func(key, value interface{}) bool { + entry := value.(*forwarderEntry) + entry.mu.RLock() + shouldDelete := entry.refCount == 0 && entry.lastUsed.Before(cutoff) + forwarder := entry.forwarder + entry.mu.RUnlock() + + if shouldDelete { + // 尝试删除并关闭 + if m.activeForwarders.CompareAndDelete(key, value) { + forwarder.Close() + } + } + + return true + }) +} + +// Shutdown 关闭管理器并清理所有转发器 +func (m *DnsForwarderManager) Shutdown() { + m.cancel() + + // 关闭所有活跃的转发器 + m.activeForwarders.Range(func(key, value interface{}) bool { + entry := value.(*forwarderEntry) + entry.forwarder.Close() + return true + }) +} + +// 全局DNS转发器管理器实例 +var GlobalDnsForwarderManager = NewDnsForwarderManager() diff --git a/control/dns_handling_state.go b/control/dns_handling_state.go new file mode 100644 index 0000000..d3acce6 --- /dev/null +++ b/control/dns_handling_state.go @@ -0,0 +1,79 @@ +/* + * SPDX-License-Identifier: AGPL-3.0-only + * Copyright (c) 2022-2025, daeuniverse Organization + */ + +package control + +import ( + "sync" + "time" +) + +// SimpleHandlingState 简化的处理状态管理，避免复杂的引用计数 +type SimpleHandlingState struct { + done chan struct{} + once sync.Once +} + +// Wait 等待处理完成 +func (s *SimpleHandlingState) Wait() { + <-s.done +} + +// Complete 标记处理完成 +func (s *SimpleHandlingState) Complete() { + s.once.Do(func() { + close(s.done) + }) +} + +// NewSimpleHandlingState 创建新的处理状态 +func NewSimpleHandlingState() *SimpleHandlingState { + return &SimpleHandlingState{ + done: make(chan struct{}), + } +} + +// HandlingStateManager 管理DNS处理状态，避免重复请求 +type HandlingStateManager struct { + states sync.Map // map[string]*SimpleHandlingState +} + +// GetOrCreateState 获取或创建处理状态 +func (m *HandlingStateManager) GetOrCreateState(key string) (*SimpleHandlingState, bool) { + // 尝试获取现有状态 + if stateValue, ok := m.states.Load(key); ok { + return stateValue.(*SimpleHandlingState), false + } + + // 创建新状态 + newState := NewSimpleHandlingState() + + // 尝试存储，如果已存在则使用现有的 + if actualValue, loaded := m.states.LoadOrStore(key, newState); loaded { + return actualValue.(*SimpleHandlingState), false + } + + // 成功创建新状态 + return newState, true +} + +// CompleteAndCleanup 完成处理并清理状态 +func (m *HandlingStateManager) CompleteAndCleanup(key string, state *SimpleHandlingState) { + state.Complete() + + // 延迟清理，给其他等待的goroutine一些时间 + go func() { + time.Sleep(100 * time.Millisecond) + m.states.Delete(key) + }() +} + +// NewHandlingStateManager 创建新的处理状态管理器 +func NewHandlingStateManager() *HandlingStateManager { + return &HandlingStateManager{} +} + +// 全局处理状态管理器 +var GlobalHandlingStateManager = NewHandlingStateManager() diff --git a/control/udp_endpoint_pool.go b/control/udp_endpoint_pool.go index 5fd972a..cb87016 100644 --- a/control/udp_endpoint_pool.go +++ b/control/udp_endpoint_pool.go @@ -38,22 +38,68 @@ type UdpEndpoint struct { } func (ue *UdpEndpoint) start() { - buf := pool.GetFullCap(consts.EthernetMtu) - defer pool.Put(buf) + // 使用buffered channel实现异步处理 + const maxPendingPackets = 1000 + packetChan := make(chan struct { + data []byte + from netip.AddrPort + }, maxPendingPackets) + + // 启动异步包处理器 + go func() { + for packet := range packetChan { + // 异步处理每个包，避免阻塞读取循环 + go func(data []byte, from netip.AddrPort) { + defer pool.Put(data) // 确保释放buffer + if err := ue.handler(data, from); err != nil { + // 处理错误但不阻塞 + return + } + }(packet.data, packet.from) + } + }() + + // 高性能读取循环 for { + buf := pool.GetFullCap(consts.EthernetMtu) n, from, err := ue.conn.ReadFrom(buf[:]) if err != nil { + pool.Put(buf) break } + + // 快速重置计时器，减少锁竞争 ue.mu.Lock() - ue.deadlineTimer.Reset(ue.NatTimeout) + if ue.deadlineTimer != nil { + ue.deadlineTimer.Reset(ue.NatTimeout) + } ue.mu.Unlock() - if err = ue.handler(buf[:n], from); err != nil { - break + + // 复制数据到正确大小的buffer + data := pool.Get(n) + copy(data, buf[:n]) + pool.Put(buf) + + // 非阻塞发送到处理器 + select { + case packetChan <- struct { + data []byte + from netip.AddrPort + }{data, from}: + // 成功发送到处理队列 + default: + // 队列满了，丢弃包（避免阻塞读取） + pool.Put(data) + // 可以在这里记录丢包统计 } } + + // 清理 + close(packetChan) ue.mu.Lock() - ue.deadlineTimer.Stop() + if ue.deadlineTimer != nil { + ue.deadlineTimer.Stop() + } ue.mu.Unlock() } diff --git a/control/udp_health_monitor.go b/control/udp_health_monitor.go new file mode 100644 index 0000000..667e863 --- /dev/null +++ b/control/udp_health_monitor.go @@ -0,0 +1,165 @@ +/* + * SPDX-License-Identifier: AGPL-3.0-only + * Copyright (c) 2022-2025, daeuniverse Organization + */ + +package control + +import ( + "context" + "sync" + "sync/atomic" + "time" +) + +// UdpHealthMonitor monitors UDP processing health and prevents deadlocks +type UdpHealthMonitor struct { + // 基本指标 + activeConnections int64 + totalPacketsHandled int64 + droppedPackets int64 + timeoutOccurrences int64 + + // 控制参数 + isShuttingDown int32 + maxActiveConns int64 + healthCheckInterval time.Duration + + // 监控 + lastActivity time.Time + mu sync.RWMutex + ctx context.Context + cancel context.CancelFunc +} + +// NewUdpHealthMonitor creates a new UDP health monitor +func NewUdpHealthMonitor() *UdpHealthMonitor { + ctx, cancel := context.WithCancel(context.Background()) + monitor := &UdpHealthMonitor{ + maxActiveConns: 20000, // 增加最大连接数 + healthCheckInterval: 30 * time.Second, + lastActivity: time.Now(), + ctx: ctx, + cancel: cancel, + } + + go monitor.healthCheckLoop() + return monitor +} + +// healthCheckLoop runs periodic health checks +func (m *UdpHealthMonitor) healthCheckLoop() { + ticker := time.NewTicker(m.healthCheckInterval) + defer ticker.Stop() + + for { + select { + case <-m.ctx.Done(): + return + case <-ticker.C: + m.performHealthCheck() + } + } +} + +// performHealthCheck 执行简化的健康检查 +func (m *UdpHealthMonitor) performHealthCheck() { + activeConns := atomic.LoadInt64(&m.activeConnections) + totalPackets := atomic.LoadInt64(&m.totalPacketsHandled) + droppedPackets := atomic.LoadInt64(&m.droppedPackets) + timeouts := atomic.LoadInt64(&m.timeoutOccurrences) + + // 简单的日志记录（如果需要的话） + _ = activeConns + _ = totalPackets + _ = droppedPackets + _ = timeouts + + // 重置计数器防止溢出 + if totalPackets > 10000000 { // 1000万包后重置 + atomic.StoreInt64(&m.totalPacketsHandled, 0) + atomic.StoreInt64(&m.droppedPackets, 0) + atomic.StoreInt64(&m.timeoutOccurrences, 0) + } +} + +// RegisterConnection registers a new UDP connection +func (m *UdpHealthMonitor) RegisterConnection() bool { + if atomic.LoadInt32(&m.isShuttingDown) != 0 { + return false + } + + activeConns := atomic.AddInt64(&m.activeConnections, 1) + if activeConns > m.maxActiveConns { + atomic.AddInt64(&m.activeConnections, -1) + atomic.AddInt64(&m.droppedPackets, 1) + return false + } + + m.mu.Lock() + m.lastActivity = time.Now() + m.mu.Unlock() + + return true +} + +// UnregisterConnection unregisters a UDP connection +func (m *UdpHealthMonitor) UnregisterConnection() { + atomic.AddInt64(&m.activeConnections, -1) +} + +// RecordPacketHandled records a successfully handled packet +func (m *UdpHealthMonitor) RecordPacketHandled() { + atomic.AddInt64(&m.totalPacketsHandled, 1) + + m.mu.Lock() + m.lastActivity = time.Now() + m.mu.Unlock() +} + +// RecordTimeout records a timeout occurrence +func (m *UdpHealthMonitor) RecordTimeout() { + atomic.AddInt64(&m.timeoutOccurrences, 1) +} + +// IsHealthy returns true if the system is in a healthy state +func (m *UdpHealthMonitor) IsHealthy() bool { + activeConns := atomic.LoadInt64(&m.activeConnections) + timeouts := atomic.LoadInt64(&m.timeoutOccurrences) + totalPackets := atomic.LoadInt64(&m.totalPacketsHandled) + + // 基本健康检查 + if activeConns > m.maxActiveConns*9/10 { // 90% 容量 + return false + } + + // 超时率检查 + if totalPackets > 1000 { + timeoutRate := float64(timeouts) / float64(totalPackets) + if timeoutRate > 0.05 { // 5% 超时率阈值 + return false + } + } + + return true +} + +// Shutdown shuts down the health monitor +func (m *UdpHealthMonitor) Shutdown() { + atomic.StoreInt32(&m.isShuttingDown, 1) + m.cancel() +} + +// GetStats returns current statistics +func (m *UdpHealthMonitor) GetStats() map[string]int64 { + return map[string]int64{ + "active_connections": atomic.LoadInt64(&m.activeConnections), + "total_packets_handled": atomic.LoadInt64(&m.totalPacketsHandled), + "dropped_packets": atomic.LoadInt64(&m.droppedPackets), + "timeout_occurrences": atomic.LoadInt64(&m.timeoutOccurrences), + "max_active_conns": m.maxActiveConns, + } +} + +// Global UDP health monitor instance +var DefaultUdpHealthMonitor = NewUdpHealthMonitor() diff --git a/control/udp_task_pool.go b/control/udp_task_pool.go index 08b02d7..09d8cb4 100644 --- a/control/udp_task_pool.go +++ b/control/udp_task_pool.go @@ -11,7 +11,11 @@ import ( "time" ) -const UdpTaskQueueLength = 128 +const ( + UdpTaskQueueLength = 512 // 增加队列容量以支持更高并发 + MaxUdpQueues = 5000 // 增加最大队列数 + UdpTaskTimeout = 100 * time.Millisecond // 极短超时时间 +) type UdpTask = func() @@ -27,22 +31,57 @@ type UdpTaskQueue struct { } func (q *UdpTaskQueue) convoy() { + defer close(q.closed) + for { select { case <-q.ctx.Done(): - close(q.closed) + // 清空剩余任务 + q.drainRemainingTasks() return + case task := <-q.ch: - task() - q.timer.Reset(q.agingTime) + // 立即异步执行任务，不等待完成 + go q.executeTaskAsync(task) + + // 重置老化定时器 + if q.timer != nil { + q.timer.Reset(q.agingTime) + } + } + } +} + +// executeTaskAsync 异步执行单个任务 +func (q *UdpTaskQueue) executeTaskAsync(task UdpTask) { + defer func() { + if r := recover(); r != nil { + // 记录panic但不影响其他任务 + } + }() + + if task != nil { + task() + } +} + +// drainRemainingTasks 清空剩余任务 +func (q *UdpTaskQueue) drainRemainingTasks() { + for { + select { + case task := <-q.ch: + // 异步执行剩余任务 + go q.executeTaskAsync(task) + default: + return } } } type UdpTaskPool struct { queueChPool sync.Pool - // mu protects m - mu sync.Mutex + // 使用RWMutex提高读取性能 + mu sync.RWMutex m map[string]*UdpTaskQueue } @@ -51,7 +90,7 @@ func NewUdpTaskPool() *UdpTaskPool { queueChPool: sync.Pool{New: func() any { return make(chan UdpTask, UdpTaskQueueLength) }}, - mu: sync.Mutex{}, + mu: sync.RWMutex{}, m: map[string]*UdpTaskQueue{}, } return p @@ -59,40 +98,123 @@ func NewUdpTaskPool() *UdpTaskPool { // EmitTask: Make sure packets with the same key (4 tuples) will be sent in order. func (p *UdpTaskPool) EmitTask(key string, task UdpTask) { + if task == nil { + return + } + + // 快速健康检查 + if !DefaultUdpHealthMonitor.RegisterConnection() { + return + } + defer DefaultUdpHealthMonitor.UnregisterConnection() + + // 尝试使用读锁快速查找现有队列 + p.mu.RLock() + q, exists := p.m[key] + queueCount := len(p.m) + p.mu.RUnlock() + + if exists { + // 队列已存在，直接提交任务 + p.submitTaskToQueue(q, task) + return + } + + // 需要创建新队列，使用写锁 p.mu.Lock() - q, ok := p.m[key] - if !ok { - ch := p.queueChPool.Get().(chan UdpTask) - ctx, cancel := context.WithCancel(context.Background()) - q = &UdpTaskQueue{ - key: key, - p: p, - ch: ch, - timer: nil, - agingTime: DefaultNatTimeout, - ctx: ctx, - closed: make(chan struct{}), - } - q.timer = time.AfterFunc(q.agingTime, func() { - // if timer executed, there should no task in queue. - // q.closed should not blocking things. - p.mu.Lock() - cancel() - delete(p.m, key) - p.mu.Unlock() - <-q.closed - if len(ch) == 0 { // Otherwise let it be GCed - p.queueChPool.Put(ch) + defer p.mu.Unlock() + + // 双重检查 + if q, exists := p.m[key]; exists { + p.submitTaskToQueue(q, task) + return + } + + // 限制队列数量 + if queueCount >= MaxUdpQueues { + DefaultUdpHealthMonitor.RecordTimeout() + return + } + + // 创建新队列 + ch := p.queueChPool.Get().(chan UdpTask) + ctx, cancel := context.WithCancel(context.Background()) + q = &UdpTaskQueue{ + key: key, + p: p, + ch: ch, + timer: nil, + agingTime: DefaultNatTimeout, + ctx: ctx, + closed: make(chan struct{}), + } + + q.timer = time.AfterFunc(q.agingTime, func() { + p.cleanupQueue(key, q, cancel, ch) + }) + + p.m[key] = q + go q.convoy() + + // 提交任务到新创建的队列 + p.submitTaskToQueue(q, task) +} + +// submitTaskToQueue 提交任务到指定队列（极简版本） +func (p *UdpTaskPool) submitTaskToQueue(q *UdpTaskQueue, task UdpTask) { + // 包装任务以增加健康监控 + wrappedTask := func() { + defer func() { + DefaultUdpHealthMonitor.RecordPacketHandled() + if r := recover(); r != nil { + // 记录panic但继续 } - }) - p.m[key] = q - go q.convoy() + }() + task() } - p.mu.Unlock() - // if task cannot be executed within 180s(DefaultNatTimeout), GC may be triggered, so skip the task when GC occurs + + // 极速任务提交 - 非阻塞模式 select { - case q.ch <- task: + case q.ch <- wrappedTask: + // 任务成功排队 case <-q.ctx.Done(): + // 上下文已取消 + DefaultUdpHealthMonitor.RecordTimeout() + default: + // 队列已满，异步重试一次 + go func() { + select { + case q.ch <- wrappedTask: + // 重试成功 + case <-q.ctx.Done(): + DefaultUdpHealthMonitor.RecordTimeout() + case <-time.After(UdpTaskTimeout): + DefaultUdpHealthMonitor.RecordTimeout() + } + }() + } +} + +// cleanupQueue 清理队列 +func (p *UdpTaskPool) cleanupQueue(key string, q *UdpTaskQueue, cancel context.CancelFunc, ch chan UdpTask) { + p.mu.Lock() + cancel() + delete(p.m, key) + p.mu.Unlock() + + // 等待清理完成，带超时 + select { + case <-q.closed: + case <-time.After(1 * time.Second): + // 强制清理 + } + + // 回收通道 + if len(ch) == 0 { + for len(ch) > 0 { + <-ch + } + p.queueChPool.Put(ch) } }