From 82203038f0ec8147ee8ac84552b5e149a571b9b5 Mon Sep 17 00:00:00 2001 From: windyboy Date: Wed, 12 Aug 2026 22:19:20 +0800 Subject: [PATCH] docs(dns): record mosdns sequence misconfig found+fixed (W1N-56) --- docs/lan-dns-architecture.md | 15 +++++++++++++++ hosts/gfw.windy.lan.md | 6 ++++++ 2 files changed, 21 insertions(+) diff --git a/docs/lan-dns-architecture.md b/docs/lan-dns-architecture.md index 819b7dc..37e7bee 100644 --- a/docs/lan-dns-architecture.md +++ b/docs/lan-dns-architecture.md @@ -28,6 +28,15 @@ - gfw DNS 链:`server=127.0.0.1#7874`(dnsmasq)→ clash:`nameserver: [127.0.0.1:6052]`(mosdns)、 `default-nameserver: [127.0.0.1:6052]`、`nameserver-policy` 国外域名 → DoH `https://1.1.1.1/dns-query`、 `enhanced-mode: fake-ip`(198.18.0.1/16)、`ipv6: false`;nft 有 UDP/53 hijack → dnsmasq。 +- **mosdns 配置缺陷(2026-08-12 发现并修复)**:`main` sequence 的国内分支 + (`matches: qname $domestic_domains → exec: $domestic_upstream`)之后**缺少 + `matches: has_resp → accept` 守卫**。mosdns v5 的 `sequence` 在 `forward` 成功后不会停止, + 只有 `accept`/`reject`/`return` 或错误会终止——因此命中 `geosite_cn` 的查询会被转发**两次** + (AGH 与 223.5.5.5/119.29.29.29),最终应答来自最后一个 forward(国内公网 DNS),**AGH 的 + 拦截/rewrite 对 DIRECT 国内域名静默失效**。实测证据:`dup.baidustatic.com`(在 `geosite_cn` + 且在 AGH 拦截表)经 mosdns 返回真实 IP `183.60.227.49` 而非 `0.0.0.0`。已修复(备份 + `/etc/mosdns/config.yaml.bak-20260812`),修复后同一域名返回 `0.0.0.0`,taobao/google 解析 + 与 clash 链均无回归。**§6 的二期示例同款缺陷已一并修正。** - AGH rewrites(实测):`hass.windy.lan`/`hass.local` → `192.168.55.11`;`dns.windy.lan` → `.36`; `ubnt.windy.lan` → `.46`;`gfw.windy.lan` → `.1`;`nas.windy.local` → `.32`。 - 拦截:仅启用 **AdGuard DNS filter**(filter_1);实测 `doubleclick.net`/`googleadservices.com` → `0.0.0.0`。 @@ -110,6 +119,8 @@ plugins: type: sequence args: - exec: cache 1024 # 缓存加速 + - matches: has_resp + exec: accept # 国内分流:命中 geosite:cn → 国内 DoH - matches: [ qname &geosite:cn ] exec: forward https://dns.alidns.com/dns-query @@ -122,6 +133,10 @@ plugins: args: { entry: main, listen: "127.0.0.1:5353" } ``` +> **注意**:`sequence` 中每个 `forward` 分支之后必须跟 `matches: has_resp → accept` +> (或改用 `goto`/`jump` + `return` 结构),否则查询会继续执行后续规则被二次转发, +> 最终应答来自最后一个 forward——gfw 上 mosdns 的同类缺陷(2026-08-12)已实测并修复(见 §1)。 + 要点: - 上游可加 `upstream` 的 `concurrent > 1` 与多地址故障切换;mosdns 自带 cache,能保证上游故障时 缓存命中仍即时应答(对应 §8 认定的降级缺口)。 diff --git a/hosts/gfw.windy.lan.md b/hosts/gfw.windy.lan.md index 602e30d..a0a4a5d 100644 --- a/hosts/gfw.windy.lan.md +++ b/hosts/gfw.windy.lan.md @@ -30,6 +30,12 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration (`/etc/mosdns/config.yaml`): domestic domains → AGH `.36:53`, foreign → `223.5.5.5`/`119.29.29.29` (Chinese public DNS). mosdns is **not** in the client query path — LAN/VLAN10 clients receive fake-ip from clash :7874. + > 2026-08-12: fixed missing `has_resp → accept` guard after the domestic + > branch in `/etc/mosdns/config.yaml` (domestic queries were double-forwarded, + > final answer came from CN public DNS, bypassing AGH blocking/rewrites; + > verified via `dup.baidustatic.com` before/after). Backup: + > `/etc/mosdns/config.yaml.bak-20260812`. See + > [docs/lan-dns-architecture.md](../docs/lan-dns-architecture.md) §1. - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)