server: fix server not exit issue on asus router

when `./Configure --api=1.0.0`, we should not use CRYPTO_set_id_callback().

Dockerfile

@@ -1,18 +1,39 @@
- FROM debian:buster-slim
+FROM ubuntu:latest as smartdns-builder
+LABEL previous-stage=smartdns-builder
+COPY . /smartdns/
+RUN apt update && \
+    apt install -y perl wget make musl-tools musl-dev && \
+    OPENSSL_VER=1.1.1f && \
+    mkdir /build -p && \
+    ln -s /usr/include/linux /usr/include/$(uname -m)-linux-musl && \
+    ln -s /usr/include/asm-generic /usr/include/$(uname -m)-linux-musl && \
+    ln -s /usr/include/$(uname -m)-linux-gnu/asm /usr/include/$(uname -m)-linux-musl && \
+    cd /build && \
+    wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_${OPENSSL_VER}.orig.tar.gz && \
+    tar xf openssl_${OPENSSL_VER}.orig.tar.gz && \
+    cd openssl-${OPENSSL_VER} && \
+    export CC=musl-gcc && \
+    if [ "$(uname -m)" = "aarch64" ]; then \
+        ./config --prefix=/opt/build no-tests -mno-outline-atomics ; \
+    else \ 
+        ./config --prefix=/opt/build no-tests; \
+    fi && \
+    make all -j8 && make install_sw && \
+    cd /smartdns && \
+    export CFLAGS="-I /opt/build/include" && \
+    export LDFLAGS="-L /opt/build/lib" && \
+    sh ./package/build-pkg.sh --platform linux --arch `dpkg --print-architecture` --static && \
+    mkdir /release -p && \
+    cd /smartdns/package && tar xf *.tar.gz && \
+    cp /smartdns/package/smartdns/etc /release/ -a && \
+    cp /smartdns/package/smartdns/usr /release/ -a && \
+    chmod +x /release/etc/init.d/smartdns && \
+    mkdir /release/var/log/ /release/var/run/ -p && \
+    rm -fr /build /smartdns
 
- RUN apt update && \
-     apt install -y git make gcc libssl-dev && \
-     git clone https://github.com/pymumu/smartdns.git --depth 1 && \
-     cd smartdns && \
-     sh ./package/build-pkg.sh --platform debian --arch `dpkg --print-architecture` && \
-     dpkg -i package/*.deb && \
-     cd / && \
-     rm -rf smartdns/ && \
-     apt autoremove -y git make gcc libssl-dev && \
-     apt clean && \
-     rm -rf /var/lib/apt/lists/*
+FROM busybox:latest
+COPY --from=smartdns-builder /release/ /
+EXPOSE 53/udp
+VOLUME "/etc/smartdns/"
 
- EXPOSE 53/udp
- VOLUME "/etc/smartdns/"
-
- CMD ["/usr/sbin/smartdns", "-f"]
+CMD ["/usr/sbin/smartdns", "-f", "-x"]

ReadMe_en.md

@@ -281,7 +281,7 @@ https://github.com/pymumu/smartdns/releases
 
     * **Check if the service is configured successfully**
 
-        * Method 1: Query domain name with `nslookup -querytype=ptr 0.0.0.1`
+        * Query domain name with `nslookup -querytype=ptr 0.0.0.1`
         See if the `name` item in the command result is displayed as `smartdns` or `hostname`, such as `smartdns`
 
         ```shell
@@ -293,18 +293,12 @@ https://github.com/pymumu/smartdns/releases
         smartdns         name = smartdns.
         ```
 
-        * Method 2: Use `nslookup` to query the `www.baidu.com` domain name to see if the IP address of Baidu in the result is `only one. If there are multiple IP addresses returned, it means that it is not valid. Please try to check several domain names.
+        * or Query doman name `smartdns `with `nslookup smartdns`
+         ```shell
+         $ nslookup smartdns
+         ```
 
-        ```shell
-        pi@raspberrypi:~ $ nslookup www.baidu.com 192.168.1.1
-        Server:         192.168.1.1
-        Address:        192.168.1.1#53
-
-        Non-authoritative answer:
-        www.baidu.com   canonical name = www.a.shifen.com.
-        Name:   www.a.shifen.com
-        Address: 14.215.177.38
-        ```
+        Check whether the command result resolves the IP address of the router, if so, it means it is working.
 
 1. Start Service
 
@@ -503,7 +497,9 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |tcp-idle-time|TCP connection idle timeout|120|integer|tcp-idle-time 120
 |rr-ttl|Domain name TTL|Remote query result|number greater than 0|rr-ttl 600
 |rr-ttl-min|Domain name Minimum TTL|Remote query result|number greater than 0|rr-ttl-min 60
+|rr-ttl-reply-max|Domain name Minimum Reply TTL|Remote query result|number greater than 0|rr-ttl-reply-max 60
 |rr-ttl-max|Domain name Maximum TTL|Remote query result|number greater than 0|rr-ttl-max 600
+|max-reply-ip-num|Maximum number of IPs returned to the client|8|number of IPs, 1~16 |max-reply-ip-num 1
 |log-level|log level|error|fatal,error,warn,notice,info,debug|log-level error
 |log-file|log path|/var/log/smartdns.log|File Pah|log-file /var/log/smartdns.log
 |log-size|log size|128K|number+K,M,G|log-size 128K
@@ -517,7 +513,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |server-tcp|Upstream TCP DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-tcp 8.8.8.8:53
 |server-tls|Upstream TLS DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name. <br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-tls 8.8.8.8:853
 |server-https|Upstream HTTPS DNS server|None|Repeatable <br>`https://[host][:port]/path`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name<br>`[-http-host]`：http header host. <br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-https https://cloudflare-dns.com/dns-query
-|speed-check-mode|Speed ​​mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:443
+|speed-check-mode|Speed ​​mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:80,tcp:443
 |address|Domain IP address|None|address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6], `-` for ignore, `#` for return SOA, `4` for IPV4, `6` for IPV6| address /www.example.com/1.2.3.4
 |nameserver|To query domain with specific server group|None|nameserver /domain/[group\|-], `group` is the group name, `-` means ignore this rule, use the `-group` parameter in the related server|nameserver /www.example.com/office
 |ipset|Domain IPSet|None|ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]], `-` for ignore|ipset /www.example.com/#4:dns4,#6:-
@@ -528,12 +524,14 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |whitelist-ip|ip whitelist|None|[ip/subnet], Repeatable，When the filtering server responds IPs in the IP whitelist, only result in whitelist will be accepted| whitelist-ip 1.2.3.4/16
 |blacklist-ip|ip blacklist|None|[ip/subnet], Repeatable，When the filtering server responds IPs in the IP blacklist, The result will be discarded directly| blacklist-ip 1.2.3.4/16
 |force-AAAA-SOA|force AAAA query return SOA|no|[yes\|no]|force-AAAA-SOA yes
+|force-qtype-SOA|force specific qtype return SOA|qtype id|[qtypeid | ...]|force-qtype-SOA 65 28
 |prefetch-domain|domain prefetch feature|no|[yes\|no]|prefetch-domain yes
-|serve-expired|Cache serve expired feature|no|[yes\|no], Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish.|serve-expired yes
+|dnsmasq-lease-file|Support reading dnsmasq dhcp file to resolve local hostname|None|dnsmasq dhcp lease file| dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
+|serve-expired|Cache serve expired feature|yes|[yes\|no], Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish.|serve-expired yes
 |serve-expired-ttl|Cache serve expired limite TTL|0|second，0：disable，> 0  seconds after expiration|serve-expired-ttl 0
 |serve-expired-reply-ttl|TTL value to use when replying with expired data|5|second，0：disable，> 0  seconds after expiration|serve-expired-reply-ttl 30
-|dualstack-ip-selection|Dualstack ip selection|no|[yes\|no]|dualstack-ip-selection yes
-|dualstack-ip-selection-threshold|Dualstack ip select threadhold|30ms|millisecond|dualstack-ip-selection-threshold [0-1000]
+|dualstack-ip-selection|Dualstack ip selection|yes|[yes\|no]|dualstack-ip-selection yes
+|dualstack-ip-selection-threshold|Dualstack ip select threadhold|15ms|millisecond|dualstack-ip-selection-threshold [0-1000]
 |ca-file|certificate file|/etc/ssl/certs/ca-certificates.crt|path|ca-file /etc/ssl/certs/ca-certificates.crt
 |ca-path|certificates path|/etc/ssl/certs|path|ca-path /etc/ssl/certs
 
@@ -638,7 +636,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     Enable cache serve expired feature with `serve-expired yes` to improve the cache hit rate and reduce the CPU consumption.
     This feature will return TTL = 0 to the client after the TTL timeout, and send a new query request again at the same time, and cache the new results for later query.
 
-1. How does the second DNS customize more behavior?
+1. How does the second DNS customize more behavior?  
     The second DNS can be used as the upstream of other DNS servers to provide more query behaviors. Bind configuration support can bind multiple ports. Different ports can be set with different flags to implement different functions, such as
 
     ```sh
@@ -646,6 +644,31 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
     bind [::]:6053 -no-speed-check -group office -no-rule-addr
     ```
 
+1. How to get SPKI of DOT  
+    The SPKI can be obtained from the page published by the DNS service provider. If it is not published, it can be obtained by the following command, replace IP with your own IP.
+
+    ```sh
+    echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
+    ```
+
+1. How to solve the problem of slow DNS resolution in iOS system?  
+    Since iOS14, Apple has supported the resolution of DNS HTTPS (TYPE65) records. This function is used for solving problems related to HTTPS connections, but it is still a draft, and it will cause some functions such as adblocking fail. It is recommended to disable it through the following configuration.
+
+    ```sh
+    force-qtype-SOA 65
+    ```
+
+1. How to resolve localhost ip by hostname?
+    smartdns can cooperate with the dhcp server of DNSMASQ to support the resolution of local host name to IP address. You can configure smartdns to read the lease file of dnsmasq and support the resolution. The specific configuration parameters are as follows, (note that the DNSMASQ lease file may be different for each system and needs to be configured according to the actual situation)
+
+    ```sh
+    dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
+    ````\
+
+    After the configuration is complete, you can directly use the host name to connect to the local machine. But need to pay attention:
+
+    * Windows system uses mDNS to resolve addresses by default. If you need to use smartdns to resolve addresses under Windows, you need to add `.` after the host name, indicating that DNS resolution is used. Such as `ping smartdns.`
+
 ## Compile
 
 smartdns contains scripts for compiling packages, supports compiling luci, debian, openwrt, opare installation packages, and can execute `package/build-pkg.sh` compilation.

etc/init.d/smartdns

@@ -68,11 +68,23 @@ case $1 in
 			echo "Stop smartdns server failed."
 			exit 1;
 		fi
-		rm -f "$PIDFILE"
+		LOOP=1
+		while true; do
+			if [ ! -d "/proc/$PID" ]; then
+				break;
+			fi
+
+			if [ $LOOP -gt 12 ]; then
+				kill -9 "$PID"
+				break;
+			fi
+			LOOP=$((LOOP+1))
+			sleep .5
+		done
 		echo "Stop smartdns server success."
 		;;
 	restart)
-		"$0" stop && sleep 1 && "$0" start
+		"$0" stop && "$0" start
 		;;
 	status)
 		PID="$(cat "$PIDFILE" 2>/dev/null)"

etc/smartdns/smartdns.conf

@@ -4,6 +4,12 @@
 #   server-name smartdns
 #
 
+# dns server run ser
+# user [username]
+# example: run as nobody
+#   user nobody
+#
+
 # Include another configuration options
 # conf-file [file]
 # conf-file blacklist-ip.conf
@@ -38,7 +44,7 @@ bind [::]:53
 # dns cache size
 # cache-size [number]
 #   0: for no cache
-cache-size 4096
+cache-size 16384
 
 # enable persist cache when restart
 # cache-persist yes
@@ -77,31 +83,42 @@ cache-size 4096
 # speed check mode
 # speed-check-mode [ping|tcp:port|none|,]
 # example:
-#   speed-check-mode ping,tcp:80
+#   speed-check-mode ping,tcp:80,tcp:443
 #   speed-check-mode tcp:443,ping
 #   speed-check-mode none
 
 # force AAAA query return SOA
 # force-AAAA-SOA [yes|no]
 
+# force specific qtype return soa
+# force-qtype-SOA [qtypeid |...]
+# force-qtype-SOA 65 28
+
 # Enable IPV4, IPV6 dual stack IP optimization selection strategy
 # dualstack-ip-selection-threshold [num] (0~1000)
+# dualstack-ip-allow-force-AAAA [yes|no]
 # dualstack-ip-selection [yes|no]
 # dualstack-ip-selection yes
 
 # edns client subnet
 # edns-client-subnet [ip/subnet]
 # edns-client-subnet 192.168.1.1/24
-# edns-client-subnet [8::8]/56
+# edns-client-subnet 8::8/56
 
 # ttl for all resource record
 # rr-ttl: ttl for all record
 # rr-ttl-min: minimum ttl for resource record
 # rr-ttl-max: maximum ttl for resource record
+# tr-ttl-reply-max: maximum reply ttl for resource record
 # example:
 # rr-ttl 300
 # rr-ttl-min 60
 # rr-ttl-max 86400
+# rr-ttl-reply-max 60
+
+# Maximum number of IPs returned to the client|8|number of IPs, 1~16
+# example:
+# max-reply-ip-num 1
 
 # set log level
 # log-level: [level], level=fatal, error, warn, notice, info, debug
@@ -122,6 +139,9 @@ log-level info
 # audit-size 128k
 # audit-num 2
 
+# Support reading dnsmasq dhcp file to resolve local hostname
+# dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
+
 # certificate file
 # ca-file [file]
 # ca-file /etc/ssl/certs/ca-certificates.crt

package/debian/DEBIAN/changelog

@@ -1,4 +1,4 @@
-smartdns (1.2018.7.9) stable; urgency=low
+smartdns (1:1.2022.04.05) stable; urgency=low
 
   * Initial build
 

package/debian/make.sh

@@ -43,7 +43,9 @@ build()
 	mkdir $ROOT/etc/default/ -p
 	mkdir $ROOT/lib/systemd/system/ -p
 
-	sed -i "s/Version:.*/Version: $VER/" $ROOT/DEBIAN/control
+
+	pkgver=$(echo ${VER}| sed 's/^1\.//g')
+	sed -i "s/Version:.*/Version: ${pkgver}/" $ROOT/DEBIAN/control
 	sed -i "s/Architecture:.*/Architecture: $ARCH/" $ROOT/DEBIAN/control
 	chmod 0755 $ROOT/DEBIAN/prerm
 

package/luci-compat/files/luci/i18n/smartdns.zh-cn.po

@@ -124,6 +124,9 @@ msgstr "域名TTL最大值"
 msgid "Maximum TTL for all domain result."
 msgstr "设置所有域名的TTL最大值"
 
+msgid "Maximum Reply TTL for all domain result."
+msgstr "设置返回给客户端的TTL最大值"
+
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"
 

package/luci-compat/files/luci/model/cbi/smartdns/smartdns.lua

@@ -70,7 +70,7 @@ end
 ---- Support DualStack ip selection
 o = s:taboption("settings", Flag, "dualstack_ip_selection", translate("Dual-stack IP Selection"), translate("Enable IP selection between IPV4 and IPV6"))
 o.rmempty     = false
-o.default     = o.disabled
+o.default     = o.enabled
 o.cfgvalue    = function(...)
     return Flag.cfgvalue(...) or "0"
 end
@@ -87,7 +87,7 @@ end
 o = s:taboption("settings", Flag, "serve_expired", translate("Serve expired"), 
 	translate("Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish."))
 o.rmempty     = false
-o.default     = o.disabled
+o.default     = o.enabled
 o.cfgvalue    = function(...)
     return Flag.cfgvalue(...) or "0"
 end
@@ -112,15 +112,19 @@ o.rempty      = true
 ---- rr-ttl-min
 o = s:taboption("settings", Value, "rr_ttl_min", translate("Domain TTL Min"), translate("Minimum TTL for all domain result."))
 o.rempty      = true
-o.placeholder = "300"
-o.default     = 300
+o.placeholder = "600"
+o.default     = 600
 o.optional    = true
 
----- second dns server
 ---- rr-ttl-max
 o = s:taboption("settings", Value, "rr_ttl_max", translate("Domain TTL Max"), translate("Maximum TTL for all domain result."))
 o.rempty      = true
 
+---- rr-ttl-reply-max
+o = s:taboption("settings", Value, "rr_ttl_reply_max", translate("Domain TTL Max"), translate("Maximum Reply TTL for all domain result."))
+o.rempty      = true
+
+---- second dns server
 ---- Eanble
 o = s:taboption("seconddns", Flag, "seconddns_enabled", translate("Enable"), translate("Enable or disable second DNS server."))
 o.default     = o.disabled

package/luci/files/luci/i18n/smartdns.zh-cn.po

@@ -130,6 +130,9 @@ msgstr "域名TTL最大值"
 msgid "Maximum TTL for all domain result."
 msgstr "设置所有域名的TTL最大值"
 
+msgid "Maximum Reply TTL for all domain result."
+msgstr "设置返回给客户端的TTL最大值"
+
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"
 

package/luci/files/root/www/luci-static/resources/view/smartdns/smartdns.js

@@ -188,7 +188,7 @@ return L.view.extend({
 		o = s.taboption("settings", form.Flag, "dualstack_ip_selection", _("Dual-stack IP Selection"),
 			_("Enable IP selection between IPV4 and IPV6"));
 		o.rmempty = false;
-		o.default = o.disabled;
+		o.default = o.enabled;
 
 		// Domain prefetch load ;
 		o = s.taboption("settings", form.Flag, "prefetch_domain", _("Domain prefetch"),
@@ -200,7 +200,7 @@ return L.view.extend({
 		o = s.taboption("settings", form.Flag, "serve_expired", _("Serve expired"),
 			_("Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish."));
 		o.rmempty = false;
-		o.default = o.disabled;
+		o.default = o.enabled;
 
 		// Redirect;
 		o = s.taboption("settings", form.ListValue, "redirect", _("Redirect"), _("SmartDNS redirect mode"));
@@ -223,16 +223,21 @@ return L.view.extend({
 		o = s.taboption("settings", form.Value, "rr_ttl_min", _("Domain TTL Min"),
 			_("Minimum TTL for all domain result."));
 		o.rempty = true;
-		o.placeholder = "300";
-		o.default = 300;
+		o.placeholder = "600";
+		o.default = 600;
 		o.optional = true;
 
-		// second dns server;
 		// rr-ttl-max;
 		o = s.taboption("settings", form.Value, "rr_ttl_max", _("Domain TTL Max"),
-			_("Maximum TTL for all domain result."));
+		_("Maximum TTL for all domain result."));
 		o.rempty = true;
 
+		// rr-ttl-reply-max;
+		o = s.taboption("settings", form.Value, "rr_ttl_reply_max", _("Domain Reply TTL Max"),
+		_("Maximum Reply TTL for all domain result."));
+		o.rempty = true;
+		
+		// second dns server;
 		// Eanble;
 		o = s.taboption("seconddns", form.Flag, "seconddns_enabled", _("Enable"),
 			_("Enable or disable second DNS server."));

package/openwrt/files/etc/init.d/smartdns

@@ -289,7 +289,7 @@ load_service()
 		fi
 	}
 	config_get dualstack_ip_selection "$section" "dualstack_ip_selection" "0"
-	[ "$dualstack_ip_selection" = "1" ] && conf_append "dualstack-ip-selection" "yes"
+	[ "$dualstack_ip_selection" = "0" ] && conf_append "dualstack-ip-selection" "no"
 
 	config_get prefetch_domain "$section" "prefetch_domain" "0"
 	[ "$prefetch_domain" = "1" ] && conf_append "prefetch-domain" "yes"
@@ -311,6 +311,9 @@ load_service()
 	config_get rr_ttl_max "$section" "rr_ttl_max" ""
 	[ -z "$rr_ttl_max" ] || conf_append "rr-ttl-max" "$rr_ttl_max"
 
+	config_get rr_ttl_reply_max "$section" "rr_ttl_reply_max" ""
+	[ -z "$rr_ttl_reply_max" ] || conf_append "rr-ttl-reply-max" "$rr_ttl_reply_max"
+
 	config_get log_size "$section" "log_size" "64K"
 	[ -z "$log_size" ] || conf_append "log-size" "$log_size"
 
@@ -374,6 +377,7 @@ load_service()
 	procd_set_param command /usr/sbin/smartdns -f -c $SMARTDNS_CONF $args
 	[ "$RESPAWN" = "1" ] &&	procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}
 	procd_set_param file "$SMARTDNS_CONF"
+	procd_set_param term_timeout 60
 	procd_close_instance
 }
 

package/optware/S50smartdns

@@ -339,7 +339,7 @@ case "$1" in
 		SLEEP="sleep"
 		SLEEPTIME=0.2
 	fi
-	N=30
+	N=300
 	while [ $N -gt 0 ]
 	do
 		pid="$(cat "$SMARTDNS_PID" | head -n 1 2>/dev/null)"
@@ -348,7 +348,13 @@ case "$1" in
 		fi
 
 		if [ ! -d "/proc/$pid" ]; then
-			return 0;
+			return 0
+		fi
+
+		stat="$(cat /proc/${pid}/stat | awk '{print $3}' 2>/dev/null)"
+		if [ "$stat" = "Z" ]; then
+			$SLEEP $SLEEPTIME
+			return 0
 		fi
 
 		$SLEEP $SLEEPTIME 2>/dev/null

src/dns.h

@@ -30,6 +30,11 @@
 #define DNS_ADDR_FAMILY_IP 1
 #define DNS_ADDR_FAMILY_IPV6 2
 
+/*
+DNS parameters:
+https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
+*/
+
 typedef enum dns_qr {
 	DNS_QR_QUERY = 0,
 	DNS_QR_ANSWER = 1,
@@ -61,6 +66,7 @@ typedef enum dns_type {
 	DNS_T_SRV = 33,
 	DNS_T_OPT = 41,
 	DNS_T_SSHFP = 44,
+	DNS_T_HTTPS = 65,
 	DNS_T_SPF = 99,
 	DNS_T_AXFR = 252,
 	DNS_T_ALL = 255
@@ -68,6 +74,7 @@ typedef enum dns_type {
 
 typedef enum dns_opt_code {
 	DNS_OPT_T_ECS = 8, // OPT ECS
+	DNS_OPT_T_COOKIE = 10, //OPT Cookie
 	DNS_OPT_T_TCP_KEEPALIVE = 11,
 	DNS_OPT_T_ALL = 255
 } dns_opt_code_t;
@@ -112,11 +119,15 @@ struct dns_head {
 	unsigned short nrcount; /* number of addititional resource entries */
 } __attribute__((packed, aligned(2)));
 
-struct dns_rrs {
-	unsigned short next;
-	unsigned short len;
-	dns_type_t type;
-	unsigned char data[0];
+#define DNS_PACKET_DICT_SIZE 16
+struct dns_packet_dict_item {
+	unsigned pos;
+	unsigned int hash;
+};
+
+struct dns_packet_dict {
+	short dict_count;
+	struct dns_packet_dict_item names[DNS_PACKET_DICT_SIZE];
 };
 
 /* packet haed */
@@ -129,21 +140,24 @@ struct dns_packet {
 	unsigned short optcount;
 	unsigned short optional;
 	unsigned short payloadsize;
+	struct dns_packet_dict namedict;
 	int size;
 	int len;
 	unsigned char data[0];
 };
 
-/* RRS encode/decode context */
-struct dns_data_context {
-	unsigned char *data;
-	unsigned char *ptr;
-	unsigned int maxsize;
+struct dns_rrs {
+	struct dns_packet *packet;
+	unsigned short next;
+	unsigned short len;
+	dns_type_t type;
+	unsigned char data[0];
 };
 
 /* packet encode/decode context */
 struct dns_context {
 	struct dns_packet *packet;
+	struct dns_packet_dict *namedict;
 	unsigned char *data;
 	unsigned int maxsize;
 	unsigned char *ptr;
@@ -169,6 +183,13 @@ struct dns_opt_ecs {
 	unsigned char source_prefix;
 	unsigned char scope_prefix;
 	unsigned char addr[DNS_RR_AAAA_LEN];
+} __attribute__((packed));;
+
+/* OPT COOLIE */
+struct dns_opt_cookie {
+	char server_cookie_len;
+	unsigned char client_cookie[8];
+	unsigned char server_cookie[32];
 };
 
 /* OPT */
@@ -226,4 +247,12 @@ int dns_encode(unsigned char *data, int size, struct dns_packet *packet);
 
 int dns_packet_init(struct dns_packet *packet, int size, struct dns_head *head);
 
+struct dns_update_param {
+	int id;
+	int ip_ttl;
+	int cname_ttl;
+};
+
+int dns_packet_update(unsigned char *data, int size, struct dns_update_param *param);
+
 #endif

src/dns_cache.c

@@ -162,6 +162,11 @@ void dns_cache_set_data_soa(struct dns_cache_data *dns_cache, int32_t cache_flag
 		goto errout;
 	}
 
+	dns_cache->head.is_soa = 1;
+	if (dns_cache->head.cache_type == CACHE_TYPE_PACKET) {
+		return;
+	}
+
 	struct dns_cache_addr *cache_addr = (struct dns_cache_addr *)dns_cache;
 	if (cache_addr == NULL) {
 		goto errout;
@@ -229,6 +234,7 @@ struct dns_cache_data *dns_cache_new_data_packet(uint32_t cache_flag, void *pack
 	}
 
 	memcpy(cache_packet->data, packet, packet_len);
+	memset(&cache_packet->head, 0, sizeof(cache_packet->head));
 
 	cache_packet->head.cache_flag = cache_flag;
 	cache_packet->head.cache_type = CACHE_TYPE_PACKET;
@@ -237,7 +243,8 @@ struct dns_cache_data *dns_cache_new_data_packet(uint32_t cache_flag, void *pack
 	return (struct dns_cache_data *)cache_packet;
 }
 
-int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+int _dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, int inactive,
+					   struct dns_cache_data *cache_data)
 {
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache_data *old_cache_data = NULL;
@@ -263,11 +270,19 @@ int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	dns_cache->info.qtype = qtype;
 	dns_cache->info.ttl = ttl;
 	dns_cache->info.speed = speed;
-	time(&dns_cache->info.insert_time);
 	old_cache_data = dns_cache->cache_data;
 	dns_cache->cache_data = cache_data;
 	list_del_init(&dns_cache->list);
-	list_add_tail(&dns_cache->list, &dns_cache_head.cache_list);
+
+	if (inactive == 0) {
+		time(&dns_cache->info.insert_time);
+		time(&dns_cache->info.replace_time);
+		list_add_tail(&dns_cache->list, &dns_cache_head.cache_list);
+	} else {
+		time(&dns_cache->info.replace_time);
+		list_add_tail(&dns_cache->list, &dns_cache_head.inactive_list);
+	}
+
 	pthread_mutex_unlock(&dns_cache_head.lock);
 
 	dns_cache_data_free(old_cache_data);
@@ -275,6 +290,16 @@ int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	return 0;
 }
 
+int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+{
+	return _dns_cache_replace(domain, ttl, qtype, speed, 0, cache_data);
+}
+
+int dns_cache_replace_inactive(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+{
+	return _dns_cache_replace(domain, ttl, qtype, speed, 1, cache_data);
+}
+
 int _dns_cache_insert(struct dns_cache_info *info, struct dns_cache_data *cache_data, struct list_head *head)
 {
 	uint32_t key = 0;
@@ -348,6 +373,7 @@ int dns_cache_insert(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	info.hitnum_update_add = DNS_CACHE_HITNUM_STEP;
 	info.speed = speed;
 	time(&info.insert_time);
+	time(&info.replace_time);
 
 	return _dns_cache_insert(&info, cache_data, &dns_cache_head.cache_list);
 }
@@ -412,15 +438,45 @@ int dns_cache_get_ttl(struct dns_cache *dns_cache)
 	return ttl;
 }
 
-int dns_cache_is_soa(struct dns_cache *dns_cache) {
+int dns_cache_get_cname_ttl(struct dns_cache *dns_cache)
+{
+	time_t now;
+	int ttl = 0;
+	time(&now);
+
+	struct dns_cache_addr *cache_addr = (struct dns_cache_addr *)dns_cache_get_data(dns_cache);
+
+	if (cache_addr->head.cache_type != CACHE_TYPE_ADDR) {
+		return 0;
+	}
+
+	ttl = dns_cache->info.insert_time + cache_addr->addr_data.cname_ttl - now;
+	if (ttl < 0) {
+		return 0;
+	}
+
+	int addr_ttl = dns_cache_get_ttl(dns_cache);
+	if (ttl < addr_ttl && ttl < 0) {
+		return addr_ttl;
+	}
+
+	if (ttl < 0) {
+		return 0;
+	}
+
+	return ttl;
+}
+
+int dns_cache_is_soa(struct dns_cache *dns_cache)
+{
 	if (dns_cache == NULL) {
 		return 0;
 	}
 
-	struct dns_cache_addr *cache_addr = (struct dns_cache_addr *)dns_cache_get_data(dns_cache);
-	if (cache_addr->head.cache_type == CACHE_TYPE_ADDR && cache_addr->addr_data.soa) {
+	if (dns_cache->cache_data->head.is_soa) {
 		return 1;
 	}
+
 	return 0;
 }
 
@@ -466,12 +522,16 @@ void dns_cache_update(struct dns_cache *dns_cache)
 	pthread_mutex_unlock(&dns_cache_head.lock);
 }
 
-void _dns_cache_remove_expired_ttl(time_t *now)
+void _dns_cache_remove_expired_ttl(dns_cache_callback inactive_precallback, int ttl_inactive_pre,
+								   unsigned int max_callback_num, time_t *now)
 {
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache *tmp;
+	int callback_num = 0;
 	int ttl = 0;
+	LIST_HEAD(checklist);
 
+	pthread_mutex_lock(&dns_cache_head.lock);
 	list_for_each_entry_safe(dns_cache, tmp, &dns_cache_head.inactive_list, list)
 	{
 		ttl = dns_cache->info.insert_time + dns_cache->info.ttl - *now;
@@ -479,21 +539,55 @@ void _dns_cache_remove_expired_ttl(time_t *now)
 			continue;
 		}
 
-		if (dns_cache_head.inactive_list_expired + ttl > 0) {
+		if (dns_cache_head.inactive_list_expired + ttl < 0) {
+			_dns_cache_remove(dns_cache);
 			continue;
 		}
 
-		_dns_cache_remove(dns_cache);
+		ttl = *now - dns_cache->info.replace_time;
+		if (ttl < ttl_inactive_pre || inactive_precallback == NULL) {
+			continue;
+		}
+
+		if (callback_num >= max_callback_num) {
+			continue;
+		}
+
+		if (dns_cache->del_pending == 1) {
+			continue;
+		}
+
+		/* If the TTL time is in the pre-timeout range, call callback function */
+		dns_cache_get(dns_cache);
+		list_add_tail(&dns_cache->check_list, &checklist);
+		dns_cache->del_pending = 1;
+		callback_num++;
+	}
+	pthread_mutex_unlock(&dns_cache_head.lock);
+
+	list_for_each_entry_safe(dns_cache, tmp, &checklist, check_list)
+	{
+		/* run inactive_precallback */
+		if (inactive_precallback) {
+			inactive_precallback(dns_cache);
+		}
+		dns_cache_release(dns_cache);
 	}
 }
 
-void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre)
+void dns_cache_invalidate(dns_cache_callback precallback, int ttl_pre, unsigned int max_callback_num,
+						  dns_cache_callback inactive_precallback, int ttl_inactive_pre)
 {
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache *tmp;
 	time_t now;
 	int ttl = 0;
 	LIST_HEAD(checklist);
+	int callback_num = 0;
+
+	if (max_callback_num <= 0) {
+		max_callback_num = -1;
+	}
 
 	if (dns_cache_head.size <= 0) {
 		return;
@@ -506,35 +600,36 @@ void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre)
 		ttl = dns_cache->info.insert_time + dns_cache->info.ttl - now;
 		if (ttl > 0 && ttl < ttl_pre) {
 			/* If the TTL time is in the pre-timeout range, call callback function */
-			if (callback && dns_cache->del_pending == 0) {
+			if (precallback && dns_cache->del_pending == 0 && callback_num < max_callback_num) {
 				list_add_tail(&dns_cache->check_list, &checklist);
 				dns_cache_get(dns_cache);
 				dns_cache->del_pending = 1;
+				callback_num++;
 				continue;
 			}
 		}
 
 		if (ttl < 0) {
-			if (dns_cache_head.enable_inactive && (dns_cache_is_soa(dns_cache) == 0)) {
+			if (dns_cache_head.enable_inactive) {
 				_dns_cache_move_inactive(dns_cache);
 			} else {
 				_dns_cache_remove(dns_cache);
 			}
 		}
 	}
+	pthread_mutex_unlock(&dns_cache_head.lock);
 
 	if (dns_cache_head.enable_inactive && dns_cache_head.inactive_list_expired != 0) {
-		_dns_cache_remove_expired_ttl(&now);
+		_dns_cache_remove_expired_ttl(inactive_precallback, ttl_inactive_pre, max_callback_num, &now);
 	}
 
-	pthread_mutex_unlock(&dns_cache_head.lock);
-
 	list_for_each_entry_safe(dns_cache, tmp, &checklist, check_list)
 	{
 		/* run callback */
-		if (callback) {
-			callback(dns_cache);
+		if (precallback) {
+			precallback(dns_cache);
 		}
+		list_del(&dns_cache->check_list);
 		dns_cache_release(dns_cache);
 	}
 }
@@ -612,11 +707,16 @@ int dns_cache_load(const char *file)
 {
 	int fd = -1;
 	int ret = 0;
+	size_t filesize;
 	fd = open(file, O_RDONLY);
 	if (fd < 0) {
 		return 0;
 	}
 
+	filesize = lseek(fd, 0, SEEK_END);
+	lseek(fd, 0, SEEK_SET);
+	posix_fadvise(fd, 0, filesize, POSIX_FADV_WILLNEED | POSIX_FADV_SEQUENTIAL);
+
 	struct dns_cache_file cache_file;
 	ret = read(fd, &cache_file, sizeof(cache_file));
 	if (ret != sizeof(cache_file)) {
@@ -634,6 +734,7 @@ int dns_cache_load(const char *file)
 		goto errout;
 	}
 
+	tlog(TLOG_INFO, "load cache file %s, total %d records", file, cache_file.cache_number);
 	if (_dns_cache_read_record(fd, cache_file.cache_number) != 0) {
 		goto errout;
 	}

src/dns_cache.h

@@ -50,6 +50,7 @@ enum CACHE_RECORD_TYPE {
 struct dns_cache_data_head {
 	uint32_t cache_flag;
 	enum CACHE_TYPE cache_type;
+	int is_soa;
 	size_t size;
 };
 
@@ -84,6 +85,7 @@ struct dns_cache_info {
 	int speed;
 	int hitnum_update_add;
 	time_t insert_time;
+	time_t replace_time;
 	dns_type_t qtype;
 };
 
@@ -123,6 +125,8 @@ int dns_cache_init(int size, int enable_inactive, int inactive_list_expired);
 
 int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);
 
+int dns_cache_replace_inactive(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);
+
 int dns_cache_insert(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);
 
 struct dns_cache *dns_cache_lookup(char *domain, dns_type_t qtype);
@@ -137,12 +141,15 @@ int dns_cache_hitnum_dec_get(struct dns_cache *dns_cache);
 
 void dns_cache_update(struct dns_cache *dns_cache);
 
-typedef void dns_cache_preinvalid_callback(struct dns_cache *dns_cache);
+typedef void dns_cache_callback(struct dns_cache *dns_cache);
 
-void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre);
+void dns_cache_invalidate(dns_cache_callback precallback, int ttl_pre, unsigned int max_callback_num,
+						  dns_cache_callback inactive_precallback, int ttl_inactive_pre);
 
 int dns_cache_get_ttl(struct dns_cache *dns_cache);
 
+int dns_cache_get_cname_ttl(struct dns_cache *dns_cache);
+
 int dns_cache_is_soa(struct dns_cache *dns_cache);
 
 struct dns_cache_data *dns_cache_new_data(void);

src/dns_client.c

@@ -58,7 +58,7 @@
 #define DNS_TCP_IDLE_TIMEOUT (60 * 10)
 #define DNS_TCP_CONNECT_TIMEOUT (5)
 #define DNS_QUERY_TIMEOUT (500)
-#define DNS_QUERY_RETRY (6)
+#define DNS_QUERY_RETRY (4)
 #define DNS_PENDING_SERVER_RETRY 40
 #define SOCKET_PRIORITY (6)
 #define SOCKET_IP_TOS (IPTOS_LOWDELAY | IPTOS_RELIABILITY)
@@ -66,13 +66,7 @@
 /* ECS info */
 struct dns_client_ecs {
 	int enable;
-	unsigned int family;
-	unsigned int bitlen;
-	union {
-		unsigned char ipv4_addr[DNS_RR_A_LEN];
-		unsigned char ipv6_addr[DNS_RR_AAAA_LEN];
-		unsigned char addr[0];
-	};
+	struct dns_opt_ecs ecs;
 };
 
 /* TCP/TLS buffer */
@@ -117,6 +111,7 @@ struct dns_server_info {
 
 	time_t last_send;
 	time_t last_recv;
+	int prohibit;
 
 	/* server addr info */
 	unsigned short ai_family;
@@ -243,6 +238,9 @@ struct dns_query_struct {
 	/* has result */
 	int has_result;
 
+	/* ECS */
+	struct dns_client_ecs ecs;
+
 	/* replied hash table */
 	DECLARE_HASHTABLE(replied_map, 4);
 };
@@ -343,6 +341,42 @@ SSL_SESSION *_ssl_get1_session(struct dns_server_info *server)
 	return ret;
 }
 
+unsigned int dns_client_server_result_flag(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return 0;
+	}
+
+	return server_info->flags.result_flag;
+}
+
+const char *dns_client_get_server_ip(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return NULL;
+	}
+
+	return server_info->ip;
+}
+
+int dns_client_get_server_port(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return 0;
+	}
+
+	return server_info->port;
+}
+
+dns_server_type_t dns_client_get_server_type(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return DNS_SERVER_TYPE_END;
+	}
+
+	return server_info->type;
+}
+
 const char *_dns_server_get_type_string(dns_server_type_t type)
 {
 	const char *type_str = "";
@@ -419,7 +453,7 @@ static int _dns_client_server_exist(const char *server_ip, int port, dns_server_
 
 static void _dns_client_server_update_ttl(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 										  struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl,
-										  struct timeval *tv, void *userptr)
+										  struct timeval *tv, int error, void *userptr)
 {
 	struct dns_server_info *server_info = userptr;
 	if (result != PING_RESULT_RESPONSE || server_info == NULL) {
@@ -907,7 +941,7 @@ SSL_CTX *_ssl_ctx_get(void)
 	pthread_mutex_unlock(&client.server_list_lock);
 	return client.ssl_ctx;
 errout:
-	
+
 	pthread_mutex_unlock(&client.server_list_lock);
 	if (ssl_ctx) {
 		SSL_CTX_free(ssl_ctx);
@@ -1004,6 +1038,7 @@ static int _dns_client_server_add(char *server_ip, char *server_host, int port,
 	server_info->ttl = ttl;
 	server_info->ttl_range = 0;
 	server_info->skip_check_cert = skip_check_cert;
+	server_info->prohibit = 0;
 	pthread_mutex_init(&server_info->lock, NULL);
 	memcpy(&server_info->flags, flags, sizeof(server_info->flags));
 
@@ -1211,6 +1246,8 @@ void _dns_client_server_pending_get(struct dns_server_pending *pending)
 
 void _dns_client_server_pending_release_lck(struct dns_server_pending *pending)
 {
+	struct dns_server_pending_group *group, *tmp;
+
 	int refcnt = atomic_dec_return(&pending->refcnt);
 
 	if (refcnt) {
@@ -1221,6 +1258,12 @@ void _dns_client_server_pending_release_lck(struct dns_server_pending *pending)
 		return;
 	}
 
+	list_for_each_entry_safe(group, tmp, &pending->group_list, list)
+	{
+		list_del_init(&group->list);
+		free(group);
+	}
+
 	list_del_init(&pending->list);
 	free(pending);
 }
@@ -1353,6 +1396,8 @@ static void _dns_client_query_release(struct dns_query_struct *query)
 
 	/* notify caller query end */
 	if (query->callback) {
+		tlog(TLOG_DEBUG, "result: %s, qtype: %d, hasresult: %d, id %d", query->domain, query->qtype, query->has_result,
+			 query->sid);
 		query->callback(query->domain, DNS_QUERY_END, 0, NULL, NULL, 0, query->user_ptr);
 	}
 
@@ -1607,8 +1652,8 @@ static int _dns_client_recv(struct dns_server_info *server_info, unsigned char *
 
 	/* notify caller dns query result */
 	if (query->callback) {
-		ret = query->callback(query->domain, DNS_QUERY_RESULT, server_info->flags.result_flag, packet, inpacket,
-							  inpacket_len, query->user_ptr);
+		ret = query->callback(query->domain, DNS_QUERY_RESULT, server_info, packet, inpacket, inpacket_len,
+							  query->user_ptr);
 		if (request_num == 0 || ret) {
 			/* if all server replied, or done, stop query, release resource */
 			_dns_client_query_remove(query);
@@ -2152,6 +2197,7 @@ static int _dns_client_process_tcp_buff(struct dns_server_info *server_info)
 		}
 
 		tlog(TLOG_DEBUG, "recv tcp packet from %s, len = %d", server_info->ip, len);
+		time(&server_info->last_recv);
 		/* process result */
 		if (_dns_client_recv(server_info, inpacket_data, dns_packet_len, &server_info->addr, server_info->ai_addrlen) !=
 			0) {
@@ -2230,7 +2276,6 @@ static int _dns_client_process_tcp(struct dns_server_info *server_info, struct e
 			return ret;
 		}
 
-		time(&server_info->last_recv);
 		server_info->recv_buff.len += len;
 		if (server_info->recv_buff.len <= 2) {
 			/* wait and recv */
@@ -2787,6 +2832,14 @@ static int _dns_client_send_packet(struct dns_query_struct *query, void *packet,
 		list_for_each_entry_safe(group_member, tmp, &query->server_group->head, list)
 		{
 			server_info = group_member->server;
+			if (server_info->prohibit) {
+				time_t now;
+				time(&now);
+				if ((now - 60 < server_info->last_send) && (now - 5 > server_info->last_recv)) {
+					continue;
+				}
+				server_info->prohibit = 0;
+			}
 			total_server++;
 			tlog(TLOG_DEBUG, "send query to server %s", server_info->ip);
 			if (server_info->fd <= 0) {
@@ -2838,6 +2891,8 @@ static int _dns_client_send_packet(struct dns_query_struct *query, void *packet,
 				time_t now;
 				time(&now);
 				if (now - 5 > server_info->last_recv || send_err != ENOMEM) {
+					server_info->prohibit = 1;
+					tlog(TLOG_INFO, "server %s not alive, prohibit", server_info->ip);
 					_dns_client_shutdown_socket(server_info);
 				}
 
@@ -2861,24 +2916,13 @@ static int _dns_client_send_packet(struct dns_query_struct *query, void *packet,
 	return 0;
 }
 
-static int _dns_client_dns_add_ecs(struct dns_packet *packet, int qtype)
+static int _dns_client_dns_add_ecs(struct dns_query_struct *query, struct dns_packet *packet)
 {
-	if (qtype == DNS_T_A && client.ecs_ipv4.enable) {
-		struct dns_opt_ecs ecs;
-		ecs.family = DNS_ADDR_FAMILY_IP;
-		ecs.source_prefix = client.ecs_ipv4.bitlen;
-		ecs.scope_prefix = 0;
-		memcpy(ecs.addr, client.ecs_ipv4.ipv4_addr, DNS_RR_A_LEN);
-		return dns_add_OPT_ECS(packet, &ecs);
-	} else if (qtype == DNS_T_AAAA && client.ecs_ipv6.enable) {
-		struct dns_opt_ecs ecs;
-		ecs.family = DNS_ADDR_FAMILY_IPV6;
-		ecs.source_prefix = client.ecs_ipv6.bitlen;
-		ecs.scope_prefix = 0;
-		memcpy(ecs.addr, client.ecs_ipv6.ipv6_addr, DNS_RR_AAAA_LEN);
-		return dns_add_OPT_ECS(packet, &ecs);
+	if (query->ecs.enable == 0) {
+		return 0;
 	}
-	return 0;
+
+	return dns_add_OPT_ECS(packet, &query->ecs.ecs);
 }
 
 static int _dns_client_send_query(struct dns_query_struct *query, char *doamin)
@@ -2912,7 +2956,7 @@ static int _dns_client_send_query(struct dns_query_struct *query, char *doamin)
 
 	dns_set_OPT_payload_size(packet, DNS_IN_PACKSIZE);
 	/* dns_add_OPT_TCP_KEEYALIVE(packet, 600); */
-	if (_dns_client_dns_add_ecs(packet, query->qtype) != 0) {
+	if (_dns_client_dns_add_ecs(query, packet) != 0) {
 		tlog(TLOG_ERROR, "add ecs failed.");
 		return -1;
 	}
@@ -2934,7 +2978,102 @@ static int _dns_client_send_query(struct dns_query_struct *query, char *doamin)
 	return _dns_client_send_packet(query, inpacket, encode_len);
 }
 
-int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name)
+int _dns_client_query_setup_default_ecs(struct dns_query_struct *query)
+{
+	int add_ipv4_ecs = 0;
+	int add_ipv6_ecs = 0;
+
+	if (query->qtype == DNS_T_A && client.ecs_ipv4.enable) {
+		add_ipv4_ecs = 1;
+	} else if (query->qtype == DNS_T_AAAA && client.ecs_ipv6.enable) {
+		add_ipv6_ecs = 1;
+	} else {
+		if (client.ecs_ipv4.enable) {
+			add_ipv4_ecs = 1;
+		} else if (client.ecs_ipv6.enable) {
+			add_ipv4_ecs = 1;
+		}
+	}
+
+	if (add_ipv4_ecs) {
+		memcpy(&query->ecs, &client.ecs_ipv4, sizeof(query->ecs));
+		return 0;
+	}
+
+	if (add_ipv6_ecs) {
+		memcpy(&query->ecs, &client.ecs_ipv6, sizeof(query->ecs));
+		return 0;
+	}
+
+	return 0;
+}
+
+int _dns_client_query_parser_options(struct dns_query_struct *query, struct dns_query_options *options)
+{
+	if (options == NULL) {
+		_dns_client_query_setup_default_ecs(query);
+		return 0;
+	}
+
+	if (options->enable_flag & DNS_QUEY_OPTION_ECS_IP) {
+		struct sockaddr_storage addr;
+		socklen_t addr_len = sizeof(addr);
+		struct dns_opt_ecs *ecs;
+
+		ecs = &query->ecs.ecs;
+		getaddr_by_host(options->ecs_ip.ip, (struct sockaddr *)&addr, &addr_len);
+
+		query->ecs.enable = 1;
+		ecs->source_prefix = options->ecs_ip.subnet;
+		ecs->scope_prefix = 0;
+
+		switch (addr.ss_family) {
+		case AF_INET: {
+			struct sockaddr_in *addr_in;
+			addr_in = (struct sockaddr_in *)&addr;
+			ecs->family = DNS_OPT_ECS_FAMILY_IPV4;
+			memcpy(&ecs->addr, &addr_in->sin_addr.s_addr, 4);
+		} break;
+		case AF_INET6: {
+			struct sockaddr_in6 *addr_in6;
+			addr_in6 = (struct sockaddr_in6 *)&addr;
+			if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+				memcpy(&ecs->addr, addr_in6->sin6_addr.s6_addr + 12, 4);
+				ecs->family = DNS_OPT_ECS_FAMILY_IPV4;
+			} else {
+				memcpy(&ecs->addr, addr_in6->sin6_addr.s6_addr, 16);
+				ecs->family = DNS_OPT_ECS_FAMILY_IPV6;
+			}
+		} break;
+		default:
+			tlog(TLOG_WARN, "ECS set failure.");
+			break;
+		}
+	}
+
+	if (options->enable_flag & DNS_QUEY_OPTION_ECS_DNS) {
+		struct dns_opt_ecs *ecs = &options->ecs_dns;
+		if (ecs->family != DNS_OPT_ECS_FAMILY_IPV6 && ecs->family != DNS_OPT_ECS_FAMILY_IPV4) {
+			return -1;
+		}
+
+		if (ecs->family == DNS_OPT_ECS_FAMILY_IPV4 && ecs->source_prefix > 32) {
+			return -1;
+		}
+
+		if (ecs->family == DNS_OPT_ECS_FAMILY_IPV6 && ecs->source_prefix > 128) {
+			return -1;
+		}
+
+		memcpy(&query->ecs.ecs, ecs, sizeof(query->ecs.ecs));
+		query->ecs.enable = 1;
+	}
+
+	return 0;
+}
+
+int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name,
+					 struct dns_query_options *options)
 {
 	struct dns_query_struct *query = NULL;
 	int ret = 0;
@@ -2969,6 +3108,11 @@ int dns_client_query(char *domain, int qtype, dns_client_callback callback, void
 		goto errout;
 	}
 
+	if (_dns_client_query_parser_options(query, options) != 0) {
+		tlog(TLOG_ERROR, "parser options for %s failed.", domain);
+		goto errout;
+	}
+
 	_dns_client_query_get(query);
 	/* add query to hashtable */
 	key = hash_string(domain);
@@ -3080,6 +3224,19 @@ static int _dns_client_add_pendings(struct dns_server_pending *pending, char *ip
 	return 0;
 }
 
+static void _dns_client_remove_all_pending_servers(void)
+{
+	struct dns_server_pending *pending, *tmp;
+
+	pthread_mutex_lock(&pending_server_mutex);
+	list_for_each_entry_safe(pending, tmp, &pending_servers, list)
+	{
+		list_del_init(&pending->list);
+		_dns_client_server_pending_release_lck(pending);
+	}
+	pthread_mutex_unlock(&pending_server_mutex);
+}
+
 static void _dns_client_add_pending_servers(void)
 {
 	struct dns_server_pending *pending, *tmp;
@@ -3141,7 +3298,7 @@ static void _dns_client_add_pending_servers(void)
 			list_del_init(&pending->list);
 			_dns_client_server_pending_release_lck(pending);
 		} else {
-			tlog(TLOG_DEBUG, "add pending DNS server %s failed, retry %d...", pending->host, pending->retry_cnt);
+			tlog(TLOG_INFO, "add pending DNS server %s failed, retry %d...", pending->host, pending->retry_cnt);
 			pending->query_v4 = 0;
 			pending->query_v6 = 0;
 		}
@@ -3196,8 +3353,11 @@ static void _dns_client_period_run(void)
 		_dns_client_check_udp_nat(query);
 		if (atomic_dec_and_test(&query->retry_count) || (query->has_result != 0)) {
 			_dns_client_query_remove(query);
+			if (query->has_result == 0) {
+				tlog(TLOG_INFO, "retry query %s, type: %d, id: %d failed", query->domain, query->qtype, query->sid);
+			}
 		} else {
-			tlog(TLOG_DEBUG, "retry query %s", query->domain);
+			tlog(TLOG_INFO, "retry query %s, type: %d, id: %d", query->domain, query->qtype, query->sid);
 			_dns_client_send_query(query, query->domain);
 		}
 		_dns_client_query_release(query);
@@ -3261,6 +3421,39 @@ static void *_dns_client_work(void *arg)
 
 int dns_client_set_ecs(char *ip, int subnet)
 {
+	struct sockaddr_storage addr;
+	socklen_t addr_len = sizeof(addr);
+	getaddr_by_host(ip, (struct sockaddr *)&addr, &addr_len);
+
+	switch (addr.ss_family) {
+	case AF_INET: {
+		struct sockaddr_in *addr_in;
+		addr_in = (struct sockaddr_in *)&addr;
+		memcpy(&client.ecs_ipv4.ecs.addr, &addr_in->sin_addr.s_addr, 4);
+		client.ecs_ipv4.ecs.source_prefix = subnet;
+		client.ecs_ipv4.ecs.scope_prefix = 0;
+		client.ecs_ipv4.ecs.family = DNS_OPT_ECS_FAMILY_IPV4;
+		client.ecs_ipv4.enable = 1;
+	} break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			client.ecs_ipv4.ecs.source_prefix = subnet;
+			client.ecs_ipv4.ecs.scope_prefix = 0;
+			client.ecs_ipv4.ecs.family = DNS_OPT_ECS_FAMILY_IPV4;
+			client.ecs_ipv4.enable = 1;
+		} else {
+			memcpy(&client.ecs_ipv6.ecs.addr, addr_in6->sin6_addr.s6_addr, 16);
+			client.ecs_ipv6.ecs.source_prefix = subnet;
+			client.ecs_ipv6.ecs.scope_prefix = 0;
+			client.ecs_ipv6.ecs.family = DNS_ADDR_FAMILY_IPV6;
+			client.ecs_ipv6.enable = 1;
+		}
+	} break;
+	default:
+		return -1;
+	}
 	return 0;
 }
 
@@ -3335,6 +3528,7 @@ void dns_client_exit(void)
 	}
 
 	/* free all resouces */
+	_dns_client_remove_all_pending_servers();
 	_dns_client_server_remove_all();
 	_dns_client_query_remove_all();
 	_dns_client_group_remove_all();

src/dns_client.h

@@ -47,17 +47,41 @@ typedef enum dns_result_type {
 #define DNSSERVER_FLAG_CHECK_EDNS (0x1 << 2)
 #define DNSSERVER_FLAG_CHECK_TTL (0x1 << 3)
 
+#define DNS_QUEY_OPTION_ECS_DNS (1 << 0)
+#define DNS_QUEY_OPTION_ECS_IP (1 << 1)
+
 int dns_client_init(void);
 
 int dns_client_set_ecs(char *ip, int subnet);
 
+struct dns_server_info;
 /* query result notify function */
-typedef int (*dns_client_callback)(char *domain, dns_result_type rtype, unsigned int result_flag,
+typedef int (*dns_client_callback)(char *domain, dns_result_type rtype, struct dns_server_info *server_info,
 								   struct dns_packet *packet, unsigned char *inpacket, int inpacket_len,
 								   void *user_ptr);
 
+unsigned int dns_client_server_result_flag(struct dns_server_info *server_info);
+
+const char *dns_client_get_server_ip(struct dns_server_info *server_info);
+
+int dns_client_get_server_port(struct dns_server_info *server_info);
+
+dns_server_type_t dns_client_get_server_type(struct dns_server_info *server_info);
+
+struct dns_query_ecs_ip {
+	char ip[DNS_MAX_CNAME_LEN];
+	int subnet;
+};
+
+struct dns_query_options {
+	unsigned long long enable_flag;
+	struct dns_opt_ecs ecs_dns;
+	struct dns_query_ecs_ip ecs_ip;
+};
+
 /* query domain */
-int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name);
+int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name,
+					 struct dns_query_options *options);
 
 void dns_client_exit(void);
 

src/dns_conf.c

@@ -21,6 +21,7 @@
 #include "rbtree.h"
 #include "tlog.h"
 #include "util.h"
+#include <errno.h>
 #include <getopt.h>
 #include <libgen.h>
 #include <stdio.h>
@@ -30,6 +31,7 @@
 #include <unistd.h>
 
 #define DEFAULT_DNS_CACHE_SIZE 512
+#define DNS_MAX_REPLY_IP_NUM 8
 
 /* ipset */
 struct dns_ipset_table {
@@ -37,29 +39,46 @@ struct dns_ipset_table {
 };
 static struct dns_ipset_table dns_ipset_table;
 
+struct dns_qtype_soa_table dns_qtype_soa_table;
+
 /* dns groups */
 struct dns_group_table dns_group_table;
 
+struct dns_ptr_table dns_ptr_table;
+
+char dns_conf_dnsmasq_lease_file[DNS_MAX_PATH];
+time_t dns_conf_dnsmasq_lease_file_time;
+
+struct dns_hosts_table dns_hosts_table;
+int dns_hosts_record_num;
+
 /* server ip/port  */
 struct dns_bind_ip dns_conf_bind_ip[DNS_MAX_BIND_IP];
 int dns_conf_bind_ip_num = 0;
 int dns_conf_tcp_idle_time = 120;
 
+int dns_conf_max_reply_ip_num = DNS_MAX_REPLY_IP_NUM;
+
 /* cache */
 int dns_conf_cachesize = DEFAULT_DNS_CACHE_SIZE;
 int dns_conf_prefetch = 0;
-int dns_conf_serve_expired = 0;
-int dns_conf_serve_expired_ttl = 0;
-int dns_conf_serve_expired_reply_ttl = 5;
+int dns_conf_serve_expired = 1;
+int dns_conf_serve_expired_ttl = 24 * 3600; /* 1 day */
+int dns_conf_serve_expired_prefetch_time;
+int dns_conf_serve_expired_reply_ttl = 3;
 
 /* upstream servers */
 struct dns_servers dns_conf_servers[DNS_MAX_SERVERS];
 char dns_conf_server_name[DNS_MAX_SERVER_NAME_LEN];
 int dns_conf_server_num;
 
-struct dns_domain_check_order dns_conf_check_order = {
-	.order = {DOMAIN_CHECK_ICMP, DOMAIN_CHECK_TCP},
-	.tcp_port = 80,
+struct dns_domain_check_orders dns_conf_check_orders = {
+	.orders =
+		{
+			{.type = DOMAIN_CHECK_ICMP, .tcp_port = 0},
+			{.type = DOMAIN_CHECK_TCP, .tcp_port = 80},
+			{.type = DOMAIN_CHECK_TCP, .tcp_port = 443},
+		},
 };
 int dns_has_cap_ping = 0;
 
@@ -88,17 +107,21 @@ art_tree dns_conf_domain_rule;
 struct dns_conf_address_rule dns_conf_address_rule;
 
 /* dual-stack selection */
-int dns_conf_dualstack_ip_selection;
-int dns_conf_dualstack_ip_selection_threshold = 30;
+int dns_conf_dualstack_ip_selection = 1;
+int dns_conf_dualstack_ip_allow_force_AAAA;
+int dns_conf_dualstack_ip_selection_threshold = 15;
 
 /* TTL */
 int dns_conf_rr_ttl;
-int dns_conf_rr_ttl_min;
+int dns_conf_rr_ttl_reply_max;
+int dns_conf_rr_ttl_min = 600;
 int dns_conf_rr_ttl_max;
 int dns_conf_force_AAAA_SOA;
-
+int dns_conf_force_no_cname;
 int dns_conf_ipset_timeout_enable;
 
+char dns_conf_user[DNS_CONF_USRNAME_LEN];
+
 /* ECS */
 struct dns_edns_client_subnet dns_conf_ipv4_ecs;
 struct dns_edns_client_subnet dns_conf_ipv6_ecs;
@@ -810,7 +833,7 @@ errout:
 	return 0;
 }
 
-static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_order, const char *mode)
+static int _config_speed_check_mode_parser(struct dns_domain_check_orders *check_orders, const char *mode)
 {
 	char tmpbuff[DNS_MAX_OPT_LEN];
 	char *field;
@@ -820,7 +843,7 @@ static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_
 	int i = 0;
 
 	safe_strncpy(tmpbuff, mode, DNS_MAX_OPT_LEN);
-	memset(check_order, 0, sizeof(*check_order));
+	memset(check_orders, 0, sizeof(*check_orders));
 
 	ptr = tmpbuff;
 	do {
@@ -841,7 +864,8 @@ static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_
 				}
 				continue;
 			}
-			check_order->order[order] = DOMAIN_CHECK_ICMP;
+			check_orders->orders[order].type = DOMAIN_CHECK_ICMP;
+			check_orders->orders[order].tcp_port = 0;
 		} else if (strstr(field, "tcp") == field) {
 			char *port_str = strstr(field, ":");
 			if (port_str) {
@@ -851,12 +875,12 @@ static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_
 				}
 			}
 
-			check_order->order[order] = DOMAIN_CHECK_TCP;
-			check_order->tcp_port = port;
+			check_orders->orders[order].type = DOMAIN_CHECK_TCP;
+			check_orders->orders[order].tcp_port = port;
 		} else if (strncmp(field, "none", sizeof("none")) == 0) {
-			check_order->order[order] = DOMAIN_CHECK_NONE;
-			for (i = order + 1; i < DOMAIN_CHECK_NUM; i++) {
-				check_order->order[i] = DOMAIN_CHECK_NONE;
+			for (i = order; i < DOMAIN_CHECK_NUM; i++) {
+				check_orders->orders[i].type = DOMAIN_CHECK_NONE;
+				check_orders->orders[i].tcp_port = 0;
 			}
 
 			return 0;
@@ -880,7 +904,7 @@ static int _config_speed_check_mode(void *data, int argc, char *argv[])
 	}
 
 	safe_strncpy(mode, argv[1], sizeof(mode));
-	return _config_speed_check_mode_parser(&dns_conf_check_order, mode);
+	return _config_speed_check_mode_parser(&dns_conf_check_orders, mode);
 }
 
 static int _config_bind_ip(int argc, char *argv[], DNS_BIND_TYPE type)
@@ -892,6 +916,7 @@ static int _config_bind_ip(int argc, char *argv[], DNS_BIND_TYPE type)
 	char group_name[DNS_GROUP_NAME_LEN];
 	const char *group = NULL;
 	unsigned int server_flag = 0;
+	int i = 0;
 
 	/* clang-format off */
 	static struct option long_options[] = {
@@ -919,6 +944,20 @@ static int _config_bind_ip(int argc, char *argv[], DNS_BIND_TYPE type)
 		return 0;
 	}
 
+	for (i = 0; i < dns_conf_bind_ip_num; i++) {
+		bind_ip = &dns_conf_bind_ip[i];
+		if (bind_ip->type != type) {
+			continue;
+		}
+
+		if (strncmp(bind_ip->ip, ip, DNS_MAX_IPLEN) != 0) {
+			continue;
+		}
+
+		tlog(TLOG_WARN, "Bind server %s, type %d, already configured, skip.", ip, type);
+		return 0;
+	}
+
 	bind_ip = &dns_conf_bind_ip[index];
 	bind_ip->type = type;
 	bind_ip->flags = 0;
@@ -1171,6 +1210,47 @@ static int _config_iplist_rule(char *subnet, enum address_rule rule)
 	return 0;
 }
 
+static int _config_qtype_soa(void *data, int argc, char *argv[])
+{
+	struct dns_qtype_soa_list *soa_list;
+	int i = 0;
+
+	if (argc <= 1) {
+		return -1;
+	}
+
+	for (i = 1; i < argc; i++) {
+		soa_list = malloc(sizeof(*soa_list));
+		if (soa_list == NULL) {
+			tlog(TLOG_ERROR, "cannot malloc memory");
+			return -1;
+		}
+
+		memset(soa_list, 0, sizeof(*soa_list));
+		soa_list->qtypeid = atol(argv[i]);
+		if (soa_list->qtypeid == DNS_T_AAAA) {
+			dns_conf_force_AAAA_SOA = 1;
+		}
+		uint32_t key = hash_32_generic(soa_list->qtypeid, 32);
+		hash_add(dns_qtype_soa_table.qtype, &soa_list->node, key);
+	}
+
+	return 0;
+}
+
+static void _config_qtype_soa_table_destroy(void)
+{
+	struct dns_qtype_soa_list *soa_list = NULL;
+	struct hlist_node *tmp = NULL;
+	int i;
+
+	hash_for_each_safe(dns_qtype_soa_table.qtype, i, tmp, soa_list, node)
+	{
+		hlist_del_init(&soa_list->node);
+		free(soa_list);
+	}
+}
+
 static int _config_blacklist_ip(void *data, int argc, char *argv[])
 {
 	if (argc <= 1) {
@@ -1216,7 +1296,7 @@ static int _conf_edns_client_subnet(void *data, int argc, char *argv[])
 	struct sockaddr_storage addr;
 	socklen_t addr_len = sizeof(addr);
 
-	if (argc <= 1 || data == NULL) {
+	if (argc <= 1) {
 		return -1;
 	}
 
@@ -1259,25 +1339,26 @@ errout:
 
 static int _conf_domain_rule_speed_check(char *domain, const char *mode)
 {
-	struct dns_domain_check_order *check_order;
+	struct dns_domain_check_orders *check_orders = NULL;
 
-	check_order = malloc(sizeof(*check_order));
-	if (check_order == NULL) {
+	check_orders = malloc(sizeof(*check_orders) * DOMAIN_CHECK_NUM);
+	if (check_orders == NULL) {
+		goto errout;
+	}
+	memset(check_orders, 0, sizeof(*check_orders));
+
+	if (_config_speed_check_mode_parser(check_orders, mode) != 0) {
 		goto errout;
 	}
 
-	if (_config_speed_check_mode_parser(check_order, mode) != 0) {
-		goto errout;
-	}
-
-	if (_config_domain_rule_add(domain, DOMAIN_RULE_CHECKSPEED, check_order) != 0) {
+	if (_config_domain_rule_add(domain, DOMAIN_RULE_CHECKSPEED, check_orders) != 0) {
 		goto errout;
 	}
 
 	return 0;
 errout:
-	if (check_order) {
-		free(check_order);
+	if (check_orders) {
+		free(check_orders);
 	}
 	return 0;
 }
@@ -1388,6 +1469,342 @@ errout:
 	return -1;
 }
 
+static struct dns_ptr *_dns_conf_get_ptr(const char *ptr_domain)
+{
+	uint32_t key = 0;
+	struct dns_ptr *ptr = NULL;
+
+	key = hash_string(ptr_domain);
+	hash_for_each_possible(dns_ptr_table.ptr, ptr, node, key)
+	{
+		if (strncmp(ptr->ptr_domain, ptr_domain, DNS_MAX_PTR_LEN) != 0) {
+			continue;
+		}
+
+		return ptr;
+	}
+
+	ptr = malloc(sizeof(*ptr));
+	if (ptr == NULL) {
+		goto errout;
+	}
+
+	safe_strncpy(ptr->ptr_domain, ptr_domain, DNS_MAX_PTR_LEN);
+	hash_add(dns_ptr_table.ptr, &ptr->node, key);
+
+	return ptr;
+errout:
+	if (ptr) {
+		free(ptr);
+	}
+
+	return NULL;
+}
+
+static int _conf_ptr_add(const char *hostname, const char *ip)
+{
+	struct dns_ptr *ptr = NULL;
+	struct sockaddr_storage addr;
+	unsigned char *paddr;
+	socklen_t addr_len = sizeof(addr);
+	char ptr_domain[DNS_MAX_PTR_LEN];
+
+	if (getaddr_by_host(ip, (struct sockaddr *)&addr, &addr_len) != 0) {
+		goto errout;
+	}
+
+	switch (addr.ss_family) {
+	case AF_INET: {
+		struct sockaddr_in *addr_in;
+		addr_in = (struct sockaddr_in *)&addr;
+		paddr = (unsigned char *)&(addr_in->sin_addr.s_addr);
+		snprintf(ptr_domain, sizeof(ptr_domain), "%d.%d.%d.%d.in-addr.arpa", paddr[3], paddr[2], paddr[1], paddr[0]);
+	} break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			paddr = addr_in6->sin6_addr.s6_addr + 12;
+			snprintf(ptr_domain, sizeof(ptr_domain), "%d.%d.%d.%d.in-addr.arpa", paddr[3], paddr[2], paddr[1],
+					 paddr[0]);
+		} else {
+			paddr = addr_in6->sin6_addr.s6_addr;
+			snprintf(ptr_domain, sizeof(ptr_domain),
+					 "%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x."
+					 "%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x."
+					 "%x.ip6.arpa",
+					 paddr[15] & 0xF, (paddr[15] >> 4) & 0xF, paddr[14] & 0xF, (paddr[14] >> 4) & 0xF, paddr[13] & 0xF,
+					 (paddr[13] >> 4) & 0xF, paddr[12] & 0xF, (paddr[12] >> 4) & 0xF, paddr[11] & 0xF,
+					 (paddr[11] >> 4) & 0xF, paddr[10] & 0xF, (paddr[10] >> 4) & 0xF, paddr[9] & 0xF,
+					 (paddr[9] >> 4) & 0xF, paddr[8] & 0xF, (paddr[8] >> 4) & 0xF, paddr[7] & 0xF,
+					 (paddr[7] >> 4) & 0xF, paddr[6] & 0xF, (paddr[6] >> 4) & 0xF, paddr[5] & 0xF,
+					 (paddr[5] >> 4) & 0xF, paddr[4] & 0xF, (paddr[4] >> 4) & 0xF, paddr[3] & 0xF,
+					 (paddr[3] >> 4) & 0xF, paddr[2] & 0xF, (paddr[2] >> 4) & 0xF, paddr[1] & 0xF,
+					 (paddr[1] >> 4) & 0xF, paddr[0] & 0xF, (paddr[0] >> 4) & 0xF);
+		}
+	} break;
+	default:
+		goto errout;
+		break;
+	}
+
+	ptr = _dns_conf_get_ptr(ptr_domain);
+	if (ptr == NULL) {
+		goto errout;
+	}
+
+	safe_strncpy(ptr->hostname, hostname, DNS_MAX_CNAME_LEN);
+
+	return 0;
+
+errout:
+	return -1;
+}
+
+static void _config_ptr_table_destroy(void)
+{
+	struct dns_ptr *ptr = NULL;
+	struct hlist_node *tmp = NULL;
+	int i;
+
+	hash_for_each_safe(dns_ptr_table.ptr, i, tmp, ptr, node)
+	{
+		hlist_del_init(&ptr->node);
+		free(ptr);
+	}
+}
+
+static struct dns_hosts *_dns_conf_get_hosts(const char *hostname, int dns_type)
+{
+	uint32_t key = 0;
+	struct dns_hosts *host = NULL;
+	char hostname_lower[DNS_MAX_CNAME_LEN];
+
+	key = hash_string(to_lower_case(hostname_lower, hostname, DNS_MAX_CNAME_LEN));
+	key = jhash(&dns_type, sizeof(dns_type), key);
+	hash_for_each_possible(dns_hosts_table.hosts, host, node, key)
+	{
+		if (host->dns_type != dns_type) {
+			continue;
+		}
+		if (strncmp(host->domain, hostname_lower, DNS_MAX_CNAME_LEN) != 0) {
+			continue;
+		}
+
+		return host;
+	}
+
+	host = malloc(sizeof(*host));
+	if (host == NULL) {
+		goto errout;
+	}
+
+	safe_strncpy(host->domain, hostname_lower, DNS_MAX_CNAME_LEN);
+	host->dns_type = dns_type;
+	host->is_soa = 1;
+	hash_add(dns_hosts_table.hosts, &host->node, key);
+
+	return host;
+errout:
+	if (host) {
+		free(host);
+	}
+
+	return NULL;
+}
+
+static int _conf_host_add(const char *hostname, const char *ip, dns_hosts_type host_type)
+{
+	struct dns_hosts *host = NULL;
+	struct dns_hosts *host_other __attribute__((unused));
+	;
+	struct sockaddr_storage addr;
+	socklen_t addr_len = sizeof(addr);
+	int dns_type = 0;
+	int dns_type_other = 0;
+
+	if (getaddr_by_host(ip, (struct sockaddr *)&addr, &addr_len) != 0) {
+		goto errout;
+	}
+
+	switch (addr.ss_family) {
+	case AF_INET:
+		dns_type = DNS_T_A;
+		dns_type_other = DNS_T_AAAA;
+		break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			dns_type = DNS_T_A;
+			dns_type_other = DNS_T_AAAA;
+		} else {
+			dns_type = DNS_T_AAAA;
+			dns_type_other = DNS_T_A;
+		}
+	} break;
+	default:
+		goto errout;
+		break;
+	}
+
+	host = _dns_conf_get_hosts(hostname, dns_type);
+	if (host == NULL) {
+		goto errout;
+	}
+
+	/* add this to return SOA when addr is not exist */
+	host_other = _dns_conf_get_hosts(hostname, dns_type_other);
+
+	host->host_type = host_type;
+
+	switch (addr.ss_family) {
+	case AF_INET: {
+		struct sockaddr_in *addr_in;
+		addr_in = (struct sockaddr_in *)&addr;
+		memcpy(host->ipv4_addr, &addr_in->sin_addr.s_addr, 4);
+		host->is_soa = 0;
+	} break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			memcpy(host->ipv4_addr, addr_in6->sin6_addr.s6_addr + 12, 4);
+		} else {
+			memcpy(host->ipv6_addr, addr_in6->sin6_addr.s6_addr, 16);
+		}
+		host->is_soa = 0;
+	} break;
+	default:
+		goto errout;
+	}
+
+	dns_hosts_record_num++;
+	return 0;
+
+errout:
+	return -1;
+}
+
+static int _conf_dhcp_lease_dnsmasq_add(const char *file)
+{
+	FILE *fp = NULL;
+	char line[MAX_LINE_LEN];
+	char ip[DNS_MAX_IPLEN];
+	char hostname[DNS_MAX_CNAME_LEN];
+	int ret = 0;
+	int line_no = 0;
+	int filed_num;
+
+	fp = fopen(file, "r");
+	if (fp == NULL) {
+		tlog(TLOG_WARN, "open file %s error, %s", file, strerror(errno));
+		return 0;
+	}
+
+	line_no = 0;
+	while (fgets(line, MAX_LINE_LEN, fp)) {
+		line_no++;
+		filed_num = sscanf(line, "%*s %*s %64s %256s %*s", ip, hostname);
+		if (filed_num <= 0) {
+			continue;
+		}
+
+		if (strncmp(hostname, "*", DNS_MAX_CNAME_LEN) == 0) {
+			continue;
+		}
+
+		ret = _conf_host_add(hostname, ip, DNS_HOST_TYPE_DNSMASQ);
+		if (ret != 0) {
+			tlog(TLOG_WARN, "add host %s/%s at %d failed", hostname, ip, line_no);
+		}
+
+		ret = _conf_ptr_add(hostname, ip);
+		if (ret != 0) {
+			tlog(TLOG_WARN, "add ptr %s/%s at %d failed.", hostname, ip, line_no);
+		}
+	}
+
+	fclose(fp);
+
+	return 0;
+}
+
+static int _conf_dhcp_lease_dnsmasq_file(void *data, int argc, char *argv[])
+{
+	struct stat statbuf;
+
+	if (argc < 1) {
+		return -1;
+	}
+
+	safe_strncpy(dns_conf_dnsmasq_lease_file, argv[1], DNS_MAX_PATH);
+	if (_conf_dhcp_lease_dnsmasq_add(argv[1]) != 0) {
+		return -1;
+	}
+
+	if (stat(dns_conf_dnsmasq_lease_file, &statbuf) != 0) {
+		return 0;
+	}
+
+	dns_conf_dnsmasq_lease_file_time = statbuf.st_mtime;
+	return 0;
+}
+
+static int _conf_hosts_file(void *data, int argc, char *argv[])
+{
+	return 0;
+}
+
+static void _config_host_table_destroy(void)
+{
+	struct dns_hosts *host = NULL;
+	struct hlist_node *tmp = NULL;
+	int i;
+
+	hash_for_each_safe(dns_hosts_table.hosts, i, tmp, host, node)
+	{
+		hlist_del_init(&host->node);
+		free(host);
+	}
+
+	dns_hosts_record_num = 0;
+}
+
+int dns_server_check_update_hosts(void)
+{
+	struct stat statbuf;
+	time_t now;
+
+	if (dns_conf_dnsmasq_lease_file[0] == '\0') {
+		return -1;
+	}
+
+	if (stat(dns_conf_dnsmasq_lease_file, &statbuf) != 0) {
+		return -1;
+	}
+
+	if (dns_conf_dnsmasq_lease_file_time == statbuf.st_mtime) {
+		return -1;
+	}
+
+	time(&now);
+
+	if (now - statbuf.st_mtime < 30) {
+		return -1;
+	}
+
+	_config_ptr_table_destroy();
+	_config_host_table_destroy();
+
+	if (_conf_dhcp_lease_dnsmasq_add(dns_conf_dnsmasq_lease_file) != 0) {
+		return -1;
+	}
+
+	dns_conf_dnsmasq_lease_file_time = statbuf.st_mtime;
+	return 0;
+}
+
 static int _config_log_level(void *data, int argc, char *argv[])
 {
 	/* read log level and set */
@@ -1412,6 +1829,35 @@ static int _config_log_level(void *data, int argc, char *argv[])
 	return 0;
 }
 
+static void _config_setup_smartdns_domain(void)
+{
+	char hostname[DNS_MAX_CNAME_LEN];
+	/* get local host name */
+	if (getdomainname(hostname, DNS_MAX_CNAME_LEN) != 0) {
+		gethostname(hostname, DNS_MAX_CNAME_LEN);
+	}
+
+	/* get host name again */
+	if (strncmp(hostname, "(none)", DNS_MAX_CNAME_LEN) == 0) {
+		gethostname(hostname, DNS_MAX_CNAME_LEN);
+	}
+
+	/* if hostname is (none), return smartdns */
+	if (strncmp(hostname, "(none)", DNS_MAX_CNAME_LEN) == 0) {
+		safe_strncpy(hostname, "smartdns", DNS_MAX_CNAME_LEN);
+	}
+
+	if (hostname[0] != '\0') {
+		_config_domain_rule_flag_set(hostname, DOMAIN_FLAG_SMARTDNS_DOMAIN, 0);
+	}
+
+	if (dns_conf_server_name[0] != '\0') {
+		_config_domain_rule_flag_set(dns_conf_server_name, DOMAIN_FLAG_SMARTDNS_DOMAIN, 0);
+	}
+
+	_config_domain_rule_flag_set("smartdns", DOMAIN_FLAG_SMARTDNS_DOMAIN, 0);
+}
+
 static struct config_item _config_item[] = {
 	CONF_STRING("server-name", (char *)dns_conf_server_name, DNS_MAX_SERVER_NAME_LEN),
 	CONF_CUSTOM("bind", _config_bind_ip_udp, NULL),
@@ -1433,7 +1879,9 @@ static struct config_item _config_item[] = {
 	CONF_YESNO("serve-expired", &dns_conf_serve_expired),
 	CONF_INT("serve-expired-ttl", &dns_conf_serve_expired_ttl, 0, CONF_INT_MAX),
 	CONF_INT("serve-expired-reply-ttl", &dns_conf_serve_expired_reply_ttl, 0, CONF_INT_MAX),
+	CONF_INT("serve-expired-prefetch-time", &dns_conf_serve_expired_prefetch_time, 0, CONF_INT_MAX),
 	CONF_YESNO("dualstack-ip-selection", &dns_conf_dualstack_ip_selection),
+	CONF_YESNO("dualstack-ip-allow-force-AAAA", &dns_conf_dualstack_ip_allow_force_AAAA),
 	CONF_INT("dualstack-ip-selection-threshold", &dns_conf_dualstack_ip_selection_threshold, 0, 1000),
 	CONF_CUSTOM("log-level", _config_log_level, NULL),
 	CONF_STRING("log-file", (char *)dns_conf_log_file, DNS_MAX_PATH),
@@ -1447,15 +1895,22 @@ static struct config_item _config_item[] = {
 	CONF_INT("rr-ttl", &dns_conf_rr_ttl, 0, CONF_INT_MAX),
 	CONF_INT("rr-ttl-min", &dns_conf_rr_ttl_min, 0, CONF_INT_MAX),
 	CONF_INT("rr-ttl-max", &dns_conf_rr_ttl_max, 0, CONF_INT_MAX),
+	CONF_INT("rr-ttl-reply-max", &dns_conf_rr_ttl_reply_max, 0, CONF_INT_MAX),
+	CONF_INT("max-reply-ip-num", &dns_conf_max_reply_ip_num, 1, CONF_INT_MAX),
 	CONF_YESNO("force-AAAA-SOA", &dns_conf_force_AAAA_SOA),
+	CONF_YESNO("force-no-CNAME", &dns_conf_force_no_cname),
+	CONF_CUSTOM("force-qtype-SOA", _config_qtype_soa, NULL),
 	CONF_CUSTOM("blacklist-ip", _config_blacklist_ip, NULL),
 	CONF_CUSTOM("whitelist-ip", _conf_whitelist_ip, NULL),
 	CONF_CUSTOM("bogus-nxdomain", _conf_bogus_nxdomain, NULL),
 	CONF_CUSTOM("ignore-ip", _conf_ip_ignore, NULL),
 	CONF_CUSTOM("edns-client-subnet", _conf_edns_client_subnet, NULL),
 	CONF_CUSTOM("domain-rules", _conf_domain_rules, NULL),
+	CONF_CUSTOM("dnsmasq-lease-file", _conf_dhcp_lease_dnsmasq_file, NULL),
+	CONF_CUSTOM("hosts-file", _conf_hosts_file, NULL),
 	CONF_STRING("ca-file", (char *)&dns_conf_ca_file, DNS_MAX_PATH),
 	CONF_STRING("ca-path", (char *)&dns_conf_ca_path, DNS_MAX_PATH),
+	CONF_STRING("user", (char *)&dns_conf_user, sizeof(dns_conf_user)),
 	CONF_CUSTOM("conf-file", config_addtional_file, NULL),
 	CONF_END(),
 };
@@ -1477,10 +1932,15 @@ static int _conf_printf(const char *file, int lineno, int ret)
 
 int config_addtional_file(void *data, int argc, char *argv[])
 {
-	char *conf_file = argv[1];
+	char *conf_file;
 	char file_path[DNS_MAX_PATH];
 	char file_path_dir[DNS_MAX_PATH];
 
+	if (argc < 1) {
+		return -1;
+	}
+
+	conf_file = argv[1];
 	if (conf_file[0] != '/') {
 		safe_strncpy(file_path_dir, conf_get_conf_file(), DNS_MAX_PATH);
 		dirname(file_path_dir);
@@ -1518,7 +1978,12 @@ static int _dns_server_load_conf_init(void)
 	art_tree_init(&dns_conf_domain_rule);
 
 	hash_init(dns_ipset_table.ipset);
+	hash_init(dns_qtype_soa_table.qtype);
 	hash_init(dns_group_table.group);
+	hash_init(dns_hosts_table.hosts);
+	hash_init(dns_ptr_table.ptr);
+
+	_config_setup_smartdns_domain();
 
 	return 0;
 }
@@ -1530,6 +1995,9 @@ void dns_server_load_exit(void)
 	Destroy_Radix(dns_conf_address_rule.ipv6, _config_address_destroy, NULL);
 	_config_ipset_table_destroy();
 	_config_group_table_destroy();
+	_config_ptr_table_destroy();
+	_config_host_table_destroy();
+	_config_qtype_soa_table_destroy();
 }
 
 static int _dns_conf_speed_check_mode_verify(void)
@@ -1542,11 +2010,13 @@ static int _dns_conf_speed_check_mode_verify(void)
 	}
 
 	for (i = 0; i < DOMAIN_CHECK_NUM; i++) {
-		if (dns_conf_check_order.order[i] == DOMAIN_CHECK_ICMP) {
+		if (dns_conf_check_orders.orders[i].type == DOMAIN_CHECK_ICMP) {
 			for (j = i + 1; j < DOMAIN_CHECK_NUM; j++) {
-				dns_conf_check_order.order[j - 1] = dns_conf_check_order.order[j];
+				dns_conf_check_orders.orders[j - 1].type = dns_conf_check_orders.orders[j].type;
+				dns_conf_check_orders.orders[j - 1].tcp_port = dns_conf_check_orders.orders[j].tcp_port;
 			}
-			dns_conf_check_order.order[j - 1] = DOMAIN_CHECK_NONE;
+			dns_conf_check_orders.orders[j - 1].type = DOMAIN_CHECK_NONE;
+			dns_conf_check_orders.orders[j - 1].tcp_port = 0;
 			print_log = 1;
 		}
 	}
@@ -1558,13 +2028,33 @@ static int _dns_conf_speed_check_mode_verify(void)
 	return 0;
 }
 
+static int _dns_ping_cap_check(void)
+{
+	int has_ping = 0;
+	int has_raw_cap;
+
+	has_raw_cap = has_network_raw_cap();
+	has_ping = has_unprivileged_ping();
+	if (has_ping == 0) {
+		if (errno == EACCES && has_raw_cap == 0) {
+			tlog(TLOG_WARN, "unpriviledged ping is disabled, please enable by setting net.ipv4.ping_group_range");
+		}
+	}
+
+	if (has_ping == 1 || has_raw_cap == 1) {
+		dns_has_cap_ping = 1;
+	}
+
+	return 0;
+}
+
 static int _dns_conf_load_pre(void)
 {
 	if (_dns_server_load_conf_init() != 0) {
 		goto errout;
 	}
 
-	dns_has_cap_ping = has_network_raw_cap();
+	_dns_ping_cap_check();
 
 	return 0;
 

src/dns_conf.h

@@ -35,10 +35,12 @@ extern "C" {
 #define DNS_MAX_BIND_IP 16
 #define DNS_MAX_SERVERS 64
 #define DNS_MAX_SERVER_NAME_LEN 128
+#define DNS_MAX_PTR_LEN 128
 #define DNS_MAX_IPSET_NAMELEN 32
 #define DNS_GROUP_NAME_LEN 32
 #define DNS_NAX_GROUP_NUMBER 16
 #define DNS_MAX_IPLEN 64
+#define DNS_CONF_USRNAME_LEN 32
 #define DNS_MAX_SPKI_LEN 64
 #define DNS_MAX_URL_LEN 256
 #define DNS_MAX_PATH 1024
@@ -72,7 +74,7 @@ typedef enum {
 #define DOMAIN_CHECK_NONE 0
 #define DOMAIN_CHECK_ICMP 1
 #define DOMAIN_CHECK_TCP 2
-#define DOMAIN_CHECK_NUM 2
+#define DOMAIN_CHECK_NUM 3
 
 #define DOMAIN_FLAG_ADDR_SOA (1 << 0)
 #define DOMAIN_FLAG_ADDR_IPV4_SOA (1 << 1)
@@ -85,6 +87,7 @@ typedef enum {
 #define DOMAIN_FLAG_IPSET_IPV6_IGN (1 << 8)
 #define DOMAIN_FLAG_NAMESERVER_IGNORE (1 << 9)
 #define DOMAIN_FLAG_DUALSTACK_SELECT (1 << 10)
+#define DOMAIN_FLAG_SMARTDNS_DOMAIN (1 << 11)
 
 #define SERVER_FLAG_EXCLUDE_DEFAULT (1 << 0)
 
@@ -136,15 +139,53 @@ struct dns_server_groups {
 };
 
 struct dns_domain_check_order {
-	char order[DOMAIN_CHECK_NUM];
+	char type;
 	unsigned short tcp_port;
 };
 
+struct dns_domain_check_orders {
+	struct dns_domain_check_order orders[DOMAIN_CHECK_NUM];
+};
+
 struct dns_group_table {
 	DECLARE_HASHTABLE(group, 8);
 };
 extern struct dns_group_table dns_group_table;
 
+struct dns_ptr {
+	struct hlist_node node;
+	char ptr_domain[DNS_MAX_PTR_LEN];
+	char hostname[DNS_MAX_CNAME_LEN];
+};
+
+struct dns_ptr_table {
+	DECLARE_HASHTABLE(ptr, 16);
+};
+extern struct dns_ptr_table dns_ptr_table;
+
+typedef enum dns_hosts_type {
+	DNS_HOST_TYPE_HOST = 0,
+	DNS_HOST_TYPE_DNSMASQ = 1,
+} dns_hosts_type;
+
+struct dns_hosts {
+	struct hlist_node node;
+	char domain[DNS_MAX_CNAME_LEN];
+	dns_hosts_type host_type;
+	int dns_type;
+	int is_soa;	
+	union {
+		unsigned char ipv4_addr[DNS_RR_A_LEN];
+		unsigned char ipv6_addr[DNS_RR_AAAA_LEN];
+	};
+};
+
+struct dns_hosts_table {
+	DECLARE_HASHTABLE(hosts, 16);
+};
+extern struct dns_hosts_table dns_hosts_table;
+extern int dns_hosts_record_num;
+
 struct dns_servers {
 	char server[DNS_MAX_IPLEN];
 	unsigned short port;
@@ -203,6 +244,16 @@ struct dns_bind_ip {
 	const char *group;
 };
 
+struct dns_qtype_soa_list {
+	struct hlist_node node;
+	uint32_t qtypeid;
+};
+
+struct dns_qtype_soa_table {
+	DECLARE_HASHTABLE(qtype, 8);
+};
+extern struct dns_qtype_soa_table dns_qtype_soa_table;
+
 extern struct dns_bind_ip dns_conf_bind_ip[DNS_MAX_BIND_IP];
 extern int dns_conf_bind_ip_num;
 
@@ -211,6 +262,7 @@ extern int dns_conf_cachesize;
 extern int dns_conf_prefetch;
 extern int dns_conf_serve_expired;
 extern int dns_conf_serve_expired_ttl;
+extern int dns_conf_serve_expired_prefetch_time;
 extern int dns_conf_serve_expired_reply_ttl;
 extern struct dns_servers dns_conf_servers[DNS_MAX_SERVERS];
 extern int dns_conf_server_num;
@@ -226,7 +278,7 @@ extern char dns_conf_ca_path[DNS_MAX_PATH];
 extern char dns_conf_cache_file[DNS_MAX_PATH];
 extern int dns_conf_cache_persist;
 
-extern struct dns_domain_check_order dns_conf_check_order;
+extern struct dns_domain_check_orders dns_conf_check_orders;
 
 extern struct dns_server_groups dns_conf_server_groups[DNS_NAX_GROUP_NUMBER];
 extern int dns_conf_server_group_num;
@@ -242,14 +294,22 @@ extern art_tree dns_conf_domain_rule;
 extern struct dns_conf_address_rule dns_conf_address_rule;
 
 extern int dns_conf_dualstack_ip_selection;
+extern int dns_conf_dualstack_ip_allow_force_AAAA;
 extern int dns_conf_dualstack_ip_selection_threshold;
 
+extern int dns_conf_max_reply_ip_num;
+
 extern int dns_conf_rr_ttl;
+extern int dns_conf_rr_ttl_reply_max;
 extern int dns_conf_rr_ttl_min;
 extern int dns_conf_rr_ttl_max;
 extern int dns_conf_force_AAAA_SOA;
 extern int dns_conf_ipset_timeout_enable;
 
+extern int dns_conf_force_no_cname;
+
+extern char dns_conf_user[DNS_CONF_USRNAME_LEN];
+
 extern struct dns_edns_client_subnet dns_conf_ipv4_ecs;
 extern struct dns_edns_client_subnet dns_conf_ipv6_ecs;
 
@@ -259,6 +319,8 @@ void dns_server_load_exit(void);
 
 int dns_server_load_conf(const char *file);
 
+int dns_server_check_update_hosts(void);
+
 extern int config_addtional_file(void *data, int argc, char *argv[]);
 #ifdef __cpluscplus
 }

src/fast_ping.c

@@ -97,6 +97,7 @@ struct ping_host_struct {
 	FAST_PING_TYPE type;
 
 	void *userptr;
+	int error;
 	fast_ping_result ping_callback;
 	char host[PING_MAX_HOSTLEN];
 
@@ -129,6 +130,7 @@ struct fast_ping_struct {
 	unsigned short ident;
 
 	int epoll_fd;
+	int no_unprivileged_ping;
 	int fd_icmp;
 	struct ping_host_struct icmp_host;
 	int fd_icmp6;
@@ -386,11 +388,10 @@ static void _fast_ping_host_put(struct ping_host_struct *ping_host)
 		tv.tv_usec = 0;
 
 		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_END, &ping_host->addr, ping_host->addr_len,
-								 ping_host->seq, ping_host->ttl, &tv, ping_host->userptr);
+								 ping_host->seq, ping_host->ttl, &tv, ping_host->error, ping_host->userptr);
 	}
 
-	tlog(TLOG_DEBUG, "ping end, id %d", ping_host->sid);
-	// memset(ping_host, 0, sizeof(*ping_host));
+	tlog(TLOG_DEBUG, "ping %s end, id %d", ping_host->host, ping_host->sid);
 	ping_host->type = FAST_PING_END;
 	free(ping_host);
 }
@@ -414,7 +415,7 @@ static void _fast_ping_host_remove(struct ping_host_struct *ping_host)
 		tv.tv_usec = 0;
 
 		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_END, &ping_host->addr, ping_host->addr_len,
-								 ping_host->seq, ping_host->ttl, &tv, ping_host->userptr);
+								 ping_host->seq, ping_host->ttl, &tv, ping_host->error, ping_host->userptr);
 	}
 
 	_fast_ping_host_put(ping_host);
@@ -445,7 +446,7 @@ static int _fast_ping_sendping_v6(struct ping_host_struct *ping_host)
 				 (struct sockaddr *)&ping_host->addr, ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 			goto errout;
 		}
 
@@ -494,7 +495,7 @@ static int _fast_ping_sendping_v4(struct ping_host_struct *ping_host)
 				 ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
@@ -541,7 +542,7 @@ static int _fast_ping_sendping_udp(struct ping_host_struct *ping_host)
 	len = sendto(fd, &dns_head, sizeof(dns_head), 0, (struct sockaddr *)&ping_host->addr, ping_host->addr_len);
 	if (len < 0 || len != sizeof(dns_head)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
@@ -588,7 +589,7 @@ static int _fast_ping_sendping_tcp(struct ping_host_struct *ping_host)
 	if (connect(fd, (struct sockaddr *)&ping_host->addr, ping_host->addr_len) != 0) {
 		if (errno != EINPROGRESS) {
 			char ping_host_name[PING_MAX_HOSTLEN];
-			if (errno == ENETUNREACH || errno == EINVAL) {
+			if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 				goto errout;
 			}
 
@@ -644,6 +645,7 @@ static int _fast_ping_sendping(struct ping_host_struct *ping_host)
 	ping_host->send = 1;
 
 	if (ret != 0) {
+		ping_host->error = errno;
 		return ret;
 	}
 
@@ -663,21 +665,34 @@ static int _fast_ping_create_icmp_sock(FAST_PING_TYPE type)
 
 	switch (type) {
 	case FAST_PING_ICMP:
-		fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+		if (ping.no_unprivileged_ping == 0) {
+			fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+		} else {
+			fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+			if (fd > 0) {
+				_fast_ping_install_filter_v4(fd);
+			}
+		}
 		if (fd < 0) {
 			tlog(TLOG_ERROR, "create icmp socket failed, %s\n", strerror(errno));
 			goto errout;
 		}
-		_fast_ping_install_filter_v4(fd);
 		icmp_host = &ping.icmp_host;
 		break;
 	case FAST_PING_ICMP6:
-		fd = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+		if (ping.no_unprivileged_ping == 0) {
+			fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6);
+		} else {
+			fd = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+			if (fd > 0) {
+				_fast_ping_install_filter_v6(fd);
+			}
+		}
+
 		if (fd < 0) {
 			tlog(TLOG_ERROR, "create icmp socket failed, %s\n", strerror(errno));
 			goto errout;
 		}
-		_fast_ping_install_filter_v6(fd);
 		setsockopt(fd, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &on, sizeof(on));
 		setsockopt(fd, IPPROTO_IPV6, IPV6_2292HOPLIMIT, &on, sizeof(on));
 		setsockopt(fd, IPPROTO_IPV6, IPV6_HOPLIMIT, &on, sizeof(on));
@@ -848,13 +863,15 @@ errout:
 
 static void _fast_ping_print_result(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 									struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl, struct timeval *tv,
-									void *userptr)
+									int error, void *userptr)
 {
 	if (result == PING_RESULT_RESPONSE) {
 		double rtt = tv->tv_sec * 1000.0 + tv->tv_usec / 1000.0;
 		tlog(TLOG_INFO, "from %15s: seq=%d ttl=%d time=%.3f\n", host, seqno, ttl, rtt);
 	} else if (result == PING_RESULT_TIMEOUT) {
 		tlog(TLOG_INFO, "from %15s: seq=%d timeout\n", host, seqno);
+	} else if (result == PING_RESULT_ERROR) {
+		tlog(TLOG_DEBUG, "from %15s: error is %s\n", host, strerror(error));
 	} else if (result == PING_RESULT_END) {
 		fast_ping_stop(ping_host);
 	}
@@ -1041,7 +1058,6 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 
 	ret = _fast_ping_get_addr_by_type(type, ip_str, port, &gai, &ping_type);
 	if (ret != 0) {
-		tlog(TLOG_ERROR, "get addr by type failed, host: %s", host);
 		goto errout;
 	}
 
@@ -1097,6 +1113,8 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 	_fast_ping_host_put(ping_host);
 	return ping_host;
 errout_remove:
+	ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_ERROR, &ping_host->addr, ping_host->addr_len,
+							 ping_host->seq, ping_host->ttl, 0, ping_host->error, ping_host->userptr);
 	fast_ping_stop(ping_host);
 	_fast_ping_host_put(ping_host);
 	ping_host = NULL;
@@ -1168,9 +1186,11 @@ static struct fast_ping_packet *_fast_ping_icmp6_packet(struct ping_host_struct
 		return NULL;
 	}
 
-	if (icmp6->icmp6_id != ping.ident) {
-		tlog(TLOG_ERROR, "ident failed, %d:%d", icmp6->icmp6_id, ping.ident);
-		return NULL;
+	if (ping.no_unprivileged_ping) {
+		if (icmp6->icmp6_id != ping.ident) {
+			tlog(TLOG_ERROR, "ident failed, %d:%d", icmp6->icmp6_id, ping.ident);
+			return NULL;
+		}
 	}
 
 	return packet;
@@ -1185,11 +1205,6 @@ static struct fast_ping_packet *_fast_ping_icmp_packet(struct ping_host_struct *
 	int hlen;
 	int icmp_len;
 
-	if (ip->ip_p != IPPROTO_ICMP) {
-		tlog(TLOG_ERROR, "ip type faild, %d:%d", ip->ip_p, IPPROTO_ICMP);
-		return NULL;
-	}
-
 	hlen = ip->ip_hl << 2;
 	packet = (struct fast_ping_packet *)(packet_data + hlen);
 	icmp = &packet->icmp;
@@ -1201,15 +1216,23 @@ static struct fast_ping_packet *_fast_ping_icmp_packet(struct ping_host_struct *
 		return NULL;
 	}
 
+	if (ping.no_unprivileged_ping) {
+		if (ip->ip_p != IPPROTO_ICMP) {
+			tlog(TLOG_ERROR, "ip type faild, %d:%d", ip->ip_p, IPPROTO_ICMP);
+			return NULL;
+		}
+
+		if (icmp->icmp_id != ping.ident) {
+			tlog(TLOG_ERROR, "ident failed, %d:%d", icmp->icmp_id, ping.ident);
+			return NULL;
+		}
+	}
+
 	if (icmp->icmp_type != ICMP_ECHOREPLY) {
 		tlog(TLOG_DEBUG, "icmp type faild, %d:%d", icmp->icmp_type, ICMP_ECHOREPLY);
 		return NULL;
 	}
 
-	if (icmp->icmp_id != ping.ident) {
-		tlog(TLOG_ERROR, "ident failed, %d:%d", icmp->icmp_id, ping.ident);
-		return NULL;
-	}
 
 	return packet;
 }
@@ -1315,7 +1338,7 @@ static int _fast_ping_process_icmp(struct ping_host_struct *ping_host, struct ti
 	if (recv_ping_host->ping_callback) {
 		recv_ping_host->ping_callback(recv_ping_host, recv_ping_host->host, PING_RESULT_RESPONSE, &recv_ping_host->addr,
 									  recv_ping_host->addr_len, recv_ping_host->seq, recv_ping_host->ttl, &tvresult,
-									  recv_ping_host->userptr);
+									  ping_host->error, recv_ping_host->userptr);
 	}
 
 	recv_ping_host->send = 0;
@@ -1349,7 +1372,8 @@ static int _fast_ping_process_tcp(struct ping_host_struct *ping_host, struct epo
 	tv_sub(&tvresult, tvsend);
 	if (ping_host->ping_callback) {
 		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_RESPONSE, &ping_host->addr,
-								 ping_host->addr_len, ping_host->seq, ping_host->ttl, &tvresult, ping_host->userptr);
+								 ping_host->addr_len, ping_host->seq, ping_host->ttl, &tvresult, ping_host->error,
+								 ping_host->userptr);
 	}
 
 	ping_host->send = 0;
@@ -1445,7 +1469,7 @@ static int _fast_ping_process_udp(struct ping_host_struct *ping_host, struct tim
 	if (recv_ping_host->ping_callback) {
 		recv_ping_host->ping_callback(recv_ping_host, recv_ping_host->host, PING_RESULT_RESPONSE, &recv_ping_host->addr,
 									  recv_ping_host->addr_len, recv_ping_host->seq, recv_ping_host->ttl, &tvresult,
-									  recv_ping_host->userptr);
+									  ping_host->error, recv_ping_host->userptr);
 	}
 
 	recv_ping_host->send = 0;
@@ -1553,7 +1577,7 @@ static void _fast_ping_period_run(void)
 		millisecond = interval.tv_sec * 1000 + interval.tv_usec / 1000;
 		if (millisecond >= ping_host->timeout && ping_host->send == 1) {
 			ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_TIMEOUT, &ping_host->addr,
-									 ping_host->addr_len, ping_host->seq, ping_host->ttl, &interval,
+									 ping_host->addr_len, ping_host->seq, ping_host->ttl, &interval, ping_host->error,
 									 ping_host->userptr);
 			ping_host->send = 0;
 		}
@@ -1654,6 +1678,7 @@ int fast_ping_init(void)
 	pthread_mutex_init(&ping.lock, NULL);
 	hash_init(ping.addrmap);
 	ping.epoll_fd = epollfd;
+	ping.no_unprivileged_ping = !has_unprivileged_ping();
 	ping.ident = (getpid() & 0XFFFF);
 	ping.run = 1;
 	ret = pthread_create(&ping.tid, &attr, _fast_ping_work, NULL);

src/fast_ping.h

@@ -34,13 +34,14 @@ typedef enum {
 typedef enum {
 	PING_RESULT_RESPONSE = 1,
 	PING_RESULT_TIMEOUT = 2,
-	PING_RESULT_END = 3,
+	PING_RESULT_ERROR = 3,
+	PING_RESULT_END = 4,
 } FAST_PING_RESULT;
 
 struct ping_host_struct;
 typedef void (*fast_ping_result)(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 								 struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl, struct timeval *tv,
-								 void *userptr);
+								 int error, void *userptr);
 
 /* start ping */
 struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int count, int interval, int timeout,

src/smartdns.c

@@ -31,12 +31,15 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
+#include <linux/capability.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
+#include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <ucontext.h>
@@ -49,6 +52,77 @@
 
 static int verbose_screen;
 
+int capget(struct __user_cap_header_struct *header, struct __user_cap_data_struct *cap);
+int capset(struct __user_cap_header_struct *header, struct __user_cap_data_struct *cap);
+
+int get_uid_gid(int *uid, int *gid)
+{
+	struct passwd *result = NULL;
+	struct passwd pwd;
+	char *buf = NULL;
+	size_t bufsize;
+	int ret = -1;
+
+	if (dns_conf_user[0] == '\0') {
+		return -1;
+	}
+
+	bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
+	if (bufsize == -1) {
+		bufsize = 1024 * 16;
+	}
+
+	buf = malloc(bufsize);
+	if (buf == NULL) {
+		goto out;
+	}
+
+	ret = getpwnam_r(dns_conf_user, &pwd, buf, bufsize, &result);
+	if (ret != 0) {
+		return -1;
+	}
+
+	*uid = result->pw_uid;
+	*gid = result->pw_gid;
+
+out:
+	if (buf) {
+		free(buf);
+	}
+
+	return ret;
+}
+
+int drop_root_privilege(void)
+{
+	struct __user_cap_data_struct cap;
+	struct __user_cap_header_struct header;
+	header.version = _LINUX_CAPABILITY_VERSION;
+	header.pid = 0;
+	int uid;
+	int gid;
+
+	if (get_uid_gid(&uid, &gid) != 0) {
+		return -1;
+	}
+
+	if (capget(&header, &cap) < 0) {
+		return -1;
+	}
+
+	prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
+	cap.effective |= (1 << CAP_NET_RAW | 1 << CAP_NET_ADMIN);
+	cap.permitted |= (1 << CAP_NET_RAW | 1 << CAP_NET_ADMIN);
+	setuid(uid);
+	setgid(gid);
+	if (capset(&header, &cap) < 0) {
+		return -1;
+	}
+
+	prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0);
+	return 0;
+}
+
 static void _help(void)
 {
 	/* clang-format off */
@@ -322,6 +396,7 @@ static int _smartdns_run(void)
 
 static void _smartdns_exit(void)
 {
+	tlog(TLOG_INFO, "smartdns starting exit...");
 	dns_server_exit();
 	dns_client_exit();
 	fast_ping_exit();
@@ -332,6 +407,7 @@ static void _smartdns_exit(void)
 
 static void _sig_exit(int signo)
 {
+	tlog(TLOG_INFO, "start stop smartdns");
 	dns_server_stop();
 }
 
@@ -393,10 +469,15 @@ int main(int argc, char *argv[])
 	char config_file[MAX_LINE_LEN];
 	char pid_file[MAX_LINE_LEN];
 	int signal_ignore = 0;
+	sigset_t empty_sigblock;
 
 	safe_strncpy(config_file, SMARTDNS_CONF_FILE, MAX_LINE_LEN);
 	safe_strncpy(pid_file, SMARTDNS_PID_FILE, MAX_LINE_LEN);
 
+	/* patch for Asus router:  unblock all signal*/
+	sigemptyset(&empty_sigblock);
+    sigprocmask(SIG_SETMASK, &empty_sigblock, NULL);
+
 	while ((opt = getopt(argc, argv, "fhc:p:Svx")) != -1) {
 		switch (opt) {
 		case 'f':
@@ -445,6 +526,8 @@ int main(int argc, char *argv[])
 		goto errout;
 	}
 
+	drop_root_privilege();
+
 	ret = _smartdns_init();
 	if (ret != 0) {
 		usleep(100000);

src/tlog.c

@@ -19,6 +19,7 @@
 #include <string.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
+#include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -45,6 +46,14 @@
 
 #define TLOG_SEGMENT_MAGIC 0xFF446154
 
+struct linux_dirent64 {
+    unsigned long long d_ino;
+    long long d_off;
+    unsigned short d_reclen;
+    unsigned char d_type;
+    char d_name[256];
+};
+
 struct tlog_log {
     char *buff;
     int buffsize;
@@ -317,7 +326,7 @@ int tlog_localtime(struct tlog_time *tm)
     return _tlog_gettime(tm);
 }
 
-tlog_log *tlog_get_root()
+tlog_log *tlog_get_root(void)
 {
     return tlog.root;
 }
@@ -504,9 +513,12 @@ static int _tlog_vprintf(struct tlog_log *log, vprint_callback print_callback, v
     if (len <= 0) {
         return -1;
     } else if (len >= log->max_line_size) {
-        strncpy(buff, "[LOG TOO LONG, DISCARD]\n", sizeof(buff));
-        buff[sizeof(buff) - 1] = '\0';
-        len = strnlen(buff, sizeof(buff));
+        len = log->max_line_size;
+        buff[len - 1] = '\0';
+        buff[len - 2] = '\n';
+        buff[len - 3] = '.';
+        buff[len - 4] = '.';
+        buff[len - 5] = '.';
     }
 
     pthread_mutex_lock(&tlog.lock);
@@ -919,47 +931,67 @@ static void _tlog_close_all_fd_by_res(void)
     }
 }
 
+static int _tlog_str_to_int(const char *str)
+{
+    int num = 0;
+
+    while (*str >= '0' && *str <= '9') {
+        num = num * 10 + (*str - '0');
+        ++str;
+    }
+
+    if (*str) {
+        return -1;
+    }
+
+    return num;
+}
+
 static void _tlog_close_all_fd(void)
 {
-    char path_name[PATH_MAX];
-    DIR *dir = NULL;
-    struct dirent *ent;
+#if defined(__linux__)
     int dir_fd = -1;
 
-    snprintf(path_name, sizeof(path_name), "/proc/self/fd/");
-    dir = opendir(path_name);
-    if (dir == NULL) {
+    dir_fd = open("/proc/self/fd/", O_RDONLY | O_DIRECTORY);
+    if (dir_fd < 0) {
         goto errout;
     }
 
-    dir_fd = dirfd(dir);
+    char buffer[sizeof(struct linux_dirent64)];
+    int bytes;
+    while ((bytes = syscall(SYS_getdents64, dir_fd,
+                (struct linux_dirent64 *)buffer,
+                sizeof(buffer)))
+        > 0) {
+        struct linux_dirent64 *entry;
+        int offset;
 
-    while ((ent = readdir(dir)) != NULL) {
-        int fd = atoi(ent->d_name);
-        if (fd < 0 || dir_fd == fd) {
-            continue;
-        }
-        switch (fd) {
-        case STDIN_FILENO:
-        case STDOUT_FILENO:
-        case STDERR_FILENO:
-            continue;
-            break;
-        default:
-            break;
-        }
+        for (offset = 0; offset < bytes; offset += entry->d_reclen) {
+            int fd;
+            entry = (struct linux_dirent64 *)(buffer + offset);
+            if ((fd = _tlog_str_to_int(entry->d_name)) < 0) {
+                continue;
+            }
 
-        close(fd);
+            if (fd == dir_fd || fd == STDIN_FILENO || fd == STDOUT_FILENO || fd == STDERR_FILENO) {
+                continue;
+            }
+            close(fd);
+        }
     }
 
-    closedir(dir);
+    close(dir_fd);
+
+    if (bytes < 0) {
+        goto errout;
+    }
 
     return;
 errout:
-    if (dir) {
-        closedir(dir);
+    if (dir_fd > 0) {
+        close(dir_fd);
     }
-
+#endif
     _tlog_close_all_fd_by_res();
     return;
 }
@@ -1395,6 +1427,35 @@ static int _tlog_root_write_log(struct tlog_log *log, const char *buff, int buff
     return tlog.output_func(&empty_info.info, buff, bufflen, tlog_get_private(log));
 }
 
+static void tlog_wait_zip_fini(void)
+{
+    tlog_log *next;
+    if (tlog.root == NULL) {
+        return;
+    }
+
+    int wait_zip = 1;
+    int time_out = 0;
+    while (wait_zip) {
+        wait_zip = 0;
+        time_out++;
+        next = tlog.log;
+        while (next) {
+            if (next->zip_pid > 0 && wait_zip == 0) {
+                wait_zip = 1;
+                usleep(1000);
+            }
+
+            if (kill(next->zip_pid, 0) != 0 || time_out >= 5000) {
+                next->zip_pid = -1;
+            }
+            next = next->next;
+        }
+    }
+
+    return;
+}
+
 static void *_tlog_work(void *arg)
 {
     int log_len = 0;
@@ -1408,6 +1469,9 @@ static void *_tlog_work(void *arg)
 
     unused = arg;
 
+    // for child process
+    tlog_wait_zip_fini();
+
     while (1) {
         log_len = 0;
         log_extlen = 0;
@@ -1680,6 +1744,12 @@ static void tlog_fork_prepare(void)
     }
 
     pthread_mutex_lock(&tlog.lock);
+    tlog_log *next;
+    next = tlog.log;
+    while (next) {
+        next->multi_log = 1;
+        next = next->next;
+    }
 }
 
 static void tlog_fork_parent(void)
@@ -1699,6 +1769,16 @@ static void tlog_fork_child(void)
         return;
     }
 
+    next = tlog.log;
+    while (next) {
+        next->start = 0;
+        next->end = 0;
+        next->ext_end = 0;
+        next->dropped = 0;
+        next->filesize = 0;
+        next = next->next;
+    }
+
     pthread_attr_init(&attr);
     int ret = pthread_create(&tlog.tid, &attr, _tlog_work, NULL);
     if (ret != 0) {
@@ -1786,6 +1866,7 @@ void tlog_exit(void)
         pthread_cond_signal(&tlog.cond);
         pthread_mutex_unlock(&tlog.lock);
         pthread_join(tlog.tid, &ret);
+        tlog.tid = 0;
     }
 
     tlog.root = NULL;
@@ -1795,4 +1876,7 @@ void tlog_exit(void)
 
     pthread_cond_destroy(&tlog.cond);
     pthread_mutex_destroy(&tlog.lock);
+
+    tlog_format = NULL;
+    tlog.is_wait = 0;
 }

src/tlog.h

@@ -78,7 +78,9 @@ level: Current log Levels
 format: Log formats
 */
 #ifndef BASE_FILE_NAME
-#define BASE_FILE_NAME __FILE__
+#define BASE_FILE_NAME                                                     \
+  (__builtin_strrchr(__FILE__, '/') ? __builtin_strrchr(__FILE__, '/') + 1 \
+                                    : __FILE__)
 #endif
 #define tlog(level, format, ...) tlog_ext(level, BASE_FILE_NAME, __LINE__, __func__, NULL, format, ##__VA_ARGS__)
 

src/util.c

@@ -28,6 +28,7 @@
 #include <fcntl.h>
 #include <inttypes.h>
 #include <linux/capability.h>
+#include <linux/limits.h>
 #include <linux/netlink.h>
 #include <netinet/tcp.h>
 #include <openssl/crypto.h>
@@ -132,7 +133,7 @@ errout:
 	return NULL;
 }
 
-int getaddr_by_host(char *host, struct sockaddr *addr, socklen_t *addr_len)
+int getaddr_by_host(const char *host, struct sockaddr *addr, socklen_t *addr_len)
 {
 	struct addrinfo hints;
 	struct addrinfo *result = NULL;
@@ -472,6 +473,31 @@ char *reverse_string(char *output, const char *input, int len, int to_lower_case
 	return begin;
 }
 
+char *to_lower_case(char *output, const char *input, int len)
+{
+	char *begin = output;
+	int i = 0;
+	if (len <= 0) {
+		*output = 0;
+		return output;
+	}
+
+	len--;
+	while (i < len && *(input + i) != '\0') {
+		*output = *(input + i);
+		if (*output >= 'A' && *output <= 'Z') {
+			/* To lower case */
+			*output = *output + 32;
+		}
+		output++;
+		i++;
+	}
+
+	*output = 0;
+
+	return begin;
+}
+
 static inline void _ipset_add_attr(struct nlmsghdr *netlink_head, uint16_t type, size_t len, const void *data)
 {
 	struct ipset_netlink_attr *attr = (void *)netlink_head + NETLINK_ALIGN(netlink_head->nlmsg_len);
@@ -517,6 +543,7 @@ static int _ipset_operate(const char *ipsetname, const unsigned char addr[], int
 	ssize_t rc;
 	int af = 0;
 	static const struct sockaddr_nl snl = {.nl_family = AF_NETLINK};
+	uint32_t expire;
 
 	if (addr_len != IPV4_ADDR_LEN && addr_len != IPV6_ADDR_LEN) {
 		errno = EINVAL;
@@ -571,8 +598,8 @@ static int _ipset_operate(const char *ipsetname, const unsigned char addr[], int
 	nested[1]->len = (void *)buffer + NETLINK_ALIGN(netlink_head->nlmsg_len) - (void *)nested[1];
 
 	if (timeout > 0 && _ipset_support_timeout(ipsetname) == 0) {
-		timeout = htonl(timeout);
-		_ipset_add_attr(netlink_head, IPSET_ATTR_TIMEOUT | NLA_F_NET_BYTEORDER, sizeof(timeout), &timeout);
+		expire = htonl(timeout);
+		_ipset_add_attr(netlink_head, IPSET_ATTR_TIMEOUT | NLA_F_NET_BYTEORDER, sizeof(expire), &expire);
 	}
 
 	nested[0]->len = (void *)buffer + NETLINK_ALIGN(netlink_head->nlmsg_len) - (void *)nested[0];
@@ -607,15 +634,22 @@ int ipset_del(const char *ipsetname, const unsigned char addr[], int addr_len)
 
 unsigned char *SSL_SHA256(const unsigned char *d, size_t n, unsigned char *md)
 {
-	SHA256_CTX c;
 	static unsigned char m[SHA256_DIGEST_LENGTH];
 
 	if (md == NULL)
 		md = m;
-	SHA256_Init(&c);
-	SHA256_Update(&c, d, n);
-	SHA256_Final(md, &c);
-	OPENSSL_cleanse(&c, sizeof(c));
+
+	EVP_MD_CTX* ctx = EVP_MD_CTX_create();
+	if (ctx == NULL) {
+		return NULL;
+	}
+
+	EVP_MD_CTX_init(ctx);
+	EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
+	EVP_DigestUpdate(ctx, d, n);
+	EVP_DigestFinal_ex(ctx, m, NULL);
+	EVP_MD_CTX_destroy(ctx);
+
 	return (md);
 }
 
@@ -736,7 +770,11 @@ void SSL_CRYPTO_thread_setup(void)
 		pthread_mutex_init(&(lock_cs[i]), NULL);
 	}
 
+#if OPENSSL_API_COMPAT < 0x10000000
 	CRYPTO_set_id_callback(_pthreads_thread_id);
+#else
+	CRYPTO_THREADID_set_callback(_pthreads_thread_id);
+#endif
 	CRYPTO_set_locking_callback(_pthreads_locking_callback);
 }
 
@@ -972,6 +1010,25 @@ int has_network_raw_cap(void)
 	return 1;
 }
 
+int has_unprivileged_ping(void)
+{
+	int fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+	if (fd < 0) {
+		return 0;
+	}
+
+	close(fd);
+
+	fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6);
+	if (fd < 0) {
+		return 0;
+	}
+
+	close(fd);
+
+	return 1;
+}
+
 int set_sock_keepalive(int fd, int keepidle, int keepinterval, int keepcnt)
 {
 	const int yes = 1;
@@ -1036,6 +1093,7 @@ void print_stack(void)
 {
 	const size_t max_buffer = 30;
 	void *buffer[max_buffer];
+	int idx = 0;
 
 	struct backtrace_state state = {buffer, buffer + max_buffer};
 	_Unwind_Backtrace(unwind_callback, &state);
@@ -1045,7 +1103,7 @@ void print_stack(void)
 	}
 	
 	tlog(TLOG_FATAL, "Stack:");
-	for (int idx = 0; idx < frame_num; ++idx) {
+	for (idx = 0; idx < frame_num; ++idx) {
 		const void *addr = buffer[idx];
 		const char *symbol = "";
 
@@ -1058,4 +1116,26 @@ void print_stack(void)
 		void *offset = (void *)((char *)(addr) - (char *)(info.dli_fbase));
 		tlog(TLOG_FATAL, "#%.2d: %p %s from %s+%p", idx + 1, addr, symbol, info.dli_fname, offset);
 	}
+}
+
+int write_file(const char *filename, void *data, int data_len)
+{
+	int fd = open(filename, O_WRONLY|O_CREAT, 0644);
+	if (fd < 0) {
+		return -1;
+	}
+
+	int len = write(fd, data, data_len);
+	if (len < 0) {
+		goto errout;
+	}
+
+	close(fd);
+	return 0;
+errout:
+	if (fd > 0) {
+		close(fd);
+	}
+
+	return -1;
 }

src/util.h

@@ -49,7 +49,7 @@ unsigned long get_tick_count(void);
 
 char *gethost_by_addr(char *host, int maxsize, struct sockaddr *addr);
 
-int getaddr_by_host(char *host, struct sockaddr *addr, socklen_t *addr_len);
+int getaddr_by_host(const char *host, struct sockaddr *addr, socklen_t *addr_len);
 
 int getsocknet_inet(int fd, struct sockaddr *addr, socklen_t *addr_len);
 
@@ -65,6 +65,8 @@ int set_fd_nonblock(int fd, int nonblock);
 
 char *reverse_string(char *output, const char *input, int len, int to_lower_case);
 
+char *to_lower_case(char *output, const char *input, int len);
+
 void print_stack(void);
 
 int ipset_add(const char *ipsetname, const unsigned char addr[], int addr_len, unsigned long timeout);
@@ -102,6 +104,8 @@ int is_numeric(const char *str);
 
 int has_network_raw_cap(void);
 
+int has_unprivileged_ping(void);
+
 int set_sock_keepalive(int fd, int keepidle, int keepinterval, int keepcnt);
 
 int set_sock_lingertime(int fd, int time);
@@ -110,6 +114,8 @@ uint64_t get_free_space(const char *path);
 
 void print_stack(void);
 
+int write_file(const char *filename, void *data, int data_len);
+
 #ifdef __cplusplus
 }
 #endif /*__cplusplus */

systemd/smartdns.service

@@ -1,19 +0,0 @@
-[Unit]
-Description=SmartDNS Server
-After=network.target 
-StartLimitBurst=0
-StartLimitIntervalSec=60
-
-[Service]
-Type=forking
-PIDFile=/var/run/smartdns.pid
-EnvironmentFile=/etc/default/smartdns
-ExecStart=/usr/sbin/smartdns -p /var/run/smartdns.pid $SMART_DNS_OPTS 
-KillMode=process
-Restart=always
-RestartSec=2
-TimeoutStopSec=5
-
-[Install]
-WantedBy=multi-user.target
-Alias=smartdns.service

systemd/smartdns.service.in

@@ -9,10 +9,9 @@ Type=forking
 PIDFile=@RUNSTATEDIR@/smartdns.pid
 EnvironmentFile=@SYSCONFDIR@/default/smartdns
 ExecStart=@SBINDIR@/smartdns -p @RUNSTATEDIR@/smartdns.pid $SMART_DNS_OPTS 
-KillMode=process
 Restart=always
 RestartSec=2
-TimeoutStopSec=5
+TimeoutStopSec=15
 
 [Install]
 WantedBy=multi-user.target