server: fix server not exit issue on asus router

security: support dropping root, and no root privileges required for ping
iniscript: Make sure the cache has enough time to save to disk
2022-07-02 13:26:58 +08:00 · 2022-07-01 23:37:24 +08:00 · 2022-07-01 22:38:37 +08:00 · 2022-06-28 22:10:42 +08:00 · 2022-06-28 22:01:14 +08:00 · 2022-06-26 18:49:17 +08:00
29 changed files with 4149 additions and 1541 deletions
--- a/53
+++ b/53
@@ -1,18 +1,39 @@
- FROM debian:buster-slim
+FROM ubuntu:latest as smartdns-builder
+LABEL previous-stage=smartdns-builder
+COPY . /smartdns/
+RUN apt update && \
+    apt install -y perl wget make musl-tools musl-dev && \
+    OPENSSL_VER=1.1.1f && \
+    mkdir /build -p && \
+    ln -s /usr/include/linux /usr/include/$(uname -m)-linux-musl && \
+    ln -s /usr/include/asm-generic /usr/include/$(uname -m)-linux-musl && \
+    ln -s /usr/include/$(uname -m)-linux-gnu/asm /usr/include/$(uname -m)-linux-musl && \
+    cd /build && \
+    wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_${OPENSSL_VER}.orig.tar.gz && \
+    tar xf openssl_${OPENSSL_VER}.orig.tar.gz && \
+    cd openssl-${OPENSSL_VER} && \
+    export CC=musl-gcc && \
+    if [ "$(uname -m)" = "aarch64" ]; then \
+        ./config --prefix=/opt/build no-tests -mno-outline-atomics ; \
+    else \ 
+        ./config --prefix=/opt/build no-tests; \
+    fi && \
+    make all -j8 && make install_sw && \
+    cd /smartdns && \
+    export CFLAGS="-I /opt/build/include" && \
+    export LDFLAGS="-L /opt/build/lib" && \
+    sh ./package/build-pkg.sh --platform linux --arch `dpkg --print-architecture` --static && \
+    mkdir /release -p && \
+    cd /smartdns/package && tar xf *.tar.gz && \
+    cp /smartdns/package/smartdns/etc /release/ -a && \
+    cp /smartdns/package/smartdns/usr /release/ -a && \
+    chmod +x /release/etc/init.d/smartdns && \
+    mkdir /release/var/log/ /release/var/run/ -p && \
+    rm -fr /build /smartdns

- RUN apt update && \
-     apt install -y git make gcc libssl-dev && \
-     git clone https://github.com/pymumu/smartdns.git --depth 1 && \
-     cd smartdns && \
-     sh ./package/build-pkg.sh --platform debian --arch `dpkg --print-architecture` && \
-     dpkg -i package/*.deb && \
-     cd / && \
-     rm -rf smartdns/ && \
-     apt autoremove -y git make gcc libssl-dev && \
-     apt clean && \
-     rm -rf /var/lib/apt/lists/*
+FROM busybox:latest
+COPY --from=smartdns-builder /release/ /
+EXPOSE 53/udp
+VOLUME "/etc/smartdns/"

- EXPOSE 53/udp
- VOLUME "/etc/smartdns/"
-
- CMD ["/usr/sbin/smartdns", "-f"]
+CMD ["/usr/sbin/smartdns", "-f", "-x"]
--- a/ReadMe.md
+++ b/ReadMe.md
@@ -311,8 +311,6 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
     
     * **检测上游服务是否配置成功**
       
-       * 方法一
-         
         执行
         
         ```shell
@@ -329,22 +327,24 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
         Non-authoritative answer:
         smartdns        name = smartdns.
         ```
-       
-       * 方法二
-         
-         使用 `nslookup` 查询域名（例如 `www.baidu.com`），查看结果中 IP 地址是否**只有一个**，如有多个 IP 地址返回，则表示未生效，请多尝试几个域名检查。
-         
+
+         或执行
+
         ```shell
-         $ nslookup www.baidu.com 192.168.1.1
-         Server:         192.168.1.1
-         Address:        192.168.1.1#53
-         
-         Non-authoritative answer:
-         www.baidu.com   canonical name = www.a.shifen.com.
-         Name:   www.a.shifen.com
-         Address: 14.215.177.38
+         $ nslookup smartdns
         ```

+         查看命令结果是否有解析出路由器的IP地址，如果是则表示生效。
+
+         或执行
+
+         ```shell
+         ping smartdns.
+         ```
+
+         检测ping是否解析对应主机的IP地址。
+
+
 4. 启动服务
   
    勾选配置页面中的 `Enable（启用）`来启动 SmartDNS。
@@ -550,49 +550,52 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms

 | 键名 | 功能说明 | 默认值 | 可用值/要求 | 举例 |
 | :--- | :--- | :--- | :--- | :--- |
-| `server-name` | DNS 服务器名称 | 操作系统主机名 / `smartdns` | 符合主机名规格的字符串 | `server-name smartdns` |
-| `bind` | DNS 监听端口号  | `[::]:53` | 可绑定多个端口。<br>`IP:PORT`: 服务器 IP:端口号<br>[`-group`]: 请求时使用的 DNS 服务器组<br>[`-no-rule-addr`]：跳过 address 规则<br>[`-no-rule-nameserver`]：跳过 Nameserver 规则<br>[`-no-rule-ipset`]：跳过 ipset 规则<br>[`-no-rule-soa`]：跳过 SOA(#) 规则<br>[`-no-dualstack-selection`]：停用双栈测速<br>[`-no-speed-check`]：停用测速<br>[`-no-cache`]：停止缓存 | `bind :53` |
-| `bind-tcp` | DNS TCP 监听端口号 | `[::]:53` | 可绑定多个端口。<br>`IP:PORT`: 服务器 IP:端口号<br>[`-group`]: 请求时使用的 DNS 服务器组<br>[`-no-rule-addr`]：跳过 address 规则<br>[`-no-rule-nameserver`]：跳过 `nameserver` 规则<br>[`-no-rule-ipset`]：跳过 `ipset` 规则。<br>[`-no-rule-soa`]：跳过 SOA(#) 规则<br>[`-no-dualstack-selection`]：停用双栈测速<br>[`-no-speed-check`]：停用测速<br>[`-no-cache`]：停止缓存 | `bind-tcp :53` |
-| `cache-size` | 域名结果缓存个数 | `512` | 大于等于 `0` 的数字 | `cache-size 512` |
-| `cache-persist` | 是否持久化缓存 | 自动。<br>当 `cache-file` 所在的位置有超过 128 MB 的可用空间时启用，否则禁用。 | [`yes`\|`no`] | `cache-persist yes` |
-| `cache-file` | 缓存持久化文件路径 | `/tmp/smartdns.cache` | 合法路径字符串 | `cache-file /tmp/smartdns.cache` |
-| `tcp-idle-time` | TCP 链接空闲超时时间 | `120` | 大于等于 `0` 的数字 | `tcp-idle-time 120` |
-| `rr-ttl` | 域名结果 TTL | 远程查询结果 | 大于 `0` 的数字 | `rr-ttl 600` |
-| `rr-ttl-min` | 允许的最小 TTL 值 | 远程查询结果 | 大于 `0` 的数字 | `rr-ttl-min 60` |
-| `rr-ttl-max` | 允许的最大 TTL 值 | 远程查询结果 | 大于 `0` 的数字 | `rr-ttl-max 600` |
-| `log-level` | 设置日志级别 | `error` | `fatal`、`error`、`warn`、`notice`、`info` 或 `debug` | `log-level error` |
-| `log-file` | 日志文件路径 | `/var/log/smartdns.log` | 合法路径字符串 | `log-file /var/log/smartdns.log` |
-| `log-size` | 日志大小 | `128K` | 数字 + `K`、`M` 或 `G` | `log-size 128K` |
-| `log-num` | 日志归档个数 | `2` | 大于等于 `0` 的数字 | `log-num 2` |
-| `audit-enable` | 设置审计启用 | `no` | [`yes`\|`no`] | `audit-enable yes` |
-| `audit-file` | 审计文件路径 | `/var/log/smartdns-audit.log` | 合法路径字符串 | `audit-file /var/log/smartdns-audit.log` |
-| `audit-size` | 审计大小 | `128K` | 数字 + `K`、`M` 或 `G` | `audit-size 128K` |
-| `audit-num` | 审计归档个数 | `2` | 大于等于 `0` 的数字 | `audit-num 2` |
-| `conf-file` | 附加配置文件 | 无 | 合法路径字符串 | `conf-file /etc/smartdns/smartdns.more.conf` |
-| `server` | 上游 UDP DNS | 无 | 可重复。<br>[`ip`][`:port`]：服务器 IP:端口（可选）<br>[`-blacklist-ip`]：配置 IP 过滤结果。<br>[`-whitelist-ip`]：指定仅接受参数中配置的 IP 范围<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 `office` 和 `foreign`，和 `nameserver` 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除 | `server 8.8.8.8:53 -blacklist-ip -group g1` |
-| `server-tcp` | 上游 TCP DNS | 无 | 可重复。<br>[`ip`][`:port`]：服务器 IP:端口（可选）<br>[`-blacklist-ip`]：配置 IP 过滤结果<br>[`-whitelist-ip`]：指定仅接受参数中配置的 IP 范围。<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 `office` 和 `foreign`，和 `nameserver` 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除  | `server-tcp 8.8.8.8:53` |
-| `server-tls` | 上游 TLS DNS | 无 | 可重复。<br>[`ip`][`:port`]：服务器 IP:端口（可选)<br>[`-spki-pin` [`sha256-pin`]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[`-host-name`]：TLS SNI 名称<br>[`-tls-host-verify`]：TLS 证书主机名校验<br> [`-no-check-certificate`]：跳过证书校验<br>[`-blacklist-ip`]：配置 IP 过滤结果<br>[`-whitelist-ip`]：仅接受参数中配置的 IP 范围<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 `office` 和 `foreign`，和 `nameserver` 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除 | `server-tls 8.8.8.8:853` |
-| `server-https` | 上游 HTTPS DNS | 无 | 可重复。<br>`https://`[`host`][`:port`]`/path`：服务器 IP:端口（可选）<br>[`-spki-pin` [`sha256-pin`]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[`-host-name`]：TLS SNI 名称<br>[`-http-host`]：http 协议头主机名<br>[`-tls-host-verify`]：TLS 证书主机名校验<br> [`-no-check-certificate`]：跳过证书校验<br>[`-blacklist-ip`]：配置 IP 过滤结果<br>[`-whitelist-ip`]：仅接受参数中配置的 IP 范围。<br>[`-group` [`group`] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[`-exclude-default-group`]：将 DNS 服务器从默认组中排除 | `server-https https://cloudflare-dns.com/dns-query` |
-| `speed-check-mode` | 测速模式选择 | 无 | [`ping`\|`tcp:`[`80`]\|`none`] | `speed-check-mode ping,tcp:80` |
-| `address` | 指定域名 IP 地址 | 无 | `address /domain/`[`ip`\|`-`\|`-4`\|`-6`\|`#`\|`#4`\|`#6`] <br>`-` 表示忽略 <br>`#` 表示返回 SOA <br>`4` 表示 IPv4 <br>`6` 表示 IPv6 | `address /www.example.com/1.2.3.4` |
-| `nameserver` | 指定域名使用 `server` 组解析 | 无 | `nameserver /domain/`[`group`\|`-`], `group` 为组名，`-` 表示忽略此规则，配套 `server` 中的 `-group` 参数使用 | `nameserver /www.example.com/office` |
-| `ipset` | 域名 ipset | 无 | `ipset /domain/`[`ipset`\|`-`\|`#`[`4`\|`6`]:[`ipset`\|`-`][`,#`[`4`\|`6`]`:`[`ipset`\|`-`]]]，`-`表示忽略 | `ipset /www.example.com/#4:dns4,#6:-` |
-| `ipset-timeout` | 设置 `ipset` 超时功能启用  | 自动 | [`yes`] | `ipset-timeout yes` |
-| `domain-rules` | 设置域名规则 | 无 | `domain-rules /domain/` [`-rules`...]<br>[`-c`\|`-speed-check-mode`]：测速模式，参考 `speed-check-mode` 配置<br>[`-a`\|`-address`]：参考 `address` 配置<br>[`-n`\|`-nameserver`]：参考 `nameserver` 配置<br>[`-p`\|`-ipset`]：参考`ipset`配置<br>[`-d`\|`-dualstack-ip-selection`]：参考 `dualstack-ip-selection`  | `domain-rules /www.example.com/ -speed-check-mode none` |
-| `bogus-nxdomain` | 假冒 IP 地址过滤 | 无 | [`ip/subnet`]，可重复 | `bogus-nxdomain 1.2.3.4/16` |
-| `ignore-ip` | 忽略 IP 地址 | 无 | [`ip/subnet`]，可重复 | `ignore-ip 1.2.3.4/16` |
-| `whitelist-ip` | 白名单 IP 地址 | 无 | [`ip/subnet`]，可重复 | `whitelist-ip 1.2.3.4/16` |
-| `blacklist-ip` | 黑名单 IP 地址 | 无 | [`ip/subnet`]，可重复 | `blacklist-ip 1.2.3.4/16` |
-| `force-AAAA-SOA` | 强制 AAAA 地址返回 SOA | `no` | [`yes`\|`no`] | `force-AAAA-SOA yes` |
-| `force-qtype-SOA` | 强制指定 qtype 返回 SOA | qtype id | [`<qtypeid>` \| ...] | `force-qtype-SOA 65 28`
-| `prefetch-domain` | 域名预先获取功能 | `no` | [`yes`\|`no`] | `prefetch-domain yes` |
-| `serve-expired` | 过期缓存服务功能 | `no` | [`yes`\|`no`]，开启此功能后，如果有请求时尝试回应 TTL 为 0 的过期记录，并发查询记录，以避免查询等待 |
-| `serve-expired-ttl` | 过期缓存服务最长超时时间 | `0` | 秒，`0` 表示停用超时，大于 `0` 表示指定的超时的秒数 | `serve-expired-ttl 0` |
-| `serve-expired-reply-ttl` | 回应的过期缓存 TTL | `5` | 秒，`0` 表示停用超时，大于 `0` 表示指定的超时的秒数 | `serve-expired-reply-ttl 30` |
-| `dualstack-ip-selection` | 双栈 IP 优选 | `no` | [`yes`\|`no`] | `dualstack-ip-selection yes` |
-| `dualstack-ip-selection-threshold` | 双栈 IP 优选阈值 | `30ms` | 单位为毫秒（`ms`） | `dualstack-ip-selection-threshold [0-1000]` |
-| `ca-file` | 证书文件 | `/etc/ssl/certs/ca-certificates.crt` | 合法路径字符串 | `ca-file /etc/ssl/certs/ca-certificates.crt` |
-| `ca-path` | 证书文件路径 | `/etc/ssl/certs` | 合法路径字符串 | `ca-path /etc/ssl/certs` |
+| server-name | DNS 服务器名称 | 操作系统主机名 / smartdns | 符合主机名规格的字符串 | server-name smartdns |
+| bind | DNS 监听端口号  | [::]:53 | 可绑定多个端口。<br>IP:PORT: 服务器 IP:端口号<br>[-group]: 请求时使用的 DNS 服务器组<br>[-no-rule-addr]：跳过 address 规则<br>[-no-rule-nameserver]：跳过 Nameserver 规则<br>[-no-rule-ipset]：跳过 ipset 规则<br>[-no-rule-soa]：跳过 SOA(#) 规则<br>[-no-dualstack-selection]：停用双栈测速<br>[-no-speed-check]：停用测速<br>[-no-cache]：停止缓存 | bind :53 |
+| bind-tcp | DNS TCP 监听端口号 | [::]:53 | 可绑定多个端口。<br>IP:PORT: 服务器 IP:端口号<br>[-group]: 请求时使用的 DNS 服务器组<br>[-no-rule-addr]：跳过 address 规则<br>[-no-rule-nameserver]：跳过 nameserver 规则<br>[-no-rule-ipset]：跳过 ipset 规则。<br>[-no-rule-soa]：跳过 SOA(#) 规则<br>[-no-dualstack-selection]：停用双栈测速<br>[-no-speed-check]：停用测速<br>[-no-cache]：停止缓存 | bind-tcp :53 |
+| cache-size | 域名结果缓存个数 | 512 | 大于等于 0 的数字 | cache-size 512 |
+| cache-persist | 是否持久化缓存 | 自动。<br>当 cache-file 所在的位置有超过 128 MB 的可用空间时启用，否则禁用。 | [yes\|no] | cache-persist yes |
+| cache-file | 缓存持久化文件路径 | /tmp/smartdns.cache | 合法路径字符串 | cache-file /tmp/smartdns.cache |
+| tcp-idle-time | TCP 链接空闲超时时间 | 120 | 大于等于 0 的数字 | tcp-idle-time 120 |
+| rr-ttl | 域名结果 TTL | 远程查询结果 | 大于 0 的数字 | rr-ttl 600 |
+| rr-ttl-min | 允许的最小 TTL 值 | 远程查询结果 | 大于 0 的数字 | rr-ttl-min 60 |
+| rr-ttl-max | 允许的最大 TTL 值 | 远程查询结果 | 大于 0 的数字 | rr-ttl-max 600 |
+| rr-ttl-reply-max | 允许返回给客户端的最大 TTL 值 | 远程查询结果 | 大于 0 的数字 | rr-ttl-reply-max 60 |
+| max-reply-ip-num | 允许返回给客户的最大IP数量 | IP数量 | 大于 0 的数字 | max-reply-ip-num 1 |
+| log-level | 设置日志级别 | error | fatal、error、warn、notice、info 或 debug | log-level error |
+| log-file | 日志文件路径 | /var/log/smartdns.log | 合法路径字符串 | log-file /var/log/smartdns.log |
+| log-size | 日志大小 | 128K | 数字 + K、M 或 G | log-size 128K |
+| log-num | 日志归档个数 | 2 | 大于等于 0 的数字 | log-num 2 |
+| audit-enable | 设置审计启用 | no | [yes\|no] | audit-enable yes |
+| audit-file | 审计文件路径 | /var/log/smartdns-audit.log | 合法路径字符串 | audit-file /var/log/smartdns-audit.log |
+| audit-size | 审计大小 | 128K | 数字 + K、M 或 G | audit-size 128K |
+| audit-num | 审计归档个数 | 2 | 大于等于 0 的数字 | audit-num 2 |
+| conf-file | 附加配置文件 | 无 | 合法路径字符串 | conf-file /etc/smartdns/smartdns.more.conf |
+| server | 上游 UDP DNS | 无 | 可重复。<br>[ip][:port]：服务器 IP:端口（可选）<br>[-blacklist-ip]：配置 IP 过滤结果。<br>[-whitelist-ip]：指定仅接受参数中配置的 IP 范围<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除 | server 8.8.8.8:53 -blacklist-ip -group g1 |
+| server-tcp | 上游 TCP DNS | 无 | 可重复。<br>[ip][:port]：服务器 IP:端口（可选）<br>[-blacklist-ip]：配置 IP 过滤结果<br>[-whitelist-ip]：指定仅接受参数中配置的 IP 范围。<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除  | server-tcp 8.8.8.8:53 |
+| server-tls | 上游 TLS DNS | 无 | 可重复。<br>[ip][:port]：服务器 IP:端口（可选)<br>[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[-host-name]：TLS SNI 名称<br>[-tls-host-verify]：TLS 证书主机名校验<br> [-no-check-certificate]：跳过证书校验<br>[-blacklist-ip]：配置 IP 过滤结果<br>[-whitelist-ip]：仅接受参数中配置的 IP 范围<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除 | server-tls 8.8.8.8:853 |
+| server-https | 上游 HTTPS DNS | 无 | 可重复。<br>https://[host][:port]/path：服务器 IP:端口（可选）<br>[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值<br>[-host-name]：TLS SNI 名称<br>[-http-host]：http 协议头主机名<br>[-tls-host-verify]：TLS 证书主机名校验<br> [-no-check-certificate]：跳过证书校验<br>[-blacklist-ip]：配置 IP 过滤结果<br>[-whitelist-ip]：仅接受参数中配置的 IP 范围。<br>[-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用<br>[-exclude-default-group]：将 DNS 服务器从默认组中排除 | server-https https://cloudflare-dns.com/dns-query |
+| speed-check-mode | 测速模式选择 | 无 | [ping\|tcp:[80]\|none] | speed-check-mode ping,tcp:80,tcp:443 |
+| address | 指定域名 IP 地址 | 无 | address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6] <br>- 表示忽略 <br># 表示返回 SOA <br>4 表示 IPv4 <br>6 表示 IPv6 | address /www.example.com/1.2.3.4 |
+| nameserver | 指定域名使用 server 组解析 | 无 | nameserver /domain/[group\|-], group 为组名，- 表示忽略此规则，配套 server 中的 -group 参数使用 | nameserver /www.example.com/office |
+| ipset | 域名 ipset | 无 | ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]]，-表示忽略 | ipset /www.example.com/#4:dns4,#6:- |
+| ipset-timeout | 设置 ipset 超时功能启用  | 自动 | [yes] | ipset-timeout yes |
+| domain-rules | 设置域名规则 | 无 | domain-rules /domain/ [-rules...]<br>[-c\|-speed-check-mode]：测速模式，参考 speed-check-mode 配置<br>[-a\|-address]：参考 address 配置<br>[-n\|-nameserver]：参考 nameserver 配置<br>[-p\|-ipset]：参考ipset配置<br>[-d\|-dualstack-ip-selection]：参考 dualstack-ip-selection  | domain-rules /www.example.com/ -speed-check-mode none |
+| bogus-nxdomain | 假冒 IP 地址过滤 | 无 | [ip/subnet]，可重复 | bogus-nxdomain 1.2.3.4/16 |
+| ignore-ip | 忽略 IP 地址 | 无 | [ip/subnet]，可重复 | ignore-ip 1.2.3.4/16 |
+| whitelist-ip | 白名单 IP 地址 | 无 | [ip/subnet]，可重复 | whitelist-ip 1.2.3.4/16 |
+| blacklist-ip | 黑名单 IP 地址 | 无 | [ip/subnet]，可重复 | blacklist-ip 1.2.3.4/16 |
+| force-AAAA-SOA | 强制 AAAA 地址返回 SOA | no | [yes\|no] | force-AAAA-SOA yes |
+| force-qtype-SOA | 强制指定 qtype 返回 SOA | qtype id | [<qtypeid> \| ...] | force-qtype-SOA 65 28
+| prefetch-domain | 域名预先获取功能 | no | [yes\|no] | prefetch-domain yes |
+| dnsmasq-lease-file | 支持读取dnsmasq dhcp文件解析本地主机名功能 | 无 | dnsmasq dhcp lease文件路径 | dnsmasq-lease-file /var/lib/misc/dnsmasq.leases |
+| serve-expired | 过期缓存服务功能 | yes | [yes\|no]，开启此功能后，如果有请求时尝试回应 TTL 为 0 的过期记录，并发查询记录，以避免查询等待 |
+| serve-expired-ttl | 过期缓存服务最长超时时间 | 0 | 秒，0 表示停用超时，大于 0 表示指定的超时的秒数 | serve-expired-ttl 0 |
+| serve-expired-reply-ttl | 回应的过期缓存 TTL | 5 | 秒，0 表示停用超时，大于 0 表示指定的超时的秒数 | serve-expired-reply-ttl 30 |
+| dualstack-ip-selection | 双栈 IP 优选 | yes | [yes\|no] | dualstack-ip-selection yes |
+| dualstack-ip-selection-threshold | 双栈 IP 优选阈值 | 15ms | 单位为毫秒（ms） | dualstack-ip-selection-threshold [0-1000] |
+| ca-file | 证书文件 | /etc/ssl/certs/ca-certificates.crt | 合法路径字符串 | ca-file /etc/ssl/certs/ca-certificates.crt |
+| ca-path | 证书文件路径 | /etc/ssl/certs | 合法路径字符串 | ca-path /etc/ssl/certs |

 ## 常见问题

@@ -727,6 +730,24 @@ rtt min/avg/max/mdev = 5.954/6.133/6.313/0.195 ms
    $ echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
    ```

+11. iOS系统解析缓慢问题怎么解决？  
+    IOS14开始，苹果支持了DNS HTTPS(TYPE65)记录的解析，此功能用于快速DNS查询和解决HTTPS链接相关的问题，但当前还是草案，另外会导致广告屏蔽等功能失效，建议通过如下配置关闭TYPE65记录查询。
+
+    ```sh
+    force-qtype-SOA 65
+    ```
+
+12. 如何解析本地主机名称？  
+    smartdns可以配合DNSMASQ的dhcp lease文件支持本地主机名->IP地址的解析，可以配置smartdns读取dnsmasq的lease文件，并支持解析。具体配置参数如下，（注意，DNSMASQ lease文件每个系统可能不一样，需要按实际情况配置）
+
+    ```
+    dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
+    ```
+
+    配置完成后，可以直接使用主机名连接对应的机器。但需要注意：
+
+    * Windows系统默认使用mDNS解析地址，如需要在windows下用使用smartdns解析，则需要在主机名后面增加`.`，表示使用DNS解析。如`ping smartdns.`
+
 ## 编译

  SmartDNS 提供了编译软件包的脚本（`package/build-pkg.sh`），支持编译 LuCI、Debian、OpenWrt 和 Optware 安装包。
--- a/ReadMe_en.md
+++ b/ReadMe_en.md
@@ -281,7 +281,7 @@ https://github.com/pymumu/smartdns/releases

    * **Check if the service is configured successfully**

-        * Method 1: Query domain name with `nslookup -querytype=ptr 0.0.0.1`
+        * Query domain name with `nslookup -querytype=ptr 0.0.0.1`
        See if the `name` item in the command result is displayed as `smartdns` or `hostname`, such as `smartdns`

        ```shell
@@ -293,18 +293,12 @@ https://github.com/pymumu/smartdns/releases
        smartdns         name = smartdns.
        ```

-        * Method 2: Use `nslookup` to query the `www.baidu.com` domain name to see if the IP address of Baidu in the result is `only one. If there are multiple IP addresses returned, it means that it is not valid. Please try to check several domain names.
+        * or Query doman name `smartdns `with `nslookup smartdns`
+         ```shell
+         $ nslookup smartdns
+         ```

-        ```shell
-        pi@raspberrypi:~ $ nslookup www.baidu.com 192.168.1.1
-        Server:         192.168.1.1
-        Address:        192.168.1.1#53
-
-        Non-authoritative answer:
-        www.baidu.com   canonical name = www.a.shifen.com.
-        Name:   www.a.shifen.com
-        Address: 14.215.177.38
-        ```
+        Check whether the command result resolves the IP address of the router, if so, it means it is working.

 1. Start Service

@@ -503,7 +497,9 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |tcp-idle-time|TCP connection idle timeout|120|integer|tcp-idle-time 120
 |rr-ttl|Domain name TTL|Remote query result|number greater than 0|rr-ttl 600
 |rr-ttl-min|Domain name Minimum TTL|Remote query result|number greater than 0|rr-ttl-min 60
+|rr-ttl-reply-max|Domain name Minimum Reply TTL|Remote query result|number greater than 0|rr-ttl-reply-max 60
 |rr-ttl-max|Domain name Maximum TTL|Remote query result|number greater than 0|rr-ttl-max 600
+|max-reply-ip-num|Maximum number of IPs returned to the client|8|number of IPs, 1~16 |max-reply-ip-num 1
 |log-level|log level|error|fatal,error,warn,notice,info,debug|log-level error
 |log-file|log path|/var/log/smartdns.log|File Pah|log-file /var/log/smartdns.log
 |log-size|log size|128K|number+K,M,G|log-size 128K
@@ -517,7 +513,7 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |server-tcp|Upstream TCP DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-tcp 8.8.8.8:53
 |server-tls|Upstream TLS DNS server|None|Repeatable <br>`[ip][:port]`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name. <br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-tls 8.8.8.8:853
 |server-https|Upstream HTTPS DNS server|None|Repeatable <br>`https://[host][:port]/path`: Server IP, port optional. <br>`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash<br>`[-host-name]`:TLS Server name<br>`[-http-host]`：http header host. <br>`[-tls-host-verify]`: TLS cert hostname to verify. <br>`-no-check-certificate:`: No check certificate. <br>`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip". <br>`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted. <br>`[-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver. <br>`[-exclude-default-group]`: Exclude DNS servers from the default group| server-https https://cloudflare-dns.com/dns-query
-|speed-check-mode|Speed mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:443
+|speed-check-mode|Speed mode|None|[ping\|tcp:[80]\|none]|speed-check-mode ping,tcp:80,tcp:443
 |address|Domain IP address|None|address /domain/[ip\|-\|-4\|-6\|#\|#4\|#6], `-` for ignore, `#` for return SOA, `4` for IPV4, `6` for IPV6| address /www.example.com/1.2.3.4
 |nameserver|To query domain with specific server group|None|nameserver /domain/[group\|-], `group` is the group name, `-` means ignore this rule, use the `-group` parameter in the related server|nameserver /www.example.com/office
 |ipset|Domain IPSet|None|ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]], `-` for ignore|ipset /www.example.com/#4:dns4,#6:-
@@ -530,11 +526,12 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 |force-AAAA-SOA|force AAAA query return SOA|no|[yes\|no]|force-AAAA-SOA yes
 |force-qtype-SOA|force specific qtype return SOA|qtype id|[qtypeid | ...]|force-qtype-SOA 65 28
 |prefetch-domain|domain prefetch feature|no|[yes\|no]|prefetch-domain yes
-|serve-expired|Cache serve expired feature|no|[yes\|no], Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish.|serve-expired yes
+|dnsmasq-lease-file|Support reading dnsmasq dhcp file to resolve local hostname|None|dnsmasq dhcp lease file| dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
+|serve-expired|Cache serve expired feature|yes|[yes\|no], Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish.|serve-expired yes
 |serve-expired-ttl|Cache serve expired limite TTL|0|second，0：disable，> 0  seconds after expiration|serve-expired-ttl 0
 |serve-expired-reply-ttl|TTL value to use when replying with expired data|5|second，0：disable，> 0  seconds after expiration|serve-expired-reply-ttl 30
-|dualstack-ip-selection|Dualstack ip selection|no|[yes\|no]|dualstack-ip-selection yes
-|dualstack-ip-selection-threshold|Dualstack ip select threadhold|30ms|millisecond|dualstack-ip-selection-threshold [0-1000]
+|dualstack-ip-selection|Dualstack ip selection|yes|[yes\|no]|dualstack-ip-selection yes
+|dualstack-ip-selection-threshold|Dualstack ip select threadhold|15ms|millisecond|dualstack-ip-selection-threshold [0-1000]
 |ca-file|certificate file|/etc/ssl/certs/ca-certificates.crt|path|ca-file /etc/ssl/certs/ca-certificates.crt
 |ca-path|certificates path|/etc/ssl/certs|path|ca-path /etc/ssl/certs

@@ -650,9 +647,27 @@ Note: Merlin firmware is derived from ASUS firmware and can theoretically be use
 1. How to get SPKI of DOT  
    The SPKI can be obtained from the page published by the DNS service provider. If it is not published, it can be obtained by the following command, replace IP with your own IP.

-    ````sh
+    ```sh
    echo | openssl s_client -connect '1.0.0.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
-    ````
+    ```
+
+1. How to solve the problem of slow DNS resolution in iOS system?  
+    Since iOS14, Apple has supported the resolution of DNS HTTPS (TYPE65) records. This function is used for solving problems related to HTTPS connections, but it is still a draft, and it will cause some functions such as adblocking fail. It is recommended to disable it through the following configuration.
+
+    ```sh
+    force-qtype-SOA 65
+    ```
+
+1. How to resolve localhost ip by hostname?
+    smartdns can cooperate with the dhcp server of DNSMASQ to support the resolution of local host name to IP address. You can configure smartdns to read the lease file of dnsmasq and support the resolution. The specific configuration parameters are as follows, (note that the DNSMASQ lease file may be different for each system and needs to be configured according to the actual situation)
+
+    ```sh
+    dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
+    ````\
+
+    After the configuration is complete, you can directly use the host name to connect to the local machine. But need to pay attention:
+
+    * Windows system uses mDNS to resolve addresses by default. If you need to use smartdns to resolve addresses under Windows, you need to add `.` after the host name, indicating that DNS resolution is used. Such as `ping smartdns.`

 ## Compile

--- a/etc/init.d/smartdns
+++ b/etc/init.d/smartdns
@@ -68,11 +68,23 @@ case $1 in
 			echo "Stop smartdns server failed."
 			exit 1;
 		fi
-		rm -f "$PIDFILE"
+		LOOP=1
+		while true; do
+			if [ ! -d "/proc/$PID" ]; then
+				break;
+			fi
+
+			if [ $LOOP -gt 12 ]; then
+				kill -9 "$PID"
+				break;
+			fi
+			LOOP=$((LOOP+1))
+			sleep .5
+		done
 		echo "Stop smartdns server success."
 		;;
 	restart)
-		"$0" stop && sleep 1 && "$0" start
+		"$0" stop && "$0" start
 		;;
 	status)
 		PID="$(cat "$PIDFILE" 2>/dev/null)"
--- a/etc/smartdns/smartdns.conf
+++ b/etc/smartdns/smartdns.conf
@@ -4,6 +4,12 @@
 #   server-name smartdns
 #

+# dns server run ser
+# user [username]
+# example: run as nobody
+#   user nobody
+#
+
 # Include another configuration options
 # conf-file [file]
 # conf-file blacklist-ip.conf
@@ -38,7 +44,7 @@ bind [::]:53
 # dns cache size
 # cache-size [number]
 #   0: for no cache
-cache-size 4096
+cache-size 16384

 # enable persist cache when restart
 # cache-persist yes
@@ -77,7 +83,7 @@ cache-size 4096
 # speed check mode
 # speed-check-mode [ping|tcp:port|none|,]
 # example:
-#   speed-check-mode ping,tcp:80
+#   speed-check-mode ping,tcp:80,tcp:443
 #   speed-check-mode tcp:443,ping
 #   speed-check-mode none

@@ -90,22 +96,29 @@ cache-size 4096

 # Enable IPV4, IPV6 dual stack IP optimization selection strategy
 # dualstack-ip-selection-threshold [num] (0~1000)
+# dualstack-ip-allow-force-AAAA [yes|no]
 # dualstack-ip-selection [yes|no]
 # dualstack-ip-selection yes

 # edns client subnet
 # edns-client-subnet [ip/subnet]
 # edns-client-subnet 192.168.1.1/24
-# edns-client-subnet [8::8]/56
+# edns-client-subnet 8::8/56

 # ttl for all resource record
 # rr-ttl: ttl for all record
 # rr-ttl-min: minimum ttl for resource record
 # rr-ttl-max: maximum ttl for resource record
+# tr-ttl-reply-max: maximum reply ttl for resource record
 # example:
 # rr-ttl 300
 # rr-ttl-min 60
 # rr-ttl-max 86400
+# rr-ttl-reply-max 60
+
+# Maximum number of IPs returned to the client|8|number of IPs, 1~16
+# example:
+# max-reply-ip-num 1

 # set log level
 # log-level: [level], level=fatal, error, warn, notice, info, debug
@@ -126,6 +139,9 @@ log-level info
 # audit-size 128k
 # audit-num 2

+# Support reading dnsmasq dhcp file to resolve local hostname
+# dnsmasq-lease-file /var/lib/misc/dnsmasq.leases
+
 # certificate file
 # ca-file [file]
 # ca-file /etc/ssl/certs/ca-certificates.crt
--- a/package/debian/DEBIAN/changelog
+++ b/package/debian/DEBIAN/changelog
@@ -1,4 +1,4 @@
-smartdns (1.2018.7.9) stable; urgency=low
+smartdns (1:1.2022.04.05) stable; urgency=low

  * Initial build

--- a/package/debian/make.sh
+++ b/package/debian/make.sh
@@ -43,7 +43,9 @@ build()
 	mkdir $ROOT/etc/default/ -p
 	mkdir $ROOT/lib/systemd/system/ -p

-	sed -i "s/Version:.*/Version: $VER/" $ROOT/DEBIAN/control
+
+	pkgver=$(echo ${VER}| sed 's/^1\.//g')
+	sed -i "s/Version:.*/Version: ${pkgver}/" $ROOT/DEBIAN/control
 	sed -i "s/Architecture:.*/Architecture: $ARCH/" $ROOT/DEBIAN/control
 	chmod 0755 $ROOT/DEBIAN/prerm

--- a/package/luci-compat/files/luci/i18n/smartdns.zh-cn.po
+++ b/package/luci-compat/files/luci/i18n/smartdns.zh-cn.po
@@ -124,6 +124,9 @@ msgstr "域名TTL最大值"
 msgid "Maximum TTL for all domain result."
 msgstr "设置所有域名的TTL最大值"

+msgid "Maximum Reply TTL for all domain result."
+msgstr "设置返回给客户端的TTL最大值"
+
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"

--- a/package/luci-compat/files/luci/model/cbi/smartdns/smartdns.lua
+++ b/package/luci-compat/files/luci/model/cbi/smartdns/smartdns.lua
@@ -70,7 +70,7 @@ end
 ---- Support DualStack ip selection
 o = s:taboption("settings", Flag, "dualstack_ip_selection", translate("Dual-stack IP Selection"), translate("Enable IP selection between IPV4 and IPV6"))
 o.rmempty     = false
-o.default     = o.disabled
+o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
@@ -87,7 +87,7 @@ end
 o = s:taboption("settings", Flag, "serve_expired", translate("Serve expired"), 
 	translate("Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish."))
 o.rmempty     = false
-o.default     = o.disabled
+o.default     = o.enabled
 o.cfgvalue    = function(...)
    return Flag.cfgvalue(...) or "0"
 end
@@ -112,15 +112,19 @@ o.rempty      = true
 ---- rr-ttl-min
 o = s:taboption("settings", Value, "rr_ttl_min", translate("Domain TTL Min"), translate("Minimum TTL for all domain result."))
 o.rempty      = true
-o.placeholder = "300"
-o.default     = 300
+o.placeholder = "600"
+o.default     = 600
 o.optional    = true

---- second dns server
 ---- rr-ttl-max
 o = s:taboption("settings", Value, "rr_ttl_max", translate("Domain TTL Max"), translate("Maximum TTL for all domain result."))
 o.rempty      = true

+---- rr-ttl-reply-max
+o = s:taboption("settings", Value, "rr_ttl_reply_max", translate("Domain TTL Max"), translate("Maximum Reply TTL for all domain result."))
+o.rempty      = true
+
+---- second dns server
 ---- Eanble
 o = s:taboption("seconddns", Flag, "seconddns_enabled", translate("Enable"), translate("Enable or disable second DNS server."))
 o.default     = o.disabled
--- a/package/luci/files/luci/i18n/smartdns.zh-cn.po
+++ b/package/luci/files/luci/i18n/smartdns.zh-cn.po
@@ -130,6 +130,9 @@ msgstr "域名TTL最大值"
 msgid "Maximum TTL for all domain result."
 msgstr "设置所有域名的TTL最大值"

+msgid "Maximum Reply TTL for all domain result."
+msgstr "设置返回给客户端的TTL最大值"
+
 msgid "smartdns custom settings"
 msgstr "smartdns 自定义设置，具体配置参数参考指导"

--- a/package/luci/files/root/www/luci-static/resources/view/smartdns/smartdns.js
+++ b/package/luci/files/root/www/luci-static/resources/view/smartdns/smartdns.js
@@ -188,7 +188,7 @@ return L.view.extend({
 		o = s.taboption("settings", form.Flag, "dualstack_ip_selection", _("Dual-stack IP Selection"),
 			_("Enable IP selection between IPV4 and IPV6"));
 		o.rmempty = false;
-		o.default = o.disabled;
+		o.default = o.enabled;

 		// Domain prefetch load ;
 		o = s.taboption("settings", form.Flag, "prefetch_domain", _("Domain prefetch"),
@@ -200,7 +200,7 @@ return L.view.extend({
 		o = s.taboption("settings", form.Flag, "serve_expired", _("Serve expired"),
 			_("Attempts to serve old responses from cache with a TTL of 0 in the response without waiting for the actual resolution to finish."));
 		o.rmempty = false;
-		o.default = o.disabled;
+		o.default = o.enabled;

 		// Redirect;
 		o = s.taboption("settings", form.ListValue, "redirect", _("Redirect"), _("SmartDNS redirect mode"));
@@ -223,16 +223,21 @@ return L.view.extend({
 		o = s.taboption("settings", form.Value, "rr_ttl_min", _("Domain TTL Min"),
 			_("Minimum TTL for all domain result."));
 		o.rempty = true;
-		o.placeholder = "300";
-		o.default = 300;
+		o.placeholder = "600";
+		o.default = 600;
 		o.optional = true;

-		// second dns server;
 		// rr-ttl-max;
 		o = s.taboption("settings", form.Value, "rr_ttl_max", _("Domain TTL Max"),
-			_("Maximum TTL for all domain result."));
+		_("Maximum TTL for all domain result."));
 		o.rempty = true;

+		// rr-ttl-reply-max;
+		o = s.taboption("settings", form.Value, "rr_ttl_reply_max", _("Domain Reply TTL Max"),
+		_("Maximum Reply TTL for all domain result."));
+		o.rempty = true;
+		
+		// second dns server;
 		// Eanble;
 		o = s.taboption("seconddns", form.Flag, "seconddns_enabled", _("Enable"),
 			_("Enable or disable second DNS server."));
--- a/package/openwrt/files/etc/init.d/smartdns
+++ b/package/openwrt/files/etc/init.d/smartdns
@@ -289,7 +289,7 @@ load_service()
 		fi
 	}
 	config_get dualstack_ip_selection "$section" "dualstack_ip_selection" "0"
-	[ "$dualstack_ip_selection" = "1" ] && conf_append "dualstack-ip-selection" "yes"
+	[ "$dualstack_ip_selection" = "0" ] && conf_append "dualstack-ip-selection" "no"

 	config_get prefetch_domain "$section" "prefetch_domain" "0"
 	[ "$prefetch_domain" = "1" ] && conf_append "prefetch-domain" "yes"
@@ -311,6 +311,9 @@ load_service()
 	config_get rr_ttl_max "$section" "rr_ttl_max" ""
 	[ -z "$rr_ttl_max" ] || conf_append "rr-ttl-max" "$rr_ttl_max"

+	config_get rr_ttl_reply_max "$section" "rr_ttl_reply_max" ""
+	[ -z "$rr_ttl_reply_max" ] || conf_append "rr-ttl-reply-max" "$rr_ttl_reply_max"
+
 	config_get log_size "$section" "log_size" "64K"
 	[ -z "$log_size" ] || conf_append "log-size" "$log_size"

@@ -374,6 +377,7 @@ load_service()
 	procd_set_param command /usr/sbin/smartdns -f -c $SMARTDNS_CONF $args
 	[ "$RESPAWN" = "1" ] &&	procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}
 	procd_set_param file "$SMARTDNS_CONF"
+	procd_set_param term_timeout 60
 	procd_close_instance
 }

--- a/package/optware/S50smartdns
+++ b/package/optware/S50smartdns
@@ -339,7 +339,7 @@ case "$1" in
 		SLEEP="sleep"
 		SLEEPTIME=0.2
 	fi
-	N=30
+	N=300
 	while [ $N -gt 0 ]
 	do
 		pid="$(cat "$SMARTDNS_PID" | head -n 1 2>/dev/null)"
@@ -348,7 +348,13 @@ case "$1" in
 		fi

 		if [ ! -d "/proc/$pid" ]; then
-			return 0;
+			return 0
+		fi
+
+		stat="$(cat /proc/${pid}/stat | awk '{print $3}' 2>/dev/null)"
+		if [ "$stat" = "Z" ]; then
+			$SLEEP $SLEEPTIME
+			return 0
 		fi

 		$SLEEP $SLEEPTIME 2>/dev/null
--- a/src/dns.c
+++ b/src/dns.c
--- a/src/dns.h
+++ b/src/dns.h
@@ -30,6 +30,11 @@
 #define DNS_ADDR_FAMILY_IP 1
 #define DNS_ADDR_FAMILY_IPV6 2

+/*
+DNS parameters:
+https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml
+*/
+
 typedef enum dns_qr {
 	DNS_QR_QUERY = 0,
 	DNS_QR_ANSWER = 1,
@@ -61,6 +66,7 @@ typedef enum dns_type {
 	DNS_T_SRV = 33,
 	DNS_T_OPT = 41,
 	DNS_T_SSHFP = 44,
+	DNS_T_HTTPS = 65,
 	DNS_T_SPF = 99,
 	DNS_T_AXFR = 252,
 	DNS_T_ALL = 255
@@ -113,11 +119,15 @@ struct dns_head {
 	unsigned short nrcount; /* number of addititional resource entries */
 } __attribute__((packed, aligned(2)));

-struct dns_rrs {
-	unsigned short next;
-	unsigned short len;
-	dns_type_t type;
-	unsigned char data[0];
+#define DNS_PACKET_DICT_SIZE 16
+struct dns_packet_dict_item {
+	unsigned pos;
+	unsigned int hash;
+};
+
+struct dns_packet_dict {
+	short dict_count;
+	struct dns_packet_dict_item names[DNS_PACKET_DICT_SIZE];
 };

 /* packet haed */
@@ -130,21 +140,24 @@ struct dns_packet {
 	unsigned short optcount;
 	unsigned short optional;
 	unsigned short payloadsize;
+	struct dns_packet_dict namedict;
 	int size;
 	int len;
 	unsigned char data[0];
 };

-/* RRS encode/decode context */
-struct dns_data_context {
-	unsigned char *data;
-	unsigned char *ptr;
-	unsigned int maxsize;
+struct dns_rrs {
+	struct dns_packet *packet;
+	unsigned short next;
+	unsigned short len;
+	dns_type_t type;
+	unsigned char data[0];
 };

 /* packet encode/decode context */
 struct dns_context {
 	struct dns_packet *packet;
+	struct dns_packet_dict *namedict;
 	unsigned char *data;
 	unsigned int maxsize;
 	unsigned char *ptr;
@@ -170,7 +183,7 @@ struct dns_opt_ecs {
 	unsigned char source_prefix;
 	unsigned char scope_prefix;
 	unsigned char addr[DNS_RR_AAAA_LEN];
-};
+} __attribute__((packed));;

 /* OPT COOLIE */
 struct dns_opt_cookie {
@@ -234,4 +247,12 @@ int dns_encode(unsigned char *data, int size, struct dns_packet *packet);

 int dns_packet_init(struct dns_packet *packet, int size, struct dns_head *head);

+struct dns_update_param {
+	int id;
+	int ip_ttl;
+	int cname_ttl;
+};
+
+int dns_packet_update(unsigned char *data, int size, struct dns_update_param *param);
+
 #endif
--- a/src/dns_cache.c
+++ b/src/dns_cache.c
@@ -162,6 +162,11 @@ void dns_cache_set_data_soa(struct dns_cache_data *dns_cache, int32_t cache_flag
 		goto errout;
 	}

+	dns_cache->head.is_soa = 1;
+	if (dns_cache->head.cache_type == CACHE_TYPE_PACKET) {
+		return;
+	}
+
 	struct dns_cache_addr *cache_addr = (struct dns_cache_addr *)dns_cache;
 	if (cache_addr == NULL) {
 		goto errout;
@@ -229,6 +234,7 @@ struct dns_cache_data *dns_cache_new_data_packet(uint32_t cache_flag, void *pack
 	}

 	memcpy(cache_packet->data, packet, packet_len);
+	memset(&cache_packet->head, 0, sizeof(cache_packet->head));

 	cache_packet->head.cache_flag = cache_flag;
 	cache_packet->head.cache_type = CACHE_TYPE_PACKET;
@@ -237,7 +243,8 @@ struct dns_cache_data *dns_cache_new_data_packet(uint32_t cache_flag, void *pack
 	return (struct dns_cache_data *)cache_packet;
 }

-int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+int _dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, int inactive,
+					   struct dns_cache_data *cache_data)
 {
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache_data *old_cache_data = NULL;
@@ -263,11 +270,19 @@ int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	dns_cache->info.qtype = qtype;
 	dns_cache->info.ttl = ttl;
 	dns_cache->info.speed = speed;
-	time(&dns_cache->info.insert_time);
 	old_cache_data = dns_cache->cache_data;
 	dns_cache->cache_data = cache_data;
 	list_del_init(&dns_cache->list);
-	list_add_tail(&dns_cache->list, &dns_cache_head.cache_list);
+
+	if (inactive == 0) {
+		time(&dns_cache->info.insert_time);
+		time(&dns_cache->info.replace_time);
+		list_add_tail(&dns_cache->list, &dns_cache_head.cache_list);
+	} else {
+		time(&dns_cache->info.replace_time);
+		list_add_tail(&dns_cache->list, &dns_cache_head.inactive_list);
+	}
+
 	pthread_mutex_unlock(&dns_cache_head.lock);

 	dns_cache_data_free(old_cache_data);
@@ -275,6 +290,16 @@ int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	return 0;
 }

+int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+{
+	return _dns_cache_replace(domain, ttl, qtype, speed, 0, cache_data);
+}
+
+int dns_cache_replace_inactive(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data)
+{
+	return _dns_cache_replace(domain, ttl, qtype, speed, 1, cache_data);
+}
+
 int _dns_cache_insert(struct dns_cache_info *info, struct dns_cache_data *cache_data, struct list_head *head)
 {
 	uint32_t key = 0;
@@ -348,6 +373,7 @@ int dns_cache_insert(char *domain, int ttl, dns_type_t qtype, int speed, struct
 	info.hitnum_update_add = DNS_CACHE_HITNUM_STEP;
 	info.speed = speed;
 	time(&info.insert_time);
+	time(&info.replace_time);

 	return _dns_cache_insert(&info, cache_data, &dns_cache_head.cache_list);
 }
@@ -412,7 +438,7 @@ int dns_cache_get_ttl(struct dns_cache *dns_cache)
 	return ttl;
 }

-int dns_cache_get_cname_ttl(struct dns_cache *dns_cache) 
+int dns_cache_get_cname_ttl(struct dns_cache *dns_cache)
 {
 	time_t now;
 	int ttl = 0;
@@ -438,19 +464,19 @@ int dns_cache_get_cname_ttl(struct dns_cache *dns_cache)
 		return 0;
 	}

-	return ttl;	
+	return ttl;
 }

-int dns_cache_is_soa(struct dns_cache *dns_cache) 
+int dns_cache_is_soa(struct dns_cache *dns_cache)
 {
 	if (dns_cache == NULL) {
 		return 0;
 	}

-	struct dns_cache_addr *cache_addr = (struct dns_cache_addr *)dns_cache_get_data(dns_cache);
-	if (cache_addr->head.cache_type == CACHE_TYPE_ADDR && cache_addr->addr_data.soa) {
+	if (dns_cache->cache_data->head.is_soa) {
 		return 1;
 	}
+
 	return 0;
 }

@@ -496,12 +522,16 @@ void dns_cache_update(struct dns_cache *dns_cache)
 	pthread_mutex_unlock(&dns_cache_head.lock);
 }

-void _dns_cache_remove_expired_ttl(time_t *now)
+void _dns_cache_remove_expired_ttl(dns_cache_callback inactive_precallback, int ttl_inactive_pre,
+								   unsigned int max_callback_num, time_t *now)
 {
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache *tmp;
+	int callback_num = 0;
 	int ttl = 0;
+	LIST_HEAD(checklist);

+	pthread_mutex_lock(&dns_cache_head.lock);
 	list_for_each_entry_safe(dns_cache, tmp, &dns_cache_head.inactive_list, list)
 	{
 		ttl = dns_cache->info.insert_time + dns_cache->info.ttl - *now;
@@ -509,21 +539,55 @@ void _dns_cache_remove_expired_ttl(time_t *now)
 			continue;
 		}

-		if (dns_cache_head.inactive_list_expired + ttl > 0) {
+		if (dns_cache_head.inactive_list_expired + ttl < 0) {
+			_dns_cache_remove(dns_cache);
 			continue;
 		}

-		_dns_cache_remove(dns_cache);
+		ttl = *now - dns_cache->info.replace_time;
+		if (ttl < ttl_inactive_pre || inactive_precallback == NULL) {
+			continue;
+		}
+
+		if (callback_num >= max_callback_num) {
+			continue;
+		}
+
+		if (dns_cache->del_pending == 1) {
+			continue;
+		}
+
+		/* If the TTL time is in the pre-timeout range, call callback function */
+		dns_cache_get(dns_cache);
+		list_add_tail(&dns_cache->check_list, &checklist);
+		dns_cache->del_pending = 1;
+		callback_num++;
+	}
+	pthread_mutex_unlock(&dns_cache_head.lock);
+
+	list_for_each_entry_safe(dns_cache, tmp, &checklist, check_list)
+	{
+		/* run inactive_precallback */
+		if (inactive_precallback) {
+			inactive_precallback(dns_cache);
+		}
+		dns_cache_release(dns_cache);
 	}
 }

-void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre)
+void dns_cache_invalidate(dns_cache_callback precallback, int ttl_pre, unsigned int max_callback_num,
+						  dns_cache_callback inactive_precallback, int ttl_inactive_pre)
 {
 	struct dns_cache *dns_cache = NULL;
 	struct dns_cache *tmp;
 	time_t now;
 	int ttl = 0;
 	LIST_HEAD(checklist);
+	int callback_num = 0;
+
+	if (max_callback_num <= 0) {
+		max_callback_num = -1;
+	}

 	if (dns_cache_head.size <= 0) {
 		return;
@@ -536,35 +600,36 @@ void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre)
 		ttl = dns_cache->info.insert_time + dns_cache->info.ttl - now;
 		if (ttl > 0 && ttl < ttl_pre) {
 			/* If the TTL time is in the pre-timeout range, call callback function */
-			if (callback && dns_cache->del_pending == 0) {
+			if (precallback && dns_cache->del_pending == 0 && callback_num < max_callback_num) {
 				list_add_tail(&dns_cache->check_list, &checklist);
 				dns_cache_get(dns_cache);
 				dns_cache->del_pending = 1;
+				callback_num++;
 				continue;
 			}
 		}

 		if (ttl < 0) {
-			if (dns_cache_head.enable_inactive && (dns_cache_is_soa(dns_cache) == 0)) {
+			if (dns_cache_head.enable_inactive) {
 				_dns_cache_move_inactive(dns_cache);
 			} else {
 				_dns_cache_remove(dns_cache);
 			}
 		}
 	}
+	pthread_mutex_unlock(&dns_cache_head.lock);

 	if (dns_cache_head.enable_inactive && dns_cache_head.inactive_list_expired != 0) {
-		_dns_cache_remove_expired_ttl(&now);
+		_dns_cache_remove_expired_ttl(inactive_precallback, ttl_inactive_pre, max_callback_num, &now);
 	}

-	pthread_mutex_unlock(&dns_cache_head.lock);
-
 	list_for_each_entry_safe(dns_cache, tmp, &checklist, check_list)
 	{
 		/* run callback */
-		if (callback) {
-			callback(dns_cache);
+		if (precallback) {
+			precallback(dns_cache);
 		}
+		list_del(&dns_cache->check_list);
 		dns_cache_release(dns_cache);
 	}
 }
@@ -642,11 +707,16 @@ int dns_cache_load(const char *file)
 {
 	int fd = -1;
 	int ret = 0;
+	size_t filesize;
 	fd = open(file, O_RDONLY);
 	if (fd < 0) {
 		return 0;
 	}

+	filesize = lseek(fd, 0, SEEK_END);
+	lseek(fd, 0, SEEK_SET);
+	posix_fadvise(fd, 0, filesize, POSIX_FADV_WILLNEED | POSIX_FADV_SEQUENTIAL);
+
 	struct dns_cache_file cache_file;
 	ret = read(fd, &cache_file, sizeof(cache_file));
 	if (ret != sizeof(cache_file)) {
@@ -664,6 +734,7 @@ int dns_cache_load(const char *file)
 		goto errout;
 	}

+	tlog(TLOG_INFO, "load cache file %s, total %d records", file, cache_file.cache_number);
 	if (_dns_cache_read_record(fd, cache_file.cache_number) != 0) {
 		goto errout;
 	}
--- a/src/dns_cache.h
+++ b/src/dns_cache.h
@@ -50,6 +50,7 @@ enum CACHE_RECORD_TYPE {
 struct dns_cache_data_head {
 	uint32_t cache_flag;
 	enum CACHE_TYPE cache_type;
+	int is_soa;
 	size_t size;
 };

@@ -84,6 +85,7 @@ struct dns_cache_info {
 	int speed;
 	int hitnum_update_add;
 	time_t insert_time;
+	time_t replace_time;
 	dns_type_t qtype;
 };

@@ -123,6 +125,8 @@ int dns_cache_init(int size, int enable_inactive, int inactive_list_expired);

 int dns_cache_replace(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);

+int dns_cache_replace_inactive(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);
+
 int dns_cache_insert(char *domain, int ttl, dns_type_t qtype, int speed, struct dns_cache_data *cache_data);

 struct dns_cache *dns_cache_lookup(char *domain, dns_type_t qtype);
@@ -137,9 +141,10 @@ int dns_cache_hitnum_dec_get(struct dns_cache *dns_cache);

 void dns_cache_update(struct dns_cache *dns_cache);

-typedef void dns_cache_preinvalid_callback(struct dns_cache *dns_cache);
+typedef void dns_cache_callback(struct dns_cache *dns_cache);

-void dns_cache_invalidate(dns_cache_preinvalid_callback callback, int ttl_pre);
+void dns_cache_invalidate(dns_cache_callback precallback, int ttl_pre, unsigned int max_callback_num,
+						  dns_cache_callback inactive_precallback, int ttl_inactive_pre);

 int dns_cache_get_ttl(struct dns_cache *dns_cache);

--- a/src/dns_client.c
+++ b/src/dns_client.c
@@ -58,7 +58,7 @@
 #define DNS_TCP_IDLE_TIMEOUT (60 * 10)
 #define DNS_TCP_CONNECT_TIMEOUT (5)
 #define DNS_QUERY_TIMEOUT (500)
-#define DNS_QUERY_RETRY (6)
+#define DNS_QUERY_RETRY (4)
 #define DNS_PENDING_SERVER_RETRY 40
 #define SOCKET_PRIORITY (6)
 #define SOCKET_IP_TOS (IPTOS_LOWDELAY | IPTOS_RELIABILITY)
@@ -66,13 +66,7 @@
 /* ECS info */
 struct dns_client_ecs {
 	int enable;
-	unsigned int family;
-	unsigned int bitlen;
-	union {
-		unsigned char ipv4_addr[DNS_RR_A_LEN];
-		unsigned char ipv6_addr[DNS_RR_AAAA_LEN];
-		unsigned char addr[0];
-	};
+	struct dns_opt_ecs ecs;
 };

 /* TCP/TLS buffer */
@@ -117,6 +111,7 @@ struct dns_server_info {

 	time_t last_send;
 	time_t last_recv;
+	int prohibit;

 	/* server addr info */
 	unsigned short ai_family;
@@ -243,6 +238,9 @@ struct dns_query_struct {
 	/* has result */
 	int has_result;

+	/* ECS */
+	struct dns_client_ecs ecs;
+
 	/* replied hash table */
 	DECLARE_HASHTABLE(replied_map, 4);
 };
@@ -343,6 +341,42 @@ SSL_SESSION *_ssl_get1_session(struct dns_server_info *server)
 	return ret;
 }

+unsigned int dns_client_server_result_flag(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return 0;
+	}
+
+	return server_info->flags.result_flag;
+}
+
+const char *dns_client_get_server_ip(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return NULL;
+	}
+
+	return server_info->ip;
+}
+
+int dns_client_get_server_port(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return 0;
+	}
+
+	return server_info->port;
+}
+
+dns_server_type_t dns_client_get_server_type(struct dns_server_info *server_info)
+{
+	if (server_info == NULL) {
+		return DNS_SERVER_TYPE_END;
+	}
+
+	return server_info->type;
+}
+
 const char *_dns_server_get_type_string(dns_server_type_t type)
 {
 	const char *type_str = "";
@@ -419,7 +453,7 @@ static int _dns_client_server_exist(const char *server_ip, int port, dns_server_

 static void _dns_client_server_update_ttl(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 										  struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl,
-										  struct timeval *tv, void *userptr)
+										  struct timeval *tv, int error, void *userptr)
 {
 	struct dns_server_info *server_info = userptr;
 	if (result != PING_RESULT_RESPONSE || server_info == NULL) {
@@ -907,7 +941,7 @@ SSL_CTX *_ssl_ctx_get(void)
 	pthread_mutex_unlock(&client.server_list_lock);
 	return client.ssl_ctx;
 errout:
-	
+
 	pthread_mutex_unlock(&client.server_list_lock);
 	if (ssl_ctx) {
 		SSL_CTX_free(ssl_ctx);
@@ -1004,6 +1038,7 @@ static int _dns_client_server_add(char *server_ip, char *server_host, int port,
 	server_info->ttl = ttl;
 	server_info->ttl_range = 0;
 	server_info->skip_check_cert = skip_check_cert;
+	server_info->prohibit = 0;
 	pthread_mutex_init(&server_info->lock, NULL);
 	memcpy(&server_info->flags, flags, sizeof(server_info->flags));

@@ -1211,6 +1246,8 @@ void _dns_client_server_pending_get(struct dns_server_pending *pending)

 void _dns_client_server_pending_release_lck(struct dns_server_pending *pending)
 {
+	struct dns_server_pending_group *group, *tmp;
+
 	int refcnt = atomic_dec_return(&pending->refcnt);

 	if (refcnt) {
@@ -1221,6 +1258,12 @@ void _dns_client_server_pending_release_lck(struct dns_server_pending *pending)
 		return;
 	}

+	list_for_each_entry_safe(group, tmp, &pending->group_list, list)
+	{
+		list_del_init(&group->list);
+		free(group);
+	}
+
 	list_del_init(&pending->list);
 	free(pending);
 }
@@ -1353,6 +1396,8 @@ static void _dns_client_query_release(struct dns_query_struct *query)

 	/* notify caller query end */
 	if (query->callback) {
+		tlog(TLOG_DEBUG, "result: %s, qtype: %d, hasresult: %d, id %d", query->domain, query->qtype, query->has_result,
+			 query->sid);
 		query->callback(query->domain, DNS_QUERY_END, 0, NULL, NULL, 0, query->user_ptr);
 	}

@@ -1607,8 +1652,8 @@ static int _dns_client_recv(struct dns_server_info *server_info, unsigned char *

 	/* notify caller dns query result */
 	if (query->callback) {
-		ret = query->callback(query->domain, DNS_QUERY_RESULT, server_info->flags.result_flag, packet, inpacket,
-							  inpacket_len, query->user_ptr);
+		ret = query->callback(query->domain, DNS_QUERY_RESULT, server_info, packet, inpacket, inpacket_len,
+							  query->user_ptr);
 		if (request_num == 0 || ret) {
 			/* if all server replied, or done, stop query, release resource */
 			_dns_client_query_remove(query);
@@ -2152,6 +2197,7 @@ static int _dns_client_process_tcp_buff(struct dns_server_info *server_info)
 		}

 		tlog(TLOG_DEBUG, "recv tcp packet from %s, len = %d", server_info->ip, len);
+		time(&server_info->last_recv);
 		/* process result */
 		if (_dns_client_recv(server_info, inpacket_data, dns_packet_len, &server_info->addr, server_info->ai_addrlen) !=
 			0) {
@@ -2230,7 +2276,6 @@ static int _dns_client_process_tcp(struct dns_server_info *server_info, struct e
 			return ret;
 		}

-		time(&server_info->last_recv);
 		server_info->recv_buff.len += len;
 		if (server_info->recv_buff.len <= 2) {
 			/* wait and recv */
@@ -2787,6 +2832,14 @@ static int _dns_client_send_packet(struct dns_query_struct *query, void *packet,
 		list_for_each_entry_safe(group_member, tmp, &query->server_group->head, list)
 		{
 			server_info = group_member->server;
+			if (server_info->prohibit) {
+				time_t now;
+				time(&now);
+				if ((now - 60 < server_info->last_send) && (now - 5 > server_info->last_recv)) {
+					continue;
+				}
+				server_info->prohibit = 0;
+			}
 			total_server++;
 			tlog(TLOG_DEBUG, "send query to server %s", server_info->ip);
 			if (server_info->fd <= 0) {
@@ -2838,6 +2891,8 @@ static int _dns_client_send_packet(struct dns_query_struct *query, void *packet,
 				time_t now;
 				time(&now);
 				if (now - 5 > server_info->last_recv || send_err != ENOMEM) {
+					server_info->prohibit = 1;
+					tlog(TLOG_INFO, "server %s not alive, prohibit", server_info->ip);
 					_dns_client_shutdown_socket(server_info);
 				}

@@ -2861,24 +2916,13 @@ static int _dns_client_send_packet(struct dns_query_struct *query, void *packet,
 	return 0;
 }

-static int _dns_client_dns_add_ecs(struct dns_packet *packet, int qtype)
+static int _dns_client_dns_add_ecs(struct dns_query_struct *query, struct dns_packet *packet)
 {
-	if (qtype == DNS_T_A && client.ecs_ipv4.enable) {
-		struct dns_opt_ecs ecs;
-		ecs.family = DNS_ADDR_FAMILY_IP;
-		ecs.source_prefix = client.ecs_ipv4.bitlen;
-		ecs.scope_prefix = 0;
-		memcpy(ecs.addr, client.ecs_ipv4.ipv4_addr, DNS_RR_A_LEN);
-		return dns_add_OPT_ECS(packet, &ecs);
-	} else if (qtype == DNS_T_AAAA && client.ecs_ipv6.enable) {
-		struct dns_opt_ecs ecs;
-		ecs.family = DNS_ADDR_FAMILY_IPV6;
-		ecs.source_prefix = client.ecs_ipv6.bitlen;
-		ecs.scope_prefix = 0;
-		memcpy(ecs.addr, client.ecs_ipv6.ipv6_addr, DNS_RR_AAAA_LEN);
-		return dns_add_OPT_ECS(packet, &ecs);
+	if (query->ecs.enable == 0) {
+		return 0;
 	}
-	return 0;
+
+	return dns_add_OPT_ECS(packet, &query->ecs.ecs);
 }

 static int _dns_client_send_query(struct dns_query_struct *query, char *doamin)
@@ -2912,7 +2956,7 @@ static int _dns_client_send_query(struct dns_query_struct *query, char *doamin)

 	dns_set_OPT_payload_size(packet, DNS_IN_PACKSIZE);
 	/* dns_add_OPT_TCP_KEEYALIVE(packet, 600); */
-	if (_dns_client_dns_add_ecs(packet, query->qtype) != 0) {
+	if (_dns_client_dns_add_ecs(query, packet) != 0) {
 		tlog(TLOG_ERROR, "add ecs failed.");
 		return -1;
 	}
@@ -2934,7 +2978,102 @@ static int _dns_client_send_query(struct dns_query_struct *query, char *doamin)
 	return _dns_client_send_packet(query, inpacket, encode_len);
 }

-int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name)
+int _dns_client_query_setup_default_ecs(struct dns_query_struct *query)
+{
+	int add_ipv4_ecs = 0;
+	int add_ipv6_ecs = 0;
+
+	if (query->qtype == DNS_T_A && client.ecs_ipv4.enable) {
+		add_ipv4_ecs = 1;
+	} else if (query->qtype == DNS_T_AAAA && client.ecs_ipv6.enable) {
+		add_ipv6_ecs = 1;
+	} else {
+		if (client.ecs_ipv4.enable) {
+			add_ipv4_ecs = 1;
+		} else if (client.ecs_ipv6.enable) {
+			add_ipv4_ecs = 1;
+		}
+	}
+
+	if (add_ipv4_ecs) {
+		memcpy(&query->ecs, &client.ecs_ipv4, sizeof(query->ecs));
+		return 0;
+	}
+
+	if (add_ipv6_ecs) {
+		memcpy(&query->ecs, &client.ecs_ipv6, sizeof(query->ecs));
+		return 0;
+	}
+
+	return 0;
+}
+
+int _dns_client_query_parser_options(struct dns_query_struct *query, struct dns_query_options *options)
+{
+	if (options == NULL) {
+		_dns_client_query_setup_default_ecs(query);
+		return 0;
+	}
+
+	if (options->enable_flag & DNS_QUEY_OPTION_ECS_IP) {
+		struct sockaddr_storage addr;
+		socklen_t addr_len = sizeof(addr);
+		struct dns_opt_ecs *ecs;
+
+		ecs = &query->ecs.ecs;
+		getaddr_by_host(options->ecs_ip.ip, (struct sockaddr *)&addr, &addr_len);
+
+		query->ecs.enable = 1;
+		ecs->source_prefix = options->ecs_ip.subnet;
+		ecs->scope_prefix = 0;
+
+		switch (addr.ss_family) {
+		case AF_INET: {
+			struct sockaddr_in *addr_in;
+			addr_in = (struct sockaddr_in *)&addr;
+			ecs->family = DNS_OPT_ECS_FAMILY_IPV4;
+			memcpy(&ecs->addr, &addr_in->sin_addr.s_addr, 4);
+		} break;
+		case AF_INET6: {
+			struct sockaddr_in6 *addr_in6;
+			addr_in6 = (struct sockaddr_in6 *)&addr;
+			if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+				memcpy(&ecs->addr, addr_in6->sin6_addr.s6_addr + 12, 4);
+				ecs->family = DNS_OPT_ECS_FAMILY_IPV4;
+			} else {
+				memcpy(&ecs->addr, addr_in6->sin6_addr.s6_addr, 16);
+				ecs->family = DNS_OPT_ECS_FAMILY_IPV6;
+			}
+		} break;
+		default:
+			tlog(TLOG_WARN, "ECS set failure.");
+			break;
+		}
+	}
+
+	if (options->enable_flag & DNS_QUEY_OPTION_ECS_DNS) {
+		struct dns_opt_ecs *ecs = &options->ecs_dns;
+		if (ecs->family != DNS_OPT_ECS_FAMILY_IPV6 && ecs->family != DNS_OPT_ECS_FAMILY_IPV4) {
+			return -1;
+		}
+
+		if (ecs->family == DNS_OPT_ECS_FAMILY_IPV4 && ecs->source_prefix > 32) {
+			return -1;
+		}
+
+		if (ecs->family == DNS_OPT_ECS_FAMILY_IPV6 && ecs->source_prefix > 128) {
+			return -1;
+		}
+
+		memcpy(&query->ecs.ecs, ecs, sizeof(query->ecs.ecs));
+		query->ecs.enable = 1;
+	}
+
+	return 0;
+}
+
+int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name,
+					 struct dns_query_options *options)
 {
 	struct dns_query_struct *query = NULL;
 	int ret = 0;
@@ -2969,6 +3108,11 @@ int dns_client_query(char *domain, int qtype, dns_client_callback callback, void
 		goto errout;
 	}

+	if (_dns_client_query_parser_options(query, options) != 0) {
+		tlog(TLOG_ERROR, "parser options for %s failed.", domain);
+		goto errout;
+	}
+
 	_dns_client_query_get(query);
 	/* add query to hashtable */
 	key = hash_string(domain);
@@ -3080,6 +3224,19 @@ static int _dns_client_add_pendings(struct dns_server_pending *pending, char *ip
 	return 0;
 }

+static void _dns_client_remove_all_pending_servers(void)
+{
+	struct dns_server_pending *pending, *tmp;
+
+	pthread_mutex_lock(&pending_server_mutex);
+	list_for_each_entry_safe(pending, tmp, &pending_servers, list)
+	{
+		list_del_init(&pending->list);
+		_dns_client_server_pending_release_lck(pending);
+	}
+	pthread_mutex_unlock(&pending_server_mutex);
+}
+
 static void _dns_client_add_pending_servers(void)
 {
 	struct dns_server_pending *pending, *tmp;
@@ -3141,7 +3298,7 @@ static void _dns_client_add_pending_servers(void)
 			list_del_init(&pending->list);
 			_dns_client_server_pending_release_lck(pending);
 		} else {
-			tlog(TLOG_DEBUG, "add pending DNS server %s failed, retry %d...", pending->host, pending->retry_cnt);
+			tlog(TLOG_INFO, "add pending DNS server %s failed, retry %d...", pending->host, pending->retry_cnt);
 			pending->query_v4 = 0;
 			pending->query_v6 = 0;
 		}
@@ -3196,8 +3353,11 @@ static void _dns_client_period_run(void)
 		_dns_client_check_udp_nat(query);
 		if (atomic_dec_and_test(&query->retry_count) || (query->has_result != 0)) {
 			_dns_client_query_remove(query);
+			if (query->has_result == 0) {
+				tlog(TLOG_INFO, "retry query %s, type: %d, id: %d failed", query->domain, query->qtype, query->sid);
+			}
 		} else {
-			tlog(TLOG_DEBUG, "retry query %s", query->domain);
+			tlog(TLOG_INFO, "retry query %s, type: %d, id: %d", query->domain, query->qtype, query->sid);
 			_dns_client_send_query(query, query->domain);
 		}
 		_dns_client_query_release(query);
@@ -3261,6 +3421,39 @@ static void *_dns_client_work(void *arg)

 int dns_client_set_ecs(char *ip, int subnet)
 {
+	struct sockaddr_storage addr;
+	socklen_t addr_len = sizeof(addr);
+	getaddr_by_host(ip, (struct sockaddr *)&addr, &addr_len);
+
+	switch (addr.ss_family) {
+	case AF_INET: {
+		struct sockaddr_in *addr_in;
+		addr_in = (struct sockaddr_in *)&addr;
+		memcpy(&client.ecs_ipv4.ecs.addr, &addr_in->sin_addr.s_addr, 4);
+		client.ecs_ipv4.ecs.source_prefix = subnet;
+		client.ecs_ipv4.ecs.scope_prefix = 0;
+		client.ecs_ipv4.ecs.family = DNS_OPT_ECS_FAMILY_IPV4;
+		client.ecs_ipv4.enable = 1;
+	} break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			client.ecs_ipv4.ecs.source_prefix = subnet;
+			client.ecs_ipv4.ecs.scope_prefix = 0;
+			client.ecs_ipv4.ecs.family = DNS_OPT_ECS_FAMILY_IPV4;
+			client.ecs_ipv4.enable = 1;
+		} else {
+			memcpy(&client.ecs_ipv6.ecs.addr, addr_in6->sin6_addr.s6_addr, 16);
+			client.ecs_ipv6.ecs.source_prefix = subnet;
+			client.ecs_ipv6.ecs.scope_prefix = 0;
+			client.ecs_ipv6.ecs.family = DNS_ADDR_FAMILY_IPV6;
+			client.ecs_ipv6.enable = 1;
+		}
+	} break;
+	default:
+		return -1;
+	}
 	return 0;
 }

@@ -3335,6 +3528,7 @@ void dns_client_exit(void)
 	}

 	/* free all resouces */
+	_dns_client_remove_all_pending_servers();
 	_dns_client_server_remove_all();
 	_dns_client_query_remove_all();
 	_dns_client_group_remove_all();
--- a/src/dns_client.h
+++ b/src/dns_client.h
@@ -47,17 +47,41 @@ typedef enum dns_result_type {
 #define DNSSERVER_FLAG_CHECK_EDNS (0x1 << 2)
 #define DNSSERVER_FLAG_CHECK_TTL (0x1 << 3)

+#define DNS_QUEY_OPTION_ECS_DNS (1 << 0)
+#define DNS_QUEY_OPTION_ECS_IP (1 << 1)
+
 int dns_client_init(void);

 int dns_client_set_ecs(char *ip, int subnet);

+struct dns_server_info;
 /* query result notify function */
-typedef int (*dns_client_callback)(char *domain, dns_result_type rtype, unsigned int result_flag,
+typedef int (*dns_client_callback)(char *domain, dns_result_type rtype, struct dns_server_info *server_info,
 								   struct dns_packet *packet, unsigned char *inpacket, int inpacket_len,
 								   void *user_ptr);

+unsigned int dns_client_server_result_flag(struct dns_server_info *server_info);
+
+const char *dns_client_get_server_ip(struct dns_server_info *server_info);
+
+int dns_client_get_server_port(struct dns_server_info *server_info);
+
+dns_server_type_t dns_client_get_server_type(struct dns_server_info *server_info);
+
+struct dns_query_ecs_ip {
+	char ip[DNS_MAX_CNAME_LEN];
+	int subnet;
+};
+
+struct dns_query_options {
+	unsigned long long enable_flag;
+	struct dns_opt_ecs ecs_dns;
+	struct dns_query_ecs_ip ecs_ip;
+};
+
 /* query domain */
-int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name);
+int dns_client_query(char *domain, int qtype, dns_client_callback callback, void *user_ptr, const char *group_name,
+					 struct dns_query_options *options);

 void dns_client_exit(void);

--- a/src/dns_conf.c
+++ b/src/dns_conf.c
@@ -21,6 +21,7 @@
 #include "rbtree.h"
 #include "tlog.h"
 #include "util.h"
+#include <errno.h>
 #include <getopt.h>
 #include <libgen.h>
 #include <stdio.h>
@@ -30,6 +31,7 @@
 #include <unistd.h>

 #define DEFAULT_DNS_CACHE_SIZE 512
+#define DNS_MAX_REPLY_IP_NUM 8

 /* ipset */
 struct dns_ipset_table {
@@ -42,26 +44,41 @@ struct dns_qtype_soa_table dns_qtype_soa_table;
 /* dns groups */
 struct dns_group_table dns_group_table;

+struct dns_ptr_table dns_ptr_table;
+
+char dns_conf_dnsmasq_lease_file[DNS_MAX_PATH];
+time_t dns_conf_dnsmasq_lease_file_time;
+
+struct dns_hosts_table dns_hosts_table;
+int dns_hosts_record_num;
+
 /* server ip/port  */
 struct dns_bind_ip dns_conf_bind_ip[DNS_MAX_BIND_IP];
 int dns_conf_bind_ip_num = 0;
 int dns_conf_tcp_idle_time = 120;

+int dns_conf_max_reply_ip_num = DNS_MAX_REPLY_IP_NUM;
+
 /* cache */
 int dns_conf_cachesize = DEFAULT_DNS_CACHE_SIZE;
 int dns_conf_prefetch = 0;
-int dns_conf_serve_expired = 0;
-int dns_conf_serve_expired_ttl = 0;
-int dns_conf_serve_expired_reply_ttl = 5;
+int dns_conf_serve_expired = 1;
+int dns_conf_serve_expired_ttl = 24 * 3600; /* 1 day */
+int dns_conf_serve_expired_prefetch_time;
+int dns_conf_serve_expired_reply_ttl = 3;

 /* upstream servers */
 struct dns_servers dns_conf_servers[DNS_MAX_SERVERS];
 char dns_conf_server_name[DNS_MAX_SERVER_NAME_LEN];
 int dns_conf_server_num;

-struct dns_domain_check_order dns_conf_check_order = {
-	.order = {DOMAIN_CHECK_ICMP, DOMAIN_CHECK_TCP},
-	.tcp_port = 80,
+struct dns_domain_check_orders dns_conf_check_orders = {
+	.orders =
+		{
+			{.type = DOMAIN_CHECK_ICMP, .tcp_port = 0},
+			{.type = DOMAIN_CHECK_TCP, .tcp_port = 80},
+			{.type = DOMAIN_CHECK_TCP, .tcp_port = 443},
+		},
 };
 int dns_has_cap_ping = 0;

@@ -90,17 +107,21 @@ art_tree dns_conf_domain_rule;
 struct dns_conf_address_rule dns_conf_address_rule;

 /* dual-stack selection */
-int dns_conf_dualstack_ip_selection;
-int dns_conf_dualstack_ip_selection_threshold = 30;
+int dns_conf_dualstack_ip_selection = 1;
+int dns_conf_dualstack_ip_allow_force_AAAA;
+int dns_conf_dualstack_ip_selection_threshold = 15;

 /* TTL */
 int dns_conf_rr_ttl;
-int dns_conf_rr_ttl_min;
+int dns_conf_rr_ttl_reply_max;
+int dns_conf_rr_ttl_min = 600;
 int dns_conf_rr_ttl_max;
 int dns_conf_force_AAAA_SOA;
-
+int dns_conf_force_no_cname;
 int dns_conf_ipset_timeout_enable;

+char dns_conf_user[DNS_CONF_USRNAME_LEN];
+
 /* ECS */
 struct dns_edns_client_subnet dns_conf_ipv4_ecs;
 struct dns_edns_client_subnet dns_conf_ipv6_ecs;
@@ -812,7 +833,7 @@ errout:
 	return 0;
 }

-static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_order, const char *mode)
+static int _config_speed_check_mode_parser(struct dns_domain_check_orders *check_orders, const char *mode)
 {
 	char tmpbuff[DNS_MAX_OPT_LEN];
 	char *field;
@@ -822,7 +843,7 @@ static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_
 	int i = 0;

 	safe_strncpy(tmpbuff, mode, DNS_MAX_OPT_LEN);
-	memset(check_order, 0, sizeof(*check_order));
+	memset(check_orders, 0, sizeof(*check_orders));

 	ptr = tmpbuff;
 	do {
@@ -843,7 +864,8 @@ static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_
 				}
 				continue;
 			}
-			check_order->order[order] = DOMAIN_CHECK_ICMP;
+			check_orders->orders[order].type = DOMAIN_CHECK_ICMP;
+			check_orders->orders[order].tcp_port = 0;
 		} else if (strstr(field, "tcp") == field) {
 			char *port_str = strstr(field, ":");
 			if (port_str) {
@@ -853,12 +875,12 @@ static int _config_speed_check_mode_parser(struct dns_domain_check_order *check_
 				}
 			}

-			check_order->order[order] = DOMAIN_CHECK_TCP;
-			check_order->tcp_port = port;
+			check_orders->orders[order].type = DOMAIN_CHECK_TCP;
+			check_orders->orders[order].tcp_port = port;
 		} else if (strncmp(field, "none", sizeof("none")) == 0) {
-			check_order->order[order] = DOMAIN_CHECK_NONE;
-			for (i = order + 1; i < DOMAIN_CHECK_NUM; i++) {
-				check_order->order[i] = DOMAIN_CHECK_NONE;
+			for (i = order; i < DOMAIN_CHECK_NUM; i++) {
+				check_orders->orders[i].type = DOMAIN_CHECK_NONE;
+				check_orders->orders[i].tcp_port = 0;
 			}

 			return 0;
@@ -882,7 +904,7 @@ static int _config_speed_check_mode(void *data, int argc, char *argv[])
 	}

 	safe_strncpy(mode, argv[1], sizeof(mode));
-	return _config_speed_check_mode_parser(&dns_conf_check_order, mode);
+	return _config_speed_check_mode_parser(&dns_conf_check_orders, mode);
 }

 static int _config_bind_ip(int argc, char *argv[], DNS_BIND_TYPE type)
@@ -894,6 +916,7 @@ static int _config_bind_ip(int argc, char *argv[], DNS_BIND_TYPE type)
 	char group_name[DNS_GROUP_NAME_LEN];
 	const char *group = NULL;
 	unsigned int server_flag = 0;
+	int i = 0;

 	/* clang-format off */
 	static struct option long_options[] = {
@@ -921,6 +944,20 @@ static int _config_bind_ip(int argc, char *argv[], DNS_BIND_TYPE type)
 		return 0;
 	}

+	for (i = 0; i < dns_conf_bind_ip_num; i++) {
+		bind_ip = &dns_conf_bind_ip[i];
+		if (bind_ip->type != type) {
+			continue;
+		}
+
+		if (strncmp(bind_ip->ip, ip, DNS_MAX_IPLEN) != 0) {
+			continue;
+		}
+
+		tlog(TLOG_WARN, "Bind server %s, type %d, already configured, skip.", ip, type);
+		return 0;
+	}
+
 	bind_ip = &dns_conf_bind_ip[index];
 	bind_ip->type = type;
 	bind_ip->flags = 0;
@@ -1176,11 +1213,13 @@ static int _config_iplist_rule(char *subnet, enum address_rule rule)
 static int _config_qtype_soa(void *data, int argc, char *argv[])
 {
 	struct dns_qtype_soa_list *soa_list;
+	int i = 0;
+
 	if (argc <= 1) {
 		return -1;
 	}

-	for (int i = 1; i < argc; i++) {
+	for (i = 1; i < argc; i++) {
 		soa_list = malloc(sizeof(*soa_list));
 		if (soa_list == NULL) {
 			tlog(TLOG_ERROR, "cannot malloc memory");
@@ -1189,6 +1228,9 @@ static int _config_qtype_soa(void *data, int argc, char *argv[])

 		memset(soa_list, 0, sizeof(*soa_list));
 		soa_list->qtypeid = atol(argv[i]);
+		if (soa_list->qtypeid == DNS_T_AAAA) {
+			dns_conf_force_AAAA_SOA = 1;
+		}
 		uint32_t key = hash_32_generic(soa_list->qtypeid, 32);
 		hash_add(dns_qtype_soa_table.qtype, &soa_list->node, key);
 	}
@@ -1254,7 +1296,7 @@ static int _conf_edns_client_subnet(void *data, int argc, char *argv[])
 	struct sockaddr_storage addr;
 	socklen_t addr_len = sizeof(addr);

-	if (argc <= 1 || data == NULL) {
+	if (argc <= 1) {
 		return -1;
 	}

@@ -1297,25 +1339,26 @@ errout:

 static int _conf_domain_rule_speed_check(char *domain, const char *mode)
 {
-	struct dns_domain_check_order *check_order;
+	struct dns_domain_check_orders *check_orders = NULL;

-	check_order = malloc(sizeof(*check_order));
-	if (check_order == NULL) {
+	check_orders = malloc(sizeof(*check_orders) * DOMAIN_CHECK_NUM);
+	if (check_orders == NULL) {
+		goto errout;
+	}
+	memset(check_orders, 0, sizeof(*check_orders));
+
+	if (_config_speed_check_mode_parser(check_orders, mode) != 0) {
 		goto errout;
 	}

-	if (_config_speed_check_mode_parser(check_order, mode) != 0) {
-		goto errout;
-	}
-
-	if (_config_domain_rule_add(domain, DOMAIN_RULE_CHECKSPEED, check_order) != 0) {
+	if (_config_domain_rule_add(domain, DOMAIN_RULE_CHECKSPEED, check_orders) != 0) {
 		goto errout;
 	}

 	return 0;
 errout:
-	if (check_order) {
-		free(check_order);
+	if (check_orders) {
+		free(check_orders);
 	}
 	return 0;
 }
@@ -1426,6 +1469,342 @@ errout:
 	return -1;
 }

+static struct dns_ptr *_dns_conf_get_ptr(const char *ptr_domain)
+{
+	uint32_t key = 0;
+	struct dns_ptr *ptr = NULL;
+
+	key = hash_string(ptr_domain);
+	hash_for_each_possible(dns_ptr_table.ptr, ptr, node, key)
+	{
+		if (strncmp(ptr->ptr_domain, ptr_domain, DNS_MAX_PTR_LEN) != 0) {
+			continue;
+		}
+
+		return ptr;
+	}
+
+	ptr = malloc(sizeof(*ptr));
+	if (ptr == NULL) {
+		goto errout;
+	}
+
+	safe_strncpy(ptr->ptr_domain, ptr_domain, DNS_MAX_PTR_LEN);
+	hash_add(dns_ptr_table.ptr, &ptr->node, key);
+
+	return ptr;
+errout:
+	if (ptr) {
+		free(ptr);
+	}
+
+	return NULL;
+}
+
+static int _conf_ptr_add(const char *hostname, const char *ip)
+{
+	struct dns_ptr *ptr = NULL;
+	struct sockaddr_storage addr;
+	unsigned char *paddr;
+	socklen_t addr_len = sizeof(addr);
+	char ptr_domain[DNS_MAX_PTR_LEN];
+
+	if (getaddr_by_host(ip, (struct sockaddr *)&addr, &addr_len) != 0) {
+		goto errout;
+	}
+
+	switch (addr.ss_family) {
+	case AF_INET: {
+		struct sockaddr_in *addr_in;
+		addr_in = (struct sockaddr_in *)&addr;
+		paddr = (unsigned char *)&(addr_in->sin_addr.s_addr);
+		snprintf(ptr_domain, sizeof(ptr_domain), "%d.%d.%d.%d.in-addr.arpa", paddr[3], paddr[2], paddr[1], paddr[0]);
+	} break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			paddr = addr_in6->sin6_addr.s6_addr + 12;
+			snprintf(ptr_domain, sizeof(ptr_domain), "%d.%d.%d.%d.in-addr.arpa", paddr[3], paddr[2], paddr[1],
+					 paddr[0]);
+		} else {
+			paddr = addr_in6->sin6_addr.s6_addr;
+			snprintf(ptr_domain, sizeof(ptr_domain),
+					 "%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x."
+					 "%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x."
+					 "%x.ip6.arpa",
+					 paddr[15] & 0xF, (paddr[15] >> 4) & 0xF, paddr[14] & 0xF, (paddr[14] >> 4) & 0xF, paddr[13] & 0xF,
+					 (paddr[13] >> 4) & 0xF, paddr[12] & 0xF, (paddr[12] >> 4) & 0xF, paddr[11] & 0xF,
+					 (paddr[11] >> 4) & 0xF, paddr[10] & 0xF, (paddr[10] >> 4) & 0xF, paddr[9] & 0xF,
+					 (paddr[9] >> 4) & 0xF, paddr[8] & 0xF, (paddr[8] >> 4) & 0xF, paddr[7] & 0xF,
+					 (paddr[7] >> 4) & 0xF, paddr[6] & 0xF, (paddr[6] >> 4) & 0xF, paddr[5] & 0xF,
+					 (paddr[5] >> 4) & 0xF, paddr[4] & 0xF, (paddr[4] >> 4) & 0xF, paddr[3] & 0xF,
+					 (paddr[3] >> 4) & 0xF, paddr[2] & 0xF, (paddr[2] >> 4) & 0xF, paddr[1] & 0xF,
+					 (paddr[1] >> 4) & 0xF, paddr[0] & 0xF, (paddr[0] >> 4) & 0xF);
+		}
+	} break;
+	default:
+		goto errout;
+		break;
+	}
+
+	ptr = _dns_conf_get_ptr(ptr_domain);
+	if (ptr == NULL) {
+		goto errout;
+	}
+
+	safe_strncpy(ptr->hostname, hostname, DNS_MAX_CNAME_LEN);
+
+	return 0;
+
+errout:
+	return -1;
+}
+
+static void _config_ptr_table_destroy(void)
+{
+	struct dns_ptr *ptr = NULL;
+	struct hlist_node *tmp = NULL;
+	int i;
+
+	hash_for_each_safe(dns_ptr_table.ptr, i, tmp, ptr, node)
+	{
+		hlist_del_init(&ptr->node);
+		free(ptr);
+	}
+}
+
+static struct dns_hosts *_dns_conf_get_hosts(const char *hostname, int dns_type)
+{
+	uint32_t key = 0;
+	struct dns_hosts *host = NULL;
+	char hostname_lower[DNS_MAX_CNAME_LEN];
+
+	key = hash_string(to_lower_case(hostname_lower, hostname, DNS_MAX_CNAME_LEN));
+	key = jhash(&dns_type, sizeof(dns_type), key);
+	hash_for_each_possible(dns_hosts_table.hosts, host, node, key)
+	{
+		if (host->dns_type != dns_type) {
+			continue;
+		}
+		if (strncmp(host->domain, hostname_lower, DNS_MAX_CNAME_LEN) != 0) {
+			continue;
+		}
+
+		return host;
+	}
+
+	host = malloc(sizeof(*host));
+	if (host == NULL) {
+		goto errout;
+	}
+
+	safe_strncpy(host->domain, hostname_lower, DNS_MAX_CNAME_LEN);
+	host->dns_type = dns_type;
+	host->is_soa = 1;
+	hash_add(dns_hosts_table.hosts, &host->node, key);
+
+	return host;
+errout:
+	if (host) {
+		free(host);
+	}
+
+	return NULL;
+}
+
+static int _conf_host_add(const char *hostname, const char *ip, dns_hosts_type host_type)
+{
+	struct dns_hosts *host = NULL;
+	struct dns_hosts *host_other __attribute__((unused));
+	;
+	struct sockaddr_storage addr;
+	socklen_t addr_len = sizeof(addr);
+	int dns_type = 0;
+	int dns_type_other = 0;
+
+	if (getaddr_by_host(ip, (struct sockaddr *)&addr, &addr_len) != 0) {
+		goto errout;
+	}
+
+	switch (addr.ss_family) {
+	case AF_INET:
+		dns_type = DNS_T_A;
+		dns_type_other = DNS_T_AAAA;
+		break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			dns_type = DNS_T_A;
+			dns_type_other = DNS_T_AAAA;
+		} else {
+			dns_type = DNS_T_AAAA;
+			dns_type_other = DNS_T_A;
+		}
+	} break;
+	default:
+		goto errout;
+		break;
+	}
+
+	host = _dns_conf_get_hosts(hostname, dns_type);
+	if (host == NULL) {
+		goto errout;
+	}
+
+	/* add this to return SOA when addr is not exist */
+	host_other = _dns_conf_get_hosts(hostname, dns_type_other);
+
+	host->host_type = host_type;
+
+	switch (addr.ss_family) {
+	case AF_INET: {
+		struct sockaddr_in *addr_in;
+		addr_in = (struct sockaddr_in *)&addr;
+		memcpy(host->ipv4_addr, &addr_in->sin_addr.s_addr, 4);
+		host->is_soa = 0;
+	} break;
+	case AF_INET6: {
+		struct sockaddr_in6 *addr_in6;
+		addr_in6 = (struct sockaddr_in6 *)&addr;
+		if (IN6_IS_ADDR_V4MAPPED(&addr_in6->sin6_addr)) {
+			memcpy(host->ipv4_addr, addr_in6->sin6_addr.s6_addr + 12, 4);
+		} else {
+			memcpy(host->ipv6_addr, addr_in6->sin6_addr.s6_addr, 16);
+		}
+		host->is_soa = 0;
+	} break;
+	default:
+		goto errout;
+	}
+
+	dns_hosts_record_num++;
+	return 0;
+
+errout:
+	return -1;
+}
+
+static int _conf_dhcp_lease_dnsmasq_add(const char *file)
+{
+	FILE *fp = NULL;
+	char line[MAX_LINE_LEN];
+	char ip[DNS_MAX_IPLEN];
+	char hostname[DNS_MAX_CNAME_LEN];
+	int ret = 0;
+	int line_no = 0;
+	int filed_num;
+
+	fp = fopen(file, "r");
+	if (fp == NULL) {
+		tlog(TLOG_WARN, "open file %s error, %s", file, strerror(errno));
+		return 0;
+	}
+
+	line_no = 0;
+	while (fgets(line, MAX_LINE_LEN, fp)) {
+		line_no++;
+		filed_num = sscanf(line, "%*s %*s %64s %256s %*s", ip, hostname);
+		if (filed_num <= 0) {
+			continue;
+		}
+
+		if (strncmp(hostname, "*", DNS_MAX_CNAME_LEN) == 0) {
+			continue;
+		}
+
+		ret = _conf_host_add(hostname, ip, DNS_HOST_TYPE_DNSMASQ);
+		if (ret != 0) {
+			tlog(TLOG_WARN, "add host %s/%s at %d failed", hostname, ip, line_no);
+		}
+
+		ret = _conf_ptr_add(hostname, ip);
+		if (ret != 0) {
+			tlog(TLOG_WARN, "add ptr %s/%s at %d failed.", hostname, ip, line_no);
+		}
+	}
+
+	fclose(fp);
+
+	return 0;
+}
+
+static int _conf_dhcp_lease_dnsmasq_file(void *data, int argc, char *argv[])
+{
+	struct stat statbuf;
+
+	if (argc < 1) {
+		return -1;
+	}
+
+	safe_strncpy(dns_conf_dnsmasq_lease_file, argv[1], DNS_MAX_PATH);
+	if (_conf_dhcp_lease_dnsmasq_add(argv[1]) != 0) {
+		return -1;
+	}
+
+	if (stat(dns_conf_dnsmasq_lease_file, &statbuf) != 0) {
+		return 0;
+	}
+
+	dns_conf_dnsmasq_lease_file_time = statbuf.st_mtime;
+	return 0;
+}
+
+static int _conf_hosts_file(void *data, int argc, char *argv[])
+{
+	return 0;
+}
+
+static void _config_host_table_destroy(void)
+{
+	struct dns_hosts *host = NULL;
+	struct hlist_node *tmp = NULL;
+	int i;
+
+	hash_for_each_safe(dns_hosts_table.hosts, i, tmp, host, node)
+	{
+		hlist_del_init(&host->node);
+		free(host);
+	}
+
+	dns_hosts_record_num = 0;
+}
+
+int dns_server_check_update_hosts(void)
+{
+	struct stat statbuf;
+	time_t now;
+
+	if (dns_conf_dnsmasq_lease_file[0] == '\0') {
+		return -1;
+	}
+
+	if (stat(dns_conf_dnsmasq_lease_file, &statbuf) != 0) {
+		return -1;
+	}
+
+	if (dns_conf_dnsmasq_lease_file_time == statbuf.st_mtime) {
+		return -1;
+	}
+
+	time(&now);
+
+	if (now - statbuf.st_mtime < 30) {
+		return -1;
+	}
+
+	_config_ptr_table_destroy();
+	_config_host_table_destroy();
+
+	if (_conf_dhcp_lease_dnsmasq_add(dns_conf_dnsmasq_lease_file) != 0) {
+		return -1;
+	}
+
+	dns_conf_dnsmasq_lease_file_time = statbuf.st_mtime;
+	return 0;
+}
+
 static int _config_log_level(void *data, int argc, char *argv[])
 {
 	/* read log level and set */
@@ -1450,6 +1829,35 @@ static int _config_log_level(void *data, int argc, char *argv[])
 	return 0;
 }

+static void _config_setup_smartdns_domain(void)
+{
+	char hostname[DNS_MAX_CNAME_LEN];
+	/* get local host name */
+	if (getdomainname(hostname, DNS_MAX_CNAME_LEN) != 0) {
+		gethostname(hostname, DNS_MAX_CNAME_LEN);
+	}
+
+	/* get host name again */
+	if (strncmp(hostname, "(none)", DNS_MAX_CNAME_LEN) == 0) {
+		gethostname(hostname, DNS_MAX_CNAME_LEN);
+	}
+
+	/* if hostname is (none), return smartdns */
+	if (strncmp(hostname, "(none)", DNS_MAX_CNAME_LEN) == 0) {
+		safe_strncpy(hostname, "smartdns", DNS_MAX_CNAME_LEN);
+	}
+
+	if (hostname[0] != '\0') {
+		_config_domain_rule_flag_set(hostname, DOMAIN_FLAG_SMARTDNS_DOMAIN, 0);
+	}
+
+	if (dns_conf_server_name[0] != '\0') {
+		_config_domain_rule_flag_set(dns_conf_server_name, DOMAIN_FLAG_SMARTDNS_DOMAIN, 0);
+	}
+
+	_config_domain_rule_flag_set("smartdns", DOMAIN_FLAG_SMARTDNS_DOMAIN, 0);
+}
+
 static struct config_item _config_item[] = {
 	CONF_STRING("server-name", (char *)dns_conf_server_name, DNS_MAX_SERVER_NAME_LEN),
 	CONF_CUSTOM("bind", _config_bind_ip_udp, NULL),
@@ -1471,7 +1879,9 @@ static struct config_item _config_item[] = {
 	CONF_YESNO("serve-expired", &dns_conf_serve_expired),
 	CONF_INT("serve-expired-ttl", &dns_conf_serve_expired_ttl, 0, CONF_INT_MAX),
 	CONF_INT("serve-expired-reply-ttl", &dns_conf_serve_expired_reply_ttl, 0, CONF_INT_MAX),
+	CONF_INT("serve-expired-prefetch-time", &dns_conf_serve_expired_prefetch_time, 0, CONF_INT_MAX),
 	CONF_YESNO("dualstack-ip-selection", &dns_conf_dualstack_ip_selection),
+	CONF_YESNO("dualstack-ip-allow-force-AAAA", &dns_conf_dualstack_ip_allow_force_AAAA),
 	CONF_INT("dualstack-ip-selection-threshold", &dns_conf_dualstack_ip_selection_threshold, 0, 1000),
 	CONF_CUSTOM("log-level", _config_log_level, NULL),
 	CONF_STRING("log-file", (char *)dns_conf_log_file, DNS_MAX_PATH),
@@ -1485,7 +1895,10 @@ static struct config_item _config_item[] = {
 	CONF_INT("rr-ttl", &dns_conf_rr_ttl, 0, CONF_INT_MAX),
 	CONF_INT("rr-ttl-min", &dns_conf_rr_ttl_min, 0, CONF_INT_MAX),
 	CONF_INT("rr-ttl-max", &dns_conf_rr_ttl_max, 0, CONF_INT_MAX),
+	CONF_INT("rr-ttl-reply-max", &dns_conf_rr_ttl_reply_max, 0, CONF_INT_MAX),
+	CONF_INT("max-reply-ip-num", &dns_conf_max_reply_ip_num, 1, CONF_INT_MAX),
 	CONF_YESNO("force-AAAA-SOA", &dns_conf_force_AAAA_SOA),
+	CONF_YESNO("force-no-CNAME", &dns_conf_force_no_cname),
 	CONF_CUSTOM("force-qtype-SOA", _config_qtype_soa, NULL),
 	CONF_CUSTOM("blacklist-ip", _config_blacklist_ip, NULL),
 	CONF_CUSTOM("whitelist-ip", _conf_whitelist_ip, NULL),
@@ -1493,8 +1906,11 @@ static struct config_item _config_item[] = {
 	CONF_CUSTOM("ignore-ip", _conf_ip_ignore, NULL),
 	CONF_CUSTOM("edns-client-subnet", _conf_edns_client_subnet, NULL),
 	CONF_CUSTOM("domain-rules", _conf_domain_rules, NULL),
+	CONF_CUSTOM("dnsmasq-lease-file", _conf_dhcp_lease_dnsmasq_file, NULL),
+	CONF_CUSTOM("hosts-file", _conf_hosts_file, NULL),
 	CONF_STRING("ca-file", (char *)&dns_conf_ca_file, DNS_MAX_PATH),
 	CONF_STRING("ca-path", (char *)&dns_conf_ca_path, DNS_MAX_PATH),
+	CONF_STRING("user", (char *)&dns_conf_user, sizeof(dns_conf_user)),
 	CONF_CUSTOM("conf-file", config_addtional_file, NULL),
 	CONF_END(),
 };
@@ -1516,10 +1932,15 @@ static int _conf_printf(const char *file, int lineno, int ret)

 int config_addtional_file(void *data, int argc, char *argv[])
 {
-	char *conf_file = argv[1];
+	char *conf_file;
 	char file_path[DNS_MAX_PATH];
 	char file_path_dir[DNS_MAX_PATH];

+	if (argc < 1) {
+		return -1;
+	}
+
+	conf_file = argv[1];
 	if (conf_file[0] != '/') {
 		safe_strncpy(file_path_dir, conf_get_conf_file(), DNS_MAX_PATH);
 		dirname(file_path_dir);
@@ -1559,6 +1980,10 @@ static int _dns_server_load_conf_init(void)
 	hash_init(dns_ipset_table.ipset);
 	hash_init(dns_qtype_soa_table.qtype);
 	hash_init(dns_group_table.group);
+	hash_init(dns_hosts_table.hosts);
+	hash_init(dns_ptr_table.ptr);
+
+	_config_setup_smartdns_domain();

 	return 0;
 }
@@ -1570,6 +1995,8 @@ void dns_server_load_exit(void)
 	Destroy_Radix(dns_conf_address_rule.ipv6, _config_address_destroy, NULL);
 	_config_ipset_table_destroy();
 	_config_group_table_destroy();
+	_config_ptr_table_destroy();
+	_config_host_table_destroy();
 	_config_qtype_soa_table_destroy();
 }

@@ -1583,11 +2010,13 @@ static int _dns_conf_speed_check_mode_verify(void)
 	}

 	for (i = 0; i < DOMAIN_CHECK_NUM; i++) {
-		if (dns_conf_check_order.order[i] == DOMAIN_CHECK_ICMP) {
+		if (dns_conf_check_orders.orders[i].type == DOMAIN_CHECK_ICMP) {
 			for (j = i + 1; j < DOMAIN_CHECK_NUM; j++) {
-				dns_conf_check_order.order[j - 1] = dns_conf_check_order.order[j];
+				dns_conf_check_orders.orders[j - 1].type = dns_conf_check_orders.orders[j].type;
+				dns_conf_check_orders.orders[j - 1].tcp_port = dns_conf_check_orders.orders[j].tcp_port;
 			}
-			dns_conf_check_order.order[j - 1] = DOMAIN_CHECK_NONE;
+			dns_conf_check_orders.orders[j - 1].type = DOMAIN_CHECK_NONE;
+			dns_conf_check_orders.orders[j - 1].tcp_port = 0;
 			print_log = 1;
 		}
 	}
@@ -1599,13 +2028,33 @@ static int _dns_conf_speed_check_mode_verify(void)
 	return 0;
 }

+static int _dns_ping_cap_check(void)
+{
+	int has_ping = 0;
+	int has_raw_cap;
+
+	has_raw_cap = has_network_raw_cap();
+	has_ping = has_unprivileged_ping();
+	if (has_ping == 0) {
+		if (errno == EACCES && has_raw_cap == 0) {
+			tlog(TLOG_WARN, "unpriviledged ping is disabled, please enable by setting net.ipv4.ping_group_range");
+		}
+	}
+
+	if (has_ping == 1 || has_raw_cap == 1) {
+		dns_has_cap_ping = 1;
+	}
+
+	return 0;
+}
+
 static int _dns_conf_load_pre(void)
 {
 	if (_dns_server_load_conf_init() != 0) {
 		goto errout;
 	}

-	dns_has_cap_ping = has_network_raw_cap();
+	_dns_ping_cap_check();

 	return 0;

--- a/src/dns_conf.h
+++ b/src/dns_conf.h
@@ -35,10 +35,12 @@ extern "C" {
 #define DNS_MAX_BIND_IP 16
 #define DNS_MAX_SERVERS 64
 #define DNS_MAX_SERVER_NAME_LEN 128
+#define DNS_MAX_PTR_LEN 128
 #define DNS_MAX_IPSET_NAMELEN 32
 #define DNS_GROUP_NAME_LEN 32
 #define DNS_NAX_GROUP_NUMBER 16
 #define DNS_MAX_IPLEN 64
+#define DNS_CONF_USRNAME_LEN 32
 #define DNS_MAX_SPKI_LEN 64
 #define DNS_MAX_URL_LEN 256
 #define DNS_MAX_PATH 1024
@@ -72,7 +74,7 @@ typedef enum {
 #define DOMAIN_CHECK_NONE 0
 #define DOMAIN_CHECK_ICMP 1
 #define DOMAIN_CHECK_TCP 2
-#define DOMAIN_CHECK_NUM 2
+#define DOMAIN_CHECK_NUM 3

 #define DOMAIN_FLAG_ADDR_SOA (1 << 0)
 #define DOMAIN_FLAG_ADDR_IPV4_SOA (1 << 1)
@@ -85,6 +87,7 @@ typedef enum {
 #define DOMAIN_FLAG_IPSET_IPV6_IGN (1 << 8)
 #define DOMAIN_FLAG_NAMESERVER_IGNORE (1 << 9)
 #define DOMAIN_FLAG_DUALSTACK_SELECT (1 << 10)
+#define DOMAIN_FLAG_SMARTDNS_DOMAIN (1 << 11)

 #define SERVER_FLAG_EXCLUDE_DEFAULT (1 << 0)

@@ -136,15 +139,53 @@ struct dns_server_groups {
 };

 struct dns_domain_check_order {
-	char order[DOMAIN_CHECK_NUM];
+	char type;
 	unsigned short tcp_port;
 };

+struct dns_domain_check_orders {
+	struct dns_domain_check_order orders[DOMAIN_CHECK_NUM];
+};
+
 struct dns_group_table {
 	DECLARE_HASHTABLE(group, 8);
 };
 extern struct dns_group_table dns_group_table;

+struct dns_ptr {
+	struct hlist_node node;
+	char ptr_domain[DNS_MAX_PTR_LEN];
+	char hostname[DNS_MAX_CNAME_LEN];
+};
+
+struct dns_ptr_table {
+	DECLARE_HASHTABLE(ptr, 16);
+};
+extern struct dns_ptr_table dns_ptr_table;
+
+typedef enum dns_hosts_type {
+	DNS_HOST_TYPE_HOST = 0,
+	DNS_HOST_TYPE_DNSMASQ = 1,
+} dns_hosts_type;
+
+struct dns_hosts {
+	struct hlist_node node;
+	char domain[DNS_MAX_CNAME_LEN];
+	dns_hosts_type host_type;
+	int dns_type;
+	int is_soa;	
+	union {
+		unsigned char ipv4_addr[DNS_RR_A_LEN];
+		unsigned char ipv6_addr[DNS_RR_AAAA_LEN];
+	};
+};
+
+struct dns_hosts_table {
+	DECLARE_HASHTABLE(hosts, 16);
+};
+extern struct dns_hosts_table dns_hosts_table;
+extern int dns_hosts_record_num;
+
 struct dns_servers {
 	char server[DNS_MAX_IPLEN];
 	unsigned short port;
@@ -221,6 +262,7 @@ extern int dns_conf_cachesize;
 extern int dns_conf_prefetch;
 extern int dns_conf_serve_expired;
 extern int dns_conf_serve_expired_ttl;
+extern int dns_conf_serve_expired_prefetch_time;
 extern int dns_conf_serve_expired_reply_ttl;
 extern struct dns_servers dns_conf_servers[DNS_MAX_SERVERS];
 extern int dns_conf_server_num;
@@ -236,7 +278,7 @@ extern char dns_conf_ca_path[DNS_MAX_PATH];
 extern char dns_conf_cache_file[DNS_MAX_PATH];
 extern int dns_conf_cache_persist;

-extern struct dns_domain_check_order dns_conf_check_order;
+extern struct dns_domain_check_orders dns_conf_check_orders;

 extern struct dns_server_groups dns_conf_server_groups[DNS_NAX_GROUP_NUMBER];
 extern int dns_conf_server_group_num;
@@ -252,14 +294,22 @@ extern art_tree dns_conf_domain_rule;
 extern struct dns_conf_address_rule dns_conf_address_rule;

 extern int dns_conf_dualstack_ip_selection;
+extern int dns_conf_dualstack_ip_allow_force_AAAA;
 extern int dns_conf_dualstack_ip_selection_threshold;

+extern int dns_conf_max_reply_ip_num;
+
 extern int dns_conf_rr_ttl;
+extern int dns_conf_rr_ttl_reply_max;
 extern int dns_conf_rr_ttl_min;
 extern int dns_conf_rr_ttl_max;
 extern int dns_conf_force_AAAA_SOA;
 extern int dns_conf_ipset_timeout_enable;

+extern int dns_conf_force_no_cname;
+
+extern char dns_conf_user[DNS_CONF_USRNAME_LEN];
+
 extern struct dns_edns_client_subnet dns_conf_ipv4_ecs;
 extern struct dns_edns_client_subnet dns_conf_ipv6_ecs;

@@ -269,6 +319,8 @@ void dns_server_load_exit(void);

 int dns_server_load_conf(const char *file);

+int dns_server_check_update_hosts(void);
+
 extern int config_addtional_file(void *data, int argc, char *argv[]);
 #ifdef __cpluscplus
 }
--- a/src/dns_server.c
+++ b/src/dns_server.c
--- a/src/fast_ping.c
+++ b/src/fast_ping.c
@@ -97,6 +97,7 @@ struct ping_host_struct {
 	FAST_PING_TYPE type;

 	void *userptr;
+	int error;
 	fast_ping_result ping_callback;
 	char host[PING_MAX_HOSTLEN];

@@ -129,6 +130,7 @@ struct fast_ping_struct {
 	unsigned short ident;

 	int epoll_fd;
+	int no_unprivileged_ping;
 	int fd_icmp;
 	struct ping_host_struct icmp_host;
 	int fd_icmp6;
@@ -386,11 +388,10 @@ static void _fast_ping_host_put(struct ping_host_struct *ping_host)
 		tv.tv_usec = 0;

 		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_END, &ping_host->addr, ping_host->addr_len,
-								 ping_host->seq, ping_host->ttl, &tv, ping_host->userptr);
+								 ping_host->seq, ping_host->ttl, &tv, ping_host->error, ping_host->userptr);
 	}

-	tlog(TLOG_DEBUG, "ping end, id %d", ping_host->sid);
-	// memset(ping_host, 0, sizeof(*ping_host));
+	tlog(TLOG_DEBUG, "ping %s end, id %d", ping_host->host, ping_host->sid);
 	ping_host->type = FAST_PING_END;
 	free(ping_host);
 }
@@ -414,7 +415,7 @@ static void _fast_ping_host_remove(struct ping_host_struct *ping_host)
 		tv.tv_usec = 0;

 		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_END, &ping_host->addr, ping_host->addr_len,
-								 ping_host->seq, ping_host->ttl, &tv, ping_host->userptr);
+								 ping_host->seq, ping_host->ttl, &tv, ping_host->error, ping_host->userptr);
 	}

 	_fast_ping_host_put(ping_host);
@@ -445,7 +446,7 @@ static int _fast_ping_sendping_v6(struct ping_host_struct *ping_host)
 				 (struct sockaddr *)&ping_host->addr, ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 			goto errout;
 		}

@@ -494,7 +495,7 @@ static int _fast_ping_sendping_v4(struct ping_host_struct *ping_host)
 				 ping_host->addr_len);
 	if (len < 0 || len != sizeof(struct fast_ping_packet)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
@@ -541,7 +542,7 @@ static int _fast_ping_sendping_udp(struct ping_host_struct *ping_host)
 	len = sendto(fd, &dns_head, sizeof(dns_head), 0, (struct sockaddr *)&ping_host->addr, ping_host->addr_len);
 	if (len < 0 || len != sizeof(dns_head)) {
 		int err = errno;
-		if (errno == ENETUNREACH || errno == EINVAL) {
+		if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 			goto errout;
 		}
 		char ping_host_name[PING_MAX_HOSTLEN];
@@ -588,7 +589,7 @@ static int _fast_ping_sendping_tcp(struct ping_host_struct *ping_host)
 	if (connect(fd, (struct sockaddr *)&ping_host->addr, ping_host->addr_len) != 0) {
 		if (errno != EINPROGRESS) {
 			char ping_host_name[PING_MAX_HOSTLEN];
-			if (errno == ENETUNREACH || errno == EINVAL) {
+			if (errno == ENETUNREACH || errno == EINVAL || errno == EADDRNOTAVAIL) {
 				goto errout;
 			}

@@ -644,6 +645,7 @@ static int _fast_ping_sendping(struct ping_host_struct *ping_host)
 	ping_host->send = 1;

 	if (ret != 0) {
+		ping_host->error = errno;
 		return ret;
 	}

@@ -663,21 +665,34 @@ static int _fast_ping_create_icmp_sock(FAST_PING_TYPE type)

 	switch (type) {
 	case FAST_PING_ICMP:
-		fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+		if (ping.no_unprivileged_ping == 0) {
+			fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+		} else {
+			fd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP);
+			if (fd > 0) {
+				_fast_ping_install_filter_v4(fd);
+			}
+		}
 		if (fd < 0) {
 			tlog(TLOG_ERROR, "create icmp socket failed, %s\n", strerror(errno));
 			goto errout;
 		}
-		_fast_ping_install_filter_v4(fd);
 		icmp_host = &ping.icmp_host;
 		break;
 	case FAST_PING_ICMP6:
-		fd = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+		if (ping.no_unprivileged_ping == 0) {
+			fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6);
+		} else {
+			fd = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+			if (fd > 0) {
+				_fast_ping_install_filter_v6(fd);
+			}
+		}
+
 		if (fd < 0) {
 			tlog(TLOG_ERROR, "create icmp socket failed, %s\n", strerror(errno));
 			goto errout;
 		}
-		_fast_ping_install_filter_v6(fd);
 		setsockopt(fd, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, &on, sizeof(on));
 		setsockopt(fd, IPPROTO_IPV6, IPV6_2292HOPLIMIT, &on, sizeof(on));
 		setsockopt(fd, IPPROTO_IPV6, IPV6_HOPLIMIT, &on, sizeof(on));
@@ -848,13 +863,15 @@ errout:

 static void _fast_ping_print_result(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 									struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl, struct timeval *tv,
-									void *userptr)
+									int error, void *userptr)
 {
 	if (result == PING_RESULT_RESPONSE) {
 		double rtt = tv->tv_sec * 1000.0 + tv->tv_usec / 1000.0;
 		tlog(TLOG_INFO, "from %15s: seq=%d ttl=%d time=%.3f\n", host, seqno, ttl, rtt);
 	} else if (result == PING_RESULT_TIMEOUT) {
 		tlog(TLOG_INFO, "from %15s: seq=%d timeout\n", host, seqno);
+	} else if (result == PING_RESULT_ERROR) {
+		tlog(TLOG_DEBUG, "from %15s: error is %s\n", host, strerror(error));
 	} else if (result == PING_RESULT_END) {
 		fast_ping_stop(ping_host);
 	}
@@ -1041,7 +1058,6 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c

 	ret = _fast_ping_get_addr_by_type(type, ip_str, port, &gai, &ping_type);
 	if (ret != 0) {
-		tlog(TLOG_ERROR, "get addr by type failed, host: %s", host);
 		goto errout;
 	}

@@ -1097,6 +1113,8 @@ struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int c
 	_fast_ping_host_put(ping_host);
 	return ping_host;
 errout_remove:
+	ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_ERROR, &ping_host->addr, ping_host->addr_len,
+							 ping_host->seq, ping_host->ttl, 0, ping_host->error, ping_host->userptr);
 	fast_ping_stop(ping_host);
 	_fast_ping_host_put(ping_host);
 	ping_host = NULL;
@@ -1168,9 +1186,11 @@ static struct fast_ping_packet *_fast_ping_icmp6_packet(struct ping_host_struct
 		return NULL;
 	}

-	if (icmp6->icmp6_id != ping.ident) {
-		tlog(TLOG_ERROR, "ident failed, %d:%d", icmp6->icmp6_id, ping.ident);
-		return NULL;
+	if (ping.no_unprivileged_ping) {
+		if (icmp6->icmp6_id != ping.ident) {
+			tlog(TLOG_ERROR, "ident failed, %d:%d", icmp6->icmp6_id, ping.ident);
+			return NULL;
+		}
 	}

 	return packet;
@@ -1185,11 +1205,6 @@ static struct fast_ping_packet *_fast_ping_icmp_packet(struct ping_host_struct *
 	int hlen;
 	int icmp_len;

-	if (ip->ip_p != IPPROTO_ICMP) {
-		tlog(TLOG_ERROR, "ip type faild, %d:%d", ip->ip_p, IPPROTO_ICMP);
-		return NULL;
-	}
-
 	hlen = ip->ip_hl << 2;
 	packet = (struct fast_ping_packet *)(packet_data + hlen);
 	icmp = &packet->icmp;
@@ -1201,15 +1216,23 @@ static struct fast_ping_packet *_fast_ping_icmp_packet(struct ping_host_struct *
 		return NULL;
 	}

+	if (ping.no_unprivileged_ping) {
+		if (ip->ip_p != IPPROTO_ICMP) {
+			tlog(TLOG_ERROR, "ip type faild, %d:%d", ip->ip_p, IPPROTO_ICMP);
+			return NULL;
+		}
+
+		if (icmp->icmp_id != ping.ident) {
+			tlog(TLOG_ERROR, "ident failed, %d:%d", icmp->icmp_id, ping.ident);
+			return NULL;
+		}
+	}
+
 	if (icmp->icmp_type != ICMP_ECHOREPLY) {
 		tlog(TLOG_DEBUG, "icmp type faild, %d:%d", icmp->icmp_type, ICMP_ECHOREPLY);
 		return NULL;
 	}

-	if (icmp->icmp_id != ping.ident) {
-		tlog(TLOG_ERROR, "ident failed, %d:%d", icmp->icmp_id, ping.ident);
-		return NULL;
-	}

 	return packet;
 }
@@ -1315,7 +1338,7 @@ static int _fast_ping_process_icmp(struct ping_host_struct *ping_host, struct ti
 	if (recv_ping_host->ping_callback) {
 		recv_ping_host->ping_callback(recv_ping_host, recv_ping_host->host, PING_RESULT_RESPONSE, &recv_ping_host->addr,
 									  recv_ping_host->addr_len, recv_ping_host->seq, recv_ping_host->ttl, &tvresult,
-									  recv_ping_host->userptr);
+									  ping_host->error, recv_ping_host->userptr);
 	}

 	recv_ping_host->send = 0;
@@ -1349,7 +1372,8 @@ static int _fast_ping_process_tcp(struct ping_host_struct *ping_host, struct epo
 	tv_sub(&tvresult, tvsend);
 	if (ping_host->ping_callback) {
 		ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_RESPONSE, &ping_host->addr,
-								 ping_host->addr_len, ping_host->seq, ping_host->ttl, &tvresult, ping_host->userptr);
+								 ping_host->addr_len, ping_host->seq, ping_host->ttl, &tvresult, ping_host->error,
+								 ping_host->userptr);
 	}

 	ping_host->send = 0;
@@ -1445,7 +1469,7 @@ static int _fast_ping_process_udp(struct ping_host_struct *ping_host, struct tim
 	if (recv_ping_host->ping_callback) {
 		recv_ping_host->ping_callback(recv_ping_host, recv_ping_host->host, PING_RESULT_RESPONSE, &recv_ping_host->addr,
 									  recv_ping_host->addr_len, recv_ping_host->seq, recv_ping_host->ttl, &tvresult,
-									  recv_ping_host->userptr);
+									  ping_host->error, recv_ping_host->userptr);
 	}

 	recv_ping_host->send = 0;
@@ -1553,7 +1577,7 @@ static void _fast_ping_period_run(void)
 		millisecond = interval.tv_sec * 1000 + interval.tv_usec / 1000;
 		if (millisecond >= ping_host->timeout && ping_host->send == 1) {
 			ping_host->ping_callback(ping_host, ping_host->host, PING_RESULT_TIMEOUT, &ping_host->addr,
-									 ping_host->addr_len, ping_host->seq, ping_host->ttl, &interval,
+									 ping_host->addr_len, ping_host->seq, ping_host->ttl, &interval, ping_host->error,
 									 ping_host->userptr);
 			ping_host->send = 0;
 		}
@@ -1654,6 +1678,7 @@ int fast_ping_init(void)
 	pthread_mutex_init(&ping.lock, NULL);
 	hash_init(ping.addrmap);
 	ping.epoll_fd = epollfd;
+	ping.no_unprivileged_ping = !has_unprivileged_ping();
 	ping.ident = (getpid() & 0XFFFF);
 	ping.run = 1;
 	ret = pthread_create(&ping.tid, &attr, _fast_ping_work, NULL);
--- a/src/fast_ping.h
+++ b/src/fast_ping.h
@@ -34,13 +34,14 @@ typedef enum {
 typedef enum {
 	PING_RESULT_RESPONSE = 1,
 	PING_RESULT_TIMEOUT = 2,
-	PING_RESULT_END = 3,
+	PING_RESULT_ERROR = 3,
+	PING_RESULT_END = 4,
 } FAST_PING_RESULT;

 struct ping_host_struct;
 typedef void (*fast_ping_result)(struct ping_host_struct *ping_host, const char *host, FAST_PING_RESULT result,
 								 struct sockaddr *addr, socklen_t addr_len, int seqno, int ttl, struct timeval *tv,
-								 void *userptr);
+								 int error, void *userptr);

 /* start ping */
 struct ping_host_struct *fast_ping_start(PING_TYPE type, const char *host, int count, int interval, int timeout,
--- a/src/smartdns.c
+++ b/src/smartdns.c
@@ -31,12 +31,15 @@
 #include <errno.h>
 #include <fcntl.h>
 #include <libgen.h>
+#include <linux/capability.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
+#include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/prctl.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <ucontext.h>
@@ -49,6 +52,77 @@

 static int verbose_screen;

+int capget(struct __user_cap_header_struct *header, struct __user_cap_data_struct *cap);
+int capset(struct __user_cap_header_struct *header, struct __user_cap_data_struct *cap);
+
+int get_uid_gid(int *uid, int *gid)
+{
+	struct passwd *result = NULL;
+	struct passwd pwd;
+	char *buf = NULL;
+	size_t bufsize;
+	int ret = -1;
+
+	if (dns_conf_user[0] == '\0') {
+		return -1;
+	}
+
+	bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
+	if (bufsize == -1) {
+		bufsize = 1024 * 16;
+	}
+
+	buf = malloc(bufsize);
+	if (buf == NULL) {
+		goto out;
+	}
+
+	ret = getpwnam_r(dns_conf_user, &pwd, buf, bufsize, &result);
+	if (ret != 0) {
+		return -1;
+	}
+
+	*uid = result->pw_uid;
+	*gid = result->pw_gid;
+
+out:
+	if (buf) {
+		free(buf);
+	}
+
+	return ret;
+}
+
+int drop_root_privilege(void)
+{
+	struct __user_cap_data_struct cap;
+	struct __user_cap_header_struct header;
+	header.version = _LINUX_CAPABILITY_VERSION;
+	header.pid = 0;
+	int uid;
+	int gid;
+
+	if (get_uid_gid(&uid, &gid) != 0) {
+		return -1;
+	}
+
+	if (capget(&header, &cap) < 0) {
+		return -1;
+	}
+
+	prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
+	cap.effective |= (1 << CAP_NET_RAW | 1 << CAP_NET_ADMIN);
+	cap.permitted |= (1 << CAP_NET_RAW | 1 << CAP_NET_ADMIN);
+	setuid(uid);
+	setgid(gid);
+	if (capset(&header, &cap) < 0) {
+		return -1;
+	}
+
+	prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0);
+	return 0;
+}
+
 static void _help(void)
 {
 	/* clang-format off */
@@ -322,6 +396,7 @@ static int _smartdns_run(void)

 static void _smartdns_exit(void)
 {
+	tlog(TLOG_INFO, "smartdns starting exit...");
 	dns_server_exit();
 	dns_client_exit();
 	fast_ping_exit();
@@ -332,6 +407,7 @@ static void _smartdns_exit(void)

 static void _sig_exit(int signo)
 {
+	tlog(TLOG_INFO, "start stop smartdns");
 	dns_server_stop();
 }

@@ -393,10 +469,15 @@ int main(int argc, char *argv[])
 	char config_file[MAX_LINE_LEN];
 	char pid_file[MAX_LINE_LEN];
 	int signal_ignore = 0;
+	sigset_t empty_sigblock;

 	safe_strncpy(config_file, SMARTDNS_CONF_FILE, MAX_LINE_LEN);
 	safe_strncpy(pid_file, SMARTDNS_PID_FILE, MAX_LINE_LEN);

+	/* patch for Asus router:  unblock all signal*/
+	sigemptyset(&empty_sigblock);
+    sigprocmask(SIG_SETMASK, &empty_sigblock, NULL);
+
 	while ((opt = getopt(argc, argv, "fhc:p:Svx")) != -1) {
 		switch (opt) {
 		case 'f':
@@ -445,6 +526,8 @@ int main(int argc, char *argv[])
 		goto errout;
 	}

+	drop_root_privilege();
+
 	ret = _smartdns_init();
 	if (ret != 0) {
 		usleep(100000);
--- a/src/tlog.c
+++ b/src/tlog.c
@@ -19,6 +19,7 @@
 #include <string.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
+#include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -45,6 +46,14 @@

 #define TLOG_SEGMENT_MAGIC 0xFF446154

+struct linux_dirent64 {
+    unsigned long long d_ino;
+    long long d_off;
+    unsigned short d_reclen;
+    unsigned char d_type;
+    char d_name[256];
+};
+
 struct tlog_log {
    char *buff;
    int buffsize;
@@ -504,9 +513,12 @@ static int _tlog_vprintf(struct tlog_log *log, vprint_callback print_callback, v
    if (len <= 0) {
        return -1;
    } else if (len >= log->max_line_size) {
-        strncpy(buff, "[LOG TOO LONG, DISCARD]\n", sizeof(buff));
-        buff[sizeof(buff) - 1] = '\0';
-        len = strnlen(buff, sizeof(buff));
+        len = log->max_line_size;
+        buff[len - 1] = '\0';
+        buff[len - 2] = '\n';
+        buff[len - 3] = '.';
+        buff[len - 4] = '.';
+        buff[len - 5] = '.';
    }

    pthread_mutex_lock(&tlog.lock);
@@ -919,47 +931,67 @@ static void _tlog_close_all_fd_by_res(void)
    }
 }

+static int _tlog_str_to_int(const char *str)
+{
+    int num = 0;
+
+    while (*str >= '0' && *str <= '9') {
+        num = num * 10 + (*str - '0');
+        ++str;
+    }
+
+    if (*str) {
+        return -1;
+    }
+
+    return num;
+}
+
 static void _tlog_close_all_fd(void)
 {
-    char path_name[PATH_MAX];
-    DIR *dir = NULL;
-    struct dirent *ent;
+#if defined(__linux__)
    int dir_fd = -1;

-    snprintf(path_name, sizeof(path_name), "/proc/self/fd/");
-    dir = opendir(path_name);
-    if (dir == NULL) {
+    dir_fd = open("/proc/self/fd/", O_RDONLY | O_DIRECTORY);
+    if (dir_fd < 0) {
        goto errout;
    }

-    dir_fd = dirfd(dir);
+    char buffer[sizeof(struct linux_dirent64)];
+    int bytes;
+    while ((bytes = syscall(SYS_getdents64, dir_fd,
+                (struct linux_dirent64 *)buffer,
+                sizeof(buffer)))
+        > 0) {
+        struct linux_dirent64 *entry;
+        int offset;

-    while ((ent = readdir(dir)) != NULL) {
-        int fd = atoi(ent->d_name);
-        if (fd < 0 || dir_fd == fd) {
-            continue;
-        }
-        switch (fd) {
-        case STDIN_FILENO:
-        case STDOUT_FILENO:
-        case STDERR_FILENO:
-            continue;
-            break;
-        default:
-            break;
-        }
+        for (offset = 0; offset < bytes; offset += entry->d_reclen) {
+            int fd;
+            entry = (struct linux_dirent64 *)(buffer + offset);
+            if ((fd = _tlog_str_to_int(entry->d_name)) < 0) {
+                continue;
+            }

-        close(fd);
+            if (fd == dir_fd || fd == STDIN_FILENO || fd == STDOUT_FILENO || fd == STDERR_FILENO) {
+                continue;
+            }
+            close(fd);
+        }
    }

-    closedir(dir);
+    close(dir_fd);
+
+    if (bytes < 0) {
+        goto errout;
+    }

    return;
 errout:
-    if (dir) {
-        closedir(dir);
+    if (dir_fd > 0) {
+        close(dir_fd);
    }
-
+#endif
    _tlog_close_all_fd_by_res();
    return;
 }
@@ -1834,6 +1866,7 @@ void tlog_exit(void)
        pthread_cond_signal(&tlog.cond);
        pthread_mutex_unlock(&tlog.lock);
        pthread_join(tlog.tid, &ret);
+        tlog.tid = 0;
    }

    tlog.root = NULL;
@@ -1843,4 +1876,7 @@ void tlog_exit(void)

    pthread_cond_destroy(&tlog.cond);
    pthread_mutex_destroy(&tlog.lock);
+
+    tlog_format = NULL;
+    tlog.is_wait = 0;
 }
--- a/src/util.c
+++ b/src/util.c
@@ -133,7 +133,7 @@ errout:
 	return NULL;
 }

-int getaddr_by_host(char *host, struct sockaddr *addr, socklen_t *addr_len)
+int getaddr_by_host(const char *host, struct sockaddr *addr, socklen_t *addr_len)
 {
 	struct addrinfo hints;
 	struct addrinfo *result = NULL;
@@ -473,6 +473,31 @@ char *reverse_string(char *output, const char *input, int len, int to_lower_case
 	return begin;
 }

+char *to_lower_case(char *output, const char *input, int len)
+{
+	char *begin = output;
+	int i = 0;
+	if (len <= 0) {
+		*output = 0;
+		return output;
+	}
+
+	len--;
+	while (i < len && *(input + i) != '\0') {
+		*output = *(input + i);
+		if (*output >= 'A' && *output <= 'Z') {
+			/* To lower case */
+			*output = *output + 32;
+		}
+		output++;
+		i++;
+	}
+
+	*output = 0;
+
+	return begin;
+}
+
 static inline void _ipset_add_attr(struct nlmsghdr *netlink_head, uint16_t type, size_t len, const void *data)
 {
 	struct ipset_netlink_attr *attr = (void *)netlink_head + NETLINK_ALIGN(netlink_head->nlmsg_len);
@@ -985,6 +1010,25 @@ int has_network_raw_cap(void)
 	return 1;
 }

+int has_unprivileged_ping(void)
+{
+	int fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
+	if (fd < 0) {
+		return 0;
+	}
+
+	close(fd);
+
+	fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6);
+	if (fd < 0) {
+		return 0;
+	}
+
+	close(fd);
+
+	return 1;
+}
+
 int set_sock_keepalive(int fd, int keepidle, int keepinterval, int keepcnt)
 {
 	const int yes = 1;
@@ -1049,6 +1093,7 @@ void print_stack(void)
 {
 	const size_t max_buffer = 30;
 	void *buffer[max_buffer];
+	int idx = 0;

 	struct backtrace_state state = {buffer, buffer + max_buffer};
 	_Unwind_Backtrace(unwind_callback, &state);
@@ -1058,7 +1103,7 @@ void print_stack(void)
 	}
 	
 	tlog(TLOG_FATAL, "Stack:");
-	for (int idx = 0; idx < frame_num; ++idx) {
+	for (idx = 0; idx < frame_num; ++idx) {
 		const void *addr = buffer[idx];
 		const char *symbol = "";

@@ -1072,3 +1117,25 @@ void print_stack(void)
 		tlog(TLOG_FATAL, "#%.2d: %p %s from %s+%p", idx + 1, addr, symbol, info.dli_fname, offset);
 	}
 }
+
+int write_file(const char *filename, void *data, int data_len)
+{
+	int fd = open(filename, O_WRONLY|O_CREAT, 0644);
+	if (fd < 0) {
+		return -1;
+	}
+
+	int len = write(fd, data, data_len);
+	if (len < 0) {
+		goto errout;
+	}
+
+	close(fd);
+	return 0;
+errout:
+	if (fd > 0) {
+		close(fd);
+	}
+
+	return -1;
+}
--- a/src/util.h
+++ b/src/util.h
@@ -49,7 +49,7 @@ unsigned long get_tick_count(void);

 char *gethost_by_addr(char *host, int maxsize, struct sockaddr *addr);

-int getaddr_by_host(char *host, struct sockaddr *addr, socklen_t *addr_len);
+int getaddr_by_host(const char *host, struct sockaddr *addr, socklen_t *addr_len);

 int getsocknet_inet(int fd, struct sockaddr *addr, socklen_t *addr_len);

@@ -65,6 +65,8 @@ int set_fd_nonblock(int fd, int nonblock);

 char *reverse_string(char *output, const char *input, int len, int to_lower_case);

+char *to_lower_case(char *output, const char *input, int len);
+
 void print_stack(void);

 int ipset_add(const char *ipsetname, const unsigned char addr[], int addr_len, unsigned long timeout);
@@ -102,6 +104,8 @@ int is_numeric(const char *str);

 int has_network_raw_cap(void);

+int has_unprivileged_ping(void);
+
 int set_sock_keepalive(int fd, int keepidle, int keepinterval, int keepcnt);

 int set_sock_lingertime(int fd, int time);
@@ -110,6 +114,8 @@ uint64_t get_free_space(const char *path);

 void print_stack(void);

+int write_file(const char *filename, void *data, int data_len);
+
 #ifdef __cplusplus
 }
 #endif /*__cplusplus */
--- a/systemd/smartdns.service.in
+++ b/systemd/smartdns.service.in
@@ -9,10 +9,9 @@ Type=forking
 PIDFile=@RUNSTATEDIR@/smartdns.pid
 EnvironmentFile=@SYSCONFDIR@/default/smartdns
 ExecStart=@SBINDIR@/smartdns -p @RUNSTATEDIR@/smartdns.pid $SMART_DNS_OPTS 
-KillMode=process
 Restart=always
 RestartSec=2
-TimeoutStopSec=5
+TimeoutStopSec=15

 [Install]
 WantedBy=multi-user.target
Author	SHA1	Message	Date
Nick Peng	301ab3ba10	server: fix server not exit issue on asus router	2022-07-02 13:26:58 +08:00
Nick Peng	362b7f978f	security: support dropping root, and no root privileges required for ping	2022-07-01 23:37:24 +08:00
Nick Peng	435b2905cf	iniscript: Make sure the cache has enough time to save to disk	2022-07-01 22:38:37 +08:00
Nick Peng	e3436263d9	conf: add config: dualstack-ip-allow-force-AAAA	2022-06-28 22:10:42 +08:00
Nick Peng	1f07a7ea97	log: make log happy when receiving malformd packet	2022-06-28 22:01:14 +08:00
Nick Peng	9fdf53baa5	Update tlog	2022-06-26 18:49:17 +08:00
Nick Peng	db328640c8	tlog: fix dead lock when forking	2022-06-25 20:25:20 +08:00
Nick Peng	5006059074	cache: fix dns cache prefetch issue	2022-06-25 20:24:27 +08:00
Nick Peng	883116708b	dualstack: fix speed check issue when there is only one ip record.	2022-06-19 10:02:34 +08:00
Nick Peng	cbc8c59125	dns_conf: add expired domain prefetch time	2022-06-18 14:11:39 +08:00
Nick Peng	b70feb112a	ipset: fix ipset missing issue	2022-06-18 10:17:25 +08:00
Nick Peng	ff0f42b87c	docker: reduce docker images size	2022-06-17 20:49:29 +08:00
Nick Peng	1873a0c336	cache: support expired domain prefetch	2022-06-12 23:39:42 +08:00
Nick Peng	995bee4088	dns_server: optimize code	2022-06-12 23:39:42 +08:00
Nick Peng	09dc2e9275	dns_server: fix discard issue.	2022-06-12 23:37:12 +08:00
Nick Peng	c0f4c72626	docker: make dockerfile build from local source	2022-06-12 00:51:19 +08:00
Nick Peng	d185b78836	dns_server: fix SRV query discard issue.	2022-06-11 23:11:25 +08:00
Nick Peng	7e985e7d11	dns_server: fix dualstack select issue.	2022-06-08 23:28:46 +08:00
Nick Peng	6cfaa639f6	speed-check: fix domain-rule speed check memleak issue	2022-06-05 16:08:19 +08:00
Nick Peng	c960f3f511	dns_server: refactoring dualstack selection code.	2022-06-05 10:10:28 +08:00
Nick Peng	848c9e6cf2	dns_server: fix dns cache issue & supress ping log	2022-05-30 23:22:03 +08:00
Nick Peng	c7db5b2667	dns_server: fix pending query callback fail issue.	2022-05-30 00:47:38 +08:00
Nick Peng	0a04b91763	Readme: add readme for DNS TYPE65 & DNSMASQ hostname	2022-05-29 23:04:10 +08:00
Nick Peng	c27040099b	dns_server: fix tcp ping config not working issue and add more ping mode.	2022-05-29 22:44:41 +08:00
Nick Peng	b6740f5aab	cache: cache special records	2022-05-28 16:09:06 +08:00
Nick Peng	6a7ce39727	dns_server: fix max reply ip number issue.	2022-05-28 12:52:25 +08:00
Nick Peng	2365a1a2b0	cache: cache NXDOMAIN records.	2022-05-28 09:33:49 +08:00
Nick Peng	b5a5311976	ecs: support pass client ecs to upstream	2022-05-26 19:59:22 +08:00
Nick Peng	b125d142bd	cache: cache cname record	2022-05-25 11:50:39 +08:00
Nick Peng	bc68d5979c	Support force not CNAME records	2022-05-22 10:09:58 +08:00
HalfLife	b6f9d7e7bc	修复openwrt中stop、restart时无法正确终止程序，导致第一端口被占用	2022-05-21 23:41:35 +08:00
Nick Peng	e6fe6771bf	conf: Supports setting the maximum number of IPs returned to the client	2022-05-21 14:18:28 +08:00
Nick Peng	94b84cd32c	dns_server: support query smartdns server ip	2022-05-21 11:32:31 +08:00
Nick Peng	dae263444f	Feature: support local host name & ptr resolve.	2022-05-21 11:23:54 +08:00
Nick Peng	dbfe9063e4	Update Readme	2022-05-19 19:14:41 +08:00
Nick Peng	ae3beb5fba	dns_client: ipv4, ipv6 ecs, use either	2022-05-19 19:14:19 +08:00
PikuZheng	7a55471ce3	luci: set dualstack-ip-selection to no when checkbox unselected.	2022-05-17 20:42:06 +08:00
Nick Peng	03478debe8	feature: auto detect ipv6 features.	2022-05-17 20:35:36 +08:00
Nick Peng	ee40591aed	dns_server: fix ipv6 not response issue	2022-05-17 01:15:14 +08:00
Nick Peng	bdc3a87d6d	debian: fake package version avoid auto upgrade	2022-05-16 14:25:53 +08:00
Nick Peng	68ce6b3f0f	dns_server: fix ipv6 multi ipaddress issue	2022-05-16 13:09:46 +08:00
Nick Peng	9dffec3fd3	dns_server: set max ip count to 10	2022-05-15 22:13:12 +08:00
Nick Peng	e64007f558	dns_server: fix issue for AAAA cache query	2022-05-15 21:42:36 +08:00
Nick Peng	87a400ebae	dns_server: fix bootstrap dns not working issue	2022-05-12 00:08:56 +08:00
Nick Peng	9804c305d0	update tlog	2022-05-12 00:08:56 +08:00
Nick Peng	e1755dadc1	Systemd: remove killmode	2022-05-12 00:08:56 +08:00
Mo Zhou	c7d54a2111	Different version scheme results in Debian package overwrite (Closes: https://github.com/pymumu/smartdns/issues/748 )	2022-05-08 12:17:41 +08:00
Nick Peng	34691154fb	passthrouth: fix passthrouth ttl	2022-05-03 10:25:33 +08:00
Nick Peng	29a5803860	Fix typo & ttl issue.	2022-05-03 09:00:30 +08:00
Nick Peng	ebd820bcbb	dns_server: make max ttl no countdown	2022-05-02 22:53:51 +08:00
Nick Peng	1de5557430	client: support ECS	2022-04-30 20:22:57 +08:00
Nick Peng	c92615e6cd	dual-stack: return soa when ipv4 exists in cache	2022-04-30 08:46:30 +08:00
Nick Peng	c561ae2fc5	Feature: Supports setting the maximum TTL value of the response to the client	2022-04-29 22:29:40 +08:00
Nick Peng	d30264ed08	script: force stop smartdns process	2022-04-29 10:09:40 +08:00
Nick Peng	22e13b40db	dns_server: fix passthrouth ipset issue	2022-04-26 20:43:11 +08:00
Nick Peng	75dda9340d	dns_conf: update default configuration.	2022-04-25 18:46:52 +08:00
Nick Peng	baf2be681d	dns-server: Parallel query performance optimization for the same domain name	2022-04-25 18:46:40 +08:00
Nick Peng	5bd521c36b	dns_server: Cache A record for AAAA query when dualstack select	2022-04-22 23:36:37 +08:00
Nick Peng	d0305f60f6	dns_server: make fastest ip first place & fix audit log and ipset for multi IPs.	2022-04-17 18:03:24 +08:00
Nick Peng	6e1363dca4	Feature: select all best ip	2022-04-10 19:47:00 +08:00
Nick Peng	23e9021d30	client: avoid retry query storm	2022-04-09 11:12:00 +08:00
Nick Peng	92af4c05c0	dns: support domain compress.	2022-04-05 21:21:33 +08:00
Nick Peng	24661c2419	Fix issue #903 TXT, SRV, record failed.	2022-04-04 10:34:55 +08:00