DNS返回IPV4数量导致的问题

[qwerttvv]

问题发现过程见这里
pymumu/smartdns#1657

最后猜测是不是代理工具传送dns解析的ip的时候，如果ip太多，比如ipv4达到33个，会导致错误

服务端会显示

ERROR tcp tunnel 127.0.0.1:14050 -> s3-us-west-1.amazonaws.com:443 connect failed, error: dns resolve s3-us-west-1.amazonaws.com:443 error: no record found for Query { name: Name("s3-us-west-1.amazonaws.com."), query_type: AAAA, query_class: IN }

ERROR tcp tunnel 127.0.0.1:18422 -> github-production-upload-manifest-file-7fdce7.s3.amazonaws.com:443 connect failed, error: dns resolve github-production-upload-manifest-file-7fdce7.s3.amazonaws.com:443 error: no record found for Query { name: Name("github-production-upload-manifest-file-7fdce7.s3.amazonaws.com."), query_type: AAAA, query_class: IN }

实际这两个域名是没有ipv6的，只有v4，所以会导致网页打不开

后经尝试，我把s3.amazonaws.com返回的ipv4限制到20个不会出错了，可以正常浏览访问

但是不知道这里出错是因为ip数量原因还是总体字节大小一类的

保险起见，我现在把返回ip数量限制在10个了，v4和v6最大各10各，目前一切正常

还请大佬给看看这怎么个事啊

@zonyitoo

[qwerttvv]

客户端是x64的Windows，服务端是x64的Linux

版本是最新的，上一个版本应该也有这个问题，在之前的不清楚

[zonyitoo]

The error log was reported originally from these calls:

shadowsocks-rust/crates/shadowsocks/src/dns_resolver/resolver.rs

Lines 375 to 394 in ac459c7

	#[cfg(feature = "hickory-dns")]
	DnsResolver::HickoryDnsSystem { ref inner, .. } => match inner.resolver.load().lookup_ip(addr).await {
	Ok(lookup_result) => Ok(EitherResolved::HickoryDnsSystem(
	lookup_result.into_iter().map(move |ip| SocketAddr::new(ip, port)),
	)),
	Err(err) => {
	let err = Error::new(ErrorKind::Other, format!("dns resolve {addr}:{port} error: {err}"));
	Err(err)
	}
	},
	#[cfg(feature = "hickory-dns")]
	DnsResolver::HickoryDns(ref resolver) => match resolver.lookup_ip(addr).await {
	Ok(lookup_result) => Ok(EitherResolved::HickoryDns(
	lookup_result.into_iter().map(move |ip| SocketAddr::new(ip, port)),
	)),
	Err(err) => {
	let err = Error::new(ErrorKind::Other, format!("dns resolve {addr}:{port} error: {err}"));
	Err(err)
	}
	},

The first call is to use the system configured DNS server, servers in /etc/resolv.conf on Linux Platform. The second one is resolve with user's configured dns server.

These two paths are all using hickory resolver's lookup_ip, which was reporting:

1. no record found for Query { name: Name("s3-us-west-1.amazonaws.com."), query_type: AAAA, query_class: IN }
2. no record found for Query { name: Name("github-production-upload-manifest-file-7fdce7.s3.amazonaws.com."), query_type: AAAA, query_class: IN }

[zonyitoo]

You may try to rerun the program with -vvv to open all logs and see if we can find any error logs in hickory-dns.

[qwerttvv]

好嘞，多谢，我回去试一下-vvv，另外我把日志拿上来的话有哪些需要注意脱敏的吗，我现在还不知道完整日志里都有什么，会不会很多很大

另外只要解析dns返回的ip数量足够多，就很容易复现。
这两个域名就可以返回足够多的ip，而且没有ipv6，就会出错。我猜测ipv4返回数量足够多，就会出错，客户端就会去请求ipv6，但是我不知道ipv6足够多会不会也有同样的问题，我这里没有太留意哪些域名有足够多的AAAA解析

[zonyitoo]

https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md?plain=1#L370

Did you check the DNS server with dig s3-us-west-1.amazonaws.com and dig github-production-upload-manifest-file-7fdce7.s3.amazonaws.com and see if it can return successfully?

Ref error:

https://github.com/hickory-dns/hickory-dns/blob/bf655508e9f56756aa33638a0a055ca07d5b4c59/crates/proto/src/error.rs#L177-L191

[qwerttvv]

是的，这两个在我使用的dns服务器都是正常的，大佬你可以瞅一眼pymumu/smartdns#1657 这里有我发现这个问题的全过程，我一开始以为是smartdns的问题 ，后来觉得有可能是解析并优先传递给我的亚马逊的ipv4做了哪些手脚，我就决定限制ip返回的数量手工进行排查，结果我限制返回5个ip，问题解决了，我才发现是返回ip数量过多就出毛病

[zonyitoo]

Interestingly I can't reproduce it locally, for example:

; <<>> DiG 9.11.26-RedHat-9.11.26-4.tl3 <<>> s3-us-west-1.amazonaws.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37523
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;s3-us-west-1.amazonaws.com.	IN	A

;; ANSWER SECTION:
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.193.96
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.116.104
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.112.64
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.193.152
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.194.160
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.193.176
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.194.8
s3-us-west-1.amazonaws.com. 5	IN	A	52.219.193.8

;; Query time: 117 msec
;; SERVER: ...#53(...)
;; WHEN: Mon Feb 05 16:54:28 CST 2024
;; MSG SIZE  rcvd: 183

and

; <<>> DiG 9.11.26-RedHat-9.11.26-4.tl3 <<>> github-production-upload-manifest-file-7fdce7.s3.amazonaws.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49512
;; flags: qr rd ra; QUERY: 1, ANSWER: 10, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;github-production-upload-manifest-file-7fdce7.s3.amazonaws.com.	IN A

;; ANSWER SECTION:
github-production-upload-manifest-file-7fdce7.s3.amazonaws.com.	42821 IN CNAME s3-1-w.amazonaws.com.
s3-1-w.amazonaws.com.	16	IN	CNAME	s3-w.us-east-1.amazonaws.com.
s3-w.us-east-1.amazonaws.com. 55 IN	A	52.217.173.137
s3-w.us-east-1.amazonaws.com. 55 IN	A	54.231.139.57
s3-w.us-east-1.amazonaws.com. 55 IN	A	52.217.14.212
s3-w.us-east-1.amazonaws.com. 55 IN	A	16.182.32.193
s3-w.us-east-1.amazonaws.com. 55 IN	A	3.5.17.230
s3-w.us-east-1.amazonaws.com. 55 IN	A	54.231.168.9
s3-w.us-east-1.amazonaws.com. 55 IN	A	52.217.92.20
s3-w.us-east-1.amazonaws.com. 55 IN	A	52.217.90.124

;; Query time: 27 msec
;; SERVER: ...#53(...)
;; WHEN: Mon Feb 05 16:55:02 CST 2024
;; MSG SIZE  rcvd: 269

It didn't return tons of IPs like your case.

[qwerttvv]

这返回的太少了，我是用了smartdns，可以解析多个上游dns服务器并且把结果整合然后进一步处理

[zonyitoo]

I can't reproduct it in my own environment then.

https://github.com/hickory-dns/hickory-dns/blob/main/bin/src/hickory-dns.rs

You could build this tool and run it directly in your environment and see if it can be reproduced.

[dev4u]

不是返多少个ip的问题，而是smrtdns返的ip并不是都能连接得上。
这也是随便搞dns会导致访问速度不增反减的原因。

[qwerttvv]

不是返多少个ip的问题，而是smrtdns返的ip并不是都能连接得上。 这也是随便搞dns会导致访问速度不增反减的原因。

别没测试就臆想。这两个域名返回的我都测过了都是好的，问题就出现在我描述的环节。我在本地绕开ss rust，限制返回40个ip，实测返回40个没有任何问题，只是和vps返回的头部结果测速不同。

如果你用smartdns建议你看看文档，做好配置，比如测速模式，可以调整为443，80，ping看看你的臆想还是不是存在

最近时间紧，没时间多测，我回头先安提示去组件那边提个issue看看

[zonyitoo]

If smartdns could respond to hickory-dns's Query, we should first make a reproducible test case. I don't recommend you to open an issue to hickory-dns right now, because very likely that they couldn't reproduce that without running a smartdns to merge different responses together from many upstreams.

I couldn't test it locally, so expecting your test report.

[qwerttvv]

If smartdns could respond to hickory-dns's Query, we should first make a reproducible test case.

I couldn't test it locally, so expecting your test report.

年底太忙了，没太多时间搭环境，要不然，，，我把vps的smartdns开个公网服务你可以做上游，咱约定个时间段，我把限制去了直接返回限制40个ip，一定复现的。
如果觉得可行，发个邮件地址我把我vps地址也就是公开dns地址给你

另外问一下ipv6支持吗？我开v6的公开服务风险小一些，不是怕别人用，怕gfw封ip

[qwerttvv]

想了一下，v4地址也行，我稍微改改配置应该也能稍微降低风险udp协议就行，我看了那个组件，可以支持非53的非标端口

[zonyitoo]

No worry, since your service working fine right now, there is no hurry.

Opening ports to strangers is not safe.

Checklists:

1. Just run sslocal or ssserver with -vvv and see if we can find any hickory-dns's error logs.
2. Test with hickory-dns's tool: https://github.com/hickory-dns/hickory-dns/blob/main/bin/src/hickory-dns.rs
3. Test with different protocols, for example, TCP. smartdns should support TCP DNS queries.