lou
efa634b574
真凶(两次"阿里云黑洞"实为系统卡死): server 每连接新建 SSLContext (每次重读证书, 内存+盘 IO 双爆点) + ThreadPoolExecutor 无界队列 (4MB 帧在内存堆积) -> 1.6G 云服 OOM -> swap 抖动 -> 系统盘 IOPS/BPS 打满 -> 整机假死(ping 丢+应用全断, 形似黑洞)。 - server: SSLContext 启动建一次复用; TLS 握手移入连接线程(不再 阻塞 accept 主循环); 在飞请求/并发连接双上限(64); 响应上限 8MB; 内存自愈(RSS 达阈值主动退出, 交由 systemd 重启释放) - proxy_dns: 通道不可用 -> 直连 fallback_dns 降级(全屋 DNS 不断), 再失败回 SERVFAIL(客户端立即切备用 DNS, 不再干等超时); 重连改 后台限频, 不再阻塞查询路径 - client: DNS 请求超时 15s -> 3.5s(让降级快速触发) - watchdog: 判据由端口/进程探测改为直连云端完成 TLS+AUTH(端口在听、 本地 DNS 探针都会给假健康信号 - 降级路径照样能答); 通道不健康即 撤 L2 劫持规则, DNS 回落 smartdns 直连; HTTP 规则排除内网段 - 配置外置: fallback_dns + 服务端防护参数 - 新增 scripts/test_dns_fallback.py(降级链单测, 2/2 PASS) QEMU OpenWrt lab 全链路验证: 降级 / 判据 / 故障演练(云挂->自动撤 规则、云回->自动重挂) 全过。
39 lines
906 B
JSON
39 lines
906 B
JSON
{
|
|
"cloud": {
|
|
"host": "203.0.113.10",
|
|
"port": 8444,
|
|
"token": "CHANGE_ME_BEFORE_DEPLOY",
|
|
"ca_path": ""
|
|
},
|
|
"http_proxy": {
|
|
"listen_port": 8080
|
|
},
|
|
"dns_proxy": {
|
|
"listen_port": 8053,
|
|
"school_dns": "192.0.2.53",
|
|
"fallback_dns": "223.5.5.5",
|
|
"internal_suffixes": [
|
|
".internal.example"
|
|
]
|
|
},
|
|
"heartbeat": 30,
|
|
"cloud_side": {
|
|
"listen_port": 8444,
|
|
"token": "CHANGE_ME_BEFORE_DEPLOY",
|
|
"dns_upstream": "223.5.5.5",
|
|
"forward_scheme": "https",
|
|
"ua": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36",
|
|
"deny_suffixes": [],
|
|
"max_inflight": 64,
|
|
"max_connections": 64,
|
|
"tls_handshake_timeout": 8,
|
|
"max_response_bytes": 8388608,
|
|
"memory_limit_mb": 220,
|
|
"memory_check_interval": 30,
|
|
"tls": {
|
|
"cert_file": "",
|
|
"key_file": ""
|
|
}
|
|
}
|
|
}
|