271 lines
9.2 KiB
Markdown
271 lines
9.2 KiB
Markdown
---
|
||
tags: [计算机网络, DNS, DHCP, WebSocket]
|
||
create time: 2026-05-18 03:10
|
||
---
|
||
|
||
# DNS / DHCP / WebSocket
|
||
|
||
## 一、DNS 原理与优化
|
||
|
||
### DNS 查询流程（递归 vs 迭代）
|
||
|
||
```mermaid
|
||
sequenceDiagram
|
||
participant U as 用户浏览器
|
||
participant LRD as 本地 DNS Resolver<br/>ISP 或 1.1.1.1/9.9.9.9
|
||
participant TLD as TLD Server<br/>.com
|
||
participant AUTH as Authoritative NS<br/>example.com
|
||
|
||
U->>LRD: 递归查询 "example.com?"
|
||
|
||
Note over LRD: 检查本地缓存...
|
||
LRD->>TLD: 迭代查询 ".com?"
|
||
TLD-->>LRD: "去问 example.com 的 NS"
|
||
|
||
LRD->>AUTH: 迭代查询 "example.com A 记录?"
|
||
AUTH-->>LRD: 93.184.216.34
|
||
|
||
Note over LRD: TTL=300 → 缓存 5 分钟
|
||
LRD-->>U: ✅ 93.184.216.34
|
||
```
|
||
|
||
### 关键概念
|
||
|
||
| 术语 | 说明 |
|
||
|------|------|
|
||
| **Recursion Desired (RD)** | 客户端要求 DNS 服务器递归查找 |
|
||
| **Authority Section** | 指向下一级的授权 NS |
|
||
| **CNAME Chain** | 别名链，最多 63 层嵌套 |
|
||
| **TTL** | Time To Live，缓存有效期（秒） |
|
||
| **ANAME/ALIAS** | 根域名的 CNAME 替代方案 |
|
||
| **Any 查询** | `query type = ANY`，RFC 8753 建议禁用 |
|
||
|
||
### 常见记录类型
|
||
|
||
| 类型 | 名称 | 用途 | 示例 |
|
||
|------|------|------|------|
|
||
| A | Address | IPv4 地址 | `@ A 93.184.216.34` |
|
||
| AAAA | Address V6 | IPv6 地址 | `@ AAAA 2606:2800:220:1:248:1893:25c8:1946` |
|
||
| CNAME | Canonical Name | 别名 | `www CNAME example.com` |
|
||
| MX | Mail Exchange | 邮件服务器优先级 | `@ MX 10 mail.example.com` |
|
||
| TXT | Text | SPF/DKIM/域名验证 | `v=spf1 include:_spf.google.com ~all` |
|
||
| SRV | Service | 服务定位 | `_sip._tcp SVC 1 0 5060 sip.example.com` |
|
||
| NS | Name Server | 授权 NS 记录 | `@ NS ns1.provider.com` |
|
||
| PTR | Pointer | 反向解析 (IP → 域名) | `34.216.184.93.in-addr.arpa PTR example.com` |
|
||
| SOA | Start of Authority | 区域文件起始权威记录 | `ns1 admin email serial refresh retry expire minimum` |
|
||
| DS / DNSKEY | — | DNSSEC 签名验证 | — |
|
||
|
||
### DNS 缓存层次
|
||
|
||
```
|
||
┌─────────────────────────────────────┐
|
||
│ Tier 1: Application/CPU Cache │ ← Go sync.Map / HTTP cache header
|
||
│ TTL controlled by Content-TTL │ Browser cache varies 0~30min
|
||
├─────────────────────────────────────┤
|
||
│ Tier 2: OS Resolver Cache │ ← nscd / systemd-resolved / DNSMasq
|
||
│ Linux: nscd (default off!) │ macOS: mDNSResponder
|
||
│ macOS: mDNSResponder (~120s) │ Windows: Dnscache
|
||
├─────────────────────────────────────┤
|
||
│ Tier 3: ISP / Recursive Resolver │ ← Cloudflare 1.1.1.1, Google 8.8.8.8
|
||
│ TTL from authoritative server │ 通常 60~300s 最小缓存
|
||
├─────────────────────────────────────┤
|
||
│ Tier 4: TLD + Authoritative │ ← .com NS → example.com NS
|
||
│ No user-controlable caching │
|
||
└─────────────────────────────────────┘
|
||
```
|
||
|
||
### DNS-over-HTTPS / DNS-over-TLS
|
||
|
||
| 协议 | RFC | 端口 | 特点 |
|
||
|------|-----|------|------|
|
||
| DoH (DNS over HTTPS) | 8484 | 443 (TCP) | 伪装成 HTTPS 流量，CDN 友好 |
|
||
| DoT (DNS over TLS) | 7858 | 853 (TCP) | 专用加密通道 |
|
||
| DoQ (DNS over QUIC) | 9230 | 853 (UDP via QUIC) | HTTP/3 风格 |
|
||
|
||
```bash
|
||
# Linux 启用 DoH
|
||
$ resolvectl dns eth0 1.1.1.1
|
||
$ resolvectl domain eth0 "~."
|
||
|
||
# dig 指定 DNS 服务器
|
||
$ dig @1.1.1.1 example.com +short
|
||
93.184.216.34
|
||
```
|
||
|
||
## 二、DHCP 自动分配
|
||
|
||
### DHCP 四步交互（DORA）
|
||
|
||
```mermaid
|
||
sequenceDiagram
|
||
participant Client as 新设备<br/>(无 IP)
|
||
participant Server as DHCP Server
|
||
|
||
Note over Client: BOOTING state, src_ip=0.0.0.0
|
||
Client->>Server: DHCPDISCOVER (broadcast ff:ff:ff:ff:ff:ff)
|
||
Note over Server: 收到后从可用池选择一个 IP
|
||
|
||
Server-->>Client: DHCPOFFER (ip=x.x.x.x, lease_time=T, gw=y.y.y.y)
|
||
Note over Client: SELECTING state
|
||
|
||
Client->>Server: DHCPREQUEST (requested ip=x.x.x.x)
|
||
Note over Server: 确认分配
|
||
|
||
Server-->>Client: DHCPACK (confirmed allocation)
|
||
Note over Client: BOUND state ✅ IP = x.x.x.x
|
||
```
|
||
|
||
### DHCP 续租机制
|
||
|
||
```
|
||
租约时间 = Lease Time（默认通常 24h）
|
||
|
||
续约时机:
|
||
• T1 = 50% 租约时 → RENEW (单播到原服务器)
|
||
• T2 = 87.5% 租约时 → REBIND (广播到新服务器)
|
||
• 到期前必须续约成功，否则释放 IP
|
||
```
|
||
|
||
```bash
|
||
# Linux DHCP 客户端配置
|
||
$ cat /etc/dhcp/dhclient.conf
|
||
timeout 300; # 超时重试间隔
|
||
retry 60; # 初始重试间隔
|
||
reboot 10; # 重启时重尝试获取 IP
|
||
request subnet-mask, broadcast-address, time-offset, routers;
|
||
|
||
# 手动刷新 IP
|
||
$ sudo dhclient -r eth0 # release
|
||
$ sudo dhclient eth0 # request new
|
||
```
|
||
|
||
## 三、WebSocket 全双工通信
|
||
|
||
### 为什么需要 WebSocket？
|
||
|
||
```
|
||
传统轮询 vs WebSocket:
|
||
═══════════════════════
|
||
Polling: Client ─→ GET /status ─→ empty
|
||
Client ─→ GET /status ─→ {"msg": "hi"}
|
||
Client ─→ GET /status ─→ empty
|
||
... 浪费带宽，延迟高
|
||
|
||
Long Polling:
|
||
Client ─→ GET /status (挂起) ─→ ...等待... ─→ {"msg": "hi"}
|
||
Client ─→ GET /status (再挂起) ─→ ...
|
||
|
||
WebSocket ✨:
|
||
Client ─── 握手升级 ───→ 持久双向通道
|
||
Server ─── 推送消息 ───→ Client
|
||
Client ─── 推送消息 ───→ Server
|
||
← 全双工、低开销! -->
|
||
```
|
||
|
||
### WebSocket 握手升级过程
|
||
|
||
```
|
||
HTTP 请求 → WebSocket → HTTP 响应
|
||
|
||
Client: Server:
|
||
GET /ws/chat HTTP/1.1 101 Switching Protocols
|
||
Host: chat.example.com Upgrade: websocket
|
||
Upgrade: websocket Connection: Upgrade
|
||
Connection: Upgrade Sec-WebSocket-Accept: <base64-hash>
|
||
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
|
||
Sec-WebSocket-Version: 13
|
||
```
|
||
|
||
**关键：** 这不是 TCP 层面的升级，而是 HTTP 协议的升级——服务器返回 `101` 状态码告诉客户端："好的，我们从这里开始用 WebSocket 协议"。
|
||
|
||
### Sec-WebSocket-Accept 计算
|
||
|
||
```go
|
||
import (
|
||
"crypto/sha1"
|
||
"encoding/base64"
|
||
"strings"
|
||
)
|
||
|
||
const magicGUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
|
||
|
||
func computeAccept(key string) string {
|
||
h := sha1.New()
|
||
h.Write([]byte(key + magicGUID))
|
||
return base64.StdEncoding.EncodeToString(h.Sum(nil))
|
||
}
|
||
|
||
// 例: key = "dGhlIHNhbXBsZSBub25jZQ=="
|
||
// accept = "s3pPLMBiTxaQ9kYGzzhZRbK+xOo="
|
||
```
|
||
|
||
### WebSocket Frame 格式
|
||
|
||
```
|
||
┌───────────┬───────────┬─────────────┬───────────────┬────────────────┐
|
||
│ FIN(1 bit)│ RSV(3bit) │ Opcode(4bit)│ Mask(1 bit) │ Payload Len │
|
||
│ │ │ │ │ + Ext Len │
|
||
├───────────┴───────────┴─────────────┴───────────────┼────────────────┤
|
||
│ Extended Payload Length │ Mask Key │
|
||
│ (0, 126, or 127 bytes) │ (4 bytes) │
|
||
├─────────────────────────────────────────────────────┴────────────────┤
|
||
│ Masked Payload Data (variable) │
|
||
└─────────────────────────────────────────────────────────────────────┘
|
||
```
|
||
|
||
| Opcode | 含义 |
|
||
|--------|------|
|
||
| 0x0 | Continuation frame |
|
||
| 0x1 | Text frame |
|
||
| 0x2 | Binary frame |
|
||
| 0x8 | Connection Close |
|
||
| 0x9 | Ping |
|
||
| 0xA | Pong |
|
||
|
||
### Go 中的 WebSocket
|
||
|
||
```go
|
||
package main
|
||
|
||
import (
|
||
"log"
|
||
"net/http"
|
||
"github.com/gorilla/websocket"
|
||
)
|
||
|
||
var upgrader = websocket.Upgrader{
|
||
CheckOrigin: func(r *http.Request) bool {
|
||
return true // 生产环境应严格校验 Origin
|
||
},
|
||
}
|
||
|
||
func wsHandler(w http.ResponseWriter, r *http.Request) {
|
||
conn, err := upgrader.Upgrade(w, r, nil)
|
||
if err != nil {
|
||
log.Println("upgrade error:", err)
|
||
return
|
||
}
|
||
defer conn.Close()
|
||
|
||
for {
|
||
mt, message, err := conn.ReadMessage()
|
||
if err != nil {
|
||
break
|
||
}
|
||
log.Printf("recv: %s", message)
|
||
conn.WriteMessage(mt, message)
|
||
}
|
||
}
|
||
|
||
func main() {
|
||
http.HandleFunc("/ws", wsHandler)
|
||
log.Fatal(http.ListenAndServe(":8080", nil))
|
||
}
|
||
```
|
||
|
||
## 关联笔记
|
||
|
||
- [[hhs/NETWORK/HTTPS与TLS握手]] — SNI 扩展在 DNS 解析中的应用
|
||
- [[hhs/NETWORK/WebSocket全双工通信]] — 心跳机制防止 NAT/代理超时断开
|
||
- [[hhs/NETWORK/NAT原理与应用]] — WebSocket 也受 NAT 影响
|