Java内部DNS查询实现和参数设置

  categories:资料  author:

一、Java内部DNS查询

Java使用域名查询时,用的自己内部的域名实现机制,最后都是交给InetAddress去做DNS解析。

源码分析参考:http://www.linuxidc.com/Linux/2016-07/133180.htm

//域名查询
String dottedQuadIpAddress = InetAddress.getByName( "blog.arganzheng.me" ).getHostAddress();

//IP对应域名
InetAddress[] addresses = InetAddress.getAllByName("8.8.8.8"); // ip or DNS name
for (int i = 0; i < addresses.length; i++) {
    String hostname = addresses[i].getHostName();
    System.out.println(hostname);
}

二、JNDI DNS服务提供者设置(JNDI DNS service provider settings)

http://docs.Oracle.com/javase/7/docs/technotes/guides/net/properties.html

sun.net.spi.nameservice.provider.<n>=<default|dns,sun|…>Specifies the name service provider that you can use. By default, Java will use the system configured name lookup mechanism, such as file, nis, etc. You can specify your own by setting this option. <n> takes the value of a positive number, it indicates the precedence order with a small number takes higher precendence over a bigger number. Aside from the default provider, the JDK includes a DNS provider named “dns,sun”.

Prior to JDK 7, the first provider that was successfully loaded was used. In JDK 7, providers are chained, which means that if a lookup on a provider fails, the next provider in the list is consulted to resolve the name.

重点是这个参数,区分jdk版本,jdk7之前,只有第一个设置的provier生效;jdk7及其之后,provider链都生效,从第一个开始,指导解析成功。

Java有两个实现:

Default:相当于设置System.setProperty(“sun.net.spi.nameservice.provider.1″, “default”); 具体解析过程是系统调用,依赖系统的DNS解析方式。

linux 默认的DNS方式是读取/etc/resolv.conf进行DNS解析。

mac 默认的方式是向网关请求获取DNS服务器,然后直接请求DNS服务器进行解析,没有读取/etc/resolv.conf。

<dns,sun>:System.setProperty(“sun.net.spi.nameservice.provider.1″, “dns,sun”);读取/etc/resolv.conf进行DNS解析。


sun.net.spi.nameservice.nameservers=<server1_ipaddr,server2_ipaddr …>You can specify a comma separated list of IP addresses that point to the DNS servers you want to use. If the sun.net.spi.nameservice.nameservers property is not defined, then the provider will use any name servers already configured in the platform DNS configuration.


sun.net.spi.nameservice.domain=<domainname>This property specifies the default DNS domain name, for instance, eng.example.com. If the sun.net.spi.nameservice.domain property is not defined then the provider will use any domain or domain search list configured in the platform DNS configuration.

 

使用dnsjava的provider:

1. 工程添加dnsjava包。

2. 设置provider:System.setProperty(“sun.net.spi.nameservice.provider.1″,”dns,dnsjava”);

dnsjava的provider功能强大:

There's no standard way to determine what the local nameserver or DNS search
path is at runtime from within the JVM.  dnsjava attempts several methods
until one succeeds.

 - The properties 'dns.server' and 'dns.search' (comma delimited lists) are
   checked.  The servers can either be IP addresses or hostnames (which are
   resolved using Java's built in DNS support).
 - The sun.net.dns.ResolverConfiguration class is queried.
 - On Unix, /etc/resolv.conf is parsed.
 - On Windows, ipconfig/winipcfg is called and its output parsed.  This may
   fail for non-English versions on Windows.
 - As a last resort, "localhost" is used as the nameserver, and the search
   path is empty.

参考:

http://www.xbill.org/dnsjava/dnsjava-current/README

http://stackoverflow.com/questions/5668058/how-to-change-the-java-dns-service-provider

三、JVM DNS缓存

如果启动了security manager,则永久缓存,但一般情况下大家是不会去启动security manager的。

可以再程序里面设置不缓存,或者在启动参数里面设置

java.security.Security.setProperty("networkaddress.cache.ttl" , "0")

如果没有启动security manager,则要区分JDK版本:

1.5及其一下,java对DNS解析IP进行缓存,默认缓存超时时间为-1(在重启JVM前永久缓存)

1.6及其以上,缓存时间根据ttl。

参考:

http://docs.oracle.com/javase/1.5.0/docs/guide/net/properties.html

http://docs.oracle.com/javase/7/docs/technotes/guides/net/properties.html

设置ttl:在命令启动JVM的时候设置参数”-Dnetworkaddress.cache.ttl=60 -Dsun.net.inetaddr.ttl=60″

四、Linux服务器是否会对dns缓存,ttl是否有用?

linux本身是没有dns缓存的,想使用dns缓存的话需要自己安装一个服务程序NSCD.

$ ps aux | grep nscd 可以查看

相关问题:http://www.linuxidc.com/Linux/2016-07/133181.htm

五、nginx 自己实现了dns resolver,并且会对dns缓存

六、ping 未知域名的全过程(依赖于操作系统)

主机A,B(可不再同一网段),主机B有域名假设为www.baidu.com
首先:1. 本地主机A在命令行下执行”ipconfig/flushdns”命令来清空本地DNS高速缓存;
2. 本地主机A在命令行下执行”arp -d”命令来清空arp缓存

然后,主机A执行ping www.baidu.com(即主机B的域名)

在此过程中都发生了那些报文交互?

思路:

1.要执行ping命令主机A必须将域名转化为IP地址,故而一定会有DNS解析过程;
2.在DNS解析之前,主机A一定要知道自己默认网关的MAC地址,这就要涉及到ARP解析的问题;
3.ping命令本身是ICMP回显请求,故而肯定要有ICMP协议的回显请求交互。

以下是全过程:

(此处可参照“跨网段的ping过程”来看,此处假设DNS服务器和主机A不在同一网段,若二者在同一网段那么我想只需进行简单arp就可得到DNS服务器的mac不需经过网关)
1.主机A发送ARP请求报文目的mac为FFFFFF-FFFFFF,目的IP为网关的IP,要求获得网关的MAC地址;
2.路由器(主机A的默认网关)发送目的mac为A的mac,目的IP为A的IP的ARP回答报文,以告知A网关的mac地址;
3.A获得网关的mac地址后,就向网关发送一个DNS查询报文,其目的mac地址为网关的mac地址,目的IP为DNS服务器的IP地址;
4.网关收到DNS查询报文后,拆包检查发现是DNS查询于是将相应(查询)信息封装,向DNS服务器发送该报文,其目的IP地址为DNS服务器的IP,目的mac为下一跳的mac,解析域名IP地址此时就交给了DNS服务器;
5.经过DNS解析,主机A知道了所要ping的域名的ip地址;
6.剩下的ping过程就和ping一个特定的ip地址相同了,首先判断ping命令的目的B的IP地址是否和A在同一网段,若在同一网段则相当于同网段内ping,若不在同一网段,就是不同网段的ping只不过此时主机不需要再解析网关的mac地址了。

本文永久更新链接地址:http://www.linuxidc.com/Linux/2016-07/133182.htm

 

默认JVM会缓存每一次DNS的查询结果,并且使缓存结果永远有效,直到你对该JVM重启为止。有时候业务需要系统能对域名切换及时而自动进行切换。这时候你就需要禁用或调整JVM的DNS缓存机制。在独立运行程序中(非容器环境),可以在应用启动的时候通过以下代码完成:

         //设置解析成功的域名记录JVM中缓存的有效时间,JVM默认是永远有效,这样一来域名IP重定向必须重启JVM,这里修改为3秒钟有效,0表示禁止缓存,-1表示永远有效
Security.setProperty(“networkaddress.cache.ttl”, “3”);

         //设置解析失败的域名记录JVM中缓存的有效时间,JVM默认是10秒,0表示禁止缓存,-1表示永远有效
Security.setProperty(“networkaddress.cache.negative.ttl”, “3”);

代码中设置“networkaddress.cache.ttl”值的方式只适用于非容器环境,当应用部署与resin等容器中时该设置控制不了JVM的行为。可行的办法是通过在容器的启动参数中设置JDK系统变量“sun.net.inetaddr.ttl“或“sun.net.inetaddr.negative.ttl”,该参数跟“networkaddress.cache.ttl”和“networkaddress.cache.negative.ttl”的值定义一样,只是一个用于命令行,一个用于程序内部。具体操作方法:
修改httpd.sh,在”args=”选项添加参数,如:-Dsun.net.inetaddr.ttl=0

如果非Resin容器的Java应用中同时配置了命令参数“sun.net.inetaddr.ttl”和Security属性“networkaddress.cache.ttl”,那么会以Security属性的设置为准。
一般情况下我们不需要完全取消JVM的DNS缓存,只需要调小有效时间,经过一些测试发现一下结论:
1)1个域名对应一个IP和一个域名对应12个IP,DNS查询响应时间差别极少,后者占用cpu稍高一点点;
2)在高并发时,不做DNS缓存时的CPU耗用比做了3s缓存的CPU耗用要高3/4倍,实时DNS请求相当耗用CPU;
3)3s和30s缓存有效时间对dns查询响应时间的影响差别不大,cpu内存占用都比较接近;
4)建议使用3秒缓存,兼顾运维和性能;
 ————

JVM DNS IP 地址缓存 (InetAddress)

JVM IP 地址缓存

JVM 的缓存策略

由于 DNS 解析是一个访问量大的不是很可靠的网络调用,因此通常大部分系统都会对 DNS 解析的结果进行一定程度的缓存。如运营商的 LDNS、常用的浏览器、包括操作系统本身,都会对 DNS 解析的结果进行缓存。在 JVM 中,为了加速 DNS 解析的过程,当然也进行了相关的缓存。

在 Java 中,最常用的进行 DNS 解析的方法就是:

java.net.InetAddress.getAllByName(“www.google.com”);

而这个方法本身也会对解析的结果进行相应的缓存。看官方文档:

InetAddress Caching

The InetAddress class has a cache to store successful as well as unsuccessful host name resolutions.

By default, when a security manager is installed, in order to protect against DNS spoofing attacks, the result of positive host name resolutions are cached forever. When a security manager is not installed, the default behavior is to cache entries for a finite (implementation dependent) period of time. The result of unsuccessful host name resolution is cached for a very short period of time (10 seconds) to improve performance.

If the default behavior is not desired, then a Java security property can be set to a different Time-to-live (TTL) value for positive caching. Likewise, a system admin can configure a different negative caching TTL value when needed.

Two Java security properties control the TTL values used for positive and negative host name resolution caching:

networkaddress.cache.ttl
Indicates the caching policy for successful name lookups from the name service. The value is specified as as integer to indicate the number of seconds to cache the successful lookup. The default setting is to cache for an implementation specific period of time.A value of -1 indicates “cache forever”.
networkaddress.cache.negative.ttl (default: 10)
Indicates the caching policy for un-successful name lookups from the name service. The value is specified as as integer to indicate the number of seconds to cache the failure for un-successful lookups.A value of 0 indicates “never cache”. A value of -1 indicates “cache forever”.

简单来说,在默认情况下,成功解析到 IP 的解析结果会被永久缓存,而解析失败的结果会被缓存 10s。

虽然在一般情况下,这个缓存有利于提高系统的效率,减少网络交互。但是当我们依赖 DNS 进行负载均衡的时候,就会出现问题了。

修改策略

想要修改 JVM 默认的缓存策略,有三种方法实现:

  1. 修改 java.sercurity 配置文件
  2. JVM 启动时添加启动参数
  3. JVM 启动后,通过 System 修改系统类属性

修改配置文件

在 JDK 的 %JAVA_HOME%/jre/lib/security  目录下存在 java.security 文件。通过修改文件中的networkaddress.cache.ttl  和 networkaddress.cache.negative.ttl  可以达到修改缓存策略的目的。配置信息如下:

JVM 启动时修改启动参数

同样的可以通过启动参数的方式来改变这个值:

https://docs.oracle.com/javase/8/docs/technotes/guides/net/properties.html

sun.net.inetaddr.ttlThis is a Oracle JDK private system property which corresponds to networkaddress.cache.ttl. It takes the same value and has the same meaning, but can be set as a command-line option. However, the preferred way is to use the security property mentioned above.


sun.net.inetaddr.negative.ttlThis is a Oracle JDK private system property which corresponds to networkaddress.cache.negative.ttl. It takes the same value and has the same meaning, but can be set as a command-line option. However, the preferred way is to use the security property mentioned above.

运行时通过 System 类修改

通过 java.lang.System  类在JVM启动后修改。

或者

—————————

二、本人找到四种方式清理jvm的DNS缓存,大家可以根据自己的情况选用。

 1. 在首次调用InetAddress.getByName()前,设置java.security.Security.setProperty(“networkaddress.cache.ttl”, “0”);
2. 修改jre/lib/security/java.security 下的 networkaddress.cache.ttl 属性
3. jvm启动参数中设置-Dsun.net.inetaddr.ttl=0
4. 通过反射清理,如本文的clearCache方法
三、代码
  1. package xiaofei;
  2. import java.lang.reflect.Field;
  3. import java.net.InetAddress;
  4. import java.net.UnknownHostException;
  5. import java.util.Map;
  6. /**
  7. * @author xiaofei.wxf
  8. * @date 13-12-18
  9. */
  10. public class DNSCacheTest {
  11. /**
  12. * 1. 在首次调用InetAddress.getByName()前,设置java.security.Security.setProperty(“networkaddress.cache.ttl”, “0”);
  13. * 2. 修改jre/lib/security/java.security 下的 networkaddress.cache.ttl 属性
  14. * 3. jvm启动参数中设置-Dsun.net.inetaddr.ttl=0
  15. * 4. 调用clearCache方法清除
  16. *
  17. * @param args
  18. * @throws UnknownHostException
  19. */
  20. public static void main(String[] args) throws UnknownHostException, NoSuchFieldException, IllegalAccessException {
  21. java.security.Security.setProperty(“networkaddress.cache.ttl”, “0”);
  22. InetAddress addr1 = InetAddress.getByName(“www.baidu.com”);
  23. System.out.println(addr1.getHostAddress());
  24. //clearCache();
  25. //在下一行设置断点.
  26. //放在此处无效,因为类加载的时候就确定了这个值(应该在使用InetAddress.getByName之前设置)已经缓存了cache
  27. //java.security.Security.setProperty(“networkaddress.cache.ttl”, “0”);
  28. InetAddress addr2 = InetAddress.getByName(“www.baidu.com”);
  29. System.out.println(addr2.getHostAddress());
  30. InetAddress addr3 = InetAddress.getByName(“www.google.com”);
  31. System.out.println(addr3.getHostAddress());
  32. InetAddress addr4 = InetAddress.getByName(“www.google.com”);
  33. System.out.println(addr4.getHostAddress());
  34. //clearCache();
  35. }
  36. public static void clearCache() throws NoSuchFieldException, IllegalAccessException {
  37. //修改缓存数据开始
  38. Class clazz = java.net.InetAddress.class;
  39. final Field cacheField = clazz.getDeclaredField(“addressCache”);
  40. cacheField.setAccessible(true);
  41. final Object obj = cacheField.get(clazz);
  42. Class cacheClazz = obj.getClass();
  43. final Field cachePolicyField = cacheClazz.getDeclaredField(“type”);
  44. final Field cacheMapField = cacheClazz.getDeclaredField(“cache”);
  45. cachePolicyField.setAccessible(true);
  46. cacheMapField.setAccessible(true);
  47. final Map cacheMap = (Map)cacheMapField.get(obj);
  48. System.out.println(cacheMap);
  49. cacheMap.remove(“www.baidu.com”);
  50. }
  51. }

 



快乐成长 每天进步一点点      京ICP备18032580号-1