Qunar DNS體系建設

{"type":"doc","content":[{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"作者簡介：苗宏濤，2010年加入去哪兒，主要負責去哪兒網站運營-技術保障部相關工作。將運維自動化，智能化一直是我秉持的理念。","attrs":{}}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/55/55eadc821fdc83048f7d010929260387.jpeg","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":1},"content":[{"type":"text","text":"DNS定義","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"DNS 是域名系統 ( Domain Name System ) 的縮寫，是因特網的一項核心服務，它作爲可以將域名和 IP 地址相互映射的一個分佈式數據庫，能夠使人更方便的訪問互聯網，而不用去記住能夠被機器直接讀取的 IP 數字串。互聯網能夠互聯互通，能夠方便人們方便訪問，DNS 起到了很大的作用。DNS 查詢過程要維護好 DNS 系統，首先要理解 DNS 的原理和查詢過程。這裏給大家介紹下一般 DNS 查詢過程。","attrs":{}}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/44/4489e9ec5ec24eb9ec92f3ccd99316ca.jpeg","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"numberedlist","attrs":{"start":1,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","text":"用戶（通過 PC/手機）向本地 DNS 服務器發起請求：“你知道 ","attrs":{}},{"type":"link","attrs":{"href":"http://www.qunar.com","title":null,"type":null},"content":[{"type":"text","text":"www.qunar.com","attrs":{}}]},{"type":"text","text":" 的 IP 嗎？”如果首選 DNS 服務器知道，那麼本地 DNS 服務器就會直接給用戶返回域名的 IP 地址","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","text":"若本地 DNS 服務器上沒有相關信息，就不能直接返回域名的 IP 地址，這時候，本地 DNS 服務器就會去詢問根DNS服務器（全球有13 臺 DNS 根服務器，所有的 DNS 服務器都知道這些根服務器的地址），根服務器可能不知道這個具體的 ","attrs":{}},{"type":"link","attrs":{"href":"http://www.qunar.com","title":null,"type":null},"content":[{"type":"text","text":"www.qunar.com","attrs":{}}]},{"type":"text","text":" 的 IP 地址，但是它知道一級域 com 的 IP","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":3,"align":null,"origin":null},"content":[{"type":"text","text":"根服務器將 com 的 IP 地址返回給 本地 DNS 服務器","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":4,"align":null,"origin":null},"content":[{"type":"text","text":"本地 DNS 服務器再去請求 “com” DNS 服務器：“你知道 ","attrs":{}},{"type":"link","attrs":{"href":"http://www.qunar.com","title":null,"type":null},"content":[{"type":"text","text":"www.qunar.com","attrs":{}}]},{"type":"text","text":" 的 IP 嗎”，但是 com DNS 服務器也不知道 ","attrs":{}},{"type":"link","attrs":{"href":"http://www.qunar.com","title":null,"type":null},"content":[{"type":"text","text":"www.qunar.com","attrs":{}}]},{"type":"text","text":" 的 IP ，但是 com DNS 服務器知道 qunar.com 的 IP","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":5,"align":null,"origin":null},"content":[{"type":"text","text":"“com” DNS 服務器將這個信息返回給本地 DNS 服務器","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":6,"align":null,"origin":null},"content":[{"type":"text","text":"本地 DNS 服務器再去請求 “qunar.com” DNS 服務器，這時候 qunar.com 服務器當然就會知道 ","attrs":{}},{"type":"link","attrs":{"href":"http://www.qunar.com","title":null,"type":null},"content":[{"type":"text","text":"www.qunar.com","attrs":{}}]},{"type":"text","text":" 的 IP 地址","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":7,"align":null,"origin":null},"content":[{"type":"text","text":"“qunar.com” DNS 服務器將這個信息返回給本地 DNS 服務器","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":8,"align":null,"origin":null},"content":[{"type":"text","text":"本地 DNS 服務器將獲取到的 ","attrs":{}},{"type":"link","attrs":{"href":"http://www.qunar.com%E7%9A%84","title":null,"type":null},"content":[{"type":"text","text":"www.qunar.com的","attrs":{}}]},{"type":"text","text":" IP 返回給用戶","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":9,"align":null,"origin":null},"content":[{"type":"text","text":"用戶根據獲取到的 ","attrs":{}},{"type":"link","attrs":{"href":"http://www.qunar.com","title":null,"type":null},"content":[{"type":"text","text":"www.qunar.com","attrs":{}}]},{"type":"text","text":" 的 IP 地址來訪問 WEB 服務器","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":10,"align":null,"origin":null},"content":[{"type":"text","text":"WEB 服務器返回相關的數據","attrs":{}}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":1},"content":[{"type":"text","text":"Qunar DNS系統","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Qunar 的 DNS 系統經歷了 幾次技術和架構的變更，逐漸演變成現在的智能 DNS 系統。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"初期系統","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Qunar 的初期 DNS 管理和大部分的 DNS 管理模式一樣。通過 DNS Master 更新記錄，測試成功後，DNS master 向 slave 發起更新通知，salve 接收到通知後，更新數據。由於我們有多臺授權域服務器。採用這種模式，可以大大降低我們出錯的機率。並且生效快。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"DNSDB管理系統","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Qunar 可以說是 DNS 系統的重度用戶。我們所有的服務器設備，虛擬機和網絡設備的訪問都是通過域名訪問的。隨着業務的不斷增多，需要的建立的域名和服務器數量也成幾何級增長。純手工配置模式已經達不到我們運維的要求。因此，我們建立了我們的 dnsdb 管理系統。隨着業務的發展要求，需要不斷建立一系列域名，提供各種服務。dnsdb 也隨之進行了一系列改造，支持各種服務需求。","attrs":{}}]},{"type":"numberedlist","attrs":{"start":null,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","text":"通過 API 接口方式爲虛機建立自動分配建立域名。","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","text":"負載均衡與 DNSDB 聯動自動建立域名。通過我們的 portal 平臺，可以直接申請域名和轉發方式。後臺自動建立域名和負載均衡配置。","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":3,"align":null,"origin":null},"content":[{"type":"text","text":"建立 Web 域名管理平臺。爲了保證 Qunar 的持續穩定服務，我們建立了多流量出口，進行流量分擔和互備冗餘。當出現一個流量出口有問題，我們需要能夠快速地將流量切到其他出口。但是我們對外服務的域名衆多，現在已經超過了1000個。要實現快速切換，我們就需要做到一鍵切換和恢復的能力。因此，我們建立了 DNSDB Web 管理界面，方便操作和管理。","attrs":{}}]}]}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/e1/e14c89fab69d8e8490a27b046436fa04.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"DNS view","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"解釋下什麼是 DNS view 功能。從 bind9 開始，bind 支持了視圖功能。什麼是視圖功能呢？簡單來說，就是不同的用戶在解析域名的時候，DNS view 可以根據用戶的源 IP ，解析出不同的域名 IP 。DNS view 給我們帶來的好處：","attrs":{}}]},{"type":"numberedlist","attrs":{"start":null,"normalizeStart":1},"content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"text","text":"可以根據不同的運營商進行流量分擔。原來我們的多流量出口都是對所有運營商同時服務的。但增加 view 功能後，我們可以實現不同的運營商訪問不同的流量出口，實現流量調節的功能。","attrs":{}}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"text","text":"優化用戶延遲。我們提供的服務是服務全球用戶的。這裏就有海外用戶訪問國內出口延遲大的問題，所以我們可以利用 view 將海外用戶切到我們的海外出口。同時，還可以進一步利用海外 CDN ，降低用戶訪問延遲。","attrs":{}}]}]}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"EDNS","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"雖然 DNS view 功能幫我們解決了流量分佈問題。但是，我們發現有些用戶還是會出現解析的地址和我們分配的不符問題。通過調查和研究發現，有用戶會修改自己的 DNS server 配置，經常發現用戶會把自己的 DNS server 設置爲8.8.8.8 。由於用戶使用了不是自己運營商的 DNS server，所以造成 DNS view 識別用戶區域時錯誤。EDNS 正好可以幫助我們解決這個問題。爲強化 DNS 服務的驗證，ICANN 不斷推廣 DNS Security Extensions（DNSSEC），目標是提升網絡的使用安全，要確保 DNS 的內容，不會在源頭被修改，以及阻止黑客惡意移轉 DNS 用戶的流量，同時也讓 DNS 的查詢將更加安全。而在 DNSSEC 中，包含了兩個重要關鍵技術，分別是數字簽名與 EDNS 。EDNS 技術中，DNS server 在向我們的授權域服務器發起請求的時候，會攜帶真實用戶的 IP 。我們的 DNS server 在版本升級後，也支持了 EDNS 的解析。這樣，我們就解決用戶流量分配錯誤的問題。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"HTTPDNS","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"回顧文章開始的部分，一個用戶在訪問一個網站的時候，首先都是通過自己本地的 DNS 服務器 去獲得網站的解析，然後完成訪問。但是，出於一些不可預知的原因，有些 DNS 域名服務提供商會修改域名解析的正常結果，導致解析錯誤。這就叫域名劫持。在 PC 端可以提供的解決辦法確實不多，但是隨着移動互聯網的應用越來越普及。我們也有了更多客戶端應用控制的能力。HTTPDNS 就是在這個場景下誕生的。HTTPDNS 就是通過 HTTP 協議實現的 DNS 解析服務。用戶通過 HTTP/HTTPS 訪問一個固定地址，獲取一個的解析，巧妙的解決了域名劫持問題。Qunar 自己實現了一套 HTTPDNS 服務系統，並且支持了 DNS view，EDNS 功能。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"DNS智能切換","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"雖然我們的 DNSDB 系統的功能已經逐步完善，但在遇到 IDC 網絡故障， IDC 上級運營商網絡故障或者 IDC 受到攻擊無法自動感知，自動切換。因此，增加了每個機房增加對不同運營商的實時監控。","attrs":{}}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/cc/cc1a0ce8183d260d78542cdb897425e6.png","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過上述不同運營商級別的數據再加工，設置報警和 callback 閾值。當出現運營商級別或者 IDC 網絡的故障時，DNSDB 可以自動將流量切換到其他流量出口。當監控恢復後，流量自動切回來。整個運維過程，完全是自動化，智能化。通過這套系統，我們可以實現分鐘級別的故障自愈能力。","attrs":{}}]},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/c3/c32ed813d9d4f59dce2fe7ccc690731e.jpeg","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":1},"content":[{"type":"text","text":"結語","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過對 DNS 系統的不斷改造和功能完善，Qunar 終於建造了一套自己的 DNS 智能管理系統，並且提供了一系列功能，滿足業務的各種需求。上面用到的技術也是這幾年業界都比較熱門的技術。也希望通過這次分享，能給同事做運維的同學帶來啓發，也希望能夠和同行業多多交流。","attrs":{}}]}]}