【网络工程】全局负载均衡：GSLB、DNS 调度与 Anycast

# 用 dig 测试 ECS 支持
dig @8.8.8.8 app.example.com +subnet=183.60.0.0/20

# 查看响应中的 ECS 信息
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
; CLIENT-SUBNET: 183.60.0.0/20/24  ← scope /24 表示缓存粒度

# 使用 PowerDNS + GeoIP Backend
# /etc/pdns/pdns.conf
launch=geoip
geoip-database-files=/usr/share/GeoIP/GeoLite2-City.mmdb
geoip-zones-file=/etc/pdns/geo-zones.yaml

# /etc/pdns/geo-zones.yaml
domains:
- domain: example.com
  ttl: 60
  records:
    app.example.com:
      - soc: "0.0.0.0/0"           # 默认
        content:
          - type: A
            value: 10.2.1.100       # 上海（默认）
      - soc: "%cn"                  # 中国
        content:
          - type: A
            value: 10.1.1.100       # 北京
      - soc: "%cn-gd"              # 广东省
        content:
          - type: A
            value: 10.3.1.100       # 广州
      - soc: "%sg"                  # 新加坡
        content:
          - type: A
            value: 10.4.1.100       # 新加坡

# 使用 BIND + GeoIP ACL
# /etc/bind/named.conf
acl "china-north" {
    202.106.0.0/16;    # 北京联通
    61.135.0.0/16;     # 北京电信
    // ... 更多中国北方 IP 段
};

acl "china-south" {
    183.60.0.0/16;     # 广东电信
    14.17.0.0/16;      # 广东联通
    // ... 更多中国南方 IP 段
};

view "china-north" {
    match-clients { china-north; };
    zone "example.com" {
        type master;
        file "/etc/bind/zones/example.com.north";
    };
};

view "china-south" {
    match-clients { china-south; };
    zone "example.com" {
        type master;
        file "/etc/bind/zones/example.com.south";
    };
};

# DNS 返回多个 IP，客户端自行选择
dig app.example.com +short
10.1.1.100
10.2.1.100
10.3.1.100

# 每个 IP 关联独立健康检查
# 不健康的 IP 自动从应答中移除

# 方案 1：PowerDNS + Lua 脚本实现动态调度
# /etc/pdns/gslb.lua
function preresolve(dq)
    if dq.qname:equal(newDN("app.example.com")) then
        -- 获取各站点健康状态
        local bj_healthy = checkHealth("10.1.1.100")
        local sh_healthy = checkHealth("10.2.1.100")

        -- 获取客户端子网（ECS）
        local ecs = dq.ecs
        local region = geoLookup(ecs or dq.remoteaddr)

        -- 调度逻辑
        if region == "north" and bj_healthy then
            dq:addAnswer(pdns.A, "10.1.1.100", 60)
        elseif sh_healthy then
            dq:addAnswer(pdns.A, "10.2.1.100", 60)
        elseif bj_healthy then
            dq:addAnswer(pdns.A, "10.1.1.100", 60)
        else
            -- 所有站点不健康，返回降级页面 IP
            dq:addAnswer(pdns.A, "10.0.0.1", 30)
        end
        return true
    end
    return false
end

# 方案 2：CoreDNS + 自定义插件
# Corefile
example.com {
    gslb {
        zone example.com
        record app {
            backend 10.1.1.100 {
                region china-north
                weight 60
                healthcheck http://10.1.1.100:8080/health 5s
            }
            backend 10.2.1.100 {
                region china-south
                weight 40
                healthcheck http://10.2.1.100:8080/health 5s
            }
        }
        geoip /usr/share/GeoIP/GeoLite2-City.mmdb
        ecs true
    }
    log
    errors
}

# 方案 3：使用 gdnsd（专为 GeoDNS 设计）
# /etc/gdnsd/config
options => {
    listen => [ 0.0.0.0 ]
    dns_port => 53
    edns_client_subnet => true
}

service_types => {
    http_check => {
        plugin => http_status
        url_path => /health
        interval => 5
        timeout => 3
    }
}

# /etc/gdnsd/zones/example.com
$TTL 60
@ SOA ns1.example.com. admin.example.com. (
    2024010101 3600 900 604800 60 )
@ NS ns1.example.com.
@ NS ns2.example.com.
app DYNA geoip!mymap

# PoP 节点的 BGP 配置 (BIRD)
# /etc/bird/bird.conf
router id 10.0.1.1;

protocol static anycast_routes {
    route 203.0.113.100/32 blackhole;  # Anycast 路由
}

protocol bgp upstream1 {
    local as 65001;
    neighbor 10.0.0.1 as 64512;
    export filter {
        if net = 203.0.113.100/32 then accept;
        reject;
    };
}

# 健康检查：如果本地服务不健康，撤回 BGP 宣告
protocol static {
    route 203.0.113.100/32 blackhole;
}

# 使用 health check 脚本控制路由宣告
# 健康时: birdc enable anycast_routes
# 不健康时: birdc disable anycast_routes

#!/bin/bash
# anycast_healthcheck.sh — Anycast 健康检查脚本
# 检查本地服务是否正常，控制 BGP 路由宣告

SERVICE_URL="http://localhost:8080/health"
CHECK_INTERVAL=3
FAIL_THRESHOLD=3
CONSECUTIVE_FAILS=0

while true; do
    HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
        --connect-timeout 2 --max-time 5 "$SERVICE_URL")

    if [ "$HTTP_CODE" = "200" ]; then
        CONSECUTIVE_FAILS=0
        # 确保路由已宣告
        birdc show protocols anycast_routes | grep -q "up" || \
            birdc enable anycast_routes
    else
        CONSECUTIVE_FAILS=$((CONSECUTIVE_FAILS + 1))
        if [ "$CONSECUTIVE_FAILS" -ge "$FAIL_THRESHOLD" ]; then
            echo "$(date): 连续失败 $CONSECUTIVE_FAILS 次，撤回 BGP 宣告"
            birdc disable anycast_routes
        fi
    fi

    sleep "$CHECK_INTERVAL"
done

# BIRD 配置：使用 BGP Community 控制路由传播
# /etc/bird/bird.conf

# 定义 Community 常量
define LOCAL_PREF_HIGH = (65001, 100);   # 高优先级
define LOCAL_PREF_LOW  = (65001, 50);    # 低优先级
define NO_EXPORT       = (65535, 65281); # 不向外部对等体宣告
define BLACKHOLE       = (65001, 666);   # 黑洞路由（DDoS 防御）

protocol bgp upstream1 {
    local as 65001;
    neighbor 10.0.0.1 as 64512;
    export filter {
        if net = 203.0.113.100/32 then {
            bgp_community.add(LOCAL_PREF_HIGH);
            accept;
        }
        reject;
    };
}

# 备用上游：设置低优先级，正常情况下不使用
protocol bgp upstream2 {
    local as 65001;
    neighbor 10.0.0.2 as 64513;
    export filter {
        if net = 203.0.113.100/32 then {
            # AS Path Prepend 降低优先级
            bgp_path.prepend(65001);
            bgp_path.prepend(65001);
            bgp_community.add(LOCAL_PREF_LOW);
            accept;
        }
        reject;
    };
}

# 验证 BGP Community
birdc show route 203.0.113.100/32 all
# 输出中应包含设置的 Community 值

# 使用 looking glass 验证全球路由状态
# https://lg.he.net/
# https://bgp.tools/prefix/203.0.113.100

# 使用 RIPE Atlas 进行全球 Anycast 覆盖测量
# 创建一个从全球 100 个探针到 Anycast IP 的 traceroute 测量
curl -X POST "https://atlas.ripe.net/api/v2/measurements/" \
    -H "Authorization: Key YOUR_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{
        "definitions": [{
            "type": "traceroute",
            "af": 4,
            "target": "203.0.113.100",
            "description": "Anycast coverage test",
            "protocol": "ICMP"
        }],
        "probes": [{
            "type": "area",
            "value": "WW",
            "requested": 100
        }]
    }'

#!/usr/bin/env python3
"""分析 Anycast 路由分布，验证用户是否被路由到最近的 PoP"""

import json
import subprocess
from collections import Counter

def analyze_anycast_distribution(target_ip, dns_servers):
    """从多个 DNS 视角分析 Anycast IP 的路由分布"""
    pop_distribution = Counter()

    for dns in dns_servers:
        # 通过 HTTP 头判断 Anycast 路由到哪个 PoP
        result = subprocess.run(
            ["curl", "-s", "--connect-timeout", "5",
             "--resolve", f"app.example.com:80:{target_ip}",
             "http://app.example.com/debug/pop"],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            pop = result.stdout.strip()
            pop_distribution[pop] += 1

    # 输出分布
    total = sum(pop_distribution.values())
    print(f"\nAnycast PoP 分布 (总计 {total} 次探测):")
    for pop, count in pop_distribution.most_common():
        pct = count / total * 100
        bar = "█" * int(pct / 2)
        print(f"  {pop:15s}: {count:3d} ({pct:5.1f}%) {bar}")

if __name__ == "__main__":
    dns_list = [
        "8.8.8.8", "1.1.1.1", "223.5.5.5",
        "114.114.114.114", "208.67.222.222",
    ]
    analyze_anycast_distribution("203.0.113.100", dns_list)

# 使用 AWS Route 53 加权路由
aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890 \
    --change-batch '{
        "Changes": [
            {
                "Action": "UPSERT",
                "ResourceRecordSet": {
                    "Name": "app.example.com",
                    "Type": "A",
                    "SetIdentifier": "beijing",
                    "Weight": 60,
                    "TTL": 60,
                    "ResourceRecords": [{"Value": "10.1.1.100"}]
                }
            },
            {
                "Action": "UPSERT",
                "ResourceRecordSet": {
                    "Name": "app.example.com",
                    "Type": "A",
                    "SetIdentifier": "shanghai",
                    "Weight": 40,
                    "TTL": 60,
                    "ResourceRecords": [{"Value": "10.2.1.100"}]
                }
            }
        ]
    }'

# 故障切换：将北京权重设为 0
aws route53 change-resource-record-sets \
    --hosted-zone-id Z1234567890 \
    --change-batch '{
        "Changes": [{
            "Action": "UPSERT",
            "ResourceRecordSet": {
                "Name": "app.example.com",
                "Type": "A",
                "SetIdentifier": "beijing",
                "Weight": 0,
                "TTL": 60,
                "ResourceRecords": [{"Value": "10.1.1.100"}]
            }
        }]
    }'

# AWS Route 53 健康检查 + 故障转移路由
# 1. 创建健康检查
HealthCheck:
  Type: HTTP
  FullyQualifiedDomainName: app-beijing.example.com
  Port: 443
  ResourcePath: /readyz
  RequestInterval: 10       # 每 10 秒检查一次
  FailureThreshold: 3       # 连续失败 3 次判定不健康

# 2. 配置故障转移路由策略
ResourceRecordSet:
  Name: app.example.com
  Type: A
  Failover: PRIMARY          # 主记录
  HealthCheckId: hc-beijing
  TTL: 60
  ResourceRecords:
    - Value: 10.1.1.100      # 北京

ResourceRecordSet:
  Name: app.example.com
  Type: A
  Failover: SECONDARY        # 备记录
  TTL: 60
  ResourceRecords:
    - Value: 10.2.1.100      # 上海（不需要健康检查）

# Prometheus + Blackbox Exporter 监控 GSLB
# prometheus.yml
scrape_configs:
  - job_name: 'dns_gslb'
    scrape_interval: 15s
    metrics_path: /probe
    params:
      module: [dns_gslb_check]
    static_configs:
      - targets:
          - 8.8.8.8       # 从 Google DNS 视角探测
          - 1.1.1.1       # 从 Cloudflare DNS 视角探测
          - 223.5.5.5     # 从阿里 DNS 视角探测
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: blackbox-exporter:9115

# blackbox.yml
modules:
  dns_gslb_check:
    prober: dns
    timeout: 5s
    dns:
      query_name: app.example.com
      query_type: A
      transport_protocol: udp
      preferred_ip_protocol: ip4
      valid_rcodes:
        - NOERROR

#!/bin/bash
# gslb_monitor.sh — 持续监控 GSLB 解析结果分布

TARGET="app.example.com"
RESOLVERS=("8.8.8.8" "1.1.1.1" "223.5.5.5" "114.114.114.114")
SAMPLES=50

echo "$(date): GSLB 解析分布监控"
echo "目标域名: $TARGET"
echo "采样次数: $SAMPLES per resolver"
echo "---"

for resolver in "${RESOLVERS[@]}"; do
    echo -e "\nResolver: $resolver"
    for i in $(seq 1 $SAMPLES); do
        dig +short @"$resolver" "$TARGET" 2>/dev/null
    done | sort | uniq -c | sort -rn | while read count ip; do
        pct=$((count * 100 / SAMPLES))
        printf "  %-20s %3d/%d (%d%%)\n" "$ip" "$count" "$SAMPLES" "$pct"
    done
done

# 告警判断：如果某个 IP 占比为 0，说明可能被移除或故障
echo -e "\n--- 异常检测 ---"
expected_ips=("10.1.1.100" "10.2.1.100")
for resolver in "${RESOLVERS[@]}"; do
    results=$(dig +short @"$resolver" "$TARGET" 2>/dev/null | sort -u)
    for expected in "${expected_ips[@]}"; do
        if ! echo "$results" | grep -q "$expected"; then
            echo "警告: $resolver 未返回 $expected"
        fi
    done
done

# 故障切换演练检查清单
#
# 演练前:
# 1. 确认备站点容量充足
# 2. 通知相关团队
# 3. 准备回滚方案
# 4. 开启详细日志
#
# 演练步骤:
# 1. 记录当前流量分布基线
# 2. 手动将主站点设为不健康（或降低 DNS 权重到 0）
# 3. 观察 DNS 解析变化
# 4. 验证流量已切换到备站点
# 5. 检查用户体验指标（错误率、延迟）
# 6. 恢复主站点
# 7. 验证流量恢复到正常分布
#
# 记录:
# - 故障检测耗时
# - DNS 切换耗时
# - 流量完全迁移耗时
# - 期间错误率变化
# - 备站点性能变化

# 执行切换
echo "Step 1: 记录当前基线"
dig +short app.example.com @8.8.8.8
curl -s https://app.example.com/metrics | grep http_requests_total

echo "Step 2: 模拟主站点故障"
# Route 53: 将主站点权重设为 0
# 自建 DNS: 修改健康检查返回 503

echo "Step 3: 监控切换过程"
while true; do
    echo "$(date +%H:%M:%S) $(dig +short app.example.com @8.8.8.8)"
    sleep 5
done

# 从不同位置验证 DNS 解析结果
# 使用不同的 DNS Resolver
for dns in 8.8.8.8 1.1.1.1 223.5.5.5 114.114.114.114; do
    echo "=== Resolver: $dns ==="
    dig @$dns app.example.com +short
done

# 验证 ECS 支持
dig @8.8.8.8 app.example.com +subnet=202.106.0.0/16    # 模拟北京
dig @8.8.8.8 app.example.com +subnet=183.60.0.0/16     # 模拟广州
dig @8.8.8.8 app.example.com +subnet=1.0.0.0/16        # 模拟新加坡

# 查看 TTL 变化（监控缓存行为）
watch -n 1 'dig @8.8.8.8 app.example.com +noall +answer'

# 追踪 DNS 解析链路
dig app.example.com +trace

# 检查 GSLB 返回的权重分布
for i in $(seq 1 100); do
    dig +short @8.8.8.8 app.example.com
done | sort | uniq -c | sort -rn
# 结果应接近配置的权重比例

# 验证 Anycast IP 路由到哪个 PoP
# 通过 HTTP 头判断
curl -s -H "Host: app.example.com" http://203.0.113.100/debug \
    | jq '{pop: .server_location, ip: .server_ip}'

# 通过 traceroute 观察路径
traceroute -n 203.0.113.100

# 多地区测试（使用在线工具或 RIPE Atlas）
# ripe-atlas measure --type traceroute --target 203.0.113.100 \
#     --from-area WW --probes 50