Restrict DoH fallback and surface Android DoH errors

fjh1997 · fjh1997 · commit 7757663aa437 · 2026-03-25T19:10:30.000+08:00
diff --git a/android/app/src/main/java/io/linuxdo/accelerator/android/LinuxdoBinary.kt b/android/app/src/main/java/io/linuxdo/accelerator/android/LinuxdoBinary.kt
@@ -16,6 +16,8 @@ data class LinuxdoConfig(
     val dnsHosts: Map<String, String>,
     val proxyDomains: List<String>,
 ) {
+    fun shouldUseManagedDoh(host: String): Boolean = matchesProxyHost(host)
+
     fun isManagedHost(host: String): Boolean {
         val candidate = host.lowercase(Locale.US)
         return findDnsHostOverride(candidate) != null || matchesProxyHost(candidate)
diff --git a/android/app/src/main/java/io/linuxdo/accelerator/android/LinuxdoDns.kt b/android/app/src/main/java/io/linuxdo/accelerator/android/LinuxdoDns.kt
@@ -66,7 +66,7 @@ class LinuxdoDnsResolver(
         .dns(StaticDns(endpoints.associate { it.host to it.addresses }))
         .build()
 
-    private val preparedEndpoints = endpoints
+    private val primaryEndpoint = endpoints.firstOrNull()
 
     fun resolveManagedPayload(requestPayload: ByteArray, query: ParsedDnsQuery): ByteArray {
         val host = query.name.lowercase(Locale.US)
@@ -82,35 +82,30 @@ class LinuxdoDnsResolver(
             return DnsPacketCodec.buildResponse(query, resolution)
         }
 
-        var lastError: Exception? = null
-        for (endpoint in preparedEndpoints) {
-            try {
-                if (supportsDnsMessage(endpoint.url)) {
-                    val resolution = queryDohDnsMessageRaw(endpoint, requestPayload, query)
+        val endpoint = requirePrimaryEndpoint()
+        try {
+            if (supportsDnsMessage(endpoint.url)) {
+                val resolution = queryDohDnsMessageRaw(endpoint, requestPayload, query)
+                writeCache(host, query.type, resolution)
+                Log.d(tag, "resolved $host type=${query.type} via ${endpoint.rawUrl} raw dns-message")
+                return DnsPacketCodec.buildResponse(query, resolution)
+            }
+
+            if (isJsonFriendlyType(query.type)) {
+                val resolution = DnsResolution(queryDohJson(endpoint, host, query.type))
+                if (resolution.answers.isNotEmpty()) {
                     writeCache(host, query.type, resolution)
-                    Log.d(tag, "resolved $host type=${query.type} via ${endpoint.rawUrl} raw dns-message")
+                    Log.d(tag, "resolved $host type=${query.type} via ${endpoint.rawUrl} answers=${resolution.answers.size}")
                     return DnsPacketCodec.buildResponse(query, resolution)
                 }
-
-                if (isJsonFriendlyType(query.type)) {
-                    val resolution = DnsResolution(queryDohJson(endpoint, host, query.type))
-                    if (resolution.answers.isNotEmpty()) {
-                        writeCache(host, query.type, resolution)
-                        Log.d(tag, "resolved $host type=${query.type} via ${endpoint.rawUrl} answers=${resolution.answers.size}")
-                        return DnsPacketCodec.buildResponse(query, resolution)
-                    }
-                    lastError = IOException("empty answer from ${endpoint.rawUrl}")
-                    continue
-                }
-
-                lastError = IOException("endpoint ${endpoint.rawUrl} does not support dns-message for type ${query.type}")
-            } catch (error: Exception) {
-                Log.w(tag, "resolver endpoint failed for $host via ${endpoint.rawUrl}: ${error.message}")
-                lastError = error
+                throw IOException("empty answer from ${endpoint.rawUrl}")
             }
-        }
 
-        throw IOException("DoH lookup failed for $host type=${query.type}: ${lastError?.message ?: "no endpoint available"}")
+            throw IOException("endpoint ${endpoint.rawUrl} does not support dns-message for type ${query.type}")
+        } catch (error: Exception) {
+            Log.w(tag, "resolver endpoint failed for $host via ${endpoint.rawUrl}: ${error.message}")
+            throw wrapDohFailure(endpoint, host, query.type, error)
+        }
     }
 
     fun resolve(query: ParsedDnsQuery): DnsResolution {
@@ -124,36 +119,30 @@ class LinuxdoDnsResolver(
             return it
         }
 
-        val managedHost = config.isManagedHost(host)
+        val managedHost = config.shouldUseManagedDoh(host)
         resolveLocal(host, query.type)?.let {
             val resolution = DnsResolution(it)
             writeCache(host, query.type, resolution)
             return resolution
         }
 
-        val endpoints = if (managedHost) {
-            preparedEndpoints
-        } else {
-            preparedEndpoints.drop(1).ifEmpty { preparedEndpoints }
+        if (!managedHost) {
+            return DnsResolution(emptyList())
         }
 
-        var lastError: Exception? = null
-        for (endpoint in endpoints) {
-            try {
-                val resolution = DnsResolution(queryDoh(endpoint, host, query.type))
-                if (resolution.answers.isNotEmpty()) {
-                    writeCache(host, query.type, resolution)
-                    Log.d(tag, "resolved $host type=${query.type} via ${endpoint.rawUrl} answers=${resolution.answers.size}")
-                    return resolution
-                }
-                lastError = IOException("empty answer from ${endpoint.rawUrl}")
-            } catch (error: Exception) {
-                Log.w(tag, "resolver endpoint failed for $host via ${endpoint.rawUrl}: ${error.message}")
-                lastError = error
+        val endpoint = requirePrimaryEndpoint()
+        try {
+            val resolution = DnsResolution(queryDoh(endpoint, host, query.type))
+            if (resolution.answers.isNotEmpty()) {
+                writeCache(host, query.type, resolution)
+                Log.d(tag, "resolved $host type=${query.type} via ${endpoint.rawUrl} answers=${resolution.answers.size}")
+                return resolution
             }
+            throw IOException("empty answer from ${endpoint.rawUrl}")
+        } catch (error: Exception) {
+            Log.w(tag, "resolver endpoint failed for $host via ${endpoint.rawUrl}: ${error.message}")
+            throw wrapDohFailure(endpoint, host, query.type, error)
         }
-
-        throw IOException("DoH lookup failed for $host: ${lastError?.message ?: "no endpoint available"}")
     }
 
     private fun resolveLocal(host: String, type: Int): List<DnsAnswerRecord>? {
@@ -186,13 +175,29 @@ class LinuxdoDnsResolver(
     }
 
     private fun queryAlias(alias: String, type: Int): List<DnsAnswerRecord> {
-        for (endpoint in preparedEndpoints) {
-            try {
-                return queryDoh(endpoint, alias, type)
-            } catch (_: Exception) {
-            }
+        val endpoint = primaryEndpoint ?: return emptyList()
+        return try {
+            queryDoh(endpoint, alias, type)
+        } catch (_: Exception) {
+            emptyList()
         }
-        return emptyList()
+    }
+
+    private fun requirePrimaryEndpoint(): PreparedDohEndpoint {
+        return primaryEndpoint ?: throw IOException("DoH 不可用，请自行更换 DoH")
+    }
+
+    private fun wrapDohFailure(
+        endpoint: PreparedDohEndpoint,
+        host: String,
+        type: Int,
+        error: Exception,
+    ): IOException {
+        val detail = error.message ?: error.javaClass.simpleName
+        return IOException(
+            "DoH 不可用，请自行更换 DoH。当前端点：${endpoint.rawUrl}，查询：$host ${queryTypeName(type)}，原因：$detail",
+            error,
+        )
     }
 
     private fun queryDoh(
diff --git a/android/app/src/main/java/io/linuxdo/accelerator/android/LinuxdoVpnService.kt b/android/app/src/main/java/io/linuxdo/accelerator/android/LinuxdoVpnService.kt
@@ -25,6 +25,7 @@ import java.io.IOException
 import java.net.Inet6Address
 import java.net.InetAddress
 import java.net.InetSocketAddress
+import java.util.Locale
 import java.util.concurrent.atomic.AtomicBoolean
 import kotlin.concurrent.thread
 
@@ -33,6 +34,12 @@ class LinuxdoVpnService : VpnService() {
     private var vpnInterface: ParcelFileDescriptor? = null
     private var workerThread: Thread? = null
     private val running = AtomicBoolean(false)
+    @Volatile
+    private var preferManagedIpv6Status = false
+    @Volatile
+    private var activeDohEndpoint = "未配置"
+    @Volatile
+    private var lastDohFailureDetail: String? = null
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
         when (intent?.action) {
@@ -42,7 +49,7 @@ class LinuxdoVpnService : VpnService() {
             }
             ACTION_START -> {
                 if (running.get()) {
-                    broadcastStatus(true, "加速中", null)
+                    broadcastStatus(true, currentRunningStatusText(), currentRunningDetail())
                     return START_STICKY
                 }
                 ensureNotificationChannel()
@@ -65,7 +72,11 @@ class LinuxdoVpnService : VpnService() {
 
     override fun onTaskRemoved(rootIntent: Intent?) {
         super.onTaskRemoved(rootIntent)
-        broadcastStatus(running.get(), if (running.get()) "加速中" else "未启动", null)
+        if (running.get()) {
+            broadcastStatus(true, currentRunningStatusText(), currentRunningDetail())
+        } else {
+            broadcastStatus(false, "未启动", null)
+        }
     }
 
     override fun onDestroy() {
@@ -105,14 +116,11 @@ class LinuxdoVpnService : VpnService() {
 
                 vpnInterface = vpn
                 running.set(true)
-                val firstDoh = preparedEndpoints.firstOrNull()?.rawUrl ?: "未配置"
-                Log.i(tag, "vpn established, first DoH=$firstDoh")
-                val detail = if (preferManagedIpv6) {
-                    "linux.do 相关 DNS 走自定义 DoH，并保留 AAAA 返回；其他域名走系统默认 DNS。"
-                } else {
-                    "linux.do 相关 DNS 走自定义 DoH，其他域名走系统默认 DNS。"
-                }
-                broadcastStatus(true, "加速中", detail)
+                preferManagedIpv6Status = preferManagedIpv6
+                activeDohEndpoint = preparedEndpoints.firstOrNull()?.rawUrl ?: "未配置"
+                lastDohFailureDetail = null
+                Log.i(tag, "vpn established, first DoH=$activeDohEndpoint")
+                broadcastStatus(true, currentRunningStatusText(), currentRunningDetail())
                 runDnsLoop(vpn, config, preparedEndpoints, systemDnsServers)
             } catch (error: Exception) {
                 Log.e(tag, "startAcceleratorAsync failed", error)
@@ -148,9 +156,12 @@ class LinuxdoVpnService : VpnService() {
                 val query = DnsPacketCodec.parseDnsQuery(requestPacket.payload) ?: continue
                 val responsePayload = if (shouldUseManagedDoh(config, query)) {
                     try {
-                        resolver.resolveManagedPayload(requestPacket.payload, query)
+                        val payload = resolver.resolveManagedPayload(requestPacket.payload, query)
+                        clearDohFailure()
+                        payload
                     } catch (error: Exception) {
                         Log.w(tag, "managed dns query failed for ${query.name} type=${query.type}: ${error.message}")
+                        reportDohFailure(query, error)
                         DnsPacketCodec.buildResponse(query, DnsResolution(emptyList(), responseCode = 2))
                     }
                 } else {
@@ -174,7 +185,51 @@ class LinuxdoVpnService : VpnService() {
     }
 
     private fun shouldUseManagedDoh(config: LinuxdoConfig, query: ParsedDnsQuery): Boolean {
-        return config.isManagedHost(query.name)
+        return config.shouldUseManagedDoh(query.name)
+    }
+
+    private fun currentRunningStatusText(): String {
+        return if (lastDohFailureDetail == null) "加速中" else "加速中（DoH 异常）"
+    }
+
+    private fun currentRunningDetail(): String {
+        return lastDohFailureDetail ?: buildHealthyRunningDetail()
+    }
+
+    private fun buildHealthyRunningDetail(): String {
+        val summary = if (preferManagedIpv6Status) {
+            "仅 linux.do / *.linux.do 走自定义 DoH，并保留 AAAA 返回；其他域名走系统默认 DNS。"
+        } else {
+            "仅 linux.do / *.linux.do 走自定义 DoH；其他域名走系统默认 DNS。"
+        }
+        return "$summary 当前 DoH：$activeDohEndpoint"
+    }
+
+    private fun clearDohFailure() {
+        if (lastDohFailureDetail == null || !running.get()) {
+            return
+        }
+        lastDohFailureDetail = null
+        broadcastStatus(true, currentRunningStatusText(), currentRunningDetail())
+    }
+
+    private fun reportDohFailure(query: ParsedDnsQuery, error: Exception) {
+        val detail = buildString {
+            append("DoH 查询失败：")
+            append(query.name.lowercase(Locale.US))
+            append(' ')
+            append(queryTypeName(query.type))
+            append("。当前 DoH：")
+            append(activeDohEndpoint)
+            append("。原因：")
+            append(error.message ?: error.javaClass.simpleName)
+            append("。请自行更换 DoH；其他域名仍走系统默认 DNS。")
+        }
+        if (detail == lastDohFailureDetail || !running.get()) {
+            return
+        }
+        lastDohFailureDetail = detail
+        broadcastStatus(true, currentRunningStatusText(), detail)
     }
 
     private fun forwardSystemDns(payload: ByteArray, servers: List<InetAddress>): ByteArray? {
@@ -233,6 +288,7 @@ class LinuxdoVpnService : VpnService() {
         running.set(false)
         safeClose(vpnInterface)
         vpnInterface = null
+        lastDohFailureDetail = null
         broadcastStatus(false, statusText, "Android VPN DNS 接管已关闭。")
         stopForeground(STOP_FOREGROUND_REMOVE)
         stopSelf()
@@ -344,7 +400,7 @@ class LinuxdoVpnService : VpnService() {
             if (actualRunning) {
                 val status = if (savedStatus.isBlank() || savedStatus == "未启动") "加速中" else savedStatus
                 val detail = if (savedDetail.isBlank()) {
-                    "linux.do 相关 DNS 由 Android VPN 接管，自定义 DoH 已生效。"
+                    "仅 linux.do / *.linux.do 走自定义 DoH；其他域名走系统默认 DNS。"
                 } else {
                     savedDetail
                 }
diff --git a/android/app/src/main/java/io/linuxdo/accelerator/android/MainActivity.kt b/android/app/src/main/java/io/linuxdo/accelerator/android/MainActivity.kt
@@ -104,7 +104,7 @@ class MainActivity : AppCompatActivity() {
             running,
             normalizedStatus,
             if (detail.isBlank()) {
-                "配置文件和 Android 壳已就绪，点击开始加速后会申请 VPN 权限，并强制通过自定义 DoH 接管 linux.do 相关 DNS。"
+                "配置文件和 Android 壳已就绪。启动后仅 linux.do / *.linux.do 走自定义 DoH，其他域名仍走系统默认 DNS。"
             } else {
                 detail
             },
@@ -137,7 +137,7 @@ class MainActivity : AppCompatActivity() {
     }
 
     private fun startVpnService() {
-        renderState(false, "正在启动", "正在建立 Android VPN，并启用自定义 DoH DNS 接管...")
+        renderState(false, "正在启动", "正在建立 Android VPN，并启用 linux.do / *.linux.do 的自定义 DoH 接管...")
         ContextCompat.startForegroundService(
             this,
             Intent(this, LinuxdoVpnService::class.java).setAction(LinuxdoVpnService.ACTION_START),
diff --git a/assets/defaults/linuxdo-accelerator.toml b/assets/defaults/linuxdo-accelerator.toml
@@ -7,7 +7,6 @@ fake_sni = "www.cloudflare.com"
 
 doh_endpoints = [
     "https://aaa.ddd.oaifree.com/query-dns",
-    "https://223.5.5.5/dns-query",
 ]
 managed_prefer_ipv6 = true
 dns_hosts = {}
diff --git a/src/proxy.rs b/src/proxy.rs
@@ -429,8 +429,7 @@ fn build_upstream_request(
         }
         builder = builder.header(name, value);
     }
-    builder = builder
-        .header(HOST, request_host);
+    builder = builder.header(HOST, request_host);
     builder
         .body(Full::new(body))
         .context("failed to build upstream request")
@@ -551,7 +550,13 @@ async fn resolve_upstream(state: &AppState, host: &str, port: u16) -> Result<Res
                 .collect::<Vec<_>>(),
             ech_config: None,
         };
-        write_cached_upstream(state, cache_key, upstream.clone(), FALLBACK_RESOLVE_CACHE_TTL).await;
+        write_cached_upstream(
+            state,
+            cache_key,
+            upstream.clone(),
+            FALLBACK_RESOLVE_CACHE_TTL,
+        )
+        .await;
         return Ok(upstream);
     }
 
@@ -632,7 +637,10 @@ async fn resolve_https_binding(
     Ok((bindings.into_iter().next().unwrap_or_default(), ttl))
 }
 
-async fn doh_lookup_ip_addrs(state: &AppState, host: &str) -> Result<(Vec<IpAddr>, Option<Duration>)> {
+async fn doh_lookup_ip_addrs(
+    state: &AppState,
+    host: &str,
+) -> Result<(Vec<IpAddr>, Option<Duration>)> {
     let mut addrs = Vec::new();
 
     let (ipv6_answers, ipv4_answers) =
@@ -692,18 +700,16 @@ async fn doh_query(state: &AppState, host: &str, record_type: &str) -> Result<Ve
         return Ok(cached);
     }
 
-    let mut last_error = None;
-    for endpoint in &state.config.doh_endpoints {
-        match doh_query_once(&state.doh_client, endpoint, host, record_type).await {
-            Ok(answers) => {
-                write_cached_doh_answers(state, cache_key.clone(), answers.clone()).await;
-                return Ok(answers);
-            }
-            Err(error) => last_error = Some(error),
-        }
-    }
+    let endpoint =
+        state.config.doh_endpoints.first().ok_or_else(|| {
+            anyhow::anyhow!("DoH 不可用，请在配置中自行更换 DoH：未配置 DoH 端点")
+        })?;
 
-    Err(last_error.unwrap_or_else(|| anyhow::anyhow!("no DoH endpoint available")))
+    let answers = doh_query_once(&state.doh_client, endpoint, host, record_type)
+        .await
+        .with_context(|| format!("DoH 不可用，请在配置中自行更换 DoH：{endpoint}"))?;
+    write_cached_doh_answers(state, cache_key, answers.clone()).await;
+    Ok(answers)
 }
 
 async fn read_cached_upstream(state: &AppState, key: &ResolveCacheKey) -> Option<ResolvedUpstream> {

Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,6 @@ fake_sni = "www.cloudflare.com"`
`7`	`7`
`8`	`8`	`doh_endpoints = [`
`9`	`9`	`"https://aaa.ddd.oaifree.com/query-dns",`
`10`		`- "https://223.5.5.5/dns-query",`
`11`	`10`	`]`
`12`	`11`	`managed_prefer_ipv6 = true`
`13`	`12`	`dns_hosts = {}`