A year has passed since I last looked at the Knot DNS server, so it's time to re-visit it; a lot has happened, and there are two features I want to single out: support for RFC 2136 (dynamic DNS updates) and a bit of RRL (Response Rate Limiting).

Dynamic DNS

Knot protects Dynamic DNS Updates to master zones with TSIG keys I create and copy into knot.conf:

...
keys {
  jpkey hmac-md5 "U/B55N6G9M8=";
}
...
remotes {
  tiggr { address 172.16.153.1@53; key jpkey; }
  anyclient { address 0.0.0.0/0;  key jpkey; }
}
...
zones {
  example.com {
    file "example.com.zone";
    update-in tiggr;
    zonefile-sync 5m;
  }
...
}

The TSIG key (named jpkey here) is associated with a remote server (or update client) and I specify the name of the remote which is allowed to update a zone with the update-in (i.e. allow IN-coming updates) statement within the zone statement.

Updates received to a master zone will be handled by the server and written out to the source zone file when the zonefile-sync period kicks in. Knot will forward updates received for a slave zone to the zone's primary master server, which I specify in an xfr-in directive.

The server logs update requests, as follows:

09:01:19.704047+01:00 UPDATE of 'example.com.' from '172.16.153.1@52480' key 'jpkey.': Started.
09:01:19.704361+01:00 UPDATE of 'example.com.' from '172.16.153.1@52480' key 'jpkey.':: Finished.

There are currently a number of limitations regarding DNS updates on DNSSEC-signed zones (in particular: Knot can't re-sign records), so keep an eye on the documentation! Knot can sign records updated dynamically.

Response Rate Limiting

Running dnsperf against my test installation (running in my portable data center, so please don't pay too much attention to the actual numbers), I obtain the following results (output abbreviated):

...
  Run time limit:       30 seconds
  Ran through file:     88305 times
  Queries sent:         88305 queries
  Queries completed:    88305 queries
  Queries lost:         0 queries

  Queries per second:   2943.478807 qps

Latency   Success  Fail |
<    0.100s 88305     0 |############################################################
...

As of version 1.2.0, response rate limiting is compiled into Knot, but it is disabled by default. I enable it by configuring the rate-limit option in the system section, for example like this:

system {
  storage "/etc/knot";
  user: "root";

  rate-limit 100;
  rate-limit-slip 2;
}

After restarting Knot with RRL enabled as above, I run dnsperf again to obtain these quite different numbers:

[Timeout] Query timed out: msg id 2042
[...]
[Timeout] Query timed out: msg id 3236

  Run time limit:       30 seconds
  Ran through file:     3236 times
  Queries sent:         3237 queries
  Queries completed:    3118 queries
  Queries lost:         119 queries

  Queries per second:   91.900425 qps

Latency   Success  Fail |
<    0.100s  3118     0 |############################################################
...

Looking only at Queries per second and Queries completed, we see Knot has indeed limited the rate of responses, and the server logs the fact that it is engaging RRL mode:

08:23:16.774694+01:00 [notice] Address '172.16.153.1' leaves rate-limiting (class 'POSITIVE').
08:23:16.877744+01:00 [notice] Address '172.16.153.1' enters rate-limiting (class 'POSITIVE').

See also: DNSSEC-signing with the Knot authoritative DNS server

Flattr this
Knot, DNS, and RRL :: 12 Mar 2013 :: e-mail

Comments

blog comments powered by Disqus