Pdns: dnsdist needs a high-performance DNS-over-HTTPS implementation

[ahupowerdns]

• Program: dnsdist
• Issue type: Feature request

Short description

So as not to burden all backends with http2 & tls support, dnsdist should offer to do this.
There are existing low-performance options available, dnsdist should offer a high speed one.

It is tempting to not do DoH in dnsdist "why not build a frontproxy" but this drags us into another layer of EDNS Client Subnet stuffing, metrics, configuration, startup scripts, moving parts etc.

Usecase

Host a DoH server that can serve "the world" or at least "whole popular browsers".

Description

Offer high-speed DoH proxying, with the full dnsdist policy framework intact.

[ahupowerdns]

My initial idea is a separate thread (or group of threads) running an independent http2 webserver that picks up questions and relays them over a pipe to the regular dnsdist, which picks them up in the eventloop and makes note which pipe needs to receive the answer. We could also do a unix domain socket even perhaps since that is two-way by itself. Can you do those anonymously?

[Habbie]

Can you do those anonymously?

socketpair(2)

[fantuz]

see https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-04

[johnhtodd]

I'd like to mutter a few words here about statistics collection here right at the start. Any implementation should highly favor lots of metrics that are visible in the standard locations as the first thing that will be done with the code is freeing it in the wild to see what performance looks like, what failures happen, and how much activity is seen on this new interface. Maybe an option for extended HTTP/2 debugging at launch will dump things to logging output.

For ongoing counters that are permanently active, I might as a very minimal start suggest: What ciphers are people using? How long are sockets staying open? How much data is exchanged over a socket? How many queries per socket? Are sockets closing naturally (FIN) from the client, or are they timing out or otherwise erroring? These are the kinds of things that an operational dashboard needs to track to discover systemic problems in the implementation, as well as issues that are more localized but just as important. This is by far not a complete list, and not well-considered - others can and should be more thorough in their contemplation. TL;DR: I'd promote the idea of an abundance of statistics.

[pavel-odintsov]

Great idea! Also, we recently got TLS 1.3 as standard it should be good idea to force only fresh crypto for this thing to keep security as first class citizen.

[paddg]

Hello Bert, I tried out your https://github.com/ahupowerdns/pdns/tree/dnsdist-doh branch. And here's what I learned, what I noticed and what does not work from my point of view.

• To compile it, I also needed the libh2o-devel library from https://github.com/h2o/h2o and the switch --enable-dns-over-https. Unfortunately libh2o is not covered by SLES. I'll try to request the extension of SLES by this library.

• I used the doh tool from https://github.com/curl/doh to make test queries.

• dnsdist does not start from systemd if I use this statement:
  addDOHLocal('127.0.0.1', dotpem, dotkey)
  systemd-journal:

Okt 23 09:11:33 node01 systemd[1]: Starting DNS Loadbalancer...
Okt 23 09:11:33 node01 dnsdist[27109]: Configuration '/etc/dnsdist/dnsdist.conf' OK!
...
Okt 23 09:11:34 node01 systemd[1]: Started DNS Loadbalancer.
Okt 23 09:11:34 node01 dnsdist[27114]: Launching DOH listener on 127.0.0.1:443
Okt 23 09:11:34 node01 dnsdist[27114]: terminate called without an active exception
Okt 23 09:11:34 node01 systemd[1]: dnsdist.service: Main process exited, code=killed, status=6/ABRT
Okt 23 09:11:34 node01 systemd[1]: dnsdist.service: Unit entered failed state.
Okt 23 09:11:34 node01 systemd[1]: dnsdist.service: Triggering OnFailure= dependencies.
Okt 23 09:11:34 node01 systemd[1]: dnsdist.service: Failed with result 'signal'.

• While it works if I start from command line:

...
> Launching DOH listener on 127.0.0.1:443

• addDOHLocal don't understand {reuseport=true}:
  Fatal Lua error: [string "chunk"]:278: Unable to convert parameter from table to N5boost8optionalISt6vectorISt4pairIiSsESaIS3_EEEE

• Multiple addDOHLocal => coredump:

addDOHLocal('127.0.0.1', dohpem, dohkey)
addDOHLocal('127.0.0.2', dohpem, dohkey)

• PoolAction based on a destination NMG NetmaskGroupRule(NMG, false) does not work unless NMG contains 0.0.0.0/0:
  Dropped query for www.example.com.|A from ..., no policy applied

• It is not possible to configure addDOHLocal on runtime. How to renew the TLS certificate on runtime without restart?

Winfried

[rgacogne]

Implemented in https://github.com/PowerDNS/pdns/pull/7726.