Page MenuHomePhabricator

Wikidough: Upgrade to dnsdist 1.6.0
Closed, ResolvedPublic

Description

The first alpha version of dnsdist 1.6.0 was released today: https://mailman.powerdns.com/pipermail/dnsdist/2021-February/000981.html

While it's too early for us to consider upgrading to 1.6.0, we should start preparing for this release by documenting the changes since 1.5.1, and also help the dnsdist developers with testing this release. (The last bit I feel is more important at this stage.)

Notables changes in this release so far include:

  • Out-of-order processing for TCP and DoT (for both queries from client to dnsdist and dnsdist to pdns-recursor)
    • Probably the most important feature!
  • Changes to Proxy Protocol, that we don't currently use
  • Custom web endpoints in Lua
    • How does this compare to what we are currently doing with getDOHFrontend and setResponsesMap? Probably when the query is intercepted...
  • Some actions and console commands have been renamed; on a casual look, it seems we are not affected but need to confirm
  • webserver has been renamed to setWebserverConfig, including some other changes such as making the password parameter optional
  • Our patch to prioritize ChaCha20 has been merged in 1.6.0, which means we should remove it during our dnsdist package build

Event Timeline

BBlack added a subscriber: BBlack.

The swap of Traffic for Traffic-Icebox in this ticket's set of tags was based on a bulk action for all such tickets that haven't been updated in 6 months or more. This does not imply any human judgement about the validity or importance of the task, and is simply the first step in a larger task cleanup effort. Further manual triage and/or requests for updates will happen this month for all such tickets. For more detail, have a look at the extended explanation on the main page of Traffic-Icebox . Thank you!

Mentioned in SAL (#wikimedia-operations) [2021-11-04T11:01:03Z] <sukhe> upload dnsdist 1.6.1-1wm1 to apt.wm.o (buster) - T273679

On doh1001,

$ dnsdist --version
dnsdist 1.6.1 (Lua 5.1.4 [LuaJIT 2.1.0-beta3])
kdig @185.71.138.138 +tls-ca +tls-host=wikimedia-dns.org wikipedia.org  +nsid
;; TLS session (TLS1.3)-(ECDHE-SECP256R1)-(ECDSA-SECP256R1-SHA256)-(AES-256-GCM)
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 64498
;; Flags: qr rd ra; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: ; UDP size: 512 B; ext-rcode: NOERROR
;; NSID: 646F6831303031 "doh1001"

;; QUESTION SECTION:
;; wikipedia.org.      		IN	A

;; ANSWER SECTION:
wikipedia.org.      	600	IN	A	208.80.154.224

;; Received 69 B
;; Time 2021-11-04 07:21:48 EDT
;; From 185.71.138.138@853(TCP) in 149.1 ms

knead-wikidough tests are also passing:

tests/test_dns.py::test_dot_plain_query[example.org-None] PASSED                                                               [  5%]
tests/test_dns.py::test_doh_plain_query[example.org-None] PASSED                                                               [ 10%]
tests/test_dns.py::test_dot_ecs_query_ulsfo[dyna.wikimedia.org-24.64.64.1-None-False] PASSED                                   [ 15%]
tests/test_dns.py::test_dot_ecs_query_codfw[dyna.wikimedia.org-206.108.0.1-None-False] PASSED                                  [ 21%]
tests/test_dns.py::test_dot_edns_query_no_wikimedia[o-o.myaddr.l.google.com-206.108.0.1-RdataType.TXT-False] PASSED            [ 26%]
tests/test_dns.py::test_dnssec_do_bit[example.org-206.108.0.1-RdataType.A-True] PASSED                                         [ 31%]
tests/test_dns.py::test_dnssec_no_do_bit[example.org-206.108.0.1-RdataType.A-False] PASSED                                     [ 36%]
tests/test_dns.py::test_dot_qname_minimization[a.b.qnamemin-test.internet.nl-RdataType.TXT] PASSED                             [ 42%]
tests/test_dns.py::test_doh_pages PASSED                                                                                       [ 47%]
tests/test_dns.py::test_doh_response_headers PASSED                                                                            [ 52%]
tests/test_dns.py::test_durum[durum.check.wikimedia-dns.org-24.64.64.1-None-False] PASSED                                      [ 57%]
tests/test_tls.py::test_dot_tls12[853-None] PASSED                                                                             [ 63%]
tests/test_tls.py::test_doh_tls12[443-None] PASSED                                                                             [ 68%]
tests/test_tls.py::test_dot_tls13[853] PASSED                                                                                  [ 73%]
tests/test_tls.py::test_doh_tls13[443] PASSED                                                                                  [ 78%]
tests/test_tls.py::test_dot_tls12_chacha20_priority[853-ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384] PASSED    [ 84%]
tests/test_tls.py::test_doh_tls13_cipher_priority[443-TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384] PASSED                    [ 89%]
tests/test_tls.py::test_dot_session_resumption PASSED                                                                          [ 94%]
tests/test_tls.py::test_certificate_cn PASSED                                                                                  [100%]

========================================================= 19 passed in 2.23s =========================================================
===== NODE GROUP =====                                                                                                                
(10) doh[1001-1002,2001-2002,3001-3002,4001-4002,5001-5002].wikimedia.org                                                             
----- OUTPUT of 'dnsdist --version' -----                                                                                             
dnsdist 1.6.1 (Lua 5.1.4 [LuaJIT 2.1.0-beta3])                                                                                        
Enabled features: cdb dns-over-tls(openssl) dns-over-https(DOH) dnscrypt ebpf fstrm ipcipher libsodium lmdb protobuf re2 recvmmsg/sendmmsg snmp systemd
================