diff --git a/CHANGELOG.md b/CHANGELOG.md index 1e3f2bf..491eab8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ IMPROVEMENTS: - Allow enabling debug logging +- Add updater that uses [DNS zone transfers via AXFR (RFC5936)](https://tools.ietf.org/html/rfc5936) to allow any secondary nameserver(s) to fetch the zone contents after (optionally) receiving a [DNS NOTIFY (RFC1996)](https://tools.ietf.org/html/rfc1996) request ## 2.2.0 (March 6, 2020) diff --git a/README.md b/README.md index fe5d66c..0c3ea77 100644 --- a/README.md +++ b/README.md @@ -4,16 +4,20 @@ A small, lightweight and extensible DynDNS server written with Ruby and Rack. + ## Description dyndnsd.rb aims to implement a small [DynDNS-compliant](https://help.dyn.com/remote-access-api/) server in Ruby supporting IPv4 and IPv6 addresses. It has an integrated user and hostname database in its configuration file that is used for authentication and authorization. Besides talking the DynDNS protocol it is able to invoke a so-called *updater*, a small Ruby module that takes care of supplying the current hostname => ip mapping to a DNS server. -There is currently one updater shipped with dyndnsd.rb `command_with_bind_zone` that writes out a zone file in BIND syntax onto the current system and invokes a user-supplied command afterwards that is assumed to trigger the DNS server (not necessarily BIND since its zone files are read by other DNS servers, too) to reload its zone configuration. +There are currently two updaters shipped with dyndnsd.rb: +- `zone_transfer_server` that uses [DNS zone transfers via AXFR (RFC5936)](https://tools.ietf.org/html/rfc5936) to allow any secondary nameserver(s) to fetch the zone contents after (optionally) receiving a [DNS NOTIFY (RFC1996)](https://tools.ietf.org/html/rfc1996) request +- `command_with_bind_zone` that writes out a zone file in BIND syntax onto the current system and invokes a user-supplied command afterwards that is assumed to trigger the DNS server (not necessarily BIND since its zone files are read by other DNS servers, too) to reload its zone configuration Because of the mechanisms used, dyndnsd.rb is known to work only on \*nix systems. See the [changelog](CHANGELOG.md) before upgrading. The older version 1.x of dyndnsd.rb is still available on [branch dyndnsd-1.x](https://github.com/cmur2/dyndnsd/tree/dyndnsd-1.x). + ## General Usage Install the gem: @@ -62,11 +66,57 @@ Run dyndnsd.rb by: dyndnsd /path/to/config.yaml -## Using dyndnsd.rb with [NSD](https://www.nlnetlabs.nl/nsd/) -NSD is a nice, open source, authoritative-only, low-memory DNS server that reads BIND-style zone files (and converts them into its own database) and has a simple config file. +## Using dyndnsd.rb with any nameserver via DNS zone transfers (AXFR) -A feature NSD is lacking is the [Dynamic DNS update](https://tools.ietf.org/html/rfc2136) functionality BIND offers but one can fake it using the following dyndnsd.rb config: +By using [DNS zone transfers via AXFR (RFC5936)](https://tools.ietf.org/html/rfc5936) any secondary nameserver can retrieve the DNS zone contents from dyndnsd.rb and serve them to clients. +To speedup propagation after changes dyndnsd.rb can issue a [DNS NOTIFY (RFC1996)](https://tools.ietf.org/html/rfc1996) to inform the nameserver that the DNS zone contents changed and should be fetched even before the time indicated in the SOA record is up. +Currently dyndnsd.rb does not support any authentication for incoming DNS zone transfer requests so it should be isolated from the internet on these ports. + +This approach has several advantages: +- dyndnsd.rb can be used in *hidden primary* fashion isolated from client's DNS traffic and does not need to implement full nameserver features +- any existing, production-grade, caching, geo-replicated nameserver setup can be used to pull DNS zone contents from the *hidden primary* dyndnsd.rb and serve it to clients +- any nameserver(s) and dyndnsd.rb do not need to be located on the same host + +Example dyndnsd.rb configuration: + +```yaml +host: "0.0.0.0" +port: 8245 # the DynDNS.com alternative HTTP port +db: "/opt/dyndnsd/db.json" +domain: "dyn.example.org" +updater: + name: "zone_transfer_server" + params: + # endpoint(s) to listen for incoming zone transfer (AXFR) requests, default 0.0.0.0@53 + server_listens: + - 127.0.0.1@5300 + # where to send DNS NOTIFY request(s) to on zone content change + send_notifies: + - '127.0.0.1' + # TTL for all records in the zone (in seconds) + zone_ttl: 300 # 5m + # zone's NS record(s) (at least one) + zone_nameservers: + - "dns.example.org." + # info for zone's SOA record + zone_email_address: "admin.example.org." + # zone's additional A/AAAA records + zone_additional_ips: + - "127.0.0.1" +users: + foo: + password: "secret" + hosts: + - foo.example.org +``` + + +## Using dyndnsd.rb with [NSD](https://www.nlnetlabs.nl/projects/nsd/about/) + +NSD is a nice, open source, authoritative-only, low-memory DNS server that reads BIND-style zone files (and converts them into its own database) and has a simple configuration file. + +A feature NSD is lacking is the [Dynamic DNS update (RFC2136)](https://tools.ietf.org/html/rfc2136) functionality BIND offers but one can fake it using the following dyndnsd.rb configuration: ```yaml host: "0.0.0.0" @@ -95,12 +145,15 @@ users: Start dyndnsd.rb before NSD to make sure the zone file exists else NSD complains. + ## Using dyndnsd.rb with X Please provide ideas if you are using dyndnsd.rb with other DNS servers :) + ## Advanced topics + ### Update URL The update URL you want to tell your clients (humans or scripts ^^) consists of the following @@ -117,6 +170,7 @@ where: * MYIP is optional and the HTTP client's IP address will be used if missing * MYIP6 is optional but if present also requires presence of MYIP + ### IP address determination The following rules apply: @@ -127,14 +181,17 @@ The following rules apply: If you want to provide an additional IPv6 address as myip6 parameter, the myip parameter containing an IPv4 address has to be present, too! No automatism is applied then. + ### SSL, multiple listen ports Use a webserver as a proxy to handle SSL and/or multiple listen addresses and ports. DynDNS.com provides HTTP on port 80 and 8245 and HTTPS on port 443. + ### Init scripts The [Debian 6 init.d script](init.d/debian-6-dyndnsd) assumes that dyndnsd.rb is installed into the system ruby (no RVM support) and the config.yaml is at /opt/dyndnsd/config.yaml. Modify to your needs. + ### Monitoring For monitoring dyndnsd.rb uses the [metriks](https://github.com/eric/metriks) framework and exposes several metrics like the number of unauthenticated requests, requests that did (not) update a hostname, etc. By default the most important metrics are shown in the [proctitle](https://github.com/eric/metriks#proc-title-reporter) but you can also configure a [Graphite](https://graphiteapp.org/) backend for central monitoring or the [textfile_reporter](https://github.com/prometheus/node_exporter/#textfile-collector) which outputs Graphite-style metrics that are also compatible with Prometheus to a file. @@ -174,6 +231,7 @@ users: password: "ihavenohosts" ``` + ### Tracing (experimental) For tracing, dyndnsd.rb is instrumented using the [OpenTracing](http://opentracing.io/) framework and will emit span tracing data for the most important operations happening during the request/response cycle. Using a middleware for Rack allows handling incoming OpenTracing span information properly. @@ -213,6 +271,7 @@ users: password: "ihavenohosts" ``` + ## License dyndnsd.rb is licensed under the Apache License, Version 2.0. See LICENSE for more information. diff --git a/dyndnsd.gemspec b/dyndnsd.gemspec index 4729579..1409d0d 100644 --- a/dyndnsd.gemspec +++ b/dyndnsd.gemspec @@ -27,6 +27,7 @@ Gem::Specification.new do |s| s.required_ruby_version = '>= 2.3' + s.add_runtime_dependency 'async-dns', '~> 1.2.0' s.add_runtime_dependency 'jaeger-client', '~> 0.10.0' s.add_runtime_dependency 'metriks' s.add_runtime_dependency 'opentracing', '~> 0.5.0' diff --git a/lib/dyndnsd.rb b/lib/dyndnsd.rb index d8483b0..b460a29 100644 --- a/lib/dyndnsd.rb +++ b/lib/dyndnsd.rb @@ -13,6 +13,7 @@ require 'rack/tracer' require 'dyndnsd/generator/bind' require 'dyndnsd/updater/command_with_bind_zone' +require 'dyndnsd/updater/zone_transfer_server' require 'dyndnsd/responder/dyndns_style' require 'dyndnsd/responder/rest_style' require 'dyndnsd/database' @@ -317,6 +318,8 @@ module Dyndnsd case config.dig('updater', 'name') when 'command_with_bind_zone' updater = Updater::CommandWithBindZone.new(config['domain'], config.dig('updater', 'params')) + when 'zone_transfer_server' + updater = Updater::ZoneTransferServer.new(config['domain'], config.dig('updater', 'params')) end daemon = Daemon.new(config, db, updater) diff --git a/lib/dyndnsd/updater/zone_transfer_server.rb b/lib/dyndnsd/updater/zone_transfer_server.rb new file mode 100644 index 0000000..a38b73e --- /dev/null +++ b/lib/dyndnsd/updater/zone_transfer_server.rb @@ -0,0 +1,158 @@ +# frozen_string_literal: true + +require 'resolv' +require 'securerandom' + +require 'async/dns' + +module Dyndnsd + module Updater + class ZoneTransferServer + DEFAULT_SERVER_LISTENS = ['0.0.0.0@53'].freeze + + # @param domain [String] + # @param updater_params [Hash{String => Object}] + def initialize(domain, updater_params) + @domain = domain + + @server_listens = self.class.parse_endpoints(updater_params['server_listens'] || DEFAULT_SERVER_LISTENS) + @notify_targets = (updater_params['send_notifies'] || []).map { |e| self.class.parse_endpoints([e]) } + + @zone_rr_ttl = updater_params['zone_ttl'] + @zone_nameservers = updater_params['zone_nameservers'].map { |n| Resolv::DNS::Name.create(n) } + @zone_email_address = Resolv::DNS::Name.create(updater_params['zone_email_address']) + @zone_additional_ips = updater_params['zone_additional_ips'] || [] + + @server = ZoneTransferServerHelper.new(@server_listens, @domain) + + # run Async::DNS server in background thread + Thread.new do + @server.run + end + end + + # @param db [Dyndnsd::Database] + # @return [void] + def update(db) + Helper.span('updater_update') do |span| + span.set_tag('dyndnsd.updater.name', self.class.name&.split('::')&.last || 'None') + + soa_rr = Resolv::DNS::Resource::IN::SOA.new( + @zone_nameservers[0], @zone_email_address, + db['serial'], + 10_800, # 3h + 300, # 5m + 604_800, # 1w + 3_600 # 1h + ) + + default_options = {ttl: @zone_rr_ttl} + + # array containing all resource records for an AXFR request in the right order + rrs = [] + # AXFR responses need to start with zone's SOA RR + rrs << [soa_rr, default_options] + + # return RRs for all of the zone's nameservers + @zone_nameservers.each do |ns| + rrs << [Resolv::DNS::Resource::IN::NS.new(ns), default_options] + end + + # return A/AAAA RRs for all additional IPv4s/IPv6s for the domain itself + @zone_additional_ips.each do |ip| + rrs << [create_addr_rr_for_ip(ip), default_options] + end + + # return A/AAAA RRs for the dyndns hostnames + db['hosts'].each do |hostname, ips| + ips.each do |ip| + rrs << [create_addr_rr_for_ip(ip), default_options.merge({name: hostname})] + end + end + + # AXFR responses need to end with zone's SOA RR again + rrs << [soa_rr, default_options] + + # point Async::DNS server thread's variable to this new RR array + @server.axfr_rrs = rrs + + # only send DNS NOTIFY if there really was a change + if db.changed? + send_dns_notify + end + end + end + + # converts into suitable parameter form for Async::DNS::Resolver or Async::DNS::Server + # + # @param endpoint_list [Array{String}] + # @return [Array{Array{Object}}] + def self.parse_endpoints(endpoint_list) + endpoint_list.map { |addr_string| addr_string.split('@') } + .map { |addr_parts| [addr_parts[0], addr_parts[1].to_i || 53] } + .map { |addr| [:tcp, :udp].map { |type| [type] + addr } } + .flatten(1) + end + + private + + # creates correct Resolv::DNS::Resource object for IP address type + # + # @param ip_string [String] + # @return [Resolv::DNS::Resource::IN::A,Resolv::DNS::Resource::IN::AAAA] + def create_addr_rr_for_ip(ip_string) + ip = IPAddr.new(ip_string).native + + if ip.ipv6? + Resolv::DNS::Resource::IN::AAAA.new(ip.to_s) + else + Resolv::DNS::Resource::IN::A.new(ip.to_s) + end + end + + # https://tools.ietf.org/html/rfc1996 + # + # @return [void] + def send_dns_notify + Async::Reactor.run do + @notify_targets.each do |notify_target| + target = Async::DNS::Resolver.new(notify_target) + + # assemble DNS NOTIFY message + request = Resolv::DNS::Message.new(SecureRandom.random_number(2**16)) + request.opcode = Resolv::DNS::OpCode::Notify + request.add_question("#{@domain}.", Resolv::DNS::Resource::IN::SOA) + + _response = target.dispatch_request(request) + end + end + end + end + + class ZoneTransferServerHelper < Async::DNS::Server + attr_accessor :axfr_rrs + + def initialize(endpoints, domain) + super(endpoints, logger: Dyndnsd.logger) + @domain = domain + end + + # @param name [String] + # @param resource_class [Resolv::DNS::Resource] + # @param transaction [Async::DNS::Transaction] + # @return [void] + def process(name, resource_class, transaction) + if name != @domain || resource_class != Resolv::DNS::Resource::Generic::Type252_Class1 + transaction.fail!(:NXDomain) + return + end + + # https://tools.ietf.org/html/rfc5936 + transaction.append_question! + @axfr_rrs.each do |rr| + transaction.add([rr[0]], rr[1]) + end + end + end + end +end