DNSDIST working on L4

[joelasagne]

Hi, as it is possible to use XSK to bypass the kernel when packets arrive and leave, have you also looked into using XDP to do the load balancing ?

I've looked into Katran/Cilium, but the first is not maintained, and Cilium decided a few weeks ago to stop maintaining their standalone L4LB option.

I'm just discovering this technology, and wonder if it would be a really difficult thing to make work and keep updated ? If it seems feasible I would be glad to bring some help into making it.

[rgacogne]

Hi! Sorry, somehow this discussion fell through the cracks. I know the NLnet Labs people have experimented with XDP and DNS:

• https://blog.nlnetlabs.nl/journeying-into-xdp-part-0/
• https://blog.nlnetlabs.nl/journeying-into-xdp-part-1-augmenting-dns/
• https://blog.nlnetlabs.nl/journeying-into-xdp-fully-fledged-dns-service-augmentation/
• https://blog.nlnetlabs.nl/journeying-into-xdp-xdperimenting-with-dns-telemetry/

I do not remember looking into load-balancing, but it's certainly possible to do so. It pretty much depends on what you are trying to achieve, as the limitations of the eBPF verifier are quickly annoying to get a complex logic in XDP. If you want to do very simple load-balancing based on the client IP or the qname, for example, that's certainly possible. But implementing anything more advanced than that is going to be painful, and thus we have not decided to go down that road. We instead use AF_XDP/XSK to get packets as efficiently as possible down to our user-space application, where we can implement complex rules, DoS and DDoS protection, etc.