Automatic reload of lmdb updates?

[rishu007]

dnsdist version 1.9
I want to use lmdb for lookup if the record is found then only i want to allow query processing. I wanted to know if lmdb is updated by a separate process will the new data is automatically loaded into dnsdist?
@rgacogne

[rgacogne]

Yes.

[rishu007]

we have deployed dnsdist to azure aks

version 1.9.10
we have kept lmdb data base to azure file share persistent volume with 2 dnsdist pods are accessing it and one cronjob updating the database
but we are facing issue with database updates are not recognized by dnsdist
below is our dnsdist configuration

addLocal("0.0.0.0:53", {reusePort=true})
addACL('0.0.0.0/0')
lmdbStore = newLMDBKVStore("/data/db/data.mdb", "", true)
pc = newPacketCache(30000, {maxTTL=86400, minTTL=0, temporaryFailureTTL=60, staleTTL=60, dontAge=false})
getPool(""):setCache(pc)
local dbr = dynBlockRulesGroup()
dbr:setQueryRate(5, 7, "Exceeded query rate", 300)
dbr:setRCodeRate(DNSRCode.SERVFAIL, 10, 20, "Exceeded ServFail rate",150)
dbr:setRCodeRate(DNSRCode.REFUSED, 10, 30, "Exceeded Refused rate",600)
function maintenance()
dbr:apply()
end
function checkFQDN(dq)
local qname = dq.qname:toString()
local label = qname:match("^([^.]+)%.")
label = string.lower(label)
if label then
local val = lmdbStore:lookup(label, false)
if val and val ~= "" then
print("Allowed: " .. qname)
return DNSAction.None
else
print("Blocked: " .. qname)
return DNSAction.Refused
end
end
return DropAction()
end

addAction(AllRule(), LuaAction(checkFQDN))
setVerbose(true)
setDynBlocksAction(DNSAction.Drop)
setMaxTCPClientThreads(8)
setRingBuffersSize(10240)

[rishu007]

yes both the pod share the same file share where data base is created. I am not sure regarding process ids if you can tell how to get this information.

Azure file share used for persistent volume

[rishu007]

Logs before running (stat -c %y /data/db/data.mdb)

dnsdist 1.9.10 comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2
Listening on 0.0.0.0:53
ACL allowing queries from: 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 0.0.0.0/0, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10
Console ACL allowing connections from: 127.0.0.0/8, ::1/128
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding DoH Client thread
No downstream servers defined: all packets will get dropped
Accepting control connections on 127.0.0.1:5199
Polled security status of version 1.9.10 at startup, no known issues reported: OK
Allowed: mr-t97649-sample1--test1.
Dropped query for mr-t97649-sample1--test1|CNAME from 127.0.0.1:53489, no downstream server available
Allowed: mr-t75459-sample1--test1.
Dropped query for mr-t75459-sample1--test1|CNAME from 127.0.0.1:44728, no downstream server available
Allowed: mr-t75459-sample1--test1.
Dropped query for mr-t75459-sample1--test1|CNAME from 127.0.0.1:58987, no downstream server available
Blocked: mr-t46672-sample1--test1.

I have disabled caching for now as you asked for it but i am sure it not because of caching since cache is last part of you packet processing. I am checking on the log messages. Here the last record says blocked, but it is there in the database.

now i have ran below stat command in the pod and ran the original query again
stat -c %y /data/db/data.mdb
and here are the logs

dnsdist 1.9.10 comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2
Listening on 0.0.0.0:53
ACL allowing queries from: 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 0.0.0.0/0, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10
Console ACL allowing connections from: 127.0.0.0/8, ::1/128
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding TCP Client thread
Adding DoH Client thread
No downstream servers defined: all packets will get dropped
Accepting control connections on 127.0.0.1:5199
Polled security status of version 1.9.10 at startup, no known issues reported: OK
Allowed: mr-t97649-sample1--test1.
Dropped query for mr-t97649-sample1--test1|CNAME from 127.0.0.1:53489, no downstream server available
Allowed: mr-t75459-sample1--test1.
Dropped query for mr-t75459-sample1--test1|CNAME from 127.0.0.1:44728, no downstream server available
Allowed: mr-t75459-sample1--test1.
Dropped query for mr-t75459-sample1--test1|CNAME from 127.0.0.1:58987, no downstream server available
Blocked: mr-t46672-sample1--test1.
Allowed: mr-t46672-sample1--test1.
Dropped query for mr-t46672-sample1--test1|CNAME from 127.0.0.1:34110, no downstream server available

here you can see last record was allowed after running stat command and data got picked up

[Habbie]

. I am not sure regarding process ids if you can tell how to get this information.

Just looking at PIDs in the different pods would be a good start. Other than that, I don't know, that's a question for Azure documentation.

[rishu007]

i want to try this out with dnsdist 2.0.0 version where some improvements were made regarding lmdb . Request to please share the timeline by when v2 will be available in alpine?

[Habbie]

2.0.0 will be in Alpine as soon as somebody does the work. We will likely get to it next week.

But you likely have a configuration problem, not a bug.

[omoerbeek]

lmdb docs at http://www.lmdb.tech/doc/ say (but I do not know how azure shares classify):
Do not use LMDB databases on remote filesystems, even between processes on the same host. This breaks flock() on some OSes, possibly memory map sync, and certainly sync between programs on different hosts.

[rishu007]

are we starting read transaction for each query or like dnsdist have long running read transaction ?

[Habbie]

Please answer our questions before asking more questions of your own.

[rishu007]

I can check on this since I don't have answer to this particular question. I can try with azure disk setup if fileshare has some sync issue with lmdb.

[Habbie]

are we starting read transaction for each query or like dnsdist have long running read transaction ?

new read transaction for each query

[rishu007]

CDB database there is check for the database modification time in dnsdist where it is not there for lmdb . I think this also should have solve this issue.