[dnsdist] Apply bandwidth limitation for AXFR responses

[AxelBomp]

Hello, we have implemented the following bandwidth limiting feature in our dnsdist configuration, which works correctly for all standard resolution requests:

-- Global Bandwith limiting per IP
setDynBlocksAction(DNSAction.Refused)
local dbr = dynBlockRulesGroup()
dbr:setResponseByteRate(150000, 30, "Exceeded BW rate", 60)
function maintenance()
  dbr:apply()
end

However, when we make AXFR requests, we are unable to trigger the bandwidth limiting threshold. We have searched the documentation but found no information regarding this matter. Is this the expected behaviour for AXFR queries?

dnsdist version: 1.9.7

Let met know if you need the rest of our configuration files!

Thanks,
Axel

[rgacogne]

Hi Axel,

AXFR and IXFR responses are tricky in the sense that they might be composed of multiple DNS messages, contrary to "normal" DNS responses. As it is not really clear what should be recorded in DNSdist's in-memory ring-buffers for the responses, they are currently not recorded, and the bandwidth limit uses the information contained in these ring-buffers.
I guess we could insert a "fake" summary once the AXFR/IXFR is fully done. It would require a bit of work but if there is enough interest, it's doable. Opening a feature request (or even better, a pull request ;)) would help ensuring we don't forget about it!

[AxelBomp]

Thanks a lot for your quick answer Rémi!

We will submit a feature request on this topic. For now, it is not an issue for us, as we do not want/need to limit bandwidth on AXFR requests, but we wanted to understand the mechanism behind this behavior.