zeronsd: Unicast DNS resolution for ZeroTier, now in alpha

How it works

So, before I go into any of this; a recent development by our Central team was the porting of all API specs to OpenAPI 3, including a translation of the zerotier-one service API! You can’t give me tools like this, and expect me to not use them! 😀

So, what zeronsd more or less does, is poll the Central API periodically and populate records in what trust-dns calls a “Catalog” and then proceeds to let trust-dns do most of the work on its own. The code footprint is quite small, and once initialized there is only one supervisory routine running (the record refresher) that does not belong to trust-dns’s crate.

To configure the listening information, we talk directly to ZeroTierOne over the privileged API, which is at localhost:9993 and ask it to tell us its IP addresses for that network. Easy sauce.

Usage

First, to get maximum benefit, ensure your users of the networks have the Manage DNS flag turned on; this will be important as your DNS server comes live.

Generate an API token. You will need to put this in a file, or in the environment, so keep it handy.

Create a network. Make note of the Network ID: the long hexadecimal number at the top of the network’s page. You will need this to pass to zeronsd.

Finally, obtain a rust environment, so you can build & install zeronsd.

Installation

The latest release can be found this way:

cargo install zeronsd

If you want to run the bleeding edge, try:

cargo install --git https://github.com/zerotier/zeronsd --branch main

Running

NOTE: If you are on OS X, Windows, or Linux your zerotier-one credentials will be automatically detected. Otherwise, (e.g., FreeBSD), you will need to pass a special flag to point at the authtoken.secret file in your ZeroTier installation.

Finally, you must run zeronsd as root. While I would like it differently, plenty of resolvers will simply not work over anything but port 53, making root pretty much a requirement on any POSIX system.

Put your API token in a file named zerotier-central-token and run this:

sudo zeronsd start -t zerotier-central-token

If you prefer, you can also pass ZEROTIER_CENTRAL_TOKEN in the environment. One of these, however, is required for the daemon to start. After that, you should see something like this:

Welcome to ZeroNS! Your IP for this network: 172.27.207.100

Your IP will of course be different. 🙂 It should correspond to the IP listed in zerotier-cli listnetworks for the network you’ve provided. Your DNS settings on the Central API will be updated, and all clients will start resolving ASAP to your DNS server.

Querying

In my case, I have the following members configured:

This allows for the following records:

Options

There are a few options you can use to modify the behavior a bit. Notably:

-d lets you adjust the TLD, which defaults to domain. Set it to any dotted combination you can think of.

**-f **lets you add a hosts file that appends static records to the TLD. It uses /etc/hosts format, e.g.:

This will result in home-router.domain pointing to 10.0.0.1. No PTRs are generated (yet).

Things to Improve

Well, nothing’s perfect.

DoT/DoH support

Does not exist yet. trust-dns supports this, so this is earmarked but we are thinking through ways to distribute certificate authorities, which is critical for these features. Stay tuned!

IPv6, 6plane, RFC4193 support

If you are a heavy IPv6 user, we could really use your help diagnosing quality-of-life issues with these features. Notably, PTR records do not work for any of these situations.

Performance

As mentioned prior, trust-dns performs quite well, and it really does most of the work once the service is configured. We can see this in performance numbers.

The benchmarking environment is slipshod; it is mostly here to say “this will perform better than mDNS”, not “OMFG THIS IS THE FASTEST DNS SERVER ON EARTH”. That said, I think we should all be comforted that this will not be your problem with this service, is my best guess.

I forked a copy of dnsbench because that was simpler than downgrading golang. Try it out!

This is running on two local nodes, so no intermediary services, just two copies of ZeroTier having a conversation. The requesting node is a 6 core, 12 thread i7-8700K mostly unloaded, running 100 threads for a million queries in total. The serving machine is a Ryzen 2800X with 8 cores and 16 threads, running a moderate workload. zeronsd RSS usage never went beyond 10MB at the time of this benchmark.

As I think we can all see here, you’re gonna be fine.

Thanks!

This was a lot of writing and thanks for getting this far! If you’re more interested in the project, feedback and patches are always great ways to contribute. Until next time!