Skip to content

Releases: cunnie/sslip.io

Rotate order of NS Records

17 Sep 13:45
@cunnie cunnie
3.2.1
adb0d5a
Compare
Choose a tag to compare
Rotate order of NS Records Latest
Latest

We rotate the order that the NS records (ns-aws, ns-azure, ns-gce, ns-ovh) are returned in the hope that this will take the load off ns-aws, whose costs have jumped from $12.66 → $20.63 → $38.51 → $62.30 in the last four months due to bandwidth charges exceeding 10 TB.

Pre-release snapshot of NS usage:

    ns-aws.sslip.io
    "Queries: 237744377 (1800.6/s)"
    "Answered Queries: 63040894 (477.5/s)"

    ns-azure.sslip.io
    "Queries: 42610823 (323.4/s)"
    "Answered Queries: 14660603 (111.3/s)"

    ns-gce.sslip.io
    "Queries: 59734371 (454.1/s)"
    "Answered Queries: 17636444 (134.1/s)"

    ns-ovh.sslip.io
    "Queries: 135897332 (1034.4/s)"
    "Answered Queries: 36010164 (274.1/s)"

Full Changelog: 3.2.0...3.2.1

Assets 9
Loading

Introduce new nameserver, ns-ovh.sslip.io

16 Sep 03:48
@cunnie cunnie
3.2.0
73df72a
Compare
Choose a tag to compare
Introduce new nameserver, ns-ovh.sslip.io

Presenting ns-ovh.sslip.io:

  • located in Warsaw, Poland
  • IPv4: 51.75.53.19
  • IPv6: 2001:41d0:602:2313::1

The raison d'être of this is to take the load off ns-aws, which jumped from $12.66 → $20.63 → $38.51 → $62.30 in the last four months due to bandwidth charges exceeding 10 TB.

Dismantling DNS-backed key-value store, k-v.io

  • I'm no longer engaged on setting up k-v.io; I thought it'd be cool to have a DNS-backed etcd implementation, but now I don't care anymore.
  • There were technical challenges, too: Specifically, updating values did not play well with DNS caching — you'd get the old value after updating.
  • If the service became popular, I'd quickly run out of disk space on my tiny cloud VMs.
  • The service would most likely be used by people doing data exfiltration via DNS. I already have enough problems with sslip.io scammers — the last thing I want is to sign up for dealing with k-v.io scammers.

What's Changed

New Contributors

Full Changelog: 3.1.0...3.2.0

Contributors

cunnie, thannaske, and Morty-Feldman
Assets 9
Loading

Shorten TTL for publicly-accessible A & AAAA records

09 Mar 15:49
@cunnie cunnie
3.1.0
6075e9e
Compare
Choose a tag to compare
Shorten TTL for publicly-accessible A & AAAA records

If we have IPs that we need to block, I want them to time-out within the hour. TTL: 604800 → 3600 (1 week → 1 hour)

Assets 9
Loading

Enable TCP Binding

04 Oct 15:17
@cunnie cunnie
3.0.0
477e88c
Compare
Choose a tag to compare
Enable TCP Binding

sslip.io-dns-server now binds to TCP as well as UDP. Although DNS queries typically pass over UDP, TCP offers better protection against cache-poisoning attacks.

If the server is unable to bind to UDP, it'll exit, but if it's unable to bind to TCP, it'll continue running.

Assets 9
Loading

Disable DNS-backed key-value store

13 Mar 23:12
@cunnie cunnie
2.7.0
8f7f2df
Compare
Choose a tag to compare
Disable DNS-backed key-value store
  • No one was using the DNS-backed key-value store
  • The removal of the etcd library dropped the executable size by over half from 17MB to 7MB
  • I didn't want users who've deployed it internally to be "surprised" by unexpected key-value features
  • Key-value-over-DNS has a seamy side to it: "data exfiltration". I know there are legitimate uses for it, but I've come to believe that a Key-value-over-HTTP solution is preferable because it's not only more legitimate but also because it eliminates the DNS caching problem.
Assets 9
Loading

`-quiet` flag suppresses logging for each DNS query

27 Nov 01:30
@cunnie cunnie
2.6.2
05c58bf
Compare
Choose a tag to compare
`-quiet` flag suppresses logging for each DNS query

Google Cloud Plaatform (GCP) charged me $17.69 last month for "Cloud Logging" which consumed 84.74 GiB.

At an average of 51.2 queries/second, and each log line averaging 192 bytes, and 606024*30 seconds/month, this works out to 25,480,396,800 bytes (23.73 GiB), which works out to a monthly savings of $4.95 if using the -quiet flag.

However, it seems that my saving would be even more because when I visually browse the logs, at least ⅔ are from sslip.io logging.

Breaking Change

The newest Docker image (v2.6.2+) should be invoked differently, without /usr/sbin/sslip.io-dns-server:

 docker run \
   -it \
   --rm \
   -p 53:53/udp \
-    /usr/sbin/sslip.io-dns-server \
       -nameservers jammy.nono.io \
       -addresses jammy.nono.io=10.9.9.114,jammy.nono.io=2601:646:100:69f0:0:ff:fe00:72

Tech note: I switched the Dockerfile CMD to ENTRYPOINT.

Full Changelog: 2.6.1...2.6.2

Assets 9
Loading

`-nameservers` & `-addresses` flags allow customized records

11 Nov 20:50
@cunnie cunnie
2.6.1
b9f0da8
Compare
Choose a tag to compare
`-nameservers` & `-addresses` flags allow customized records
  • -nameservers flag allows overriding the hard-coded nameservers, ns-aws.sslip.io, ns-azure.sslip.io, and ns-gce.sslip.io. Typical use: -nameservers=ns-0.pivotal.io,ns-1.pivotal.io. Useful in internetless (air-gapped) environments
  • -addresses flag allows customizing address records, often used in conjunction with -nameservers, e.g. -addresses ns-0.pivotal.io=10.8.8.8,ns-1.pivotal.io=10.9.9.9,ns-1.pivotal.io=fcab::
  • 🐞 Reliably bind to individual IP addresses. Sometimes the server would panic when binding to IP addresses individually
  • 🐞 Parallel integration tests would fail ~11% of the time due to a race condition. That condition has been fixed
  • Integration tests work internetless by default (good for coding on a plane)
  • Integration tests are parallelized
  • Updated SOA to two days before Armistice Day (11/09)
  • Dependency bumps, including bumping Ginkgo in Dockerfiles & go.mod
  • The Docker image cunnie/sslip.io-dns-server supports both amd64 and arm64 architectures.

Full Changelog: 2.6.0...2.6.1

Assets 9
Loading

PTR Records for IPv4 & IPv6

15 Jul 02:10
@cunnie cunnie
2.6.0
757ff7a
This commit was signed with the committer’s verified signature. The key has expired.
cunnie Brian Cunnie
GPG key ID: 93B3BB2C9F7F5BA4
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
PTR Records for IPv4 & IPv6
  • IPv4 reverse lookup, e.g. 1.0.0.127.in-addr.arpa. → 127-0-0-1.sslip.io.
  • IPv6 reverse lookup, e.g. 2.a.b.b.4.0.2.9.a.e.e.6.e.c.4.1.0.f.9.6.0.0.1.0.6.4.6.0.1.0.6.2.ip6.arpa. →
    2601-646-100-69f0-14ce-6eea-9204-bba2.sslip.io.
  • Compressed TXT metrics.status.sslip.io (more info including PTR and k-v.io metrics, smaller packet)
  • Updated SOA to Bastille Day (7/14)

Full Changelog: 2.5.4...2.6.0

Assets 9
Loading

Security Release: prohibit TXT records on k-v.io itself

01 May 00:16
@cunnie cunnie
2.5.4
4a59752
This commit was signed with the committer’s verified signature. The key has expired.
cunnie Brian Cunnie
GPG key ID: 93B3BB2C9F7F5BA4
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
Security Release: prohibit TXT records on k-v.io itself

This is a security release which prevents scammers from procuring a *.k-v.io wildcard certificate from commercial certificate authorities who use the DNS-01 challenge.

Much thanks to @Alan-Liang, who noted the following:

... one could easily add (and modify) a TXT record at _acme-challenge.k-v.io, which I believe is used for verifying domain ownership at various cert providers, so anyone could in theory obtain valid SSL certs for k-v.io and *.k-v.io. I think this might be a security issue

Full Changelog: 2.5.3...2.5.4

Contributors

Alan-Liang
Assets 9
Loading

k-v.io is operational

22 Apr 23:25
@cunnie cunnie
2.5.3
a21d434
This commit was signed with the committer’s verified signature. The key has expired.
cunnie Brian Cunnie
GPG key ID: 93B3BB2C9F7F5BA4
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
k-v.io is operational
  • k-v.io has an A record
  • Dockerfile builds image to run https://k-v.io on GKE
  • Rigorous testing of key-value get/put/delete on each of the three servers
  • Bug fixes to etcd TLS certificates (wrong SANs),

Full Changelog: 2.5.2...2.5.3

Assets 9
Loading