Deadwood 2.9.03 released ; some thoughts on EDNS

I have released Deadwood 2.9.03 today. This is Deadwood 2.9.02 with a number of bug fixes added, as described in the Deadwood change log.

It can be downloaded here:

http://maradns.org/deadwood/testing/

---

One of the bugs I have fixed in Deadwood 2.9.03 is to change how EDNS (RFC2671) packets are handled. It used to be that Deadwood would just discard such packets, since Deadwood’s policy is to ignore anything that looks unusual.

RFC2671, in section 5.3, says that these packets should be handled by sending an error message back; I use the error message NOTIMPL (“not implemented”), which RFC2671 suggests as a possible error to give back when an EDNS request is sent. However, thinking about it some more, it may make more sense to what MaraDNS and DJB’s dnscache do: Treat a DNS packet with an EDNS section as if the packet were an ordinary DNS packet, ignoring the EDNS information.

The advantage with this approach is that poorly written non-RFC-compliant DNS servers which aren’t smart enough to try with a non-ENDS packet after getting a “not implemented” reply will still work with Deadwood. Considering that MaraDNS and dnscache have done this for years, it looks like this approach won’t result in any problems.

Update: I just uploaded a snapshot of Deadwood which by default ignores the EDNS part of a EDNS query. The old RFC-compliant behavior of sending a NOTIMPL can be enabled by defining STRICT_RFC2671_COMPLIANCE when compiling Deadwood. It can be downloaded in the usual place.

MaraDNS 1.4.04 released

Now that Deadwood is feature-complete, I have released MaraDNS 1.4.04. This is the most current stable release of MaraDNS; if using an older MaraDNS, please update to this release (yes, I ran a bunch of SQA tests so anything that worked before should work in 1.4.04).

While the old recursive code is still in place to allow people to slowly make the transition to using Deadwood as their recursive DNS server, Deadwood 2.9.02 is included. The Windows version of MaraDNS has had its documentation updated to encourage people to use Deadwood for recursion instead of MaraDNS; I will also start nudging *NIX users along.

I have also, as blogged about yesterday, made a tool for getting entropy from the OS and putting it in a file. This is currently a very simple tool; it makes a random 64-byte file called secret.txt which MaraDNS and Deadwood can use. It acts like a UNIX command: There is no user interface; when it is run, it just silently creates the 64-byte random secret.txt file, overwriting any already existing secret.txt, and only outputting something if something goes wrong.

It’s a lot better than the old “just type in some random text to make secret.txt” directions I have given. I plan on making it a little more friendly (failing if secret.txt already exists, and stating the secret.txt file has been created, and always pausing and having the user hit a key so they know what the program is doing if called from the GUI.)

In addition, I fixed the bug with delegation NS records and ANY queries, as well as incorporating a NAPTR bugfix I made a few months ago in to the code. There is a full changelog.

It can be looked at here:

http://maradns.org/download.html

Or here:

http://sourceforge.net/projects/maradns

MaraDNS 1.4.03 and 1.3.07.10 released

I have released MaraDNS 1.4.03 and 1.3.07.10 today. This fixes a minor security issue.

There was a bug introduced in MaraDNS 1.3.03 (January 2007): Hostnames that incorrectly not end with a dot result in a string being deallocated then used.

MaraDNS 1.2 does not have this issue.

This issue can not be exploited from zones loaded using DNS's zone transfer mechanism; fetchzone filters data obtained this way. This issue can only be exploited in the unusual case of an attacker having control of the contents of a csv2 zone file to be parsed by MaraDNS.

This issue, on Linux systems, results in a null pointer dereference that terminates that MaraDNS process.

Impact: Denial of service

This issue is now fixed in MaraDNS 1.4.03 and 1.3.07.10, released February 2, 2010. I have already talked with the relevant people at Debian, who feel this bug is not serious enough to warrant a new stable release of MaraDNS in the Debian repositories.

The updated files can be downloaded here:

http://www.maradns.org/download.html

Next: Upload MaraDNS 1.4.03 to Sourceforge (Update: Done)

Note also that MaraDNS 1.4.03 documents the reject_aaaa/ptr parameters, as posted to the blog yesterday.

MaraDNS 1.4.02 released

I have just released MaraDNS 1.4.02 today. This has one important bug-fix: csv2_default_zonefile works again. Also, I’ve updated the documentation to reflect 1.4 being the current MaraDNS release, and the SQA regressions work in my current development environment (CentOS 5) — using these tests is how I found the csv2_default_zonefile bug.

It can be downloaded at Sourceforge and on the MaraDNS download page:

http://maradns.org/download.html

There is also a changelog.

MaraDNS 1.4.01 released

OK, for the first time since 2007, I am making a stable branch of MaraDNS. I have released MaraDNS 1.4.01 today, which is MaraDNS 1.3.07 with some minor feature enhancements and bug fixes. It can be downloaded from the MaraDNS download page.

While I have updated some of the documentation to reflect the fact MaraDNS is now MaraDNS 1.4, not all of the documentation has been updated.

To do:

• Make MaraDNS 1.4.01 available on MaraDNS' Sourceforge download page (Update: Done 20091221)
• Work on updating the documentation and pieces of the code which assume we're using an older MaraDNS release.

Deadwood 2.4.10 released

In preparation for Monday's release of MaraDNS 1.4.01, I have released Deadwood 2.4.10 today. This is Deadwood 2.4.09 with the documentation fully updated to reflect the fact it uses Google's DNS servers as the upstream by default (e.g. The README in the Windows binary makes it clear that you don't need to change the upstream DNS servers).

In addition, I ran the full SQA test in 64-bit CentOS 5.3 in addition to running it in 32-bit CentOS 5.3 to make sure the code has no regressions; in other words, everything that worked before still works.

It can be downloaded here:

http://www.maradns.org/deadwood/

Deadwood 2.4.08 released; MaraDNS snapshot update

Since I have delayed, for the time being, my work finishing up the recursive version of Deadwood and releasing MaraDNS 2.0, I am declaring Deadwood 2.4 stable and making it the new stable version of Deadwood.

Deadwood 2.4 has a number of features Deadwood 2.3 doesn't have, most notably RR rotation, TTL aging, and dictionary support for upstream_servers--you can have one upstream DNS servers to recursively resolve "google.com" for you and another, that redirects phishing domains, resolve "rnyspace.com" or "paypaI.com" for you.

I have just released Deadwood 2.4.08 today. Compared to Deadwood 2.3, Deadwood 2.4 has:

• TCP and UDP done by the same service/process
• upstream_servers now a full "dictionary" variable
• Full DNS compression and decompression support
• RR rotation and TTL aging
• ip_blacklist support (if you have an annoying ISP DNS server that redirects mistyped domains to some ad-filled page, just put the IPs of that annoying page on your ip_blacklist and Deadwood will make it a DNS "not there" reply again)
• execfile support (Deadwood can now include other files while parsing its configuration file)
• Merging multiple identical in-flight queries (if you just asked for google.com, and ask for it again, instead of creating a new query for google.com, it will just merge your query with the one already sent)

It can be downloaded here:

http://www.maradns.org/deadwood/

I have also updated the MaraDNS snapshot release to have the download page point to the new 2.4 stable release of Deadwood.

Deadwood 2.3.05 released

I have released Deadwood 2.3.05 today. This is a stable release of Deadwood; the only changes from Deadwood 2.3.04 are bug fixes. To wit:

• Spurious fflush() removed
• Deadwood now forwards on to the client (but doesn't cache) unusual DNS packets, as long as the ID and question match. This can be disabled by setting a new dwood2rc parameter, deliver_all, to 0
• Slight revision to code so it will compile in GCC 4.4 without any warnings
• Documentation and SQA tests updated. Most notably, the deliver_all parameter is documented and the BUGS section of the manpage points out having an incomplete last line is a syntax error.

It can be downloaded here:

http://www.maradns.org/deadwood

Deadwood 2.4.07 released

I have just released Deadwood 2.4.07. This is a testing release that emphasizes adding new features more than fixing bugs.

The new features added after 2.4.06 are:

• execfile support
• Multiple in-flight queries for the same hostname are merged.

It can be downloaded here:

http://maradns.org/deadwood/testing/

OK, I'm going to take a break from Deadwood and MaraDNS development for a few days or so.

Deadwood 2.4.06 released: ip_blacklist support

I have released Deadwood 2.4.06; this release of Deadwood has ip_blacklist support.

This is useful if you have one of those annoying ISPs who take "not there" queries or otherwise performs "NXDOMAIN redirection". Simply add the IPs your ISP directs to you when you should get a NXDOMAIN, and Deadwood will convert any DNS response with one of the offending IPs in to a "not there" DNS reply.

Note that Deadwood will not convert cached entries this way; if you wish to use this feature and have used earlier versions of Deadwood, please delete your Deadwood cache first.

It can be downloaded for both CentOS Linux (as source code) and Windows here:

http://maradns.org/deadwood/testing

Deadwood 2.4.05 released

OK, it's here: Deadwood 2.4.05. This release of Deadwood takes advantage of the now-working DNS compression code by implementing both resource record rotation and TTL aging. I've also updated the documents included in the Windows version to reflect the Deadwood changes.

It can be downloaded at maradns.org/deadwood/testing

Next: I need to update Deadwood 2.3's SQA regressions to work with the maradns-1.3.14 changes. Then I need to release Deadwood 2.3.05 with these minor changes. Then I should update the MaraDNS docs (things like having the internal copy of the MaraDNS download webpage point to MaraDNS 1.3.14), add a NAPTR test to MaraDNS, etc..

Then I can start thinking about when I should release MaraDNS 1.3.15.01.

And, oh, I should start thinking about making Deadwood fully recursive.

MaraDNS 1.3.14 released

I have just released MaraDNS 1.3.14:

• William Summers submitted a patch to fix OpenBSD compile issues.
• Deadwood 2 updated to Deadwood-2.04 (with the tools also in MaraDNS removed and the INSTALL document revised accordingly)
• Workaround for AFNIC (.fr) registration issues added
• GCC 4.3.2 compile-time warnings removed
• Milan Kupcevic added dns_port support to zoneserver
• stdint.h now used for fixed-sized integers; this should make MaraDNS easier to compile on unsupported platforms.

It can be downloaded here

Deadwood 2.4.04 released

OK, after over a day of testing, it looks like I have definitely fixed the crash bug. Cityhopper showed me how to look at Dr. Watson logs in Windows XP, which I did in order to verify all of the crashes we have seen are caused by the code I have since fixed. When they say C is portable assembler, they mean it; the compiled assembly looks a lot like the C code.

That in mind, I have released Deadwood 2.4.04. The only change from the 20080718 snapshot is that we only log times when we get a valid DNS packet, but the packet is not correctly decompressed-then-compressed.

I did a lot of testing this weekend and I have yet to see a DNS packet that doesn't decompress-then-compress correctly. If people see this (it's logged in dwlog.txt or on standard output in CentOS 5), let me know with the full DNS packets.

Now that Deadwood can compress and decompress DNS packets (it takes some 5k of code to do this), the next step is to add support for TTL aging and RR rotation.

It can be downloaded at maradns.org/deadwood/testing

- Sam

Deadwood 2.3.04 released: Documentation updated

I have just released Deadwood 2.3.04. This is the stable branch of Deadwood; the only changes to the code are documentation updates and bug fixes. The code is nearly identical to Deadwood's 2.3.03 code, but the documentation has been updated:

• "ifconfig" replaced by "ipconfig" in Windows version of dwood2rc.txt
• I tested and verified Deadwood 2.3 works in Windows 7 last night, so the docs have been updated to mention Windows 7.
• The random hash compression prime has been updated
• Full testing has been done in both 32-bit and 64-bit CentOS 5

It can be downloaded at maradns.org/deadwood

Deadwood 2.4.03 released

I have just released Deadwood 2.4.03. Like all 2.4 releases of Deadwood, this is a testing release; while reasonable effort has been made to keep the code bug-free, the emphasis is on adding new features and not on fixing bugs.

This release is, from the user's point of view, identical to Deadwood 2.4.02. The changes are all under-the-hood changes.

I have changed the code that handles dictionary variables to use the already-in-place code in DwHash.c instead of trying to implement yet another string-indexed array in Deadwood. The changes I made were fairly minor, but needed a lot of testing with Valgrind to make sure I wasn't leaking any memory or doing any double-freeing of elements.

I also made the Valgrind test more fussy; for Deadwood to pass its regression, it now needs to generate no errors when Deadwood is compiled with -DVALGRIND_NOERRORS (Valgrind doesn't like how Deadwood reads uninitialized memory to get more entropy for the random number generator).

I also had to revise the hash_magic_number test a little since the DwDict.c code is now mostly a wrapper for the relevant functions in DwHash.c.

Next: Implement real compression and decompression for DNS RRs, and implement resource record rotation.

It can be downloaded at maradns.org/deadwood/testing.

To keep things clean, I have removed all snapshot releases.

Deadwood 2.4.02 released

OK, Deadwood 2.4.02 has passed all CentOS Linux 5 regressions (I had to increase the timeout in the sqa_tcp test; all other tests were OK), and has been compiled and runs in Windows. That in mind, I have just released Deadwood 2.4.02.

This is a testing release of MaraDNS; testing releases have been internally tested, appear to work, but the emphasis is on adding new features, not fixing bugs while otherwise leaving the codebase unchanged.

The stable branch of Deadwood is Deadwood 2.3; Deadwood 2.4 is where the lion's share of development is happening. Compared to Deadwood 2.4.01, the following features have been added:

• upstream_servers can now let one have different servers process subtrees of the DNS space (such as having one's internal DNS server handle names ending in ".local")
• DNS-over-TCP is now, by default, disabled, and needs to be enabled with tcp_listen = 1 if desired
• The Windows build of Deadwood can now run without being a service (mainly for my own debugging)

It can be downloaded at maradns.org/deadwood/testing.

Deadwood 2.3.03 released and snapshot update

Since MaraDNS requires lines like upstream_servers = {} before any lines like upstream_servers["."] = "10.1.2.3", I have fixed both Deadwood 2.3 and the current snapshot to be able to parse the upstream_servers = {} line without thinking it's a syntax error.

This hotfix only makes the above line parse without error; it's a 3-line change to the source code. The line doesn't do anything and I will not make it mandatory in Deadwood 2.3, so that this bugfix-only update doesn't break current existing configurations.

Note that Deadwood 2.1 will not be updated with this fix.

This release can be downloaded at maradns.org/deadwood

Deadwood 2.4.01 released

I have released Deadwood 2.4.01 today. This release is a complete revamp of Deadwood's DNS-over-TCP handling; instead of having a separate daemon/service handle DNS-over-TCP, the same daemon listens on both UDP and TCP, and only sends TCP queries upstream if upstream gives us a "truncated" reply and downstream is using TCP to get the DNS data.

Note that these oversized DNS packets that need TCP are not cached.

In addition, I have added full buffering to the DNS-over-TCP code and a number of tests that test this code.

For the record, now that I have made this release, I am changing the snapshot naming scheme. Instead of using deadwood-Q-YYYYMMDD-N.tar.bz2 (Q: The letter Q; Y: Year; M: Month; D: Day; N: Release number for the day), I will use two different schemes: deadwood-S-YYYYMMDD-N.tar.bz2 for snapshots of updates to the stable (2.3) code, and deadwood-H-YYYYMMDD-N.tar.bz2 for snapshots of updated to the testing (2.4) code.

Next: Backport the TCP buffering tests and add full TCP buffering (partial send support) to the 2.3 branch of Deadwood.

Deadwood 2.4.01 can be downloaded, either as source code or as a Windows binary at maradns.org/deadwood/testing

Deadwood 2.3.02 released: Documentation clean-up

As I was going through some of the Deadwood documentation the other day, I realized that the Windows documentation was, in some parts out of date, with information no longer true like Deadwood-over-TCP not being installable as a Windows service. So, the last couple of days, I have been going through the Deadwood documentation and updating it, especially the Windows documentation.

I have also noted the default value for all Deadwood parameters in the Deadwood man page (Deadwood reference).

This revised documentation should be more clear to read and follow, especially for Windows users.

I have also slightly rearranged the SQA tests (the "maxprocs" tests sometimes randomly fails in my CentOS 5 virtual machine, so it's now one of the first tests done), and added a comment in DwMararc.c pointing out the default values there are not always the default values used by Deadwood, with a pointer on how to find the real default values. The code is otherwise unchanged (except for the random prime updated and the version number bumped up).

This is a stable release of Deadwood, and will be supported for the foreseeable future.

Deadwood 2.3.02 can be downloaded at maradns.org/deadwood or at maradns.org/download.html.

My next project is to start work on adding TCP support to the UDP code, so we can have a combined UDP and TCP daemon. I should probably also remove that one passing reference to IPv6 in the Deadwood Windows reference (no IPv6 support in Windows).

Deadwood 2.3.01 released: Stable Deadwood release

I have released Deadwood 2.3.01 today. This is a stable release of Deadwood that will be maintained for the foreseeable future with bugfixes; it is a very good tiny forwarding/caching DNS server when one has access to other recursive DNS servers.

The biggest change, compared to Deadwood 2.1, is that the program is now a full-fledged Windows service. In addition, it's now possible, in CentOS 5, to compile the program without caching, which makes the binary a little smaller.

I did a number of tests with this code. I've added a couple of tests to make sure Deadwood can compile and run correctly when compiled without caching; in addition I have added a test to make sure there are no warnings when compiled with GCC 4.3. I also installed CentOS 5 64-bit and made sure it passed all of the tests (except the network TCP test, which I can't run in CentOS 5 because it's non-trivial to get my Intel 3945ABG wifi card to work).

The documentation included with the Windows binary has improved, and the program is now a single combined binary under 32k in size.

One minor issue with the Windows binary is that one can not see the DeadwoodTCP service logs until the service is stopped (the buffer is not flushed). The Deadwood (UDP) service will not flush logs unless it is idle for a second (so as to not waste time flushing buffers when heavily loaded).

Deadwood 2.3.01 can be downloaded on the Deadwood web page or on MaraDNS' download page. The Deadwood 2.1 branch will only be available and supported for three more months (it will be removed from the website on July 22, 2009), and is available here