MaraDNS - a security-aware DNS server

MaraDNS A security-aware DNS server |  |
Erre con erre cigarro Erre con erre barril Rápido ruedan los carros En el ferrocarril
Main Download Documentation Blog Changelog Roadmap Contact
## MaraDNS roadmap I am starting a 1.3 branch of MaraDNS. The reason for the 1.2 to 1.3 jump is because I need to make some minor changes to the csv2 zone file format to make it feasible to finish my Python script that converts BIND zone files to csv2 zone files. The plan is this: Have a tilde (~) separate records. Require that the tilde is only used to separate records. I chose the tilde because it's a character that one is usually not going to have in comments nor in TXT/SPF/RAW records. What the csv2 parser will do is parse the first record. If it sees a tilde between the end of the first record and the beginning of the second record, the parser will require that there be a tilde between every single record. A tilde will not be allowed anywhere else in a csv2 zone file; a tilde will not be allowed in comments nor in TXT/SPF records, for example. If you need a tilde in a TXT record, use the \x7e escape sequence. For people who have csv2 zone files with tildes in them already, it will be possible to disable this new behavior by setting a new mararc variable, called csv2_tilde_handling, to 0. Basically, I am transitioning zone files from looking like this:
    %       SOA     % email@% 1 7200 3600 604800 1800
    %       NS      a.%
    %       NS      b.%
    a.example.net.  10.10.10.10
    b.example.net.  10.10.10.11
    b.example.net.  10.10.10.12
    Z.EXAMPLE.NET.  10.2.3.4
    Y.EXAMPLE.net.  10.3.4.5
    percent.%       a               10.9.8.7
    *.example.net.  A               10.11.12.13
    d.example.net. +86400 A 10.11.12.13
    f.example.net.
                    A       10.2.19.83
To looking like this:
    %       SOA     % email@% 1 7200 3600 604800 1800 ~
    %       NS      a.% ~
    %       NS      b.% ~
    a.example.net.  10.10.10.10 ~
    b.example.net.  10.10.10.11 ~
    b.example.net.  10.10.10.12 ~
    Z.EXAMPLE.NET.  10.2.3.4
    ~
    Y.EXAMPLE.net.  10.3.4.5
    ~
    percent.%       a               10.9.8.7 ~
    *.example.net.  A               10.11.12.13 ~
    d.example.net. +86400 A 10.11.12.13 ~
    f.example.net.
                    A       10.2.19.83 ~
Once I make these changes to the csv2 parser, I will finish the Python script to convert BIND zone files to csv2 zone files. I also plan on making the following small changes to the 1.3 branch: I'll add two variables, bind_port and upstream_port, which allow MaraDNS to bind to or listen on other ports. This makes certain setups where we're using MaraDNS to handle dangling CNAME records easier. I'll make it possible to customize the nameserver used to recursively resolve a given subdomain. A lot of djbdns refugees miss this feature, and this won't be too difficult to add (as long as upstream_servers and root_servers aren't both set; I'll continue to prohibit that). udpany() will be rewritten to be two functions; one to be used by the authoritative code; one by the recursive code. This function currently is ugly looking. After doing this, I plan on rewriting the recursive resolver. Basically, the code is quite ugly and this recursive resolver has been needing a rewrite for a few years now. While I'm at it, I may as well add ipv6 support to the recursive half of Mara. After that, I'll revamp the authoritative code to handle AXFRs correctly and to have "views". Since MaraDNS is an open source project, any of these plans can change at any time. MaraDNS 1.2 has the following new features over 1.0: MaraDNS can now run with only a single three-line configuration file. Expanded and improved documentation. A partial native Win32 port has been done; basic MaraDNS functionality is now available on Windows. Full Y2038 compliance; on systems with a 32-bit timestamp, MaraDNS will happily run until 2106 or so. A tool, called `duende` that can daemonize MaraDNS or any other non-daemonizing program, outputting the program's standard output to syslog. The ability to bind to multiple IP addresses. A new zone file format that works side-by-side with the MaraDNS 1.0 zone file format. A Perl tool for converting csv1 (older) zone files to csv2 (newer) zone files. Note that MaraDNS continues to parse csv1 zone files; this tool is here for people who want to transition to the enhanced csv2 zone files. Full support for processing DNS records over ipv4 TCP. Better RFC compliance: Have the rcode in the DNS header for a reply reflect whether we have any records for the host name in question. The addition of a `+=` operator to the mararc file parser, so that long strings may be split up. It is now possible to have a default zonefile with stars at the end of hostnames It is possible to compile the server without recursive support, making the maradns binary 20% smaller and not needing to be linked to the pthread library. There is a special DOS survival mode which resoves hostnames as quickly as possible at the expense of not supporting some DNS features (such as CNAME records or star records) MaraDNS now has authoritative-only UDP ipv6 support. AAAA records are supported in csv2 zone files, and it is possible to run MaraDNS on an ipv6 address. Cname records now point back for any record type, not just A records in the authoritative half. I have added the following features to the post-1.2.00 releases of MaraDNS: Optional strict RFC-compliant handling of star records. Added special record which sets up both forward and reverse DNS lookup for a given IP. Added limited remove administrative features (disabled by default), and restricted all queries that give internal informaiton about MaraDNS to a list of IPs specified by the admin. Ability to customize the case of informing the DNS stub resolver how to handle the case of being unable to contact any remote servers. Daniel Zilli has translated all of Mara's documentation in to Brazilian Portuguese. My next plan for the 1.2 branch is to add the ability to query all of the servers for a given zone multiple times before giving up. I also plan on eventually rewriting MaraDNS in C++. - Sam (2006.05.03)