MaraDNS - a security-aware DNS server

MaraDNS A security-aware DNS server |  |
Erre con erre cigarro Erre con erre barril Rápido ruedan los carros En el ferrocarril
Main Download Documentation Blog Changelog Roadmap Contact
## MaraDNS roadmap The MaraDNS 1.3.07 branch of MaraDNS is now in beta testing. In other words, the only changes to this branch before being declared stable will be documentation updates, bug fixes, and new SQA tests added. The 1.3.07 branch has a few new features compared to MaraDNS 1.2: BIND zone file support. This is done with a Python script that converts a BIND zone file in to a MaraDNS-compatible zone file, and with some minor changes to the CSV2 zone file format (see below). It's now possible to tell the recursive resolver to use different DNS servers to resolve records that end with a given string. For example, you can tell the recursive resolver to use the DNS server with the IP 192.168.1.2 to resolve anything that ends in `.local`. New mararc variables: `upstream_port` and `dns_port` (these two mararc variables allow one to resolve dangling CNAME records when one only has a single IP), `recurse_min_bind_port` and `recurse_number_ports` (these mararc variables allow one to choose which ports MaraDNS binds to when making recursive queries), `recurse_delegation` (how we handle things when we are both a recursive server and delegate zones), and `max_mem` (What is the maximum amount of memory we allow MaraDNS to allocate). '.' can now be a hostname by itself in csv2 zone files ### Tildes now separate records In order to make it easier to convert from BIND's zone file format to MaraDNS' zone file format, the tilde (~) now separates records. The tilde is only used to separate records. I chose the tilde because it's a character that one is usually not going to have in comments nor in TXT/SPF/RAW records. What the csv2 parser does is parse the first record. If it sees a tilde between the end of the first record and the beginning of the second record, the parser requires that there be a tilde between every single record. A tilde is not allowed anywhere else in a csv2 zone file except in comments; a tilde is not allowed in TXT/SPF records, for example. If you need a tilde in a TXT record, use the \x7e escape sequence. For people who have csv2 zone files with tildes in them already, it is possible to disable this new behavior by setting a new mararc variable, called `csv2_tilde_handling`, to 0. `csv2_tilde_handling`, with a value of 0, is also supported in MaraDNS 1.2.12.04 and later 1.2 releases of MaraDNS. Basically, I am transitioning zone files from looking like this:
    %       SOA     % email@% 1 7200 3600 604800 1800
    %       NS      a.%
    %       NS      b.%
    a.example.net.  10.10.10.10
    b.example.net.  10.10.10.11
    b.example.net.  10.10.10.12
    Z.EXAMPLE.NET.  10.2.3.4
    Y.EXAMPLE.net.  10.3.4.5
    percent.%       a               10.9.8.7
    *.example.net.  A               10.11.12.13
    d.example.net. +86400 A 10.11.12.13
    f.example.net.
                    A       10.2.19.83
To looking like this:
    %       SOA     % email@% 1 7200 3600 604800 1800 ~
    %       NS      a.% ~
    %       NS      b.% ~
    a.example.net.  10.10.10.10 ~
    b.example.net.  10.10.10.11 ~
    b.example.net.  10.10.10.12 ~
    Z.EXAMPLE.NET.  10.2.3.4
    ~
    Y.EXAMPLE.net.  10.3.4.5
    ~
    percent.%       a               10.9.8.7 ~
    *.example.net.  A               10.11.12.13 ~
    d.example.net. +86400 A 10.11.12.13 ~
    f.example.net.
                    A       10.2.19.83 ~
### MaraDNS 1.3.07 plans I will be creating new tests for the 1.3.07 series to see if I can find any other bugs before making the 1.3.07 series stable on December 21, 2007. I will also be updating the documentation, and fixing any bugs that I find. Once 1.3.07 is made stable on December 21, the only changes I will make to this branch are important bugfixes and documentation updates. ### Post-1.3.07 plans I, on September 21, 2007, split the 1.3 series in to two branches: The 1.3.07 branch, and the post-1.3.07 branch, starting with MaraDNS 1.3.08. The reason for this split is new features to MaraDNS can be contributed. For example, Jean-Jacques Sarton is working on improving MaraDNS' ipv6 support, and I added support for the NAPTR record that someone on the mailing list asked for. I plan on rewriting the recursive resolver. Basically, the code is quite ugly and this recursive resolver has been needing a rewrite for a few years now. While I'm at it, I will probably add ipv6 support to the recursive half of Mara. This is a project that will take at least six months to implement once I start writing code (I've been too busy babysitting older releases and answering support questions to start work on my code, and, yeah, this thing called real life sometimes gets in the way too). After that, I may revamp the authoritative code to handle AXFRs correctly, to have "views", and to be able to reload zones without restarting MaraDNS. It will be a while before I start writing this code. ### Show me the money Since MaraDNS is an open source project, any of these plans can change at any time. For example, since I'm not getting paid to work on MaraDNS, I may decide that it's more fun to hang out with my girlfriend or to play some interactive fiction. If people desperately need features added to MaraDNS, let's talk. Since I'm living in Mexico, my expenses are fairly low so I can add new features at good prices. Note that, if you want to keep the new features proprietary, I will charge considerably more to implement the new features. ### MaraDNS 1.0 and 1.2 MaraDNS 1.0 was released over five years ago, and will only be supported (with the exception of security updates) until December 21, 2007. After that date, MaraDNS 1.0 users will be on their own. I no longer answer "how do I" questions for this release of MaraDNS, and will not fix non-security bugs after December 21. If anyone is interested in becoming the maintainer of MaraDNS 1.0, let me know. MaraDNS 1.2, which was released nearly two years ago, has the following new features over 1.0: MaraDNS can now run with only a single three-line configuration file. Expanded and improved documentation. A partial native Win32 port has been done; basic MaraDNS functionality is now available on Windows. Full Y2038 compliance; on systems with a 32-bit timestamp, MaraDNS will happily run until 2106 or so. A tool, called `duende` that can daemonize MaraDNS or any other non-daemonizing program, outputting the program's standard output to syslog. The ability to bind to multiple IP addresses. A new zone file format that works side-by-side with the MaraDNS 1.0 zone file format. A Perl tool for converting csv1 (older) zone files to csv2 (newer) zone files. Note that MaraDNS continues to parse csv1 zone files; this tool is here for people who want to transition to the enhanced csv2 zone files. Full support for processing DNS records over ipv4 TCP. Better RFC compliance: Have the rcode in the DNS header for a reply reflect whether we have any records for the host name in question. The addition of a `+=` operator to the mararc file parser, so that long strings may be split up. It is now possible to have a default zonefile with stars at the end of hostnames It is possible to compile the server without recursive support, making the maradns binary 20% smaller and not needing to be linked to the pthread library. There is a special DOS survival mode which resoves hostnames as quickly as possible at the expense of not supporting some DNS features (such as CNAME records or star records) MaraDNS now has authoritative-only UDP ipv6 support. AAAA records are supported in csv2 zone files, and it is possible to run MaraDNS on an ipv6 address. Cname records now point back for any record type, not just A records in the authoritative half. I have added the following features to the post-1.2.00 releases of MaraDNS: Optional strict RFC-compliant handling of star records. Added special record which sets up both forward and reverse DNS lookup for a given IP. Added limited remove administrative features (disabled by default), and restricted all queries that give internal informaiton about MaraDNS to a list of IPs specified by the admin. Ability to customize the case of informing the DNS stub resolver how to handle the case of being unable to contact any remote servers. Daniel Zilli has translated all of Mara's documentation in to Brazilian Portuguese. The 1.2 release of MaraDNS will only be updated to fix critical and security bugs, and to fix errors in the documentation. - Sam (2007.09.23)