Commits

0.9.0 is the last version of Wildcarddnsd, the succeeding project is called Delphinusdnsd and will have its first release around November 15th, 2015. The new project page is at http://delphinusdns.centroid.eu.

/var/db/wdns for mac os x

2.0.5 -> 2.1.1

* make wildcarddnsd compile on Mac OS X with default privileges of "nobody" * indicate install instructions for Mac OS X Yosemite (10.10)

remove freebsd directory

move example file to directory examples as stated in the README

OpenBSD 5.4 -> 5.6

typo

* make wildcarddnsd compile and run on NetBSD 6.1.5

libressl 2.1.1

Untested change to libressl 2.1.1, I'll follow-up commit if this needs touchup

Remove root hints file which offers a great amplification for reflection attacks. Whoever used my servers for this, go to hell, you know who you are. This section will be reinstated after recursing works, which may be never.

Log TCP bytes as well...

log this change (recieved bytes / sent bytes)

After talking about a DDOS attack that I saw in my logs with my friend, I decided to log received bytes and sent bytes. Much useless typing for this but I got it.

Linux MINT needs to apt-get install build-essential, in order to build libressl, other than that it works like the others

instead of setproctitle()'ing "wildcarddnsd master on port %u" just display "wildcarddnsd master" as we don't know the port yet when it's defined in the later checked configfile. So DONT LIE if it differs.

* reflect linux's dependence on libressl 2.0.5

* move todo for 0.9.0 away, I probably won't have the time to finish these things. They are just more on my plate for 1.0.0

we use LibreSSL 2.0.5 now, make mention of it. Also update the Mac OS X compile table.

we now rely on libressl 2.0.5, one must download this if using linux and make it (takes about an hour on the raspberry pi) this is better though than having to maintain a utility for arc4random which portably is hard to get right, just let libressl take care of that. We also fix the Mac OS X port with this. At least it compiles now.

A wildcarddns.conf(5) manpage

add mention of wildcarddns.conf(5) in SEE ALSO section

* Makefile updates for including the manpage wildcarddns.conf(5) for NetBSD (untested) and FreeBSD (tested)

* add a wildcarddns.conf(5) manpage, this is incomplete but a good start perhaps someone wants to complete this?

* a preparation I made last month but wasn't able to finish, here it is anyhow

* document a failure that is caused by a freebsd jail.

* we need to partition the struct domain to reduce size overhead

* filtering these are dangerous options to have lingering in example files

* mention filter and whitelist ip ranges functionality

* add whitelisting * this mode is based on the filter which is a blacklist. * whitelist assumes everything as denied and opens access to listed ip ranges. * while there fix filtering for tcp6 which was broken

* make everything prettier (KNF) * OpenSMTPD is taken as an example here for prototypes * grooming these was a lot of hard work...

* where the berkeley db database is stored...

* this makes linux compile again (bad linux, bad bad bad)

* remove old Berkeley DB code, by now we're committed fully to Berkeley DB versions 4.6 and higher (as long as it's below version 6 which has license changes I read).

* make sure that files are cleaned up upon signals SIGTERM, SIGINT and SIGHUP the databases are written to /var/db/wdns/[pid]/* and then cleaned up after use, after a kernel panic these may be left lingering and should be cleaned up by the administrator per rm -rf once in a while as they will amount...

In programming consistency is key, so clean up the prototypes (KNF), and also move code that was duplicated into it's own check_qtype() function. While there clean up this code and make it consistent.

make an outline of what I want done in the next two releases... - 0.9.0 release is in November 2014 - 1.0.0 release is in November 2015 (10 years of W)

* add RFC 1996 master-only support

One less todo

RFC 1996 (DNS Notify) support, this couldn't be fully tested on IPv6 since I lack a master on IPv6. Tested on FreeBSD 10, OpenBSD 5.5

* yes do free malloc'ed data.

* NAPTR RFC 2915 support

* NAPTR (RFC 2915) support * while there I did some checking against replysize for large packets in reply_* instead of UDP_MAXSIZE * the NAPTR pointers take up 20KB more per record, so if you got 200 records your database will grow by roughly 4 MB

* EDNS0 support complete * the "bug" that I found was not exploitable since we checked the len earlier for 63 or less length, in fact the code for that is redundant.

One less TODO

* Fix up some previous made mistakes regarding EDNS0 * This should _hopefully_ complete EDNS0 support (receive and send) * relevant RFC's are RFC 6891 and RFC3225

* RFC 6891 section 6.2.3 states: Values lower than 512 MUST be treated as equal to 512. This conforms to that.

* RFC 3225 (Indicating Resolver Support of DNSSEC) support * this is a fixup to last commit to show edns0 queries when they are done with the DO bit set. tested on OpenBSD

Partial EDNS0 support and bug fix