setting up a dnscurve forwarder

I spent some time today setting up the DNSCurve forwarder for a domain.
Here's what I did.


                             NOTE NOTE NOTE

Because the software (and DNSCurve itself) are under development right
now, it's likely that these instructions will be out of date soon.

                             NOTE NOTE NOTE

Software:

- daemontools
- NaCl: http://nacl.cr.yp.to/install.html
- Matthew Dempsky's dnscurve repo: git://github.com/mrd/dnscurve.git

I used what's available right now: NaCl 20090405 and revision
488b8a21b8cd870b499436346534d3207216291e of mrd/dnscurve.  I set up the
forwarder on a 64-bit Debian 5.0 system.  The forwarder uses epoll, so
it won't compile on, say, FreeBSD.

NaCl first:

- cd /usr/local/src
- wget http://hyperelliptic.org/nacl/nacl-20090405.tar.bz2
- tar xjf nacl-20090405.tar.bz2 && cd nacl-20090405 && ./do

You should end up with some files in the build/`hostname` directory.  In
particular, the build/`hostname`/lib and build/`hostname`/include
directories should have a subdirectory named after your hardware
platform (x86 for 32-bit Intel, amd64 for 64-bit Intel, etc).

What the NaCl build system doesn't do right now is install the headers
and libraries somewhere in the system; they're all in the build
directory.  In my case, they were

/usr/local/src/nacl-20090405/build/v1/include/amd64
/usr/local/src/nacl-20090405/build/v1/lib/amd64

Next, the forwarder:

- cd /usr/local/src
- git clone git://github.com/mrd/dnscurve.git
- cd dnscurve/forward
- apply the attached patch (makes it easier to build)
- make \
  NACLINC="-I/usr/local/src/nacl-20090405/build/`hostname`/include/amd64 \
  NACLLD="-L/usr/local/src/nacl-20090405/build/`hostname`/lib/amd64"

You should end up five binaries:

base32-test
dnscurve-keygen
dnscurve-test-client
forward
udpserver

You'll probably want to copy dnscurve-keygen, forward, and udpserver
somewhere more standard, like /usr/local/sbin.

forward, as its name suggests, sits between DNSCurve-aware resolvers and
a non-DNSCurve-aware authoritative nameserver (tinydns, bind, it doesn't
matter).  For the rest of this email, I'm going to use 10.0.0.1 as the
forwarder's IP address, and 192.168.1.1 for the authoritative
nameserver.

Run dnscurve-keygen and note down its output:

% ./dnscurve-keygen 
DNS public key: uz5997ptv831hxdrqzju6nqxzg26034c66qp0tbfu8wm5brxs0q496
Hex public key: 299d9a371ae17576ed87da50dbbf13060cb28cb11564d534e2b3a8db31b02419
Hex secret key: 59bd8bbf44145f1f7ab5bfc55e63458f7ca929cd4b66618e87294071ad3d2b44
% 

The DNS public key will go into DNS, and the forwarder will want to read
the secret key from its environment.  Here's how I set it up using
daemontools:

- mkdir /somewhere/dnsforward
- cd /somewhere/dnsforward
- mkdir env log log/main
- echo 59bd8bbf44145f1f7ab5bfc55e63458f7ca929cd4b66618e87294071ad3d2b44 > env/DNSCURVE_PRIVATE_KEY

You probably want to make sure the private key file isn't publicly
readable.

Create dnsforward/run with

--- cut here ---
#!/bin/sh

PATH=/usr/local/sbin:/bin:/usr/bin
export PATH

exec envdir ./env sh -c 'exec envuidgid someone udpserver 10.0.0.1 53 forward 192.168.1.1'
--- cut here ---

dnsforward/log/run is ordinary:

--- cut here ---
#!/bin/sh

exec setuidgid someone multilog t ./main
--- cut here ---

- chmod +x dnsforward/run and dnsforward/log/run
- chown someone log/main
- ln -s /somewhere/dnsforward /service

You'll need to create a DNS entry for the forwarder.  It looks just like
a nameserver to the outside world:

.example.org:10.0.0.1:uz5997ptv831hxdrqzju6nqxzg26034c66qp0tbfu8wm5brxs0q496.example.org:259200

I think that's it.


Faried.
-- 
The Great GNU has arrived, infidels, behold his wrath !
Kein Mitleid Für Die Mehrheit.
It is wonderful how much may be done if we are always doing. -- TJ

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkpzFBsACgkQWVufAqdzMWPBTQCdGbCaxHEuz8PGBPHKv0THtQYu
h0IAn1TTV7j6tTzvx0rTDTUyPi+Zk0OV
=TOD6
-----END PGP SIGNATURE-----

diff --git a/forward/Makefile b/forward/Makefile
index bfda474..57418ef 100644
--- a/forward/Makefile
+++ b/forward/Makefile
@@ -1,4 +1,6 @@
-CFLAGS=-Wall -ggdb -std=c99
+NACLINC=
+CFLAGS=-Wall -ggdb -std=c99 $(NACLINC)
+NACLLD=
 TARGETS=forward udpserver dnscurve-keygen dnscurve-test-client base32-test
 
 targets: $(TARGETS)
@@ -7,16 +9,16 @@ clean:
 	rm -f *.o $(TARGETS)
 
 dnscurve-test-client: dnscurve-test-client.o randombytes.o ip_parse.o dns_packet.o base32.o
-	gcc $(CFLAGS) -o dnscurve-test-client dnscurve-test-client.o randombytes.o ip_parse.o dns_packet.o base32.o -lnacl
+	gcc $(CFLAGS) -o dnscurve-test-client dnscurve-test-client.o randombytes.o ip_parse.o dns_packet.o base32.o $(NACLLD) -lnacl
 
 forward: forward.o dns_packet.o base32.o randombytes.o ip_parse.o dns_random.o
-	gcc $(CFLAGS) -o forward forward.o dns_packet.o base32.o randombytes.o ip_parse.o dns_random.o -lpthread -lnacl -lrt
+	gcc $(CFLAGS) -o forward forward.o dns_packet.o base32.o randombytes.o ip_parse.o dns_random.o $(NACLLD) -lpthread -lnacl -lrt
 
 udpserver: udpserver.o ip_parse.o
 	gcc $(CFLAGS) -o udpserver udpserver.o ip_parse.o
 
 dnscurve-keygen: dnscurve-keygen.o base32.o randombytes.o
-	gcc $(CFLAGS) -o dnscurve-keygen dnscurve-keygen.o base32.o randombytes.o -lnacl
+	gcc $(CFLAGS) -o dnscurve-keygen dnscurve-keygen.o base32.o randombytes.o $(NACLLD) -lnacl
 
 base32-test: base32-test.o base32.o
 	gcc $(CFLAGS) -o base32-test base32-test.o base32.o