Add support for dnscrypt protocol

[UniverseM5]

Here is the error log:

Sun Oct 22 11:33:06 2017 uucp.warn /usr/sbin/noddos[5167]: HostCache: Couldn't open /var/lib/noddos/DnsCache.json for reading
Sun Oct 22 11:33:06 2017 uucp.info /usr/sbin/noddos[5167]: HostCache: DeviceMatches read: 0
Sun Oct 22 11:33:06 2017 uucp.crit /usr/sbin/noddos[5167]: Mdns: bind
Sun Oct 22 11:33:06 2017 daemon.info procd: Instance noddos::instance1 s in a crash loop 6 crashes, 1 seconds since last crash

Installed version - 0.5.4-1

[tapper82]

Hi I am getting:
Sun Oct 22 18:53:10 2017 uucp.warn /usr/sbin/noddos[8268]: HostCache: Couldn't open /var/lib/noddos/DnsCache.json for reading
Sun Oct 22 18:53:10 2017 uucp.warn /usr/sbin/noddos[8268]: HostCache: Couldn't open /etc/noddos/DeviceMatches.json
Sun Oct 22 18:53:10 2017 uucp.crit /usr/sbin/noddos[8268]: Mdns: bind

LEDE
Model
Linksys WRT3200ACM
Firmware Version
Lede Reboot SNAPSHOT r5113-2af10c30fe / LuCI Master (git-17.291.51172-a98548e)
Kernel Version
4.9.57

I installed latest from here:
https://noddos.io/dist/lede/releases/snapshots/arch/mvebu/packages/master/

[byoda]

The bind(2) call is failing. Can you please attach the output of `ifconfig -a' to this bug? Please review this output with the definition of LanInterfaces and WanInterfaces in /etc/noddos/noddos.conf and make any changes as necessary. Additionally, please install strace with 'opkg install strace', execute from the command line 'strace /usr/sbin/noddos -n -c /var/etc/noddos.conf' and attach the output to this bug.

[UniverseM5]

Hi @StevenHessing

The /etc/noddos/noddos.conf-base has correct interfaces defined against
"LanInterfaces": ["eth0", "br-lan"],
"WanInterfaces": ["eth1"]
ifconfig.txt

Here is the output of strace:
strace.txt

Thanks.

[byoda]

Thanks for the strace. It shows that noddos can't bind to MDNS / 5353 UDP port. Do you have an MDNS daemon running like Avahi? (opkg install lsof; lsof -i 5353)

To test, please disable that daemon and start noddos again. If that resolves the issue then I'll need to see how noddos can run in parallel with any MDNS daemon.

Relevant strace output: bind(11, {sa_family=AF_INET, sin_port=htons(5353), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EADDRINUSE (Address in use)

[UniverseM5]

@StevenHessing
I've got DNSCrypt installed (don't know if it affects noddos somehow).
lsof -i 5353 output:

lsof: unknown protocol name (5353) in: -i 5353

[byoda]

Sorry, lsof -i :5353

[UniverseM5]

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
dnscrypt- 19340 nobody 7u IPv4 2624343 0t0 UDP localhost:mdns
dnscrypt- 19340 nobody 9u IPv4 2624345 0t0 TCP localhost:mdns (LISTEN)

[byoda]

Yup, we have the culprit. Not sure if you want to stop using dnscrypt but would be helpful to confirm that this is the issue if you can temporarily stop dnscrypt (probably using 'service dnscrypt stop') and then launch noddos ('service noddos start'). If noddos launches successfully then you can stop noddos and restart dnscrypt (of course I would have rather that you skip the last step). Reading up a bit in dnscrypt, it could interfere with the capability of noddos to track DNS queries so would have to add support for the dnscrypt protocol to noddos.

[UniverseM5]

Disabling DNSCrypt and Adblock(just in case) seems to be fixing the issue as I can see some noddos actions in the log:

Sat Oct 28 15:47:48 2017 uucp.notice /usr/sbin/noddos[2657]: HostCache: Got invalid ARP entry 00:00:00:00:00:00 for fd42:19f3:38c3::a1b
Sat Oct 28 15:47:48 2017 uucp.notice /usr/sbin/noddos[2657]: HostCache: Got invalid ARP entry 00:00:00:00:00:00 for fd42:19f3:38c3::a1b
Sat Oct 28 15:47:48 2017 uucp.notice /usr/sbin/noddos[2657]: HostCache: Got invalid ARP entry 00:00:00:00:00:00 for fd42:19f3:38c3::a1b
Sat Oct 28 15:47:49 2017 uucp.notice /usr/sbin/noddos[2657]: HostCache: Got invalid ARP entry 00:00:00:00:00:00 for fd42:19f3:38c3::a1b
Sat Oct 28 15:48:25 2017 uucp.notice /usr/sbin/noddos[2657]: HostCache: Got invalid ARP entry 00:00:00:00:00:00 for fe80::1cf1:2a9c:8c29:3842
Sat Oct 28 15:48:27 2017 uucp.notice /usr/sbin/noddos[2657]: HostCache: Got invalid ARP entry 00:00:00:00:00:00 for fe80::9610:3eff:fe18:470a

[byoda]

You can ignore those log messages, they are harmless and in the upcoming v0.5.5 demoted to debug messages..

Try starting DNScrypt while noddos is running?

[UniverseM5]

Started.
No crash message on the log. Still can see above errors(2657). noddos screen with un/recognised clients has nothing.

[byoda]

See if there are /etc/noddos/DeviceMatches.json and /var/lib/noddos/DeviceDump.json files and what their contents are.