Re: [dane] Behavior in the face of no answer?

[Nicholas Weaver <[e-mail]>]

On May 11, 2012, at 9:46 AM, John Gilmore wrote:

> Paul Wouters said:
>> But we all know there are many embedded devices with badly written DNS
>> proxy software that do things like comparing packets to known byte
>> streams without actual understanding of bit values.
> 
> I don't personally know this.  If we're going to design a protocol
> around such devices, let's at least get some details instead of vague
> generalizations that "we all know".
> 
> Can you provide some actual names of such devices, preferably with
> links to people complaining about their badly written DNS proxies?
> What is the practical effect of the limitations in their DNS proxies?
> How widely deployed are they, and where?  Are these endpoint devices
> or routers?  Has the mfr released updated firmware for them?  Etc.

Its very ubiquitous, and the biggest problem is the CPE (Customer Premesis Equipment, aka the @#)(@*#)$ NAT!).

www.icir.org/christian/publications/2011-satin-netalyzr.pdf

See section IV


A good 9%+ can't handle unknown RTYPES, TXT records, or requests with EDNS0.


Almost all NATS have DNS proxies that they return as the address of the DNS server always, so they can give an IP address even when they aren't connected.



A good 10% of clients are behind a firewall that attempts to enforce DNS semantics when trying to directly contact a remote authority server.  


A good 4% of clients can't fetch >512B DNS but unfragmented with EDNS0, an unknown RTYPE, and/or TXT records when DIRECTLY querying the remote server (bypassing b0rken recursive resolvers, see above)

We don't know what fraction of these are correct in terms of DNSSEC, but its on the todo list.

We don't know what fraction can use TCP DNS unmolested, but again, its on the todo list.




Also, not reported yet (we haven't analyzed the data fully), but updates in CPE frankly don't occur.  Only Apple even sort of tries (you still need to open the AirPort utility tho for updates to happen), and SOME cable operator provided NAT/cable modems are maintained by the cable operator.  Otherwise, its very often "the crud that shipped is the crud that runs"


E.G, we see nearly 800 sessions (a good fraction of a percent of the tests which are executed) where the configured resolver is runing dnsmasq-1.18, which was released in 2003-2004! 

We're now also fetching UPnP strings these days and we see a distressing variety of unupdated kit.



> Are these proxies only in the data stream while the box is trying to
> interpose itself into "your first web access" to force you to log in?
> Or are the proxies permanently affecting every end user's ability (on
> that network) to send and receive arbitrary packets on port 53?

The latter.