Re: [dnsext] DTLS alternative to DNS-Curve

[Nicholas Weaver <[e-mail]>]

On Sep 16, 2010, at 1:20 PM, Phillip Hallam-Baker wrote:

>  One of the problems of using DNS for anything at this point is that some networks have firewalls that filter the DNS traffic and some broadband providers intercept and redirect DNS traffic.

Based on our insights from Netalyzr ( http://www.icir.org/vern/papers/netalyzr.imc2010.pdf )...


If you want your traffic unmolested, tunnel it over TCP 443 and use TLS: thats just about the only thing that's pretty much guaranteed to be unmolested.



For DNS in particular, there are a surprising number of boxes that molest traffic that it deems 'non-conforming' (11% of sessions): DNS packets works fine to an arbitrary host (actual blocking or proxying real DNS over UDP was surprisingly rare), but non-DNS over DNS gets brutally shot down by the network.  Often the network admins are completely unaware this is occurring.

Heck, there are plenty of middleboxes that stomp EDNS0 replies > 512B but < 1500B, and a few that just stomp EDNS0 period.

This is arguably one of the biggest problems with DNSCurve: it WILL get stomped on by middleboxes.




Things are probably a bit better about dealing with unknown type resource-records on-the-wire, but I won't know for sure for a couple of months (it in our enhanced test suite we are pushing out RSN), but the common NAT DNS proxies don't seem very good with unknown resource records (again, in our enhanced testing, but so far I'm two-for-two on the dinky NATs I'm using rejecting requests for an 'unknown' RTYPE (type 169, just grabbed that number for the experiment, AFAIK thats an unused RTYPE)).



And don't trust the recursive resolver.  Not only did we see malicious resolvers, and the now endemic NXDOMAIN wildcarding, but we also saw multiple ISPs that used DNS to MitM search engines (www.google.com, search.yahoo.com, www.bing.com) so that all search traffic is directed through an ISP controlled proxy.



Overall, this suggests the following:

New RTYPEs can be used, but reluctantly.  But it does make it much more tempting to push things into TXT records rather than using rare records that may be unused (eg, CERT) or creating new RTYPE, because there is less worry with TXT records being stomped on by the network or user's DNS infrastructure.

Changing the DNS 'packet format', yet keeping UDP port 53, however is a total no-go: use a different port # if you want something that won't parse to the wire as DNS.  Otherwise, it won't work.