Re: [Doh] Running code

[Massimiliano Fantuzzi <[e-mail]>]

Hi to the Doh mailing list and group,

Bringing your attention to an interesting project (born around 2009).
DNSP is written in C (local client server) and PHP (remote resolver):
https://github.com/fantuz/DNSProxy  it WAS NOT built on "H2 compliancy" by
the time, quite obviuously.
Now thanks to more recent CURL libs, the H2 part has been added and passing
tests; by this weekend I can commit to have it completely DOH-aware.

Some functions/plugins for DNSP are being staged and to be released soon.
more features are to be supported with minimum effort.
Redis cache for example is trivial, adding QUIC might be not. Please let me
know your feedback !
The tree of the project might look ugly to you; I am not a software
engineer, just a passionate technician (sysadmin/networking/webservers/db)
with sufficient debug skills.

The initial credit goes to Andrea Fabrizi who created alpha DNSP back in
2009.
Since 2010 I have been thinking of how to expand further this idea, got
lucky enough to test its functionality within a small satellite-provider in
some time later (2013) [1]
Andrea has fully authorized me to take on his project as he would not have
interest or time to carry on. Code changed quite a bit, but the core hasn't
(principle was good).
I even created an Arduino version, as POC and for fun :)

As I could not find any draft on a DOH topic back then (DNSSEC was rolling
out) I cannot even name that many experiments on embrionic-Doh ancestors,
per my knowledge,
The only 3 examples deserving a credit for being innovative in vehiculating
DNS over differernt channels are to me "dnspod"[2] and Pcap_DNSProxy[3] and
more recently, ChinaDNS[4]. Might there be other, I let you complete.

Summarising:
 - DNSP did its modest job, against DNS censorship,
blocking/locating/redirecting
and leaks, offering a *mitigation* to TOR-leaks and helping people bypass
Chinese walls or anycast/proximity DNS... outside of Torsocks (i was on
that for short time).
 - It also proved being "practical" on highly-delayed network paths with
possibly high packet loss (airplane use squid to cache traffic as much as
possible).
 - since geolocation, anycast and CDNs step into the game, such a tool
showed being helpful as valuable workaround in *some* situation (an user
reported watchning Netflix via DNSP, not sure if still holds true, is not
my scope).

Hopefully just less than a month ago I discovered the D-o-H draft version 3
and this working group....
*Such a reliev !! I have been wating on DoH even prior it's "officiial"
birth :)*

After I got to know about the upcoming London IETF Hackathon, I am
implementing DOH-set-of-features including ease of use and ease of deploy
(for the moment is more a local DNS than a distributed one, not
impossible to scale out, is just threads and send_to).
The phase of making it compliant with DOH-proposed-format(s) is almost
completed (check README or run the code).
In my simplicistic roadmap I am still somehow willing to support Google DNS
and keep supporting my ultrabasic standard (the q-type is contained in
GET/POST request, simplicistic but my initial purposes was to shorten
answers, by tailoring the response packet without ADDITIONAL and AUTHORITY
sections) and veichulating such via proxied HTTP (fast responses, TTL
valid).

Probably there was no buzz about DNS over HTTP because such
transport/encapsulation direction was not foreseenable or desired few years
ago.... surely there will be objections, in terms of traceability (law
enforcement to mention one).
The increased demand for "anonimity", for "security", along with the
increasing size of DNS messaging and the advent of H2 made it convenient to
*try* and serve the DNS by the same mean we serve web-pages, possibly along
the same iteration (i.e. browser integration with APIs). I have again some
doubts on the logging of such requests, but this is probaly an open point
yet.

Then just to complete the story, some times in 2016 I have seen Google
HTTPS DNS service being published but I was busy so I sincerely do not
remember interacting with it alot. [5]
Unfortunately, I think it didn't raise alot lot of interest, neither it got
fully advertised... Is it true? Am i totally wrong?


Happy to address you all, apologise for long thread/simple language. Hope
you will appreciate DNSP as wannabe DOH local server.


See you 17/18 March at the Hilton Metropole !
Thanks for your time,
Massimiliano (Max)



Footnotes:

[1]: satellite connectivity made me needing short responses and HTTP is
more friendly to billing, UDP was getting lost and users unhappy.
[2]: made in China out of similar branch of mine (
http://dnspod.github.io/dnspod-int-api-docs/ and https://
github.com/DNSPod/dplus-c/blob/master/src/http.c htt
ps://github.com/DNSPod/dplus-c
[3]: chinese windows proxy was just inspirational sometimes and made me
curious about China internet situation, but this project had no HTTP
involved. https://github.com/chengr28/Pcap_DNSProxy/blob/mas
ter/Documents/ReadMe.en.txt
[4]: https://github.com/shadowsocks/ChinaDNS
[5]: Just my 2c: let's compare for a second the SPDY evolution into H2, and
look at DOH (or alternatives of it) as the next promising tech. IMHO, this
Google DNSHTTPS experimental product came bit lately than "expected".
How many millions users are on 8.8.8.8 standard DNS ? Whole enterprises
(not nice of them, that's why they *used to* get throttled)... The
forwarder view offered by Google has been "accepted" by its users since
longer time than any other "free" DNS service, i.e. OpenDNS. We believe
that Google did an astounding commercial choice in using all 8s
digits. This is why I say that this DNS/HTTPS Google service was launched
"late", just because big G earned an enormous share on the free DNS market
and oviously is always in the position to help supporting DOH
adoption/advertisement with such a easy mnemonic choice !! Free-of-charge
google services are attractive. I recall that Google service is not DOH
compliant, but i see a common intent. Does anyone have some numbers on
dns.google.com HTTPS service, in terms of active users (or system
uptime/faults) ? just approximately ? BTW, IBM owns 9.9.9.9 and HP
16.16.16.16.16, mnemonic choices do "avoid re-translating something we
already known by heart" (is a bit like "thinking in the same language your
conversation happens to be", considered a must in foreign languages
interpretation).



With kind regards,
Massimiliano Fantuzzi

-- 

*Massimiliano Fantuzzi*
*IT professional, expert in DB Linux and networks.*

*[phone] <%2B41%2076%20754%201037>*