Re: [Doh] DOH and Induced DNS

Mark Nottingham <mnot@mnot.net> Mon, 06 November 2017 23:32 UTC

Return-Path: <mnot@mnot.net>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E34B13F698 for <doh@ietfa.amsl.com>; Mon, 6 Nov 2017 15:32:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.721
X-Spam-Level:
X-Spam-Status: No, score=-2.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=XExW77Cc; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Hce0i4Vz
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NQWRW1UQpJOF for <doh@ietfa.amsl.com>; Mon, 6 Nov 2017 15:32:57 -0800 (PST)
Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43D3613FB59 for <doh@ietf.org>; Mon, 6 Nov 2017 15:32:57 -0800 (PST)
Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id 9712C20C7A; Mon, 6 Nov 2017 18:32:56 -0500 (EST)
Received: from frontend2 ([10.202.2.161]) by compute3.internal (MEProxy); Mon, 06 Nov 2017 18:32:56 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=nN10TEnAbhFrqhl2yRzjIICknXKyM NIIOzvvmoco8/I=; b=XExW77CcCXhFTmlPspN3tMjt24CqnXJUK4ZRklBG1ps29 z7B2cPTSgi98tf0Z/9dMTrJxdJvSZRcMY5ipvjF3TlfZCwV96rjXYIkxQ6I3H/sJ QKzdaQt2siQ+KXiKEqO+nmdh8BBAwP7Q9E2P0QQtWXJ1wN+7PNHh0VHN/2MEFW+7 a08FokmouDUjniXL9QgzgmSD3Xk2vkslHuN1PZLl3Bi9hLWM9ptHTDroXhoggd0v h+OwUe2mJqGqPlImd1POUyf0SG7xf8ybraasey8upWGqvkisxnahulIJtd/GVrY1 FW0hricFtzlMT7vwYawV8qPai7r4unod30EAUAlIw==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=nN10TE nAbhFrqhl2yRzjIICknXKyMNIIOzvvmoco8/I=; b=Hce0i4VzpK9bULOp/UoV3n eXJYsWjkisoa0LO5uE606QmPwdGWSPFmYONpsm6R9Trj6sG19bhOI6TTRJF/7zHh UKNWunT5+eZ4UAUuzIm5LotxxPMueT4javIhH75R3RwpUy3gnqXP7Xabk3DBi2Yr 1FixOHOp3Ndze18eg4bKIaQp4lanUPb+GUhsbu4CdLTPLNmH6d79dqQto3wGqSHa hMQ42AvyUUz3IhMBeDnb+cHsLCUzFWLBkid1WRaBSQkgtFJeB0xpsm0vXaaNXUYU i/tIif1tXDMZyGX30Q0p4f/SaWKcV2sIUlw+IKs3zTueQHGgLqC40NwDDBbNl3UA ==
X-ME-Sender: <xms:KPEAWq0Faq9Gzp20-nWdG8wfZhpPONxtN2Lj4mCc6bPemd8jKQO79A>
Received: from [192.168.1.18] (cpe-124-188-19-231.hdbq1.win.bigpond.net.au [124.188.19.231]) by mail.messagingengine.com (Postfix) with ESMTPA id A8F13242CF; Mon, 6 Nov 2017 18:32:55 -0500 (EST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 11.0 \(3445.1.7\))
From: Mark Nottingham <mnot@mnot.net>
In-Reply-To: <20171106170750.GA24665@sudo.sh>
Date: Tue, 7 Nov 2017 10:32:52 +1100
Cc: doh@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <C93D011F-68D3-4B21-BB37-4ABF10488372@mnot.net>
References: <20171106170750.GA24665@sudo.sh>
To: dagon <dagon@sudo.sh>
X-Mailer: Apple Mail (2.3445.1.7)
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/o15MNjY-gk7EDz6BGSyrYNLO1Ao>
Subject: Re: [Doh] DOH and Induced DNS
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Nov 2017 23:32:59 -0000


> On 7 Nov 2017, at 4:07 am, dagon <dagon@sudo.sh> wrote:
> 
>  c) Header-only?  If we assume implementation mistakes will always
> occur in DOH stubs and recursives, perhaps the wire encoding should
> appear only in HTTP headers, since these are less easily manipulated
> by crafted javascript and HTML.  At the same time, the headers are
> presumably within reach of the stub.  Header fields seem more likely
> to reflect browser user decisions, and not the HTML author's malicious
> whims.  (At least the problem would only be as bad as DNS prefetch, in
> terms of volume.)

It's trivial for scripts to modify headers, EXCEPT those starting with Sec-:
  https://fetch.spec.whatwg.org/#forbidden-header-name

If this is a concern, it might be workable to define a header that looks something like:

Sec-Doh: 1

to indicate that the request was generated by the browser / client internals, not script.

Cheers,

--
Mark Nottingham   https://www.mnot.net/