7 ms·

Show HN: dingo - a Google DNS-over-HTTPS caching proxy in Go

75 points by pjf 10y ago

allendoerfer 10y ago
Encryption is nice, but does it have to be the overhead of HTTP? What would be a sensible alternative protocol?
- zokier 10y ago
  DNSCrypt or RFC7858 (dprive) are probably closest equivalents.
  - ademarre 10y ago
    I suppose it could also be implemented with DTLS [0] over UDP [1]. (Checking Wikipedia...) A 2013 paper [2] published some vulnerabilities; mostly implementation flaws, but it raised some questions about the core spec as well. However you implement it, encrypting DNS probably has it's place, but it doesn't make a whole lot of sense for most applications. [0] https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Security https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Secur... [1] https://tools.ietf.org/html/rfc6347 https://tools.ietf.org/html/rfc6347 [2] http://www.isg.rhul.ac.uk/~kp/dtls.pdf http://www.isg.rhul.ac.uk/~kp/dtls.pdf
    - zokier 10y ago
      There are IETF drafts actively being worked on for DNS over DTLS: https://datatracker.ietf.org/doc/draft-ietf-dprive-dnsodtls/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dnsodtls/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-tls-profiles/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-...
wyattjoh 10y ago
The use of `go run` here makes adopting this very hard. The benefit of using Go for projects (in my experience) is that you can build for multiple OS/Arch super, super easy. I'd thin that having uploaded artefacts would be the first thing most people do when releasing Go code into the wild that is meant to be consumed by someone just wanting to run the program.
- icholy 10y ago
  go get github.com/pforemski/dingo
  - gouggoug 10y ago
    I think the point wyattjoh was making is that having to install the go toolchain is hindering adoption and that giving downloadable binaries that you could run directly, like `./dingo` would be nicer.
    - zalmoxes 10y ago
      Thats a great point. As a Go developer I always try to make sure that there's a linux and binary for my small projects released on github. I'm surprised more Go devs don't do this. The toolchain makes it very easy to update releases. You can also use ldflags to set the current git revision and branch into the project. Here's an example release.sh I have in most of my projects https://github.com/micromdm/scep/blob/master/cmd/scepclient/release.sh https://github.com/micromdm/scep/blob/master/cmd/scepclient/...
  - eropple 10y ago
    The literal only selling point for Go, from my perspective--as a software developer, platform engineer, and someone willing to put up with others' Go applications but under no circumstances could be paid enough to write it or fight with its ecosystem--is a statically linked binary deployable. It's not an unmitigated good, of course, for obvious and dependency-related reasons. But it's the only reason to consider a Go tool at all. Otherwise, I might as well be using a Python dependency. Or Ruby or Java.
- j3097736 10y ago
  But then you would have to rely on supposedly authentic binaries to run a supposedly secure service.
  - eropple 10y ago
    Cryptographic signatures exist.
vemv 10y ago
What problem does this project solve? It's not immediately obvious what the thing does from the description.
- sciurus 10y ago
  The description sounds pretty clear to me. "A caching DNS proxy for the Google DNS-over-HTTPS. It effectively encrypts all your DNS traffic." https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over...
- dexterdog 10y ago
  When you are out and about with your laptop you are usually making your DNS calls to the local router which many view as a big privacy concern. Even if you use something like google's 8.8.8.8 and 8.8.4.4 public DNS servers as your defaults the traffic is easily sniffable.
  - icebraining 10y ago
    When you connect to any site, your browser sends the domain in clear-text (even for HTTPS - see SNI). The only way to avoid this is to use a VPN, but then you can route regular DNS over that too.
davidu 10y ago
DNSCrypt (https://dnscrypt.org/ https://dnscrypt.org/) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but for DNS and keeps things UDP. Worth pointing out, this is not a google project, it just uses Google's DNS over HTTP endpoint. We have one we made at https://www.openresolve.com/ https://www.openresolve.com/
ShakataGaNai 10y ago
Am I the only one who took a quick look at this and went "How can this DNS be 'secure' if it has to use normal DNS to look up dns.google.com?"
- advisedwang 10y ago
  Because you validate the certificate presented so that you know the endpoint is really Google.
pjf 10y ago
Thanks for all your comments. Below I put quick replies to some of them: 1/ I hope to update the project to use QUIC soon, so it will use encrypted UDP to fetch DNS data from Google Public DNS. It is somehow similar to the DNS over DTLS idea, developed under IETF dprive WG. 2/ dingo does not need to resolve dns.google.com. Providing the server IP address is enough (IPv4 or IPv6, make sure it is close to your location). dingo verifies the server certificate to make sure we talk to Google. It can even "spoof" the TLS SNI string to avoid HTTPS firewalls, too (by default it asks for www.google.com, which is pretty benign). 3/ Last but not least, it's just my first non-trivial Golang project - thanks for all your suggestions! :)
- textmode 10y ago
  "It can even \"spoof\" the TLS SNI string to avoid HTTPS firewalls..." Are you confirming SNI is being used for censorship?
  - clinta 10y ago
    Plenty of content blockers support blocking domains based on SNI. Here's just a couple of examples from a quick google search. https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content/en-us/proxies/https/https_domain_names_c.html http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...
  - NetStrikeForce 10y ago
    If someone is doing DPI their best bet to know where are you connecting to is to look at the host in SNI, but if you're in a corporate environment with an explicit proxy, your computer would be sending a "CONNECT hostname.tld" in plain text anyway :)
- nickodell 10y ago
  It seems like this includes up to 500 bytes of padding in a request. Is there a reason for that?
deleted 10y ago
[deleted]
jzelinskie 10y ago
This code needs a pass through gofmt, among many of the other Go linting technologies.
yegle 10y ago
My friend also wrote a similar tool in Go. This tool uses Taobao's API to detect your external IP address so edns will not be fixed string. https://github.com/ayanamist/gdns-go https://github.com/ayanamist/gdns-go
deleted 10y ago
[deleted]
x0rx0r 10y ago
This is very cool. If you compile it into a go executable and run it with the -dbg 3 option it shows all the lookup information for the clients.

75 points by pjf 10y ago

allendoerfer 10y ago

Encryption is nice, but does it have to be the overhead of HTTP? What would be a sensible alternative protocol?

zokier 10y ago
DNSCrypt or RFC7858 (dprive) are probably closest equivalents.
- ademarre 10y ago
  I suppose it could also be implemented with DTLS [0] over UDP [1]. (Checking Wikipedia...) A 2013 paper [2] published some vulnerabilities; mostly implementation flaws, but it raised some questions about the core spec as well. However you implement it, encrypting DNS probably has it's place, but it doesn't make a whole lot of sense for most applications. [0] https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Security https://en.wikipedia.org/wiki/Datagram_Transport_Layer_Secur... [1] https://tools.ietf.org/html/rfc6347 https://tools.ietf.org/html/rfc6347 [2] http://www.isg.rhul.ac.uk/~kp/dtls.pdf http://www.isg.rhul.ac.uk/~kp/dtls.pdf
  - zokier 10y ago
    There are IETF drafts actively being worked on for DNS over DTLS: https://datatracker.ietf.org/doc/draft-ietf-dprive-dnsodtls/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dnsodtls/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-tls-profiles/ https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-...

wyattjoh 10y ago

The use of `go run` here makes adopting this very hard. The benefit of using Go for projects (in my experience) is that you can build for multiple OS/Arch super, super easy. I'd thin that having uploaded artefacts would be the first thing most people do when releasing Go code into the wild that is meant to be consumed by someone just wanting to run the program.

icholy 10y ago
go get github.com/pforemski/dingo
- gouggoug 10y ago
  I think the point wyattjoh was making is that having to install the go toolchain is hindering adoption and that giving downloadable binaries that you could run directly, like `./dingo` would be nicer.
  - zalmoxes 10y ago
    Thats a great point. As a Go developer I always try to make sure that there's a linux and binary for my small projects released on github. I'm surprised more Go devs don't do this. The toolchain makes it very easy to update releases. You can also use ldflags to set the current git revision and branch into the project. Here's an example release.sh I have in most of my projects https://github.com/micromdm/scep/blob/master/cmd/scepclient/release.sh https://github.com/micromdm/scep/blob/master/cmd/scepclient/...
- eropple 10y ago
  The literal only selling point for Go, from my perspective--as a software developer, platform engineer, and someone willing to put up with others' Go applications but under no circumstances could be paid enough to write it or fight with its ecosystem--is a statically linked binary deployable. It's not an unmitigated good, of course, for obvious and dependency-related reasons. But it's the only reason to consider a Go tool at all. Otherwise, I might as well be using a Python dependency. Or Ruby or Java.
j3097736 10y ago
But then you would have to rely on supposedly authentic binaries to run a supposedly secure service.
- eropple 10y ago
  Cryptographic signatures exist.

vemv 10y ago

What problem does this project solve? It's not immediately obvious what the thing does from the description.

sciurus 10y ago
The description sounds pretty clear to me. "A caching DNS proxy for the Google DNS-over-HTTPS. It effectively encrypts all your DNS traffic." https://developers.google.com/speed/public-dns/docs/dns-over-https https://developers.google.com/speed/public-dns/docs/dns-over...
dexterdog 10y ago
When you are out and about with your laptop you are usually making your DNS calls to the local router which many view as a big privacy concern. Even if you use something like google's 8.8.8.8 and 8.8.4.4 public DNS servers as your defaults the traffic is easily sniffable.
- icebraining 10y ago
  When you connect to any site, your browser sends the domain in clear-text (even for HTTPS - see SNI). The only way to avoid this is to use a VPN, but then you can route regular DNS over that too.

davidu 10y ago

DNSCrypt (https://dnscrypt.org/ https://dnscrypt.org/) would be more elegant here (DTLS also okay) and is in-band wrapper for DNS. It's what TLS is for HTTP but for DNS and keeps things UDP. Worth pointing out, this is not a google project, it just uses Google's DNS over HTTP endpoint. We have one we made at https://www.openresolve.com/ https://www.openresolve.com/

ShakataGaNai 10y ago

Am I the only one who took a quick look at this and went "How can this DNS be 'secure' if it has to use normal DNS to look up dns.google.com?"

advisedwang 10y ago
Because you validate the certificate presented so that you know the endpoint is really Google.

pjf 10y ago

Thanks for all your comments. Below I put quick replies to some of them: 1/ I hope to update the project to use QUIC soon, so it will use encrypted UDP to fetch DNS data from Google Public DNS. It is somehow similar to the DNS over DTLS idea, developed under IETF dprive WG. 2/ dingo does not need to resolve dns.google.com. Providing the server IP address is enough (IPv4 or IPv6, make sure it is close to your location). dingo verifies the server certificate to make sure we talk to Google. It can even "spoof" the TLS SNI string to avoid HTTPS firewalls, too (by default it asks for www.google.com, which is pretty benign). 3/ Last but not least, it's just my first non-trivial Golang project - thanks for all your suggestions! :)

textmode 10y ago
"It can even \"spoof\" the TLS SNI string to avoid HTTPS firewalls..." Are you confirming SNI is being used for censorship?
- clinta 10y ago
  Plenty of content blockers support blocking domains based on SNI. Here's just a couple of examples from a quick google search. https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options https://wiki.untangle.com/index.php/Web_Filter#HTTPS_Options http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content/en-us/proxies/https/https_domain_names_c.html http://www.watchguard.com/help/docs/wsm/xtm_11/en-us/content...
- NetStrikeForce 10y ago
  If someone is doing DPI their best bet to know where are you connecting to is to look at the host in SNI, but if you're in a corporate environment with an explicit proxy, your computer would be sending a "CONNECT hostname.tld" in plain text anyway :)
nickodell 10y ago
It seems like this includes up to 500 bytes of padding in a request. Is there a reason for that?

deleted 10y ago

[deleted]

jzelinskie 10y ago

This code needs a pass through gofmt, among many of the other Go linting technologies.

yegle 10y ago

My friend also wrote a similar tool in Go. This tool uses Taobao's API to detect your external IP address so edns will not be fixed string. https://github.com/ayanamist/gdns-go https://github.com/ayanamist/gdns-go

deleted 10y ago

[deleted]

x0rx0r 10y ago

This is very cool. If you compile it into a go executable and run it with the -dbg 3 option it shows all the lookup information for the clients.