6 ms·

> Operating systems can and should implement DoH I see a comment like this basically every time something about DoH comes up. What I haven't seen: A plan how

by hannob 6y ago

> Operating systems can and should implement DoH I see a comment like this basically every time something about DoH comes up. What I haven't seen: A plan how this should be implemented, a proposal to OS vendors and developers, ideally with patches. This raises a few questions. How should the OS decide which server to use? It obviously can't be DHCP, because that's not a secure thing to begin with. How does this interact with things like captive portals if you have a disconnect between the DNS functionality and the gui application? Do you have good answers for these?

detaro 6y ago
The questions also apply to browser implementations, don't they?
- hannob 6y ago
  Some do, some don't. For example the captive portal issue, browsers can try to connect without DoH to a captive portal test page and provide a special non-DoH login tab. You can't do that on the OS level. You could create some interaction between the browser and the OS, but that's nontrivial and needs a solution.
  - Spivak 6y ago
    Sure you can! iOS, Android, and GNOME/NetworkManager just open up a webview to handle the portal. I’m sure others do too I just can’t say for certain.
    - zinekeller 6y ago
      Windows: Network Connectivity Status Indicator (NCSI) will ping www.msftncsi.com on older versions (8.1 and lower) or www.msftconnecttest.com on newer versions (10), and then prompts to open the web browser. Since IE/Edge will be always there, it works. macOS: same as iOS (a dedicated window pinging www.apple.com). Firefox: Detects detectportal.firefox.com and asks the user if the want to access the captive portal. Android: Detects connectivitycheck.android.com on Android 5 and connectivitycheck.gstatic.com on Android 6+. I don't know if it applies to all phones, but I'm sure (that except for phones on Android One or Nexus/Pixel) Samsung also does this for phones outside of China.
  - detaro 6y ago
    OSes do at least some captive portal detection and prompting already too, but true, that might need additional work, I'm not familiar enough with the details.
gsich 6y ago
The answer is: DHCP. In an environment where a captive portal is active you can ensure that only one DHCP server is running in your segment with no rogue DHCP servers. So telling a client with DHCP that a captive portal is active, and with URL to show it, is sane. This would eliminate a lot of stupid probing done by clients. Same goes for announcing DoT/DoH servers that way. The same applies for your "home" environment. Since you usually don't want to run multiple DHCP servers, this would also work there.
- LinuxBender 6y ago
  And it isn't like anyone needs to modify DHCP standards to support this. Just use any of the "options" text to add DoH/DoT, the same way browsers are advised of PAC URL's today. Only the clients would need updates to know how to use this, and adding the capability to an OS should be fairly easy to implement. option wpad-url code 252 = text; option wpad-url "http://10.10.10.10/proxy.pac\n"; I'm sure there is a clean way to overload or augment this capability to extend it to DoH/DoT.
  - gsich 6y ago
    I did something similar for a PoC at my university. It worked, no surprise there. All you need to do is have a another client script in Debian to configure your resolver.
  - LinuxBender 6y ago
    I should add that DoH developers should reach out to ISC for comment on DHCP, to get an idea what the cleanest method would be to implement DoH/DoT in DHCP that would work for 90%+ of DHCP implementations.
    - gsich 6y ago
      https://datatracker.ietf.org/group/add/documents/ https://datatracker.ietf.org/group/add/documents/ There is some work regarding this.
deleted 6y ago
[deleted]
tremon 6y ago
It obviously can't be DHCP, because that's not a secure thing to begin with Why not? DHCP is supposed to be authoritative for the network you're connected to. If you don't trust that network, you should probably also not be using its advertised gateway. Where does that leave you?
- StillBored 6y ago
  "you should probably also not be using its advertised gateway" Why not? Just make sure to use a VPN/etc to access services over the gateway. I mean, this is the default case for everything going over the internet. Do you trust every router in the path?
  - iso1631 6y ago
    Fine, then set your own DNS server in your network settings.
    - kelnos 6y ago
      How do you know the network you're connected to isn't intercepting DNS requests and returning whatever it wants?
      - gsich 6y ago
        Use DNSSEC.
        tptacek 6y ago
        DNSSEC doesn't do that at all. DNSSEC does no transaction encryption. It allows full recursive resolvers --- the kind virtually nobody runs on their own machines --- to validate signatures on the tiny minority of domains (virtually none of them among the most popular on the Internet) that have opted in to DNSSEC over the last 10 years. Note that even in the unusual corner case where you're looking up a name that's actually signed with a DNS recursor that actually verifies DNSSEC signatures, the network between you can still snoop on all your DNS requests, because DNSSEC is bad. If you're worried that your network upstream is intercepting your DNS requests (and if you're in the US on a mainstream ISP, you should be), this is the problem DoH is designed to solve, and it does so quite effectively.
StillBored 6y ago
Isn't this the trusted network dialog in windows/etc when you connect to a new network? If you don't trust the network, then the OS should be tunneling to a trusted one. If you do trust it then it can go ahead and use the DHCP/etc provided name servers. After all it can decide to enable/disable access to services (windows filesharing for example) based on this, there isn't any reason it can't decide to trust the local nameserver too.
iso1631 6y ago
> What I haven't seen: A plan how this should be implemented, a proposal to OS vendors and developers, ideally with patches. Windows has support https://techcommunity.microsoft.com/t5/networking-blog/windows-insiders-can-now-test-dns-over-https/ba-p/1381282 https://techcommunity.microsoft.com/t5/networking-blog/windo...
megous 6y ago
It's already implemented for years. Personally I'm using dnscrypt-proxy for system level DoH. You can put the proxy anywhere on the network and set up DHCP to point the clients to this proxy.

by hannob 6y ago

detaro 6y ago

The questions also apply to browser implementations, don't they?

hannob 6y ago
Some do, some don't. For example the captive portal issue, browsers can try to connect without DoH to a captive portal test page and provide a special non-DoH login tab. You can't do that on the OS level. You could create some interaction between the browser and the OS, but that's nontrivial and needs a solution.
- Spivak 6y ago
  Sure you can! iOS, Android, and GNOME/NetworkManager just open up a webview to handle the portal. I’m sure others do too I just can’t say for certain.
  - zinekeller 6y ago
    Windows: Network Connectivity Status Indicator (NCSI) will ping www.msftncsi.com on older versions (8.1 and lower) or www.msftconnecttest.com on newer versions (10), and then prompts to open the web browser. Since IE/Edge will be always there, it works. macOS: same as iOS (a dedicated window pinging www.apple.com). Firefox: Detects detectportal.firefox.com and asks the user if the want to access the captive portal. Android: Detects connectivitycheck.android.com on Android 5 and connectivitycheck.gstatic.com on Android 6+. I don't know if it applies to all phones, but I'm sure (that except for phones on Android One or Nexus/Pixel) Samsung also does this for phones outside of China.
- detaro 6y ago
  OSes do at least some captive portal detection and prompting already too, but true, that might need additional work, I'm not familiar enough with the details.

gsich 6y ago

The answer is: DHCP. In an environment where a captive portal is active you can ensure that only one DHCP server is running in your segment with no rogue DHCP servers. So telling a client with DHCP that a captive portal is active, and with URL to show it, is sane. This would eliminate a lot of stupid probing done by clients. Same goes for announcing DoT/DoH servers that way. The same applies for your "home" environment. Since you usually don't want to run multiple DHCP servers, this would also work there.

LinuxBender 6y ago
And it isn't like anyone needs to modify DHCP standards to support this. Just use any of the "options" text to add DoH/DoT, the same way browsers are advised of PAC URL's today. Only the clients would need updates to know how to use this, and adding the capability to an OS should be fairly easy to implement. option wpad-url code 252 = text; option wpad-url "http://10.10.10.10/proxy.pac\n"; I'm sure there is a clean way to overload or augment this capability to extend it to DoH/DoT.
- gsich 6y ago
  I did something similar for a PoC at my university. It worked, no surprise there. All you need to do is have a another client script in Debian to configure your resolver.
- LinuxBender 6y ago
  I should add that DoH developers should reach out to ISC for comment on DHCP, to get an idea what the cleanest method would be to implement DoH/DoT in DHCP that would work for 90%+ of DHCP implementations.
  - gsich 6y ago
    https://datatracker.ietf.org/group/add/documents/ https://datatracker.ietf.org/group/add/documents/ There is some work regarding this.

deleted 6y ago

[deleted]

tremon 6y ago

It obviously can't be DHCP, because that's not a secure thing to begin with Why not? DHCP is supposed to be authoritative for the network you're connected to. If you don't trust that network, you should probably also not be using its advertised gateway. Where does that leave you?

StillBored 6y ago
"you should probably also not be using its advertised gateway" Why not? Just make sure to use a VPN/etc to access services over the gateway. I mean, this is the default case for everything going over the internet. Do you trust every router in the path?
- iso1631 6y ago
  Fine, then set your own DNS server in your network settings.
  - kelnos 6y ago
    How do you know the network you're connected to isn't intercepting DNS requests and returning whatever it wants?
    - gsich 6y ago
      Use DNSSEC.
      - tptacek 6y ago
        DNSSEC doesn't do that at all. DNSSEC does no transaction encryption. It allows full recursive resolvers --- the kind virtually nobody runs on their own machines --- to validate signatures on the tiny minority of domains (virtually none of them among the most popular on the Internet) that have opted in to DNSSEC over the last 10 years. Note that even in the unusual corner case where you're looking up a name that's actually signed with a DNS recursor that actually verifies DNSSEC signatures, the network between you can still snoop on all your DNS requests, because DNSSEC is bad. If you're worried that your network upstream is intercepting your DNS requests (and if you're in the US on a mainstream ISP, you should be), this is the problem DoH is designed to solve, and it does so quite effectively.

StillBored 6y ago

Isn't this the trusted network dialog in windows/etc when you connect to a new network? If you don't trust the network, then the OS should be tunneling to a trusted one. If you do trust it then it can go ahead and use the DHCP/etc provided name servers. After all it can decide to enable/disable access to services (windows filesharing for example) based on this, there isn't any reason it can't decide to trust the local nameserver too.

iso1631 6y ago

> What I haven't seen: A plan how this should be implemented, a proposal to OS vendors and developers, ideally with patches. Windows has support https://techcommunity.microsoft.com/t5/networking-blog/windows-insiders-can-now-test-dns-over-https/ba-p/1381282 https://techcommunity.microsoft.com/t5/networking-blog/windo...

megous 6y ago

It's already implemented for years. Personally I'm using dnscrypt-proxy for system level DoH. You can put the proxy anywhere on the network and set up DHCP to point the clients to this proxy.