DNSSEC for legacy applications libnss_getdns, a nsswitch module as an alternative for the system stub Willem Toorop 19 November 2015 DNS-WG @ RIPE71 Genesis API is ● ● A DNS API specification by and for application developers First implementation by From Verisign: LABS (for resolving) (for application) and From NLnet Labs: Theogene Bucuti, Craig Despeaux, Angelique Finan, Neel Goyal, Scott Hollenbeck, Shumon Huque, Sanjay Mahurpawar, Allison Mankin, Sai Mogali, Prithvi Ranganath, Rushi Shah, Vinay Soni, Bob Steagall, Gowri Visweswaran, Glen Wiley Olaf Kolkman, Benno Overeinder, Willem Toorop, Wouter Wijngaards From Sinodun: Sara and John Dickinson From No Mountain Software: Melinda Shore Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 2/22 Genesis ● Give applications a better handle on DNS, ie: – Asynchronous – Get resource records other then A and AAAA – Get DNSSEC status for DANE Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 3/22 Genesis ● Give applications a better handle on DNS, ie: – Asynchronous – Get resource records other then A and AAAA – Get DNSSEC status for DANE , but also signalling! Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 4/22 Genesis ● Give applications a better handle on DNS, ie: – Asynchronous – Get resource records other then A and AAAA – Get DNSSEC status for DANE , but also signalling! ● Many features don't need application interface – TCP Pipelining, Keep connections open, TCP Fast Open – DNS over TLS Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 5/22 Genesis _443._tcp.getdnsapi.net TLSA Application ● _443._tcp.getdnsapi.net TLSA Authoritatives net NS net DS . Give applications a better handle on DNS, ie: net DNSKEY OS os _443._tcp.getdnsapi.net TLSA DNSSEC Aware net DNSKEY resource Recursive records other then A and AAAA, net getdnsapi.net NS getdnsapi.net DS Resolver – Get – Asynchronous signalling! – Get DNSSEC status for DANE , but alsogetdnsapi ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ● Many features don't need application interface – TCP Pipelining, Keep connections open, TCP Fast Open – DNS over TLS – DNSSEC iteration as STUB Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 6/22 Genesis ● Give applications a better handle on DNS, ie: – Get resource records other then A and AAAA, – Asynchronous – Get DNSSEC status for DANE , but also signalling! ● Many features don't need application interface – – – – TCP Pipelining, Keep connections open, TCP Fast Open DNS over TLS DNSSEC iteration as STUB Since version 0.5.1, Roadblock Avoidance Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 7/22 Genesis _443._tcp.getdnsapi.net TLSA Application ● _443._tcp.getdnsapi.net TLSA Authoritatives net NS net DS . Give applications a better handle on DNS, ie: net DNSKEY OS os _443._tcp.getdnsapi.net TLSA DNSSEC Aware net DNSKEY resource Recursive records other then A and AAAA, net getdnsapi.net NS getdnsapi.net DS Resolver – Get – Asynchronous signalling! – Get DNSSEC status for DANE , but also getdnsapi ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ••From FromXavier's Xavier'spresentation: presentation: ••64% 64%provide provideDNSSEC DNSSECfor forexisting existingthings things DNSSEC for Denial ● • Many features don'tproof need interface •56% 56%provide provide DNSSEC proof forapplication DenialofofExistance Existance ••40% provide DNSSEC for wildcards 40% provide DNSSEC for wildcards open, TCP Fast Open – TCP Pipelining, Keep connections – DNS over TLS – DNSSEC iteration as STUB – Since version 0.5.1, Roadblock Avoidance Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 8/22 Genesis _443._tcp.getdnsapi.net TLSA Application ● _443._tcp.getdnsapi.net TLSA Authoritatives net NS net DS . Give applications a better handle on DNS, ie: net DNSKEY OS os _443._tcp.getdnsapi.net TLSA DNSSEC Aware net DNSKEY resource Recursive records other then A and AAAA, net getdnsapi.net NS getdnsapi.net DS Resolver – Get – Asynchronous signalling! – Get DNSSEC status for DANE , but also getdnsapi ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ••From FromXavier's Xavier'spresentation: presentation: ••64% 64%provide provideDNSSEC DNSSECfor forexisting existingthings things DNSSEC for Denial ● • Many features don'tproof need interface •56% 56%provide provide DNSSEC proof forapplication DenialofofExistance Existance ••40% provide DNSSEC for wildcards 40% provide DNSSEC for wildcards open, TCP Fast Open – TCP Pipelining, Keep connections ••draftietfdnsopdnssecroadblockavoidance draftietfdnsopdnssecroadblockavoidance – DNS over TLS • •Minimal passive implementation: Minimal passive implementation:on onBOGUS, BOGUS,retry retrywith withfull fullrecursion recursion – DNSSEC iteration as STUB – Since version 0.5.1, Roadblock Avoidance Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 9/22 Genesis Authoritatives _443._tcp.getdnsapi.net TLSA net NS net DS ● . Give applications a better handle on DNS, ie: Application OS os net DNSKEY _443._tcp.getdnsapi.net TLSA records – Get resource Recursive net Resolver other then A and AAAA, – Asynchronous signalling! – Get DNSSEC status for DANE , but also getdnsapi ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA net DNSKEY getdnsapi.net NS getdnsapi.net DS getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ✓ ••From FromXavier's Xavier'spresentation: presentation: ••64% 64%provide provideDNSSEC DNSSECfor forexisting existingthings things DNSSEC for Denial ● • Many features don'tproof need interface •56% 56%provide provide DNSSEC proof forapplication DenialofofExistance Existance ••40% provide DNSSEC for wildcards 40% provide DNSSEC for wildcards open, TCP Fast Open – TCP Pipelining, Keep connections ••draftietfdnsopdnssecroadblockavoidance draftietfdnsopdnssecroadblockavoidance – DNS over TLS • •Minimal passive implementation: Minimal passive implementation:on onBOGUS, BOGUS,retry retrywith withfull fullrecursion recursion – DNSSEC iteration as STUB – Since version 0.5.1, Roadblock Avoidance Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 10/22 Genesis ••https://www.us-cert.gov/ncas/alerts/TA15-240A Authoritatives https://www.us-cert.gov/ncas/alerts/TA15-240A _443._tcp.getdnsapi.net TLSA net NS net DS ● . Give applications a better handle on DNS, ie: Application OS os net DNSKEY _443._tcp.getdnsapi.net TLSA records – Get resource Recursive net Resolver other then A and AAAA, – Asynchronous signalling! – Get DNSSEC status for DANE , but also getdnsapi ✓ getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA net DNSKEY getdnsapi.net NS getdnsapi.net DS getdnsapi.net DNSKEY _443._tcp.getdnsapi.net TLSA ✓ ••From Configure enterprise presentation: Configure enterpriseperimeter perimeternetwork networkdevices devicestotoblock blockall all FromXavier's Xavier's presentation: outbound User Protocol (UDP) Transmission ••64% provide DNSSEC for things outbound UserDatagram Datagram Protocol (UDP)and and TransmissionControl Control 64% provide DNSSEC forexisting existing things Protocol (TCP) totodestination port 53, except specific, authorized provide DNSSEC proof for Denial of Existance ● • Protocol (TCP)traffic traffic destination port 53, exceptfrom from specific, authorized Many features don't need application interface •56% 56% provide DNSSEC proof for Denial of Existance DNS both and ••40% DNSservers servers(including (including bothauthoritative authoritative andcaching/forwarding caching/forwardingname name provide DNSSEC for wildcards 40% provide DNSSEC for wildcards servers). – TCP Pipelining, Keep connections open, TCP Fast Open servers). ••draftietfdnsopdnssecroadblockavoidance draftietfdnsopdnssecroadblockavoidance – DNS over TLS • •Minimal passive implementation: Minimal passive implementation:on onBOGUS, BOGUS,retry retrywith withfull fullrecursion recursion – DNSSEC iteration as STUB – Since version 0.5.1, Roadblock Avoidance Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 11/22 Genesis ● ● ● Many features don't need application interface Linux and Unix systems provide a default DNS resolver library – Applications perform name resolution via getaddrinfo(), getnameinfo(), etc. Current library implementations do not support DNSSEC nor other modern DNS capabilities Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 12/22 Enhanced system wide lookup using getdns A summer student project executed at LABS, by Theogene H. Bucuti, University of North Texas Supervised by: Gowri Visweswaran and Allison Mankin Explore the ways to provide an alternative for the system's stub resolver, adding modern DNS capabilities such as security and privacy, and compare the usability, possibilities and impossibilities of the different options. Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 13/22 Enhanced system wide lookup using getdns ● libnss_getdns – Open Source module that provides DNSSEC validation for legacy systems through the Linux/Unix name resolution framework (nsswitch) using the getdns library ● https://github.com/getdnsapi/libnss_getdns ● Works for: ● ● Firefox, Opera, Links2, Epiphany, lynx, curl, wget, ssh, ping, telnet, etc. Does not work for Google Chrome & Chromium Also LD_PRELOAD based version. Not recommended Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 14/22 libnss_getdns Configuration ● In /etc/nsswitch.conf replace dns with getdns # /etc/nsswitch.conf # /etc/nsswitch.conf # # # Example configuration of GNU Name Service Switch functionality. # Example configuration of GNU Name Service Switch functionality. hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 networks: files networks: files Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 15/22 libnss_getdns Configuration ● In /etc/nsswitch.conf replace dns with getdns # /etc/nsswitch.conf # /etc/nsswitch.conf # # # Example configuration of GNU Name Service Switch functionality. # Example configuration of GNU Name Service Switch functionality. hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 networks: files networks: files ● Issue: Many of the modern DNS capabilities have state: – State full transports (TCP & TLS) – The cache with full recursion – Upstream capability tagging etc. all contained in a getdns_context Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 16/22 libnss_getdns Configuration ● In /etc/nsswitch.conf replace dns with getdns # /etc/nsswitch.conf # /etc/nsswitch.conf # # # Example configuration of GNU Name Service Switch functionality. # Example configuration of GNU Name Service Switch functionality. hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 networks: files networks: files ● ● Issue: Many of the modern DNS capabilities have state all contained in a getdns_context $ ./getdns_daemon Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 17/22 libnss_getdns Configuration ● In /etc/nsswitch.conf replace dns with getdns # /etc/nsswitch.conf # /etc/nsswitch.conf # # # Example configuration of GNU Name Service Switch functionality. # Example configuration of GNU Name Service Switch functionality. hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 hosts: files mdns4_minimal [NOTFOUND=return] getdns mdns4 networks: files networks: files ● ● ● Issue: Many of the modern DNS capabilities have state all contained in a getdns_context $ ./getdns_daemon configure disabledaemononlymode configure withoutcontextproxy configure withcontextproxy=dbus Not recommended Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 18/22 libnss_getdns Configuration ● User level config: ~/.getdns/preferences.conf ● Global level config: /etc/getdns.conf # /etc/getdns.conf # /etc/getdns.conf dnssec: roadblock_avoidance dnssec: roadblock_avoidance tls: prefer_tls tls: prefer_tls logging: critical logging: critical Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 19/22 libnss_getdns In path signalling Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 20/22 libnss_getdns In path signalling ● ● Better approach: Desktop notifications Offer to add negative trust anchor Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 21/22 Summary ● ● ● ● ● DNSSEC-capable alternative to the system’s stub resolver Seamlessly enforce secure and private name resolution Avoid DNSSEC roadblocks Customisable at system and user level DNSSEC failure signalling (http only) Warning! Warning! An Anexploring exploringstudy. study. Code Codeisisaacollection collectionofofmany manydifferent differenttry tryouts. outs. Use Usefor forexperimentation experimentationonly. only. Do Donot notuse useininproduction! production! roadblock_avoidance roadblock_avoidanceextension extensionneeds needsmuch muchmore morework worktoo too github repo https://github.com/getdnsapi/libnss_getdns me Willem Toorop <[email protected]> Willem Toorop (NLnet Labs) DNSSEC for legacy applications – RIPE71 22/22
© Copyright 2024 ExpyDoc
