Subject: [Doh] DOH bypassing protection mechanisms

From: "Paul Hoffman" <[email-masked]>
Date: Sun, 05 Nov 2017 07:48:21 -0800

On 5 Nov 2017, at 0:30, Eliot Lear wrote:

>   * Use of DoH will bypass protection mechanisms commonly used to
>     efficiently detect and prevent access to known malware-infested
>     sites.  There are two mitigation mechanisms available, but one is
>     incomplete:  deployments make use of in-path blocking methods such
>     as IP access lists.  This is partial because there is a
>     performance/memory impact in doing so, and the query itself can
>     indicate that the device itself is infected.  The other mitigation
>     here is to have a configuration mechanism to turn on/off DoH in
>     order to use the existing infrastructure.  This has the least impact
>     on surrounding infrastructure (and takes the least text ;-).

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 5 Nov 2017 15:57:46 +0000

On 5 Nov 2017, at 7:48, tjw ietf wrote:

> in the case of detect and prevent access to known malware-infested
> sites, could;n't DoH deploy an RPZ like mechanism?
>

Yes. A DOH server is just like any DNS recursive resolver that a user might choose (such as from DHCP). It could use RPZ, it could offer anti-malware, it could be be malicious itself, ...

As to Eliot's main question: The policy to choose a DOH server is similar to the policy to choose a DNS resolver, it's just done in a different application. For the latter, the typical is "trust whatever DHCP tells you", but there are also commonly policies of "ignore DHCP, always use one of these". Both those policies could be mirrored in a browser for DOH.

--Paul Hoffman

---

From: Eliot Lear <[email-masked]>
Date: Sun, 5 Nov 2017 17:29:17 +0100

> As to Eliot's main question: The policy to choose a DOH server is similar to the policy to choose a DNS resolver, it's just done in a different application. For the latter, the typical is "trust wh…

That's the theory.  In reality, for the enterprise, you would be hard
pressed to find examples in which the enterprise itself doesn't control
where a query goes on a client (DHCP is not the only control function).

Eliot

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 5 Nov 2017 19:31:14 +0000

> where a query goes on a client (DHCP is not the only control function).

It sounds like the operational document might say something like "an enterprise that cares about which DNS resolver its users access needs to also make that policy in DOH-enabled web clients".

--Paul Hoffman

---

From: Adam Roach <[email-masked]>
Date: Sun, 5 Nov 2017 13:48:38 -0600

[as an individual]

> It sounds like the operational document might say something like "an enterprise that cares about which DNS resolver its users access needs to also make that policy in DOH-enabled web clients".

s/web clients/DNS clients/, right? I don't get the impression that the 
use cases are intended to be restricted to web browsers as clients.

/a

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 5 Nov 2017 19:58:44 +0000

On Nov 5, 2017, at 11:48 AM, Adam Roach <[email-masked]> wrote:
> s/web clients/DNS clients/, right?

Maybe?

> I don't get the impression that the use cases are intended to be restricted to web browsers as clients.

They are not restricted to web clients (I was careful not to say "browsers"), but I don't expect current DNS clients to add DOH capabilities any time in the near future. We have had approximately zero success in getting stub resolvers deployed with DNS-over-TLS (RFC 7858), and getting them to do that would be easier than DNS-encoded-in-HTTP-over-TLS. DNS clients are a use case listed in Section 3 of the draft, but not one that we've heard much interest in.

--Paul Hoffman

---

From: Eliot Lear <[email-masked]>
Date: Mon, 6 Nov 2017 06:12:12 +0100

> They are not restricted to web clients (I was careful not to say "browsers"), but I don't expect current DNS clients to add DOH capabilities any time in the near future. We have had approximately z…

Indeed.  That is why I suggested some practical approaches that do
consider browsers.

Eliot

---

From: Adam Roach <[email-masked]>
Date: Mon, 6 Nov 2017 00:16:39 -0600

> They are not restricted to web clients (I was careful not to say "browsers"), but I don't expect current DNS clients to add DOH capabilities any time in the near future. We have had approximately z…

Right. And if we're talking about text that we're planning to add to 
documents that will be published as RFCs, I think we'd want them to be 
valid for a pretty long period of time, rather than just for "the near 
future."

/a