1543811 - EDNS Padding support for encrypted DNS transports

Status: RESOLVED FIXED

(Core :: Networking: DNS, enhancement, P3)

Description

[nusenu]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0

Steps to reproduce:

Firefox supports DoH and there is an enhancement request for DoT.
https://bugzilla.mozilla.org/show_bug.cgi?id=1434852
https://bugzilla.mozilla.org/show_bug.cgi?id=1348406

With the availability of encrypted DNS transports in firefox traffic analysis mitigations like padding are becoming relevant.

This enhancement request is about adding support for EDNS padding support to firefox.

related RFCs:

https://tools.ietf.org/html/rfc8310#section-11.1
https://tools.ietf.org/html/rfc7830
https://tools.ietf.org/html/rfc8467

Comment 1

[Junior [inactive]]

Is this a duplication of bug 1542754, nusenu?

Comment 2

[nusenu]

You linked to bug 1542754 which is about supporting ESNI without requiring DoH, I don't see any overlap there.

Comment 3

[nusenu]

one more note:

padding could also happen on the HTTP/2 layer as mentioned in
https://tools.ietf.org/html/rfc8484#section-4.1
https://tools.ietf.org/html/rfc7540#section-10.7

Comment 4

[Georgios Kontaxis]

I don't think that either RFC 8484 or RFC 7540 define the specifics of the proposed padding.

Moreover, if the goal is to find a good balance between privacy and performance (i.e., don't pad the link to capacity) then the padding should probably be tailored to the respective application, i.e., DNS.

RFC 8467 (mentioned in the description of this bug) seems to describe a specific and reasonable padding strategy.
Specifically section 4.1 "Block-Level Padding" produces query sizes that are multiples of 128 bytes.
Response sizes are multiples of 468 bytes.

Someone could for instance study the DNS queries and responses generated when visiting the top 1,000 websites according to Cisco Umbrella (http://s3-us-west-1.amazonaws.com/umbrella-static/index.html) and get an idea of out how much the data overhead would be.

Comment 6

[Manuel Bucher [:manuel]]

Attachment: Bug 1543811 - EDNS Padding support for encrypted DNS transports r=#necko

Comment 7

[Manuel Bucher [:manuel]]

Attachment: Bug 1543811 - Add test cases for EncodeRequest with padding r=#necko

Depends on D126480

Comment 8

[Manuel Bucher [:manuel]]

Attachment: Bug 1543811 - Add integration test case for trr requests with padding r=#necko

Depends on D126953

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5b0d115a9b6e
EDNS Padding support for encrypted DNS transports r=necko-reviewers,valentin
https://hg.mozilla.org/integration/autoland/rev/cfdd0fddbce9
Add test cases for EncodeRequest with padding r=necko-reviewers,valentin
https://hg.mozilla.org/integration/autoland/rev/6ee09543a37f
Add integration test case for trr requests with padding r=necko-reviewers,valentin

Comment 11

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/5b0d115a9b6e
https://hg.mozilla.org/mozilla-central/rev/cfdd0fddbce9
https://hg.mozilla.org/mozilla-central/rev/6ee09543a37f