On Sun, Jun 17, 2007 at 05:40:05PM +0100, Robert Hogan wrote:
> On Sunday 17 June 2007 17:01:44 Nick Mathewson wrote:
> > On Sun, Jun 17, 2007 at 03:38:15PM +0100, Robert Hogan wrote:
> >[.]
> >
> > I've applied this patch too. Thanks!
> >
> > Two points to note:
> >
> > 1) These requests are made by a Tor server to check for DNS
> > hijacking. (Some jerk DNS providers like to helpfully remap all
> > NEXIST replies into advertising sites. Tor detects this, works
> > around it, and calls these providers mean names.)
> >
>
> Sure, but I think a log message stating the 'domains' being queried
> would help settle a few nerves. Bizarre-looking DNS queries are just
> the sort of thing Tor users might expect from a snooper.
No argument there. I was just explaining where those requests come
from.
>
> > 2) It isn't a good idea to have a Tor client be the DNS server for a
> > Tor server. I wonder what we can do to prevent this from
> > happening.
> >
> > peace,
>
> Do you mean that it is a bad idea to force a tor server's un-proxied dns
> requests through tor with all-encompassing netfilter rules such as
>
> iptables -t nat -I OUTPUT 1 -o ! lo -p udp -m udp --dport 53 -j
> DNAT --to-destination 127.0.0.1:9999 -m comment --comment "Redirect UDP DNS
> Requests to Tor" ?
>
> This does seem a bit stupid on the face of it, though I'm not clear whether
> it's actually dangerous or just wasteful.
Well, remember how it's _supposed_ to work. A client wants the answer
to a DNS request, so it sends an anonymized request to a server. The
server does a DNS lookup, and sends the reply back to the client.
But if the server's DNS lookup goes back into Tor (acting as a
client), then the request gets answered by _another_ server, which
tells the second Tor client, which tells the first server, which tells
the client.
The biggest problems here are:
- Latency doubles (or worse, if the second Tor server is also
configured like this.)
- If everybody does it, DNS on Tor will fail completely.
yrs,
--
Nick Mathewson
Attachment:
pgpJuPvq3CEkW.pgp
Description: PGP signature