From 53a18387b4d378fec3996d940b0084ad85dca688 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Asbj=C3=B8rn=20Sloth=20T=C3=B8nnesen?= Date: Sat, 19 Apr 2025 16:40:59 +0000 Subject: initial commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Asbjørn Sloth Tønnesen --- .gitignore | 3 + Makefile | 15 ++ README.md | 509 ++++++++++++++++++++++++++++++++++++++ gen_canned.sh | 122 +++++++++ static/0000-refuse-root.toml | 11 + static/0001-refuse-iis.se.toml | 11 + static/0002-refuse-icann.org.toml | 11 + static/0003-refuse-ripe.net.toml | 11 + static/0010-edns_version.toml | 16 ++ static/0100-soa-ede.dn5.dk.toml | 24 ++ static/0101-any-rfc8482.toml | 18 ++ static/0102-ns.toml | 18 ++ static/0103-txt.toml | 18 ++ static/0104-mx.toml | 19 ++ static/0110-a.toml | 18 ++ static/0111-aaaa.toml | 18 ++ static/0120-notice-a.toml | 18 ++ static/0121-notice-aaaa.toml | 18 ++ static/0130-ns-a.toml | 18 ++ static/0131-ns-aaaa.toml | 18 ++ static/9999-nxdomain.toml | 24 ++ templates/ede-addr-a.toml | 25 ++ templates/ede-addr-aaaa.toml | 25 ++ templates/ede-cname.toml | 37 +++ templates/ede-nx.toml | 19 ++ templates/nodata.toml | 24 ++ 26 files changed, 1068 insertions(+) create mode 100644 .gitignore create mode 100644 Makefile create mode 100644 README.md create mode 100755 gen_canned.sh create mode 100644 static/0000-refuse-root.toml create mode 100644 static/0001-refuse-iis.se.toml create mode 100644 static/0002-refuse-icann.org.toml create mode 100644 static/0003-refuse-ripe.net.toml create mode 100644 static/0010-edns_version.toml create mode 100644 static/0100-soa-ede.dn5.dk.toml create mode 100644 static/0101-any-rfc8482.toml create mode 100644 static/0102-ns.toml create mode 100644 static/0103-txt.toml create mode 100644 static/0104-mx.toml create mode 100644 static/0110-a.toml create mode 100644 static/0111-aaaa.toml create mode 100644 static/0120-notice-a.toml create mode 100644 static/0121-notice-aaaa.toml create mode 100644 static/0130-ns-a.toml create mode 100644 static/0131-ns-aaaa.toml create mode 100644 static/9999-nxdomain.toml create mode 100644 templates/ede-addr-a.toml create mode 100644 templates/ede-addr-aaaa.toml create mode 100644 templates/ede-cname.toml create mode 100644 templates/ede-nx.toml create mode 100644 templates/nodata.toml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e6214e2 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +/canned/ +/pub/ +*.sw? diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..b34c9ee --- /dev/null +++ b/Makefile @@ -0,0 +1,15 @@ +.PHONY: build publish all +all: build + +pub: + mkdir pub + +pub/index.html: README.md | pub + pandoc -s README.md -o pub/index.html + +build: pub/index.html + ./gen_canned.sh + +publish: + rsync -a --delete-after canned/ ede.dn5.dk:canned/ + rsync -a --delete-after pub/ ede.dn5.dk:pub/ diff --git a/README.md b/README.md new file mode 100644 index 0000000..1914c64 --- /dev/null +++ b/README.md @@ -0,0 +1,509 @@ +--- +title: RFC 8914 Extended DNS Errors testbed +--- + +This is a testbed, for testing propagation of [RFC8914 Extended DNS Errors][RFC8914] in the wild. + +``` +$ dig blocked.nx.ede.dn5.dk @1.1.1.1 + +; <<>> DiG 9.20.7-1-Debian <<>> blocked.nx.ede.dn5.dk @1.1.1.1 +;; global options: +cmd +;; Got answer: +;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28690 +;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 + +;; OPT PSEUDOSECTION: +; EDNS: version: 0, flags:; udp: 1232 +; EDE: 15 (Blocked): (🚧 Blocked 🚧) +;; QUESTION SECTION: +;blocked.nx.ede.dn5.dk. IN A + +;; Query time: 15 msec +;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP) +;; WHEN: Sat Apr 19 16:34:11 UTC 2025 +;; MSG SIZE rcvd: 73 +``` + +## What does `RFC 8914` say about propagation? + +In `RFC 8914` [section 3 - Extended DNS Error Processing][RFC8914sec3]: + +> [...] +> +> When a resolver or forwarder receives an EDE option, whether or not (and how) to pass along EDE information on to their original client is implementation dependent. Implementations MAY choose to not forward information, or they MAY choose to create a new EDE option(s) that conveys the information encoded in the received EDE. When doing so, the source of the error SHOULD be attributed in the EXTRA-TEXT field, since an EDNS0 option received by the original client will appear to have come from the resolver or forwarder sending it. +> +> [...] + +We probably need to write an update, at least changing it so that +forwarders SHOULD propagate EDE's. + +Currently there is no formal definition of `EXTRA-TEXT`, so in this +testbed `EXTRA-TEXT` is currently used for static Unicode messages for each error. + +## Adoption status + +### Adoption in DNSSEC + +The DNSSEC related EDE are probably the most widely deployed EDE's. +The EDE concept also originated from the needs of the DNSSEC working-group, +so it's not that surprising. + +### Use with DNS filtering + +While there are several EDE's defined for use with DNS filtering, +they are still lacking implementations, hence the need for this testbed. +In particular work is needed on integrating EDE's with [RPZ][Response Policy Zone], +and ensuring that DNS forwarders, like home routers, propagate EDE's to end-user applications. + +#### STOP pages + +Traditionally DNS filtering have often hijacked the filtered domain, +and sent visitors to a "STOP" page, served only over HTTP, sometimes +with a HTTP status code `451 Unavailable for legal reasons`. +As plain HTTP is being phased out, concepts like HSTS Preload and HTTPS-by-default and end-users following `https://` links, means that it is very +unlikely that end-users will actually see these STOP-pages. + +Adopting the DNS filtering-related EDE's and formalising `EXTRA-TEXT`, +could lead to end-user applications, like web-browsers, having more +user-friendly error-messages, than simply `Connection refused`. + +### Improvement projects + +Last updated: 2025-04-18 + +This is an incomplete list of improvement projects: + +* [Unbound: Add support for RPZ to reply with an EDE][unbound-1191] +* Ongoing, use [RIPE Atlas][] to map EDE propagation. (Initial findings: to be presented at RIPE90 DNS-WG) +* Find / file more bugs (TODO) + +#### Completed + +* [dnsdist: Add support for adding EDE codes with Lua][pdns-12572] (unfortunately, no support for `EXTRA-TEXT` yet) + +## Testbed + +This testbed was setup, to help with testing EDE propagation. + +### Query format + +The following queries are currently supported: + +- `