Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
T
tails
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 967
    • Issues 967
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
  • Merge Requests 22
    • Merge Requests 22
  • CI / CD
    • CI / CD
    • Pipelines
    • Jobs
    • Schedules
  • Operations
    • Operations
    • Incidents
    • Environments
  • Analytics
    • Analytics
    • CI / CD
    • Repository
    • Value Stream
  • Members
    • Members
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • tails
  • tails
  • Issues
  • #6070

Closed
Open
Opened Jul 18, 2013 by import-from-Redmine@import-from-Redmine

Support arbitrary DNS queries

Originally created by Tails on #6070 (Redmine)

{{toc}}

Rationale

The Tor DNS resolver Tails is currently using lacks support for most types of DNS queries except "A". A better user experience would be provided if Tails was able to resolve any kind of DNS queries out of the box.

Implementation

Inserting ttdnsd into the DNS resolver loop is the obvious solution. ttdnsd listens for UDP DNS requests and forwards these via the Tor SOCKS proxy to an open recursive DNS resolver on the Internet.

But we cannot just replace pdnsd with ttdnsd as the latter, unlike the former, does no caching at all. The DNS resolution process could then be:

resolv.conf -> DNS forwarding+caching proxy -> ttdnsd -> Tor

Forwarding+caching DNS proxy candidates:

  • pdnsd: already installed on Tails
  • dnsmasq: very flexible DNS forwarder
  • unbound: "recursive-only" caching DNS server which can perform DNSSEC validation of results; the DNSSEC feature is appealing; its "forward zones" feature seems to allow plugging it into the proposed DNS resolution process: forwarding a zone called "." seems sufficient; see Haven SVN for examples that may not be working yet (as of June 2011, see tor-talk ML)

=> keeping our known-working pdnsd configuration seems to be the safe choice.

Work is being done on this topic in our feature/support_arbitrary_dns_queries Git branch.

Merged in devel, with everything but .onion / .exit being resolved using ttdnsd because of bug #3369 on Tor Project’s Trac. This bug was fixed in the Tor 0.2.2.x branch; let’s wait for this release to be stabilized; once we ship it, we can move to "try the Tor resolver first, fallback on ttdnsd if the former fails".

The feature/support_arbitrary_dns_queries Git branch implements the above described policy. Only thing missing is Tor 0.2.2.x.

Tor 0.2.2 is now the official Tor stable tree. Time to merge.

done in 0.8

Related issues

  • Related to #6158 (closed)
  • Blocks #7453 (closed)
Edited May 15, 2020 by import-from-Redmine
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
None
Milestone
None
Assign milestone
Time tracking
None
Due date
None
Reference: tails/tails#6070