Okay, sorry for that.
So as an introduction to what the theme of this presentation is, I'm going to talk about
the Thuleumithos.
And so about 100 years ago, there was an American writer and he created this kind of world
that was dark and hidden and all around us all the time.
And in this universe, humans are not that the world is acting against us, but we were so
far beneath the creatures that inhabited it, that we were not even important to them.
And in his world, a common theme was that the more you learned about it, the closer to
madness you got.
And the human brain is just not capable of comprehending the true nature of the universe without
going utterly insane.
So the question that we faced with this idea, this fiction maybe of the universe, is, though
the crazy person know that they're crazy, right?
I think most crazy people probably think that everyone else is crazy, right?
So if you combine this with this idea of lovecraft where you kind of, the characters in
this story, learned about the world and often went crazy.
Now, this is just fiction.
I worked 25 years on the DNS.
The protocol is 40 years old and I'm fine, so this is just fiction.
All right, so let's get started here.
So what we're going to do in this presentation is I'm going to basically sprinkle a few
weird things from the DNS, but you may or may not know, but even if you do know about
the, maybe you haven't thought about it in quite this way.
So the first thing I'm going to talk about is serial numbers.
So in the DNS, we have an SOA, start of authority record.
Every zone has this, this is kind of what defines a zone and it has a little bit of information
that's useful.
One of these pieces of information, you can see it embolden that kind of first line
by itself, the serial number.
And this is what primaries and secondaries use to keep zones in sync.
So the primary will update this number, and the secondary will see that it's been changed
and then transfer an updated version of the zone, pretty basic stuff.
One would think, they were pretty basic stuff.
However, this number is in a 32 bit space.
So what do you do when you get to do more than that?
What you use normal unsigned integer math and you roll, right?
And so, but the question is, well, what happens when you get to the end?
So it turns out in engineering, there's a way to define these numbers that roll around.
And there's a kind of math that you use to compare numbers in this space.
And so you can look at this image and like, amadding you get to the end of your 32 bit space
and then you add one.
Well, then you go back to zero, pretty easy.
And so it turns out that in this case, what we end up with is zero is greater than
two to the 32nd minus one.
It makes sense if you think about it, it's not that weird.
But it also means that if you try to compare to any two numbers, this more or less makes sense.
But once you start adding other numbers and trying to sort them, for example, sometimes it works.
So for example, if we added another one and had one and two and so on, then those numbers would
sort pretty well.
But if we started adding a billion or another billion, then we end up with a set of numbers
where you can't put them in order because with the order that they come up with, depends
on where you start and which one you compare.
So you have a system of numbers where some comparisons are possible sometimes but not always.
So if that doesn't blow your mind enough, it gets even weirder because in the specifications
if you get exactly two to the 32nd minus one away, it's undefined which number is greater
or less than the other.
And they're not equal.
So you have a numerical system where every number has one other number that it's neither
greater than, more or less than, more equal to.
So anyway, that's serial numbers, something to think about on your train right home.
All right, next thing we're going to talk about, TTL records.
So if you're in the DNS derby room, you're probably very familiar with TTLs, it's not
that weird.
One thing that lurks me, that annoys me a lot about these records, is that the large amount
of redundancy in the system that these incurred.
So every resource record has a TTL.
But if you have, for example, one name, www.fostem.org, all of the address records for it
are in what we call a resource record set.
So they all have to have the same TTL and if there's different, there's rules for how
you're supposed to interpret that.
But what it means is that you're wasting 32 bits for every record when you really only
need one for the whole set.
That's the first thing.
The other thing is that because it wasn't 100% clear when the specification was defined,
whether it was signed or unsigned, although what a negative time to live would mean is a
bit strange and you might want to consider that.
What they eventually did was said, look, it's too hard.
We're just going to ignore that last bit.
Which basically means half of the TTL space is missing or unusable or undefined or I don't
know exactly, again, we're in kithulu realm, so who knows.
Now, it operationally, it's not normally a problem two to the 31st is 68 years, which
is probably long enough for keeping most records.
I did a little research about this last year, if you curious, we can talk about that.
Anyway, TTL's only a little bit weird, not as weird as serial number, so it's fine.
So sticking with the theme of wasting space.
In addition to TTL's, every resource record has something called class, which is a 16-bit
field, which is always one, so it's literally always one.
You're wasting tons of space in every query, and keep in mind that the DNS packet format
is designed to be compact and well organized, but it has this historical craft, and to
be fair, I say it's always one, sometimes it's not, sometimes it's two, which is the
lovely name chaos class, which I love.
So you can see an example here at the bottom of the kind of things that you can do with
the chaos class, and they're mostly used for asking the server about itself, so you can
some servers will tell you where it's located, or let's tell you what the name is, or
what version of software it's running, which may or may not be a security problem, depending
on your philosophies about these things.
Anyway, class is mostly a waste, and people have discussed trying to get rid of it, but
not had much success, because it's very, very hard to change things in such an old, and
the DNS itself, it kind of is like a living organism, it kind of resists change in a weird
way.
What's that?
Yeah, all right, next thing, text records, text records were in the very first DNS
RFCs, and they're very simple, we use them for a ton of things, because they're basically
an 8-bit clean way to send, to put random data in the DNS, so it's pretty cool, pretty
simple, however, it's not actually that simple as it could be, because it's not just
a blob of data or a blob of textual data, it's actually a list of strings, which are between
zero and 255 bytes long, each one has a length-specifier in the front, so this presents
problems to an application developer.
What do you do if you have 300 bytes you want to put into the DNS, so one way to do
it is to look at it semantically and break the data in the right way and so on, or what
a lot of applications do is they just go to, they get to the byte 255 and then create
a new string, but that breaking them up and putting them together is not defined anywhere
as far as I know, so it's an undefined operation and you're not exactly sure what you're
going to get when you do that.
Now, even though this weirdness causes problems, it actually does have advantages, so in
the DNS, for example, if I do a lookup of records and I talked about R sets before, normally
those will come back to you in an indeterminate order, so good resolvers will shuffle those,
so they'll appear randomly, and that has very useful properties, but in any case, the resource
record sets are sets, they're not actually ordered, so when you get them back, they kind
of appear in some random order.
This list of strings and a text record is a list of strings, it has an order, so you can see
on this slide, at the top, these are the kind of results you get when you query, when
you query, just separate text records, and you can see just based on these two queries,
they come in random orders, please don't speak these names out loud, I don't know what
will happen, so, and in the bottom, you can see a single text record with multiple values
and they come in a deterministic order, so we can bring order out of the chaos of text
records, at least, so you're just at a web browser and you want to check a text record
quickly, so you might go to, these are all of the web-based query lookup tools, if you say
lookup DNS record on duct.go, I just looked at them all, none of them handle text records
properly, they all do things in slightly different ways, I did find one tool which understood
that they were separate fields within a text record, but it treated them exactly the same
as if they were separate records, and there was no way to distinguish them, so I don't know
what people get your act together, if you're in here, yeah, you're doing it wrong,
there's no good answer, so, don't do that, I think there's someone giving an equivalent
presentation in a web room about HTML, so, all right, next thing we're going to talk
about here is status, so, like HP Lovecraft was kind of an elitist, he believed that some
people were better than there was, he thought that status was really important, so does
the DNS, and every DNS message has an op code, operation code, and almost always
that's query, zero, there's also notify, and for when the primary talks to a secondary
says something's changed, there's update for dynamic DNS, there's DNS-date for operations,
I don't really know what those are for, I don't really care, I query, which was absolutely
deleted, that was where you tried to look up, I think that's where you tried to look
up things based on the R data, so you'd say, like, give me all the web servers that
have, you know, a given IP address or whatever, and then we have status, which is not
defined, it just says get the server status, it has no information about what it contains,
or what it's going to work, so John Dickinson tried to get rid of it because no one knows
what it is, no one even knows what it is, so let's get rid of it, and he put together
an RFC, and it was met with fierce resistance within the DNS community, people were morally
opposed to this, I suspect that the RFC is working on them, that we don't really understand,
but I don't really know for sure, now I heard a report just last night that someone stopped
answering status queries and started ignoring them, and then they got a report from a
customer, who couldn't tell them what they were for, but just that they needed them,
so there you go, there you go, all right, true story, next thing is about escape sequences,
right, so DNS comes from a more elegant era where things were in text, asky text, everything
was simple, nowadays we live in a world with Unicode, which is complicated and constantly moving,
but even in the Asky world, you would sometimes want to put data that wasn't
seven bit printable, right, and so the way you can do that is you can use a little escape code,
so like this is Octal Code for 32, which gives you a space, right, or Octal Code for a dash, right,
now the DNS also has a similar way to represent non-asky data in an Asky way,
it's a very similar except different, so you can see here that we use the exact same codes
and we get different results, so this is just using dynamic DNS to add these records and then
we just use dig to query them so we can show what we get, and the reason is that these codes
while they look Octal are actually decimal because, because I don't know why, it seems like a
good idea at the time, or again maybe mysterious forces were working on them, all right,
so the next one I decided I should actually do some research for this presentation, and I looked
at our name, so going back to our SOA record, every zone has what's supposed to be an email address
up here at the top, so you can see if you look up the phosdom one, hostmaster.phosdom.org,
like what does that mean? Well, I think it's on the next slide, yeah, no it's not on the next one,
but basically what you're supposed to do is replace the first dot with an add, and then it's an email
address, now of course you may ask yourself what happens if I have a dot in my email address,
like well then you're supposed to escape it of course, that's basically the answer,
now as far as I know this never works, like maybe phosdom, if you email this, we'll get
an answer back in a few days, but I think very few places actually monitor that email addresses
you used in these, it's more of a historical thing. Oh, well there we go, there we go.
Me too, but I actually don't get any email about it, I don't know, I figure there's
stammers have tried it, but it doesn't work, I don't know, maybe actually maybe I get tons of
email that it all ends up in my field. Yeah, yeah, so they look different from the normal format
because of this conversion of dots and escaping and things like that. So I thought like I know
because we run a name server and I've been working on the dance, that there's a lot of weird
names in there, so I just like let's just do a very simple test. The sweetest government
lets you download, or the sweetest registry lets you download all of the content, it's creative
comments license for .se and you, which is handy. So you can just download it, get all of the zones
that get all of the domain delegations there, and then do an SOA look up and see what you get.
Now, in my measurements, only 0.5% have strange our name, so I was actually really impressed.
I doubt most of the more. So anyway, let's what kind of stuff do you see in there?
Well, obviously if I try to try to send an email to hostmaster.it's not going to go anywhere.
So we have a lot of bare emails. We have things like this, which are of course TTLs, I guess.
We have this, which is probably a serial number, I don't know. This looks like some sort of old IP address.
They used to use these quite a decimal IP addresses. And then we have a lot of just emails
that are badly formed, like with at symbols that are encoded in there, things like that.
And my favorite, which is please set email.absolutely.knower.
Actually, I didn't try to send mail and maybe it works, I don't know.
All right, so that's our our name. So DNS is very old and I've just shown you a few strange things
that are in there. But I wanted to make sure that everyone kept in mind that the DNS isn't limited
to the DNS standards, right? So this is a dice graph that I found that a Japanese, I don't know if
these are researcher or something like that. But anyway, he tried to put together a nice graph
of all of the, all of the RFCs and how they fit together and everything like that.
Just for DNS. Yeah. Yeah. Yeah. So there's a lot. And a lot of them don't mean anything anymore,
a lot of them do, but not exactly how it looks. And so there's, but in addition to all of this,
which there will be a test on at the end of the week, there's a lot of features which aren't
defined in any of these. And I have the next slide we'll talk a little bit about those. There's
also things that aren't as far as I know not written down anywhere that you kind of just have to
learn by writing DNS software. Simple example of this is for example, when you get a, when you get a
UDP packet, which is the most common way you get a query in DNS, you then send the reply back
to where it came from. Well, if the query came from port 0, most unixes won't let you reply to it,
because that's not how it works. So you just have, so what you end up seeing is all of a sudden
you'll start getting spam in your error logs because you're getting errors trying to send a packet.
And then you have to say, oh, there's nothing, I'm not doing anything wrong, the internet is wrong.
And so I think these are coming from embedded devices or maybe people like putting their
packets together directly and using like direct raw, raw, IO or something, I don't know.
But these are the kind of things that you just have to learn by doing it. There's not,
as far as I know, there's not a manual, so good luck. So here's a few things that are in the DNS
expanded universe. The first thing is bind views, which are so old that many, many people think
that they're part of the DNS, but they're not. It's just something that someone thought of
sometime. And the idea is that you give different answers to the people in the office and the people
outside the office so that only your coworker can see your printer, basically. And then there's also
something called response policy zones. So it's kind of a cool idea, so like because we like DNS,
because we're DNS people, we put everything in the DNS, including data about which answers
to block and things like that. So response policy zones are a way to basically stream over the DNS
updates about which zones to block and how. And people actually sell feeds with this with like
bad people. And of course some governments say you must apply our block list and things like that.
And there's RL. Someone was talking earlier about reflection and amplification attacks.
This is basically that you spoof your source address, send a UDP query to a server, and then it
goes to the target, which is the address that you gave it. And that can both hide you and amplify the damage
you call. Because the responses are bigger than the questions. So that's, this is a technique
for dealing with that, which basically keeps track of the answers that you're sending. And if you keep
sending the same answer to the same address, something's wrong because they're not cashing it or whatever.
And so you just drop some of them on the floor. So it works pretty well, but not standardized,
very, very widely deployed. And then the final thing on this slide, there's many, many, many, many more.
So that the final one this slide is just DNS tap, which I think was mentioned earlier, I can't
remember. It's just an efficient way to log queries and answers. So there's tons of stuff in this
expanded universe. And that is all I have. I have a couple of reference slides. I don't expect
you to read these, but they'll be in the slides that you can download. As far as I know, there's no AI
generated images in this presentation. And as far as I know, all of the links and references and
everything are available for personal use. If you want to use this in your company, you'll have to
talk to Castilia yourself. Anyway, that is it.