discd

Overview

Discovery daemon (discd) is an implementation of the "Discovery Proxy for Multicast DNS-Based Service Discovery" specified as an internet draft of the IETF:

draft-ietf-dnssd-hybrid

It dynamically maps multicast DNS services into the unicast DNS name space. This allows remote service discovery requests to be answered when the querier is not on the same link local network as the service provider.

Traditionally, zero-conf networking (or Bonjour as Apple Computer calls it) only provides answers to queries on the local network. This works great for home and small offfice (SOHO) networks but frustrates corporate and campus users when a device they want to communicate with is on another IP subnet for network scaling reasons.

By dynamically mapping the ever changing multicast DNS (mDNS) services into the unicast DNS namespace, it's possible to remotely query services through a proxy.

discd is that proxy.

more ...

iPhone/iPad TLS DNS Proxy

As Sarah Dickinson recently mentioned at DNS-OARC 27 in San Jose, CA, https://indico.dns-oarc.net/event/27/session/4/contribution/20, there is a work in progress for a TLS DNS Proxy for the Apple iPhone/iPad running iOS 11 and above. This uses the new DNS Proxy Network Extension and, when enabled, all DNS requests will be sent to a resolver over TLS.

I expect this new DNS Network Extension to be available for macOS in a future release as well.

Check back here in a bit to see the status and sign up for beta testing.

UPDATE:

After receiving the following message on the Console, it appears that the only way to use the new DNS Proxy Network Extension in iOS 11 is through Mobile Device Management (MDM) Tools as a supervised device. This makes it impossible to install for the average user through the App Store.

Therefore, I am suspending this effort until this extension is more useful to a wider audience.

Oct  5 17:29:26 iPhone nehelper(NetworkExtension)[99] <Error>: -[NEHelperConfigurationManager:562  Warning: allowing creation/modification of a DNS proxy configuration on non-supervised device because the requesting app (DNS-TLS) is a development version. This will not be allowed for the production version of DNS-TLS

UPDATE 2:

An Apple representative confirmed this is currently only for supervised devices but he seems to indicate they are considering opening this up to all devices but with no assurances or timeline:

I’ve just confirmed that, as things currently stand, NEDNSProxyProvider is limited to supervised devices.  We have a bug on file (r. 34843801) requesting that this restriction be lifted.  I suspect that this will happen but, as per usual, I can’t make any specific promises about that, or about the timeline for this change.  It certainly wouldn’t hurt for each of you to file your own bug describing your use case, how this restriction is affecting you, and what workarounds you’ve resorted to.
more ...

IETFers iPhone/iPad app

The IETFers iPhone/iPad app I wrote and maintain for the worldwide Internet Engineering Task Force (IETF) meetings is available for download in the Apple App Store.

If you have bug reports or feature requests, use the Settings panel and send me your wishes!

IETFers

more ...

sdtest tool

Overview

  • sdtest is a client simulation tool for testing DNS subscriptions. It supports both the older Long Lived Queries (LLQ) and the new replacement DNS Push Notifications.

  • Since it is a work in progress, the best way to follow it is to look at the github sdtest project documentation that is being updated as the code is written.

https://github.com/pusateri/sdtest

more ...

DNS Delegating Server

Requirements of the delegating server

The hybrid proxy is an authoritative DNS server for one or more subdomains. Each of these subdomains MUST be delegated to the hybrid proxy by the parent zone.

Subdomains

Subdomains are delegated to another server by defining NS records in the delegating server. The following records create three subdomains and delegate those subdomains to the listed servers.

floor1.example.com. IN      NS      server1.example.com.
floor2.exmaple.com. IN      NS      server2.example.com.
floor3.example.com. IN      NS      server3.example.com.

Browse Records

Service Discovery clients will query known search domains to see if they are browseable for services. Initially, they will query for b.dns-sd.udp.example.com. If the domain is browseable, it will have PTR records for one or more browseable domains. This could include a PTR record for the domain and also for subdomains. For a client to search a hybrid proxy for discoverable services, PTR records for the subdomain of each IP subnet represented by the hybrid proxy must be listed in the delegating server.

b._dns-sd._udp IN      PTR     @                   ;apex is browseable
b._dns-sd._udp IN      PTR     floor1.example.com. ;delegated to discovery proxy
b._dns-sd._udp IN      PTR     floor2.example.com.
b._dns-sd._udp IN      PTR     floor3.example.com.

The client will then query each of the subdomains listed to see if they are browseable, for example, b.dns-sd.udp.floor1.example.com. The hybrid proxy should answer this query with its hostname.

more ...

discd Configuration

Lua style configuration

Most configuration can be provided in the delegating DNS server. discd queries this DNS server for subdomains and names to listen for. If you don't have full control over the delegating server, you can override or augment the configuration with a local config file.

There is a sample config file in $SYSCONFIDR/discd.lua. For Linux, this is /etc/discd.lua. For FreeBSD, it would be /usr/local/etc/discd.lua. Here, you can override the host and domain name as well as the subdomains for each interface. Some sample configuration is included below. While it might not be obvious, using a Lua language file for configuration provides a lot of flexibility for generating the variables to be read by the discd daemon.

hostname = 'foo.bar.com' -- only needed to override default
port = {
    -- defaults, not yet implemented
    udp = 53, tcp = 53, tls = 853, llq = 5352, push = 853
}
certificate = {
    -- looks for letsencrypt certs automatically in the default location by hostname
    crt = '/etc/letsenscrypt/live/foo.bar.com/cert.pem',
    key = '/etc/letsenscrypt/live/foo.bar.com/privkey.pem',
    chain = '/etc/letsenscrypt/live/foo.bar.com/fullchain.pem'
}
interfaces = {
    -- currently required if no reverse PTR net records
    { name = 'eth0', subdomain = 'sub1.bar.com' },
    { name = 'eth1', disable = true },
}

Disclaimer

LLQ and DNS Push Notifications are not fully implemented.

more ...

discd Install

To install on Ubuntu 14.04 LTS (Trusty Tahr), please add this repo and update. 64-bit only.

sudo apt-key adv --keyserver pgp.mit.edu --recv-keys F93418C56652E60C
sudo add-apt-repository 'deb [arch=amd64] http://dl.dnsdisco.com/ trusty main'
sudo apt-get update

To install on Ubuntu 16.04 LTS (Xenial Xerus), please add this repo and update. 64-bit only.

sudo apt-key adv --keyserver pgp.mit.edu --recv-keys F93418C56652E60C
sudo add-apt-repository 'deb [arch=amd64] http://dl.dnsdisco.com/ xenial main'
sudo apt-get update

The software can then be installed with the following commands:

sudo apt-get install discd
sudo apt-get install discli
sudo apt-get install discweb # (coming soon)
more ...


IETF 92 DNS Push Talk

In March of 2015, I gave a talk to the IETF DNS-SD Working Group in Dallas introducing DNS Push Notifications. This work was a joint effort between Stuart Cheshire and myself as a next generation follow on to LLQ.

Here are the slides:

IETF 92 DNS Push Slides

more ...