{"id":395,"date":"2020-08-31T20:48:39","date_gmt":"2020-08-31T19:48:39","guid":{"rendered":"https:\/\/blog.thomarite.uk\/?p=395"},"modified":"2020-08-31T20:48:39","modified_gmt":"2020-08-31T19:48:39","slug":"sni-and-esni","status":"publish","type":"post","link":"https:\/\/blog.thomarite.uk\/index.php\/2020\/08\/31\/sni-and-esni\/","title":{"rendered":"SNI and ESNI"},"content":{"rendered":"\n

I am subscribed to this site<\/a> to get news about SSL\/TLS. I am not great at security so want to try to read things like this.<\/p>\n\n\n\n

This week there was an article<\/a> about GFC blocking encrypted SNI. Obviously I had to read about what was ESNI<\/a> via the Cloudflare link. <\/p>\n\n\n\n

From that article, I recognized the SANs from certificates (if you have to renew a certificate with SANs is more expensive, that’s how I learned it). They consider it a hack, not 100% sure why. I thought having encrypted DNS should be enough but I forgot that when you negotiate TLS, that is not encrypted so the SNI you are sending is seen. The picture below, clarified it to me:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

So for more details about ESNI, I had to read another entry<\/a>. So you need TLS 1.3, DNSSEC and DoT\/DoH to get the whole thing working. And not everybody support eSNI<\/a> (rfc3546). As far as I can see, my GC browser doesnt support it and only FF does.<\/p>\n\n\n\n

So if I want to get this working in my end I need to encrypt my DNS and use FF. Somehow, I have to be playing with this before because I noticed I had already installed stubby<\/a> for configuring DNS over TLS. But it wasn’t in use as my resolv.conf is updated every time my laptop wakes up. So I have to change it manually:<\/p>\n\n\n\n

cat \/etc\/resolv.conf\n# Generated by NetworkManager\n# Check stubby is running\n# $ sudo netstat -lnptu | grep stubby\n# you can test having wireshark and check tcp 853 to 1.1.1.1 and not seeing # any udp 53.\n# dig @127.0.0.0 www.google.com\nsearch mynet\nnameserver 127.0.0.1\n\n# netstat -lnptu | grep stubby\ntcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 478658\/stubby\ntcp6 0 0 ::1:53 :::* LISTEN 478658\/stubby\nudp 0 0 127.0.0.1:53 0.0.0.0:* 478658\/stubby\nudp6 0 0 ::1:53 :::* 478658\/stubby<\/pre>\n\n\n\n
After that change, I tried to test it but I couldnt see any traffic on tcp 853. The stubby service was running but something wasn’t ok.<\/p>\n\n\n\n
Aug 31 17:34:44 athens stubby[11294]: Could not schedule query: None of the configured upstreams could be used to send queries on the spe>\nAug 31 17:34:44 athens stubby[11294]: Could not schedule query: None of the configured upstreams could be used to send queries on the spe>\nAug 31 17:34:44 athens stubby[11294]: Could not schedule query: None of the configured upstreams could be used to send queries on the spe>\nAug 31 17:34:44 athens stubby[11294]: Could not schedule query: None of the configured upstreams could be used to send queries on the spe>\n<\/pre>\n\n\n\n
So I decided to check the config. My config is the default one so it is using some specific servers. I enabled Google and Cloudflare resolvers and restart stubby. After that, we have tcp 853!<\/p>\n\n\n\n
# vim \/etc\/stubby\/stubby.yml\n\n\n# tcpdump -i wlp2s0 tcp port 853\n...\n8:40:42.680280 IP 192.168.1.158.32850 > one.one.one.one.domain-s: Flags [S], seq 2282297719, win 64240, options [mss 1460,sackOK,TS val 1220711339 ecr 0,nop,wscale 7,tfo cookiereq,nop,nop], length 0\n18:40:42.683573 IP one.one.one.one.domain-s > 192.168.1.158.32850: Flags [S.], seq 4197575255, ack 2282297720, win 65535, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0\n18:40:42.926432 IP 192.168.1.158.39920 > one.one.one.one.domain-s: Flags [S], seq 3775203823, win 64240, options [mss 1460,sackOK,TS val 4179354929 ecr 0,nop,wscale 7,tfo cookiereq,nop,nop], length 0\n18:40:42.929220 IP one.one.one.one.domain-s > 192.168.1.158.39920: Flags [S.], seq 911192268, ack 3775203824, win 65535, options [mss 1460,nop,nop,sackOK,nop,wscale 10], length 0\n18:40:47.496031 IP 192.168.1.158.49154 > dns.google.domain-s: Flags [S], seq 4032010100, win 64240, options [mss 1460,sackOK,TS val 224906238 ecr 0,nop,wscale 7,tfo cookiereq,nop,nop], length 0\n18:40:47.499698 IP dns.google.domain-s > 192.168.1.158.49154: Flags [S.], seq 4016982215, ack 4032010101, win 60192, options [mss 1380,sackOK,TS val 1421566573 ecr 224906238,nop,wscale 8,tfo cookie b0b482362b412e4b,nop,nop], length 0\n18:40:47.499728 IP 192.168.1.158.49154 > dns.google.domain-s: Flags [.], ack 1, win 502, options [nop,nop,TS val 224906242 ecr 1421566573], length 0\n18:40:47.499886 IP 192.168.1.158.49154 > dns.google.domain-s: Flags [P.], seq 1:261, ack 1, win 502, options [nop,nop,TS val 224906242 ecr 1421566573], length 260\n18:40:47.503025 IP dns.google.domain-s > 192.168.1.158.49154: Flags [.], ack 261, win 240, options [nop,nop,TS val 1421566577 ecr 224906242], length 0\n18:40:47.514228 IP dns.google.domain-s > 192.168.1.158.49154: Flags [P.], seq 1:3174, ack 261, win 240, options [nop,nop,TS val 1421566585 ecr 224906242], length 3173\n18:40:47.514283 IP 192.168.1.158.49154 > dns.google.domain-s: Flags [.], ack 3174, win 480, options [nop,nop,TS val 224906256 ecr 1421566585], length 0<\/pre>\n\n\n\n
What it looks very clear, it is very verbose. I have “suspender” enabled in GC so there are not may tabs in the background doing things… In my former employer. The firewalls stats showed that DNS was the protocol most used in our corporate network…<\/p>\n\n\n\n
So once I have DNSSEC enabled, let’s run the eSNI test<\/a>.<\/p>\n\n\n\n
This is from GC:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
So good thing DNSSEC and TLS1.3 are fine. Expected that eSNI is failing.<\/p>\n\n\n\n
For FF, eSNI is not enabled by default, and took me a bit to find a blog that showed the correct steps to configure it. This is the winner<\/a>. I need two changes in my about.config and restart FF. And this is the result for the same test page:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
So it is nice to have the whole setup working with FF. It would be great if GC had eSNI support. But still this has to be supported by the destination web server.<\/p>\n","protected":false},"excerpt":{"rendered":"
I am subscribed to this site to get news about SSL\/TLS. I am not great at security so want to try to read things like this. This week there was an article about GFC blocking encrypted SNI. Obviously I had to read about what was ESNI via the Cloudflare link. From that article, I recognized … Continue reading “SNI and ESNI”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-395","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts\/395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/comments?post=395"}],"version-history":[{"count":1,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts\/395\/revisions"}],"predecessor-version":[{"id":399,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/posts\/395\/revisions\/399"}],"wp:attachment":[{"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/media?parent=395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/categories?post=395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.thomarite.uk\/index.php\/wp-json\/wp\/v2\/tags?post=395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}