How to interpret Cloudflare's SVCB/HTTPS DNS record type?

user_436745 0
Viewed 1892

From a recent article of Cloudflare adding SVCB/HTTPS DNS records automatically, I'm trying to interpret what they're publishing in the DNS record.

The current draft for SVCB or HTTPS seems to be "draft-ietf-dnsop-svcb-https-01".

Using dig to get cloudflare blog's DNS record:

dig blog.cloudflare.com -t TYPE65

Answer to the query:

;; ANSWER SECTION:
blog.cloudflare.com.    300 IN  TYPE65  \# 76 000100000100150568332D32390568332D32380568332D3237026832 0004000868121A2E68121B2E00060020260647000000000000000000 68121A2E26064700000000000000000068121B2E

Returns a RFC3597 encoded format of the answer.

It would be nice to know what it says. What does it say?

dns https
3 Answers

The drill command supports HTTPS RR (type 65) in the latest git revision [1]. To use it, build ldns with --enable-rrtype-svcb-https. Here are example usages:

$ drill HTTPS blog.cloudflare.com | grep ^blog
blog.cloudflare.com.    300     IN      HTTPS   1 . alpn=h3-29,h3-28,h3-27,h2 ipv4hint=104.18.26.46,104.18.27.46 ipv6hint=2606:4700::6812:1a2e,2606:4700::6812:1b2e

$ drill HTTPS crypto.cloudflare.com | grep ^crypto
crypto.cloudflare.com.  237     IN      HTTPS   1 . alpn=h2 ipv4hint=162.159.135.79,162.159.136.79 echconfig=AEj+CgBEhwAgACA8RalVTTRgfQYqMSqwX4GiBa6kftXcUcQZIkqhwe0PLwAEAAEAAQAAABNjbG91ZGZsYXJlLWVzbmkuY29tAAA= ipv6hint=2606:4700:7::a29f:874f,2606:4700:7::a29f:884f

Update 2021/09/05: dig now also supports HTTPS records in the latest git revision [2]. Here are example usages:

$ dig HTTPS blog.cloudflare.com | grep ^blog    
blog.cloudflare.com.    242     IN      HTTPS   1 . alpn="h3,h3-29,h3-28,h3-27,h2" ipv4hint=104.18.26.46,104.18.27.46 ipv6hint=2606:4700::6812:1a2e,2606:4700::6812:1b2e

$ dig HTTPS crypto.cloudflare.com | grep ^crypto
crypto.cloudflare.com.  285     IN      HTTPS   1 . alpn="h2" ipv4hint=162.159.135.79,162.159.136.79 ech=AEb+DQBCmwAgACA5ysTCbPox2yTLTsrGuJ8QHfwHjqZLcNGTA7xAiBJNSQAEAAEAAQATY2xvdWRmbGFyZS1lc25pLmNvbQAA ipv6hint=2606:4700:7::a29f:874f,2606:4700:7::a29f:884f

[1] https://github.com/NLnetLabs/ldns/pull/115

[2] https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/2135

user_37862450

I managed to manually decode the first part of it:

\# 76 total length
0001 priority
00 full registered name, null, "."
0001 alpn key type
0015 alpn value length
05 alpn-id length
68332D3239 alpn-id: h3-29
05 alpn-id length
68332D3238 alpn-id: h3-28
05 alpn-id length
68332D3237 alpn-id: h3-27
02 alpn-id length
6832 alpn-id: h2

Maybe I'll work through the rest later, but interesting to see the h3-29, 28, and 27 ALPN types.

I also found that dnspython has support for the record type in master, and some other software does to according to this list: https://github.com/MikeBishop/dns-alt-svc/blob/master/svcb-implementations.md

user_4367450

Wireshark 3.4.0 seems to now have support for decoding HTTPS records if you can take a packet capture.

It shows me that Cloudflare are providing IPv4 and IPv6 hints as well as the ALPN information.

user_146551060
Related