Preventing a network protocol over an encrypted channel, and applications thereof
In an embodiment, a computer-implemented method prevents use of a network protocol over an encrypted channel. In the method, a packet is received on an encrypted channel addressed to a network address. It is determined whether a network host at the network address is able to service a request formatted according to the network protocol over the encrypted channel. When the network host is determined to be able to resolve to a domain name over the encrypted channel, the network packet is blocked.
1. A computer-implemented method for preventing domain name service (DNS) over Hypertext Transfer Protocol Secure (HTTPS), comprising:
(a) receiving an HTTPS network packet addressed to a network address;
(b) determining whether a network host at the network address is able to resolve a DNS request over HTTPS by testing using a DNS query-response to the network host at the network address or by determining that the network address is known to resolve the DNS request over HTTPS by prior testing using a DNS query-response to the network host at the network address; and
(c) when the network host is determined to be able to resolve the DNS request over HTTPS, blocking the HTTPS network packet.
2. The method of claim 1 , wherein the testing using a DNS query-response comprises:
obfuscating a source of a DNS query.
3. The method of claim 2 , wherein the testing is executed by a firewall between a private network and the network host, and wherein the obfuscating comprises:
generating the DNS query such that the DNS query uses a source address from within the private network, the source address not identifying the firewall.
4. The method of claim 3 , wherein the obfuscating comprises:
generating the DNS query such that the DNS query uses the HTTPS network packet's source address and source port number.
5. The method of claim 3 , wherein the DNS query requests an IP address for a domain name, the obfuscating comprising:
varying selection of the respective domain name for the DNS query.
6. The method of claim 1 , wherein steps (a)-(c) are executed by a network firewall between a private network that originated the HTTPS network packet and the network host.
7. The method of claim 1 , wherein the determining (b) occurs in response to receipt of the HTTPS network packet, and wherein the determining further comprises:
determining whether a valid entry for the network address exists in a table, the valid entry indicating whether the network host resolves the DNS request over HTTPS;
when the valid entry exists in the table, (ii) checking the entry in the table;
when the valid entry does not exist in the table, (iii) performing the testing to determine whether the network host at the network address supports DNS over HTTPS;
(iv) entering the results of the test to create the valid entry in the table.
8. The method of claim 7 , wherein the determining (b) further comprises (v) while steps (i) and (ii) or (iii) occur, preventing the HTTPS network packet from reaching the network host, and wherein the method further comprises:
(d) when the network host is determined not to resolve to a domain name over HTTPS, forwarding the HTTPS network packet onward toward the network host.
9. The method of claim 7 , wherein the valid entry becomes invalid after a particular period of time has transpired.
10. The method of claim 9 , wherein the particular period of time is the same regardless of whether the entry indicates that the network host can resolve the DNS request over HTTPS.
11. The method of claim 10 , further comprising when the particular period of time has elapsed since a previous test, retesting to determine whether the network host at the network address supports DNS over HTTPS.
12. The method of claim 7 , wherein steps (a)-(c) are executed by one of a plurality of network firewalls between a private network that originated the HTTPS network packet and the network host, each of the plurality of network firewalls using a corresponding table to block traffic destined to addresses listed on the corresponding table, the determining (b) further comprising:
(v) sharing the created, valid entry among the plurality of network firewalls to synchronize the corresponding tables.
13. A non-transitory computer-readable device having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations to prevent domain name service (DNS) over Hypertext Transfer Protocol Secure (HTTPS), the operations comprising:
(a) receiving an HTTPS network packet addressed to a network address;
(b) determining whether a network host at the network address is able to resolve a DNS request over HTTPS by testing using a DNS query-response to the network host at the network address or by determining that the network address is known to resolve the DNS request over HTTPS by prior testing using a DNS query-response to the network host at the network address; and
(c) when the network host is determined to be able to resolve to the DNS request over HTTPS, blocking the HTTPS network packet.
14. The non-transitory computer-readable device of claim 13 , wherein the determining (b) occurs in response to receipt of the HTTPS network packet and wherein the determining further comprises:
determining whether a valid entry for the network address exists in a table, the valid entry indicating whether the network host resolves a domain name over HTTPS;
when the valid entry exists in the table, (ii) checking the entry in the table; and
when the valid entry does not exist in the table:
(iii) performing the testing to determine whether the network host at the network address supports DNS over HTTPS; and
(iv) entering the results of the test to create the valid entry in the table.
15. The non-transitory computer-readable device of claim 14 , wherein the determining (b) further comprises (v) while steps (i) and (ii) or (iii) occur, preventing the HTTPS network packet from reaching the network host, and wherein the method further comprises:
(d) when the network host is determined not to resolve to a domain name over HTTPS, forwarding the HTTPS network packet onward toward the network host.
16. The non-transitory computer-readable device of claim 15 , wherein the valid entry becomes invalid after a particular period of time has transpired.
17. The non-transitory computer-readable device of claim 15 , wherein steps (a)-(c) are executed by one of a plurality of network firewalls between a private network that originated the HTTPS network packet and the network host, each of the plurality of network firewalls using a corresponding table to block traffic destined to addresses listed on the corresponding table, the determining (b) further comprising:
(v) sharing the created, valid entry among the plurality of network firewalls to synchronize the corresponding tables.
18. A system for preventing domain name service (DNS) over Hypertext Transfer Protocol Secure (HTTPS), comprising:
a non-transitory memory;
a processor, coupled to the memory, the processor configured to execute:
a packet analyzer that receives an HTTPS network packet addressed to a network address;
a DoH tester that determines whether a network host at the network address is able to resolve a DNS request over HTTPS by testing using a DNS query-response to the network host at the network address or by determining that the network address is known to resolve the DNS request over HTTPS by prior testing using a DNS query-response to the network host at the network address; and
a packet manager that, when the network host is determined to be able to resolve to a domain name over HTTPS, blocks the HTTPS network packet.