{"id":95716,"date":"2020-10-02T01:42:50","date_gmt":"2020-10-01T23:42:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp"},"modified":"2020-10-02T01:42:50","modified_gmt":"2020-10-01T23:42:50","slug":"inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","title":{"rendered":"Iniciativa DNS flag day 2020 pro \u0159e\u0161en\u00ed probl\u00e9m\u016f s fragmentac\u00ed a podporou TCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dnes se n\u011bkolik v\u00fdznamn\u00fdch DNS slu\u017eeb a v\u00fdrobc\u016f DNS server\u016f z\u00fa\u010dastn\u00ed spole\u010dn\u00e9ho podniku DNS flag day 2020<\/a><\/noindex>, jeho\u017e c\u00edlem je zam\u011b\u0159it pozornost na \u0159e\u0161en\u00ed<\/a><\/noindex> probl\u00e9mech<\/a><\/noindex> s fragmentac\u00ed IP p\u0159i zpracov\u00e1n\u00ed velk\u00fdch DNS zpr\u00e1v. To je druh\u00e1 podobn\u00e1 ud\u00e1lost, loni «DNS flag day» zam\u011b\u0159en<\/a><\/noindex> na spr\u00e1vn\u00e9 zpracov\u00e1n\u00ed EDNS dotaz\u016f. <\/p>\n

\u00da\u010dastn\u00edci iniciativy DNS flag day 2020 vyz\u00fdvaj\u00ed k uzam\u010den\u00ed doporu\u010den\u00fdch velikost\u00ed buffer\u016f pro EDNS na \u00farove\u0148 1232 byt\u016f (velikost MTU 1280 minus 48 byt\u016f pro hlavi\u010dky), a tak\u00e9 p\u0159e\u0159adit<\/a><\/noindex> zpracov\u00e1n\u00ed dotaz\u016f p\u0159es TCP mezi nezbytn\u011b podporovan\u00e9 na serverech. V RFC 1035<\/a><\/noindex> je povinn\u011b ozna\u010dena pouze podpora zpracov\u00e1n\u00ed dotaz\u016f p\u0159es UDP, zat\u00edmco TCP je uvedeno jako \u017e\u00e1douc\u00ed, ale nikoli nezbytn\u00e9 pro fungov\u00e1n\u00ed. Nov\u00e9 RFC 7766<\/a><\/noindex> a RFC 5966<\/a><\/noindex> jasn\u011b \u0159ad\u00ed TCP mezi nezbytn\u00e9 funkce pot\u0159ebn\u00e9 pro spr\u00e1vn\u00e9 fungov\u00e1n\u00ed DNS. V r\u00e1mci prob\u00edhaj\u00edc\u00ed iniciativy se navrhuje urychlit p\u0159echod od odes\u00edl\u00e1n\u00ed dotaz\u016f p\u0159es UDP k pou\u017e\u00edv\u00e1n\u00ed TCP v p\u0159\u00edpadech, kdy je doporu\u010den\u00e1 velikost bufferu EDNS nedostate\u010dn\u00e1.<\/p>\n

Navrhovan\u00e9 zm\u011bny odstran\u00ed zmatek p\u0159i v\u00fdb\u011bru velikosti bufferu EDNS a vy\u0159e\u0161\u00ed probl\u00e9m s fragmentac\u00ed velk\u00fdch UDP zpr\u00e1v, jejich\u017e zpracov\u00e1n\u00ed \u010dasto vede ke ztr\u00e1t\u011b paket\u016f a timeout\u016fm na stran\u011b klienta. Na stran\u011b klienta bude velikost bufferu EDNS konstantn\u00ed a velk\u00e9 odpov\u011bdi budou okam\u017eit\u011b odesl\u00e1ny klientovi p\u0159es TCP. Vylou\u010den\u00ed odes\u00edl\u00e1n\u00ed velk\u00fdch zpr\u00e1v p\u0159es UDP tak\u00e9 vy\u0159e\u0161\u00ed probl\u00e9my s odpadem velk\u00fdch paket\u016f na n\u011bkter\u00fdch firewallech a umo\u017en\u00ed blokovat \u00fatok\u016fm<\/a><\/noindex> utoky na DNS cache, zalo\u017een\u00e9 na manipulaci s fragmentovan\u00fdmi UDP pakety (p\u0159i fragmentaci druh\u00fd fragment neobsahuje hlavi\u010dku s identifik\u00e1torem, a proto m\u016f\u017ee b\u00fdt fal\u0161ov\u00e1n tak, aby byla zn\u00e1ma pouze kontroln\u00ed suma).<\/p>\n

Od dne\u0161n\u00edho dne se \u00fa\u010dastn\u00edc\u00ed t\u00e9to iniciativy DNS, v\u010detn\u011b CloudFlare, Quad 9, Cisco (OpenDNS) a Google, postupn\u011b zm\u011bn\u00ed<\/a><\/noindex> velikost EDNS bufferu z 4096 na 1232 bajt\u016f na sv\u00fdch DNS serverech (zm\u011bna EDNS se bude rozprost\u00edrat na 4-6 t\u00fddn\u016f a s \u010dasem se bude t\u00fdkat st\u00e1le v\u011bt\u0161\u00edho po\u010dtu dotaz\u016f). Odpov\u011bdi na UDP dotazy, kter\u00e9 se nevejdou do nov\u00e9ho omezen\u00ed, budou zas\u00edl\u00e1ny p\u0159es TCP. V\u00fdrobci DNS server\u016f, v\u010detn\u011b BIND, Unbound, Knot, NSD a PowerDNS, vydaj\u00ed aktualizace se zm\u011bnou v\u00fdchoz\u00ed velikosti EDNS bufferu z 4096 na 1232 bajt\u016f. <\/p>\n

Nakonec mohou zav\u00e1d\u011bn\u00e9 zm\u011bny v\u00e9st k probl\u00e9m\u016fm s resolvov\u00e1n\u00edm p\u0159i dotazov\u00e1n\u00ed na DNS servery, jejich\u017e DNS odpov\u011bdi p\u0159esahuj\u00ed 1232 bajt\u016f p\u0159es UDP a kter\u00e9 nemohou poslat odpov\u011b\u010f p\u0159es TCP. Experiment proveden\u00fd spole\u010dnost\u00ed Google uk\u00e1zal, \u017ee zm\u011bna velikosti EDNS bufferu m\u00e1 prakticky nepatrn\u00fd vliv na \u00farove\u0148 selh\u00e1n\u00ed \u2014 p\u0159i velikosti bufferu 4096 bajt\u016f \u010din\u00ed po\u010det zkr\u00e1cen\u00fdch UDP dotaz\u016f 0,345 %, zat\u00edmco po\u010det nedostupn\u00fdch opakovan\u00fdch odpov\u011bd\u00ed p\u0159es TCP \u010din\u00ed 0,115 %. P\u0159i velikosti bufferu 1232 bajt\u016f jsou tyto hodnoty 0,367 % a 0,116 %. P\u0159evod podpory TCP na obligatorn\u00ed funkci DNS povede k probl\u00e9m\u016fm s p\u0159ibli\u017en\u011b 0,1 % DNS server\u016f. Je pozorov\u00e1no, \u017ee v sou\u010dasn\u00fdch podm\u00ednk\u00e1ch je bez TCP provoz t\u011bchto server\u016f ji\u017e tak nestabiln\u00ed.<\/p>\n

Spr\u00e1vci autoritativn\u00edch (authoritative) DNS server\u016f by m\u011bli zajistit, aby jejich server odpov\u00eddal p\u0159es TCP na s\u00ed\u0165ov\u00e9m portu 53 a tento TCP port nebyl blokov\u00e1n firewallem. Autoritativn\u00ed DNS server tak\u00e9 nesm\u00ed pos\u00edlat UDP odpov\u011bdi, jejich\u017e velikost p\u0159esahuje
\npo\u017eadovan\u00e1 velikost EDNS bufferu. Na samotn\u00e9m serveru mus\u00ed b\u00fdt velikost EDNS bufferu nastavena na 1232 bajt\u016f. Na resolvery jsou kladeny p\u0159ibli\u017en\u011b stejn\u00e9 po\u017eadavky \u2014 povinn\u00e1 schopnost odpov\u011bd\u011bt p\u0159es TCP, povinn\u00e1 podpora opakovan\u00fdch dotaz\u016f p\u0159es TCP p\u0159i p\u0159ijet\u00ed zkr\u00e1cen\u00e9 odpov\u011bdi UDP a nastaven\u00ed EDNS bufferu na 1232 bajt\u016f.<\/p>\n

Za nastaven\u00ed velikosti EDNS bufferu v r\u016fzn\u00fdch DNS serverech odpov\u00eddaj\u00ed n\u00e1sleduj\u00edc\u00ed parametry:<\/p>\n

  • BIND\n

    options {
    \n edns-udp-size 1232;
    \n max-udp-size 1232;
    \n };<\/p>\n

  • Knot DNS\n

    max-udp-payload: 1232<\/p>\n

  • Knot Resolver\n

    net.bufsize(1232)<\/p>\n

  • PowerDNS Authoritative\n

    udp-truncation-threshold=1232<\/p>\n

  • PowerDNS Recursor\n

    edns-outgoing-bufsize=1232
    \n udp-truncation-threshold=1232<\/p>\n

  • Unbound\n

    edns-buffer-size: 1232<\/p>\n

  • NSD\n

    ipv4-edns-size: 1232
    \n ipv6-edns-size: 1232<\/p>\n

    <\/a><\/noindex><\/p>\n

    Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 IP-\u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 DNS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435, \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 «DNS flag day» \u0431\u044b\u043b \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d \u043d\u0430 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 EDNS. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b DNS flag day 2020 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u044e\u0442 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u043c\u0435\u0440\u044b \u0431\u0443\u0444\u0435\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95716","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Iniciativa DNS flag day 2020 k \u0159e\u0161en\u00ed probl\u00e9m\u016f s fragmentac\u00ed a podporou TCP | ProHoster","description":"Dnes prob\u011bhne spole\u010dn\u00e1 akce n\u011bkolika velk\u00fdch DNS slu\u017eeb a v\u00fdrobc\u016f DNS server\u016f DNS flag day 2020, kter\u00e1 m\u00e1 za c\u00edl zam\u011b\u0159it se na.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0430 DNS flag day 2020 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 TCP | ProHoster","og:description":"\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-01T23:42:50+00:00","article:modified_time":"2020-10-01T23:42:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95716","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:59:41","updated":"2022-10-02 16:18:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=95716"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95716\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=95716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=95716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=95716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}