{"id":95716,"date":"2020-10-02T01:42:50","date_gmt":"2020-10-01T23:42:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp"},"modified":"2020-10-02T01:42:50","modified_gmt":"2020-10-01T23:42:50","slug":"inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","title":{"rendered":"DNS flag day 2020-initiativet til l\u00f8sning af problemer med fragmentering og st\u00f8tte til TCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I dag holder en r\u00e6kke store DNS-tjenester og producenter af DNS-servere et f\u00e6lles arrangement DNS flag day 2020<\/a><\/noindex>, der har til form\u00e5l at fokusere opm\u00e6rksomheden p\u00e5 l\u00f8sningen<\/a><\/noindex> problemer<\/a><\/noindex> med IP-fragmentering ved behandling af store DNS-meddelelser. Dette er det andet lignende arrangement, efter 'DNS flag day' sidste \u00e5r. fokuseret<\/a><\/noindex> p\u00e5 korrekt behandling af EDNS-anmodninger. <\/p>\n

Deltagerne i initiativet DNS flag day 2020 opfordrer til at fasts\u00e6tte de anbefalede bufferst\u00f8rrelser for EDNS til niveauer p\u00e5 1232 bytes (MTU st\u00f8rrelse 1280 minus 48 bytes til overskrifter), samt at g\u00f8re<\/a><\/noindex> h\u00e5ndtering af anmodninger over TCP til en obligatorisk underst\u00f8ttet funktion p\u00e5 servere. I RFC 1035<\/a><\/noindex> er underst\u00f8ttelsen af behandling af anmodninger over UDP kun obligatorisk, mens TCP er angivet som \u00f8nskelig, men ikke n\u00f8dvendig for funktion. De nye RFC 7766<\/a><\/noindex> og RFC 5966<\/a><\/noindex> tilf\u00f8jer tydeligt TCP blandt de obligatoriske funktioner, der er n\u00f8dvendige for korrekt DNS-drift. I forbindelse med det gennemf\u00f8rte initiativ foresl\u00e5s det at tvinge overgangen fra at sende anmodninger over UDP til at anvende TCP i tilf\u00e6lde, hvor den fastsatte bufferst\u00f8rrelse for EDNS er utilstr\u00e6kkelig.<\/p>\n

De foresl\u00e5ede \u00e6ndringer vil eliminere forvirringen omkring valget af EDNS-bufferst\u00f8rrelse og l\u00f8se problemet med fragmentering af store UDP-beskeder, hvis behandling ofte f\u00f8rer til tab af pakker og timeout p\u00e5 klientsiden. P\u00e5 klientsiden vil EDNS-bufferst\u00f8rrelsen v\u00e6re konstant, og store svar vil straks blive sendt til klienten over TCP. Undtagelsen til at sende store beskeder over UDP vil ogs\u00e5 l\u00f8se problemer med udsmidning af store pakker p\u00e5 nogle firewall-enheder og muligg\u00f8re blokering angreb<\/a><\/noindex> af DNS-cache-forgiftning baseret p\u00e5 manipulation af fragmenterede UDP-pakker (ved fragmentering inkluderer det andet fragment ikke overskriften med identificeringen, hvorfor det kan forfalskes, s\u00e5 l\u00e6nge kontrolsummen passer).<\/p>\n

Fra i dag vil de deltagende DNS-udbydere, herunder CloudFlare, Quad 9, Cisco (OpenDNS) og Google, gradvist \u00e6ndre<\/a><\/noindex> \u00c6ndringen af EDNS-bufferen fra 4096 til 1232 byte p\u00e5 deres DNS-servere (\u00e6ndringen af EDNS vil blive udrullet over 4-6 uger og vil gradvist omfatte flere anmodninger). Svar p\u00e5 UDP-anmodninger, der ikke overholder den nye gr\u00e6nse, vil blive sendt via TCP. Producenter af DNS-servere, herunder BIND, Unbound, Knot, NSD og PowerDNS, vil frigive opdateringer, der \u00e6ndrer standard-st\u00f8rrelsen p\u00e5 EDNS-bufferen fra 4096 til 1232 byte. <\/p>\n

I sidste ende kan de indf\u00f8rte \u00e6ndringer f\u00f8re til problemer med opl\u00f8sning ved adgang til DNS-servere, hvis DNS-svar over UDP overstiger 1232 byte, og som ikke kan sende svar via TCP. Et eksperiment udf\u00f8rt af Google har vist, at \u00e6ndringen af EDNS-bufferst\u00f8rrelsen praktisk talt ikke p\u00e5virker fejlprocenten - med en buffer p\u00e5 4096 byte er andelen af afsk\u00e5rne UDP-foresp\u00f8rgsler 0,345%, mens andelen af uopn\u00e5elige gentagne TCP-svar er 0,115%. Med en buffer p\u00e5 1232 byte er disse tal 0,367% og 0,116%. Overgangen til at st\u00f8tte TCP som en obligatorisk funktion i DNS vil f\u00f8re til problemer med interaktionen med omkring 0,1% af DNS-serverne. Det bem\u00e6rkes, at under moderne forhold uden TCP fungerer disse servere allerede ustabilt.<\/p>\n

Administratorer af autoritative DNS-servere b\u00f8r sikre, at deres server kan svare via TCP p\u00e5 netv\u00e6rksport 53, og at denne TCP-port ikke blokeres af en firewall. Den autoritative DNS-server b\u00f8r heller ikke sende UDP-svar, hvis st\u00f8rrelsen overstiger
\nden anmodede EDNS-bufferst\u00f8rrelse. P\u00e5 selve serveren skal EDNS-bufferst\u00f8rrelsen indstilles til 1232 byte. Resolvere stilles omtrent de samme krav - obligatorisk mulighed for svar via TCP, obligatorisk st\u00f8tte til at sende gentagne anmodninger via TCP ved modtagelse af et afsk\u00e5ret UDP-svar og indstilling af EDNS-bufferen til 1232 byte.<\/p>\n

Indstillingerne for EDNS-bufferst\u00f8rrelsen i forskellige DNS-servere er som f\u00f8lger:<\/p>\n

  • BIND\n

    options {
    \n edns-udp-size 1232;
    \n max-udp-size 1232;
    \n };<\/p>\n

  • Knot DNS\n

    max-udp-payload: 1232<\/p>\n

  • Knot Resolver\n

    net.bufsize(1232)<\/p>\n

  • PowerDNS Authoritative\n

    udp-truncation-threshold=1232<\/p>\n

  • PowerDNS Recursor\n

    edns-outgoing-bufsize=1232
    \n udp-truncation-threshold=1232<\/p>\n

  • Unbound\n

    edns-buffer-size: 1232<\/p>\n

  • NSD\n

    ipv4-edns-size: 1232
    \n ipv6-edns-size: 1232<\/p>\n

    <\/a><\/noindex><\/p>\n

    Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 IP-\u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 DNS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435, \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 «DNS flag day» \u0431\u044b\u043b \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d \u043d\u0430 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 EDNS. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b DNS flag day 2020 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u044e\u0442 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u043c\u0435\u0440\u044b \u0431\u0443\u0444\u0435\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95716","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Initiativet DNS flag day 2020 til l\u00f8sning af problemer med fragmentation og TCP-support | ProHoster","description":"I dag vil en r\u00e6kke st\u00f8rre DNS-tjenester og producenter af DNS-servere gennemf\u00f8re et f\u00e6lles arrangement kaldet DNS flag day 2020, der har til form\u00e5l at fokusere.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0430 DNS flag day 2020 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 TCP | ProHoster","og:description":"\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-01T23:42:50+00:00","article:modified_time":"2020-10-01T23:42:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95716","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:59:41","updated":"2022-10-02 16:18:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/95716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=95716"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/95716\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=95716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=95716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=95716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}