Today, a number of major DNS services and DNS server manufacturers will hold a joint event. , aimed at focusing attention on with IP fragmentation when processing large DNS messages. This is the second such event; last year was "DNS flag day." on the correct processing of EDNS requests.
Participants in the DNS flag day 2020 initiative urge to set recommended buffer sizes for EDNS to values at the level of 1232 bytes (MTU size 1280 minus 48 bytes for headers), as well as requiring TCP request processing to be supported on servers. In mandatory support is only marked for UDP request handling, while TCP is indicated as desired but not required for functionality. New and explicitly classify TCP as one of the essential capabilities necessary for the correct functioning of DNS. As part of the ongoing initiative, it is proposed to enforce the transition from sending requests over UDP to using TCP in cases where the set EDNS buffer size is insufficient.
The proposed changes will eliminate confusion regarding EDNS buffer size selection and address the problem of fragmenting large UDP messages, which often leads to packet loss and timeouts on the client side. On the client side, the EDNS buffer size will be constant, and large responses will be sent to the client over TCP immediately. The exclusion of sending large messages over UDP will also resolve issues with the dropping of large packets on certain firewalls and allow for blocking. of DNS cache poisoning, based on manipulating fragmented UDP packets (when fragmented, the second fragment does not include the header with the identifier, so it can be forged as long as the checksum matches).
Starting today, participating DNS providers, including CloudFlare, Quad 9, Cisco (OpenDNS), and Google, the EDNS buffer size from 4096 to 1232 bytes on their DNS servers (the EDNS change will be spread over 4-6 weeks and will eventually cover an increasing number of requests). Responses to UDP requests that exceed the new limit will be sent via TCP. DNS server manufacturers, including BIND, Unbound, Knot, NSD, and PowerDNS, will release updates changing the default EDNS buffer size from 4096 to 1232 bytes.
Ultimately, the changes implemented may lead to resolution issues when contacting DNS servers whose DNS responses exceed 1232 bytes over UDP and cannot send responses over TCP. A Google experiment showed that changing the EDNS buffer size has little effect on failure rates—using a buffer of 4096 bytes, the number of truncated UDP requests was 0.345%, and unreachable TCP re-response counts were 0.115%. With a buffer of 1232 bytes, these figures were 0.367% and 0.116%. Making TCP support mandatory for DNS functionalities will lead to issues with around 0.1% of DNS servers. It is noted that under modern conditions, these servers are already unstable without TCP.
Administrators of authoritative DNS servers should ensure their server responds over TCP on network port 53 and that this TCP port is not blocked by a firewall. An authoritative DNS server should also not send UDP responses exceeding
the requested EDNS buffer size. On the server itself, the EDNS buffer size should be set to 1232 bytes. Resolvers are subject to similar requirements—mandatory TCP response capability, mandatory support for resending requests over TCP when receiving truncated UDP responses, and setting the EDNS buffer to 1232 bytes.
The following parameters are responsible for configuring the EDNS buffer size across different DNS servers:
options {
edns-udp-size 1232;
max-udp-size 1232;
};
max-udp-payload: 1232
net.bufsize(1232)
udp-truncation-threshold=1232
edns-outgoing-bufsize=1232
udp-truncation-threshold=1232
edns-buffer-size: 1232
ipv4-edns-size: 1232
ipv6-edns-size: 1232
Source: opennet.ru
