A BIND DNS server developers reported the addition of server support for «DNS over HTTPS» (DoH, DNS over HTTPS) and DNS over TLS (DoT, DNS over TLS) in the experimental branch 9.17, as well as the XFR-over-TLS mechanism for secure transfer of DNS zone content between servers. DoH is available for testing in release 9.17.10, while DoT support has been present since release 9.17.7. Once stabilized, DoT and DoH support will be backported to the stable branch 9.16. <\/p>\n
The implementation of the HTTP\/2 protocol used in DoH is based on the nghttp2 library, which is included among the build dependencies (in the future, the library is planned to be moved to optional dependencies). Both encrypted (TLS) and unencrypted HTTP\/2 connections are supported. With the appropriate settings, one named process can now handle not only traditional DNS requests but also requests sent using DoH (DNS-over-HTTPS) and DoT (DNS-over-TLS). HTTPS support on the client side (dig) is not yet implemented. XFR-over-TLS support is available for both incoming and outgoing requests. <\/p>\n
Request handling using DoH and DoT is enabled by adding the http and tls options in the listen-on directive. To support unencrypted DNS-over-HTTP, you should specify «tls none» in the settings. Keys are defined in the «tls» section. Standard network ports 853 for DoT, 443 for DoH, and 80 for DNS-over-HTTP can be overridden by the tls-port, https-port, and http-port parameters. For example: tls local-tls { key-file «\\\/path\\\/to\\\/priv_key.pem»; cert-file «\\\/path\\\/to\\\/cert_chain.pem»; }; http local-http-server { endpoints { «\\\/dns-query»; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n
Notable features of the DoH implementation in BIND include integration as a common transport, which can be used not only for processing client requests to the resolver but also for data exchange between servers, for transferring zones by authoritative DNS servers, and for processing any requests supported by other DNS transports. <\/p>\n
A m\u00e1sik jellegzetess\u00e9g az, hogy a TLS titkos\u00edt\u00e1si m\u0171veletek \u00e1thelyezhet\u0151ek egy m\u00e1sik szerverre, ami sz\u00fcks\u00e9ges lehet olyan k\u00f6rnyezetekben, ahol a TLS tan\u00fas\u00edtv\u00e1nyok t\u00e1rol\u00e1sa egy m\u00e1sik rendszeren t\u00f6rt\u00e9nik (p\u00e9ld\u00e1ul web szerverek infrastrukt\u00far\u00e1j\u00e1ban), \u00e9s m\u00e1s szem\u00e9lyzet kezeli. A titkos\u00edtatlan DNS-over-HTTP t\u00e1mogat\u00e1sa a hibakeres\u00e9s egyszer\u0171s\u00edt\u00e9se \u00e9rdek\u00e9ben val\u00f3sult meg, \u00e9s mint egy szint a bels\u0151 h\u00e1l\u00f3zatban t\u00f6rt\u00e9n\u0151 \u00e1tvitelhez, amely alapj\u00e1n egy m\u00e1sik szerveren szervezhet\u0151 a titkos\u00edt\u00e1s. Az \u00e1tmeneti szerveren a TLS forgalom gener\u00e1l\u00e1s\u00e1ra nginx haszn\u00e1lhat\u00f3, hasonl\u00f3an ahhoz, ahogy a HTTPS csomagol\u00e1s\u00e1t szervezik a weboldalakhoz. <\/p>\n
Ne feledj\u00fck, hogy a DNS-over-HTTPS hasznos lehet a szolg\u00e1ltat\u00f3k DNS szerverei \u00e1ltal t\u00f6rt\u00e9n\u0151 h\u00edvott hostnevek adatainak kisziv\u00e1rg\u00e1s\u00e1nak megakad\u00e1lyoz\u00e1s\u00e1ra, a MITM t\u00e1mad\u00e1sokkal \u00e9s a DNS forgalom hamis\u00edt\u00e1s\u00e1val szembeni v\u00e9dekez\u00e9sre (p\u00e9ld\u00e1ul nyilv\u00e1nos Wi-Fi haszn\u00e1latakor), valamint a DNS szint\u0171 blokkol\u00e1sokkal szembeni k\u00fczdelemre (a DNS-over-HTTPS nem helyettes\u00edthet\u0151 a blokkol\u00e1sok megker\u00fcl\u00e9s\u00e9ben, amelyeket a DPI szintj\u00e9n val\u00f3s\u00edtanak meg) vagy a DNS szerverekhez val\u00f3 k\u00f6zvetlen csatlakoz\u00e1s hi\u00e1ny\u00e1ban val\u00f3 m\u0171k\u00f6d\u00e9s megszervez\u00e9s\u00e9re (p\u00e9ld\u00e1ul proxy-n kereszt\u00fcli m\u0171k\u00f6d\u00e9s eset\u00e9n). Ha a norm\u00e1l helyzetben a DNS lek\u00e9rdez\u00e9sek k\u00f6zvetlen\u00fcl a rendszer konfigur\u00e1ci\u00f3j\u00e1ban megadott DNS szerverekre ker\u00fclnek, akkor DNS-over-HTTPS eset\u00e9n a lek\u00e9rdez\u00e9s a VPN<\/a> hostot a HTTPS forgalom keretein bel\u00fcl kapszul\u00e1zva \u00e9s egy HTTP szerverre k\u00fcldve, amelyen a resolver a web API-n kereszt\u00fcl dolgozza fel a lek\u00e9rdez\u00e9seket. IP address<\/a> A \u201eDNS over TLS\u201d a \u201eDNS over HTTPS\u201d-t\u0151l abban k\u00fcl\u00f6nb\u00f6zik, hogy a szok\u00e1sos DNS protokollt (amely \u00e1ltal\u00e1ban a 853-as portot haszn\u00e1lja) titkos\u00edtott kapcsolaton kereszt\u00fcl val\u00f3s\u00edtja meg, amelyet a TLS protokoll seg\u00edts\u00e9g\u00e9vel alak\u00edtanak ki, a host \u00e9rv\u00e9nyes\u00edt\u00e9se TLS\/SSL tan\u00fas\u00edtv\u00e1nyokkal, amelyeket egy hiteles\u00edt\u00e9si k\u00f6zpont igazolt. Az egy l\u00e9tez\u0151 DNSSEC szabv\u00e1ny csak az \u00fcgyf\u00e9l \u00e9s a szerver hiteles\u00edt\u00e9s\u00e9nek biztos\u00edt\u00e1s\u00e1ra haszn\u00e1l titkos\u00edt\u00e1st, de nem v\u00e9di a forgalmat a lehallgat\u00e1st\u00f3l \u00e9s nem garant\u00e1lja a lek\u00e9rdez\u00e9sek titkoss\u00e1g\u00e1t. <\/p>\n