{"id":95716,"date":"2020-10-02T01:42:50","date_gmt":"2020-10-01T23:42:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp"},"modified":"2020-10-02T01:42:50","modified_gmt":"2020-10-01T23:42:50","slug":"inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","title":{"rendered":"A iniciativa DNS flag day 2020 para resolver problemas de fragmenta\u00e7\u00e3o e suporte a TCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hoje, uma s\u00e9rie de grandes servi\u00e7os DNS e fabricantes de servidores DNS realizar\u00e1 um evento conjunto Dia da Flag DNS 2020<\/a><\/noindex>, que visa chamar a aten\u00e7\u00e3o para a solu\u00e7\u00e3o<\/a><\/noindex> problemas<\/a><\/noindex> com fragmenta\u00e7\u00e3o de IP ao processar mensagens DNS de grande tamanho. Este \u00e9 o segundo evento semelhante, o «dia da bandeira DNS» do ano passado. foi focado<\/a><\/noindex> na correta manipula\u00e7\u00e3o de consultas EDNS. <\/p>\n

Os participantes da iniciativa Dia da Flag DNS 2020 pedem para fixar os tamanhos de buffer recomendados para EDNS at\u00e9 valores de 1232 bytes (tamanho MTU de 1280 menos 48 bytes para cabe\u00e7alhos), al\u00e9m de tornar<\/a><\/noindex> o processamento de consultas via TCP uma obrigatoriedade nos servidores. No RFC 1035<\/a><\/noindex> est\u00e1 obrigatoriamente marcada apenas a suporte ao processamento de consultas via UDP, enquanto o TCP \u00e9 mencionado como desej\u00e1vel, mas n\u00e3o obrigat\u00f3rio para opera\u00e7\u00e3o. Novos RFC 7766<\/a><\/noindex> e RFC 5966<\/a><\/noindex> explicitamente classificam o TCP como uma das capacidades obrigat\u00f3rias necess\u00e1rias para o funcionamento correto do DNS. No \u00e2mbito da iniciativa, prop\u00f5e-se for\u00e7ar a transi\u00e7\u00e3o de enviar consultas via UDP para o uso de TCP em casos onde o tamanho do buffer EDNS estabelecido seja insuficiente.<\/p>\n

As mudan\u00e7as propostas eliminar\u00e3o a confus\u00e3o na escolha do tamanho do buffer EDNS e resolver\u00e3o o problema da fragmenta\u00e7\u00e3o de grandes mensagens UDP, cujo processamento muitas vezes leva \u00e0 perda de pacotes e a timeouts do lado do cliente. Do lado do cliente, o tamanho do buffer EDNS ser\u00e1 fixo, e grandes respostas ser\u00e3o imediatamente enviadas ao cliente via TCP. A exclus\u00e3o do envio de grandes mensagens via UDP tamb\u00e9m resolver\u00e1 problemas de descartar grandes pacotes em alguns firewalls e permitir\u00e1 bloquear ataques<\/a><\/noindex> evita\u00e7\u00f5es de cache DNS baseadas na manipula\u00e7\u00e3o de pacotes UDP fragmentados (como na fragmenta\u00e7\u00e3o, o segundo fragmento n\u00e3o inclui o cabe\u00e7alho com o identificador, podendo ser forjado, pois s\u00f3 precisa coincidir com a soma de verifica\u00e7\u00e3o).<\/p>\n

A partir de hoje, os provedores de DNS envolvidos na iniciativa, incluindo CloudFlare, Quad 9, Cisco (OpenDNS) e Google, come\u00e7ar\u00e3o a trocar gradualmente<\/a><\/noindex> o tamanho do buffer EDNS ser\u00e1 alterado de 4096 para 1232 bytes em seus servidores DNS (a mudan\u00e7a do EDNS ser\u00e1 estendida por 4 a 6 semanas e gradualmente abranger\u00e1 um maior n\u00famero de consultas). Respostas a consultas UDP que n\u00e3o se encaixam no novo limite ser\u00e3o enviadas via TCP. Os fabricantes de servidores DNS, incluindo BIND, Unbound, Knot, NSD e PowerDNS, lan\u00e7ar\u00e3o atualiza\u00e7\u00f5es alterando o tamanho do buffer EDNS padr\u00e3o de 4096 para 1232 bytes. <\/p>\n

No final, as mudan\u00e7as introduzidas podem causar problemas de resolu\u00e7\u00e3o ao acessar servidores DNS cujas respostas DNS via UDP excedem 1232 bytes e que n\u00e3o conseguem enviar respostas via TCP. Um experimento realizado pelo Google mostrou que a altera\u00e7\u00e3o no tamanho do buffer EDNS quase n\u00e3o afetar\u00e1 o n\u00edvel de falhas \u2014 com um buffer de 4096 bytes, a taxa de solicita\u00e7\u00f5es UDP truncadas \u00e9 de 0.345%, enquanto as respostas n\u00e3o alcan\u00e7\u00e1veis via TCP s\u00e3o de 0.115%. Com um buffer de 1232 bytes, esses n\u00fameros s\u00e3o 0.367% e 0.116%, respectivamente. A transforma\u00e7\u00e3o da capacidade de suporte a TCP em uma obrigatoriedade do DNS levar\u00e1 a problemas ao interagir com cerca de 0.1% dos servidores DNS. Observa-se que, nas condi\u00e7\u00f5es atuais, a opera\u00e7\u00e3o desses servidores j\u00e1 \u00e9 inst\u00e1vel sem TCP.<\/p>\n

Os administradores de servidores DNS autoritativos devem garantir que seu servidor responda via TCP na porta de rede 53 e que esta porta TCP n\u00e3o esteja bloqueada por um firewall. O servidor DNS autoritativo tamb\u00e9m n\u00e3o deve enviar respostas UDP cujo tamanho exceda
\no tamanho de buffer EDNS solicitado. No pr\u00f3prio servidor, o tamanho do buffer EDNS deve ser configurado para 1232 bytes. Os resolvedores t\u00eam requisitos aproximadamente semelhantes \u2014 a capacidade obrigat\u00f3ria de resposta via TCP, a obriga\u00e7\u00e3o de suportar o envio de consultas repetidas via TCP ao receber uma resposta UDP truncada e a configura\u00e7\u00e3o do buffer EDNS para 1232 bytes.<\/p>\n

As configura\u00e7\u00f5es do tamanho do buffer EDNS em diversos servidores DNS s\u00e3o determinadas pelos seguintes par\u00e2metros:<\/p>\n

  • BIND\n

    op\u00e7\u00f5es {
    \n edns-udp-size 1232;
    \n max-udp-size 1232;
    \n };<\/p>\n

  • Knot DNS\n

    max-udp-payload: 1232<\/p>\n

  • Knot Resolver\n

    net.bufsize(1232)<\/p>\n

  • PowerDNS Authoritative\n

    udp-truncation-threshold=1232<\/p>\n

  • PowerDNS Recursor\n

    edns-outgoing-bufsize=1232
    \n udp-truncation-threshold=1232<\/p>\n

  • Unbound\n

    edns-buffer-size: 1232<\/p>\n

  • NSD\n

    ipv4-edns-size: 1232
    \n ipv6-edns-size: 1232<\/p>\n

    <\/a><\/noindex><\/p>\n

    Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 IP-\u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 DNS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435, \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 «DNS flag day» \u0431\u044b\u043b \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d \u043d\u0430 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 EDNS. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b DNS flag day 2020 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u044e\u0442 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u043c\u0435\u0440\u044b \u0431\u0443\u0444\u0435\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95716","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A iniciativa DNS flag day 2020 para resolver problemas de fragmenta\u00e7\u00e3o e suporte a TCP | ProHoster","description":"Hoje, uma s\u00e9rie de grandes servi\u00e7os de DNS e fabricantes de servidores DNS realizar\u00e3o um evento conjunto chamado DNS flag day 2020, com foco.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0430 DNS flag day 2020 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 TCP | ProHoster","og:description":"\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-01T23:42:50+00:00","article:modified_time":"2020-10-01T23:42:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95716","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:59:41","updated":"2022-10-02 16:18:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/95716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=95716"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/95716\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=95716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=95716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=95716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}